Key authorization authentication method, related device and medium

Abstract

The invention provides a key authorization authentication method, a related device and a medium. The key authorization authentication method comprises the following steps: acquiring an authorization key on a target terminal and authorization process information corresponding to the authorization key; receiving a key acquisition request of a target process on a target terminal; in response to the key acquisition request, acquiring target process information of a target process; comparing the target process information with the multiple pieces of authorization process information to obtain matched authorization process information from the multiple pieces of authorization process information; and returning an authorization key corresponding to the matched authorization process information to the target process. According to the embodiment of the invention, the security of the key authorization authentication process is improved, and the risk of key leakage is reduced. The embodiment of the invention can be applied to various scenes needing to safely use the secret key, such as identity verification, block chains, data security and information technologies.

Description

Technical Field

[0001] The present disclosure relates to the field of information security, and in particular to a key authorization and authentication method, related devices and media. Background Art

[0002] At present, in order to ensure the security of data encryption and decryption, the keys used in data encryption and decryption are generally kept by the key management server. When the key is needed for data encryption and decryption, a request is made to the key management server. At present, before a terminal uses the key management service, it needs to register with the key management server. The key management server issues an access identity authentication credential and a verification credential identifier to the terminal. When the terminal needs to use the key management service, it sends the access identity authentication credential and the verification credential identifier to the key management server, which is verified by the key management server. After the verification is passed, the key management server returns the key to the terminal.

[0003] The access authentication credentials and the authentication credential identifier are generally stored by the terminal in a configuration file, code or database. Malicious personnel can easily obtain the access authentication credentials and the authentication credential identifier through the configuration file, code and database, thereby illegally accessing the key management server, resulting in the risk of key leakage. Summary of the invention

[0004] The disclosed embodiments provide a key authorization and authentication method, a related device, and a medium, which can improve the security of the key authorization and authentication process and reduce the risk of key leakage.

[0005] According to one aspect of the present disclosure, a key authorization authentication method is provided, comprising:

[0006] Acquire an authorization key on a target terminal and authorization process information corresponding to the authorization key;

[0007] Receiving a key acquisition request from a target process on the target terminal;

[0008] In response to the key acquisition request, acquiring target process information of the target process;

[0009] Comparing the target process information with the plurality of authorized process information to obtain matching authorized process information from the plurality of authorized process information;

[0010] An authorization key corresponding to the matching authorization process information is returned to the target process.

[0011] According to one aspect of the present disclosure, a key authorization authentication device is provided, comprising:

[0012] A first acquisition unit, configured to acquire an authorization key on a target terminal and authorization process information corresponding to the authorization key;

[0013] A first receiving unit, configured to receive a key acquisition request from a target process on the target terminal;

[0014] A second acquisition unit, configured to acquire target process information of the target process in response to the key acquisition request;

[0015] a third obtaining unit, configured to compare the target process information with the plurality of authorized process information to obtain matching authorized process information from the plurality of authorized process information;

[0016] The returning unit is used to return the authorization key corresponding to the matching authorization process information to the target process.

[0017] Optionally, the first acquiring unit is specifically configured to:

[0018] Sending a first request to a key management server, wherein the first request includes a target terminal address of the target terminal;

[0019] The authorization key corresponding to the target terminal address and the authorization process information corresponding to the authorization key are received and sent by the key management server in response to the first request.

[0020] Optionally, the authorization key corresponding to the target terminal address and the authorization process information corresponding to the authorization key are determined by the key management server in the following manner:

[0021] Determining a target process group corresponding to the target terminal address based on a first correspondence table, wherein the first correspondence table indicates a first correspondence between a terminal address and a process group;

[0022] Based on a second correspondence table, determining the authorization key corresponding to the target process group as the authorization key corresponding to the target terminal address, the second correspondence table indicating a second correspondence between the process group and the authorization key;

[0023] Based on a third correspondence table, the authorized process information corresponding to the target process group is determined as the authorized process information corresponding to the authorization key, and the third correspondence table indicates a third correspondence between the process group and the authorized process information of the process included in the process group.

[0024] Optionally, the first corresponding relationship is pre-generated in the key management server in the following manner:

[0025] Display a process group configuration interface, wherein the process group configuration interface has a process group identifier input area and a terminal address input area for the process group application;

[0026] In the process group identifier input area, receiving an input process group identifier;

[0027] In the terminal address input area, receiving an input terminal address;

[0028] The process group corresponding to the input process group identifier and the input terminal address are stored in correspondence as the first corresponding relationship.

[0029] Optionally, the first corresponding relationship is pre-generated in the key management server in the following manner:

[0030] For each process group, sending a second request to the process group deployment management node, where the second request includes a process group identifier of the process group;

[0031] receiving a terminal address corresponding to the process group identifier sent by the process group deployment management node in response to the second request;

[0032] The process group and the received terminal address are stored as the first corresponding relationship.

[0033] Optionally, the second corresponding relationship is pre-generated in the key management server in the following manner:

[0034] receiving a selection of the authorization key;

[0035] In response to a process group input instruction for the selected authorization key, displaying a process group input area;

[0036] In the process group input area, receiving an input process group;

[0037] The input process group and the authorization key are stored as the second corresponding relationship.

[0038] Optionally, the third corresponding relationship is pre-generated in the key management server in the following manner:

[0039] In response to an authorization process information configuration instruction for a process under the process group, displaying an authorization process information configuration interface;

[0040] In the authorization process information configuration interface, receiving input authorization process information;

[0041] The process group and the authorized process information are stored as the third corresponding relationship.

[0042] Optionally, the key acquisition request includes a target process identifier, and the second acquisition unit includes:

[0043] A process identification acquisition unit, used to acquire the target process identification from the key acquisition request;

[0044] A process information acquisition unit is used to acquire the target process information based on the target process identifier.

[0045] Optionally, the key authorization authentication method is performed by a key management agent having a permission to read the process running status, and the target process information includes a target process execution object identifier, a target process name, a target process execution path, and a target process file summary; the process information acquisition unit is specifically used to:

[0046] Obtaining the target process execution object identifier corresponding to the target process identifier;

[0047] Using the process running status reading permission, read the target process running status corresponding to the target process identifier, the target process running status including the target process name and the target process execution path;

[0048] Acquire the target process name and the target process execution path from the target process running status;

[0049] According to the target process name and the target process execution path, the target process file is obtained, and a digest operation is performed on the target process file to obtain a digest of the target process file.

[0050] Optionally, the authorization process information includes an authorization process execution object identifier, an authorization process name, an authorization process execution path, and an authorization process file summary;

[0051] The third acquisition unit is specifically used for:

[0052] If, among the multiple authorized process information, there is one authorized process information in which the authorized process execution object identifier is the same as the target process execution object identifier, the authorized process name is the same as the target process name, the authorized process execution path is the same as the target process execution path, and the authorized process file digest is the same as the target process file digest, the authorized process information is determined as the matching authorized process information.

[0053] Optionally, the obtaining of the authorization key on the target terminal and the authorization process information corresponding to the authorization key comprises: obtaining the authorization key on the target terminal, a key identifier corresponding to the authorization key, and the authorization process information corresponding to the authorization key;

[0054] The process identification acquisition unit is used to:

[0055] Acquire the target process identifier and the target key identifier from the key acquisition request;

[0056] The third acquisition unit is specifically used for:

[0057] From the plurality of authorization process information, obtain candidate authorization process information whose key identifier corresponding to the authorization key is consistent with the target key identifier;

[0058] If the target process information is consistent with the candidate authorization process information, the candidate authorization process information is determined as the matching authorization process information.

[0059] Optionally, the key identifier corresponding to the authorization key is obtained based on the authorization key with reference to a fourth correspondence table, and the fourth correspondence table indicates a fourth correspondence between the authorization key and the key identifier;

[0060] The fourth correspondence table is pre-generated in the key management server in the following manner:

[0061] Displaying an authorization key configuration interface, wherein the authorization key configuration interface includes a key identifier input area and an authorization key generation method selection control;

[0062] In the key identifier input area, receiving the key identifier input;

[0063] In response to selecting a random generation method using the authorization key generation method selection control, randomly generating the authorization key;

[0064] The authorization key and the key identifier are stored as the fourth corresponding relationship.

[0065] Optionally, the first acquiring unit is used to:

[0066] Get the effective time and expiration time of each authorization key;

[0067] From the plurality of authorization keys, the authorization key whose effective time is earlier than the current time and whose expiration time is later than the current time and the authorization process information corresponding to the authorization key are selected.

[0068] Optionally, the first acquisition unit is further used to: acquire an authorization key on the target terminal, a first encryption algorithm version corresponding to the authorization key, and authorization process information corresponding to the authorization key;

[0069] The key authorization authentication device further includes a comparison unit, which is used to:

[0070] receiving an encryption algorithm version verification request from the target process during encryption using the authorization key, the encryption algorithm version verification request having a second encryption algorithm version applied by the authorization key;

[0071] If the second encryption algorithm version is consistent with the first encryption algorithm version, an encryption algorithm version verification success response is sent to the target process.

[0072] Optionally, the authorization process information includes an authorization process execution object identifier, an authorization process name, and an authorization process execution path;

[0073] The third acquisition unit further includes:

[0074] A first matching unit, configured to determine a first matching score based on the target process execution object identifier and the authorized process execution object identifier;

[0075] A second matching unit, configured to determine a second matching score based on the target process name and the authorized process name;

[0076] A third matching unit, configured to determine a third matching score based on the target process execution path and the authorized process execution path;

[0077] A screening unit is used to obtain the matching authorization process information from the plurality of authorization process information based on the first matching score, the second matching score, and the third matching score.

[0078] Optionally, the screening unit is used to:

[0079] Performing a weighted sum operation on the first matching score, the second matching score, and the third matching score to obtain a total matching score;

[0080] Based on the total matching score, the matching authorization process information is obtained from the plurality of authorization process information. According to one aspect of the present disclosure, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the key authorization authentication method as described above when executing the computer program.

[0081] According to one aspect of the present disclosure, a computer-readable storage medium is provided, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the key authorization authentication method as described above is implemented.

[0082] According to one aspect of the present disclosure, a computer program product is provided. The computer program product includes a computer program. The computer program is read and executed by a processor of a computer device, so that the computer device executes the key authorization authentication method as described above.

[0083] The disclosed embodiment does not use static credential information such as access identity authentication credentials and verification credential identifiers that can be easily obtained by malicious personnel to perform key authorization authentication, but performs key authorization authentication based on the target process information of the target process that calls the key for encryption and decryption processing. It first obtains the authorization key on the target terminal and the authorization process information corresponding to the authorization key. When the target process information of the target process is obtained, the target process information is compared with multiple authorization process information to obtain matching authorization process information, and then the corresponding authorization key is obtained. The target process information varies with the specific process that calls the key for encryption and decryption processing. As long as the process is different, the information is different. Even if a malicious person wants to forge the same process information to obtain the key, it is difficult to forge exactly the same process, so it is difficult to obtain the same process information, and therefore it is difficult to obtain the key. The disclosed embodiment greatly improves the security of the key authorization authentication process and reduces the risk of key leakage.

[0084] Other features and advantages of the present disclosure will be described in the following description, and partly become apparent from the description, or understood by practicing the present disclosure. The purpose and other advantages of the present disclosure can be realized and obtained by the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] The accompanying drawings are used to provide further understanding of the technical solution of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the technical solution of the present disclosure and do not constitute a limitation on the technical solution of the present disclosure.

[0086] Figure 1 is a system architecture diagram of a system to which the key authorization authentication method according to an embodiment of the present disclosure is applied;

[0087] Figure 2A It is a schematic diagram of the key authorization authentication method in the related art applied in the key authorization scenario;

[0088] Figure 2B It is a schematic diagram of a key authorization authentication method according to an embodiment of the present disclosure applied in a key authorization scenario;

[0089] Figure 3 is a flow chart of a key authorization authentication method according to an embodiment of the present disclosure;

[0090] Figure 4 Shows Figure 3 Flowchart of obtaining the authorization key and the authorization process information corresponding to the authorization key in step 310;

[0091] Figure 5A flowchart of determining an authorization key and authorization process information corresponding to the authorization key according to an embodiment of the present disclosure is shown;

[0092] Fig. 6A -D is a schematic diagram showing a first correspondence table, a second correspondence table, and a third correspondence table of an embodiment of the present disclosure;

[0093] Figure 7 A flowchart of generating a first correspondence relationship according to an embodiment of the present disclosure is shown;

[0094] Figure 8 A flowchart of generating a first corresponding relationship according to another embodiment of the present disclosure is shown;

[0095] Fig. 9 is a schematic diagram of an implementation process of a first corresponding relationship generation process of an embodiment of the present disclosure;

[0096] Fig.10 A flowchart of generating a second corresponding relationship according to an embodiment of the present disclosure is shown;

[0097] Fig.11A -B is a schematic diagram of an implementation process of a second corresponding relationship generation process according to an embodiment of the present disclosure;

[0098] Fig.12 A flowchart of generating a third corresponding relationship according to an embodiment of the present disclosure is shown;

[0099] Fig.13 is a schematic diagram of an implementation process of a generation process of a third corresponding relationship in an embodiment of the present disclosure;

[0100] Fig.14 Shows Figure 3 Flowchart of obtaining target process information in step 330;

[0101] Fig.15 Shows Fig.13 Flowchart of step 1420 obtaining the target execution object identifier, target process name, target process execution path and target process file summary;

[0102] Fig.16 A schematic diagram of an implementation process of obtaining a target execution object identifier, a target process name, a target process execution path, and a target process file summary according to an embodiment of the present disclosure is shown;

[0103] Fig.17 Shows Figure 3 Step 340 is a flowchart of comparing the target process information with the plurality of authorized process information;

[0104] Fig.18A flowchart of generating a fourth corresponding relationship according to an embodiment of the present disclosure is shown;

[0105] Fig.19A -C is a schematic diagram of an implementation process of a generation process of a fourth corresponding relationship according to an embodiment of the present disclosure;

[0106] Fig. 20 Shows Figure 3 Another flow chart of comparing the target process information with the plurality of authorized process information in step 340;

[0107] Fig.21 Shows Fig. 20 Step 2040 is a flowchart of obtaining matching authorization process information from multiple authorization process information based on the first matching score, the second matching score, and the third matching score;

[0108] Fig. 22 is a flow chart of a key authorization authentication method according to another embodiment of the present disclosure;

[0109] Fig.23 is a schematic diagram of implementation details of a key authorization authentication method according to an embodiment of the present disclosure;

[0110] Fig.24 is a module diagram of a key authorization authentication device according to an embodiment of the present disclosure;

[0111] Fig.25 is a terminal structure diagram of a key authorization authentication method according to an embodiment of the present disclosure;

[0112] Fig.26 It is a server structure diagram of the key authorization authentication method according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0113] In order to make the purpose, technical solution and advantages of the present disclosure more clear, the present disclosure is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present disclosure and are not used to limit the present disclosure.

[0114] Before further describing the embodiments of the present disclosure in detail, the nouns and terms involved in the embodiments of the present disclosure are described. The nouns and terms involved in the embodiments of the present disclosure are subject to the following interpretations:

[0115] Artificial intelligence: It is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain target results. In other words, artificial intelligence is a comprehensive technology in computer science. It attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that machines have the functions of perception, reasoning and decision-making. Artificial intelligence technology is a comprehensive discipline that covers a wide range of fields, including both hardware-level technology and software-level technology. The basic technologies of artificial intelligence generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, and mechatronics. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning. With the research and advancement of artificial intelligence technology, artificial intelligence technology has been studied and applied in many fields, such as common smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, unmanned driving, automatic driving, drones, robots, smart medical care, smart customer service, etc. I believe that with the development of technology, artificial intelligence technology will be applied in more fields and play an increasingly important role.

[0116] Blockchain: Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of transaction information, which is used to verify the validity of its information (anti-counterfeiting) and associate with the previous block.

[0117] Process: It is a running activity of a program in a computer on a certain data set. It is the basic unit for resource allocation in the system and the foundation of the operating system structure. A process is the basic execution entity of a program.

[0118] At present, in order to ensure the security of data encryption and decryption, the keys used in data encryption and decryption are generally kept by the key management server. When the key is needed for data encryption and decryption, a request is made to the key management server. At present, before a terminal uses the key management service, it needs to register with the key management server. The key management server issues an access identity authentication credential and a verification credential identifier to the terminal. When the terminal needs to use the key management service, it sends the access identity authentication credential and the verification credential identifier to the key management server, which is verified by the key management server. After the verification is passed, the key management server returns the key to the terminal.

[0119] The access authentication credentials and the authentication credential identifier are generally stored by the terminal in a configuration file, code or database. Malicious personnel can easily obtain the access authentication credentials and the authentication credential identifier through the configuration file, code and database, thereby illegally accessing the key management server, resulting in the risk of key leakage.

[0120] System architecture and scenario description of the application of the embodiments of the present disclosure

[0121] Figure 1 It is a system architecture diagram used by the key authorization authentication method according to the embodiment of the present disclosure. It includes a target terminal 140, a key management server 110, etc., wherein the target terminal 140 includes a target process and a key management agent 120 deployed on the same machine, and the target process includes a key management software for the target process to transmit data with the key management agent through the key management software. The key management server 110 includes a key management background server 130, a key management terminal 140, an encryption machine 150 and a database 160.

[0122] The target terminal 140 includes various forms such as desktop computers, laptop computers, PDAs (personal digital assistants), mobile phones, vehicle-mounted terminals, home theater terminals, and dedicated terminals. In addition, it can be a single device or a collection of multiple devices. The target terminal 140 can communicate with the key management server 110 through the key management agent 120 in a wired or wireless manner to exchange data.

[0123] The key management server 110 refers to a computer system that can provide certain services to the target terminal 140. Compared with the ordinary target terminal 140, the key management server 110 has higher requirements in terms of stability, security, performance, etc. The key management server 110 can be a high-performance computer in a network platform, a cluster of multiple high-performance computers, a part of a high-performance computer (such as a virtual machine), a combination of parts of multiple high-performance computers (such as virtual machines), etc. The key management server 110 refers to a server that performs key authentication for the target process. The key management terminal 140 in the key management server 110 is used to perform operations such as key addition and key management on the object; the encryption machine 150 is used to encrypt various data in the key management server 110; the database 160 is used to store various data in the key management server 110.

[0124] When object A operates on the operation interface corresponding to the key management terminal 140, the key management server 110 will receive the key information and process information added by object A through input operation, and will also receive the association relationship between the key information and the process information input by object A, and associate the key with the process information, etc. Further, the key management background server 130 will send the key information to the encryption machine 150 for encryption processing to obtain encrypted data. Further, the key management background server 130 will store the encrypted data in the database 160.

[0125] When the key management agent 120 on the target terminal sends a request for obtaining desired information to the key management server 110 , the key management server 110 sends the key information and the associated process information to the key management agent 120 .

[0126] When the target process on the target terminal wants to obtain key authorization authentication, the target process sends a key acquisition request to the key management agent 120 through the key management software, and sends its own process information along with the key acquisition request to the key management agent 120. The key management agent 120 compares the process information provided by the target process with the process information associated with the key information, and determines whether to return the key information to the target process based on the comparison.

[0127] like Figure 2A As shown, the object 210 first sends an access request to the key management terminal 140 of the key service manager 110, and the access request is used to access the key management server. Then, the key management server 110 allocates an authorization key to the object 210 based on the access request, generates an identity credential corresponding to the authorization key, and returns the identity credential to the object 210. Further, when the business module 220 needs to use the key management service, the object 210 provides the identity credential to the business module 220, and the business module 220 sends the identity credential to the key management server 110, which verifies it. After the verification is passed, the key management server 110 returns the authorization key to the business module 220.

[0128] This method makes it easy for malicious personnel to obtain access authentication credentials and verification credential identifiers, thereby illegally accessing the key management server, and the risk of key leakage is high.

[0129] Compared with the related art, the embodiment of the present disclosure performs key authorization authentication based on the target process information of the target process that calls the key for encryption and decryption processing. The embodiment of the present disclosure can be applied in various scenarios, such as Figure 2B The key authorization scenario shown, etc.

[0130] like Figure 2BAs shown, the key management server 220 stores the authorization key and the authorization process information corresponding to the authorization key. When the target process needs to use the key management service, the target process information of the target process is compared with the authorization process information to verify the target process information and the authorization process information. After the verification is passed, the authorization key is returned to the target process.

[0131] General description of the disclosed embodiments

[0132] According to an embodiment of the present disclosure, a key authorization authentication method is provided.

[0133] Key authorization authentication methods are often used for Figure 2B Key authorization scenario. In the key authorization method of the related art, it is easy for malicious personnel to obtain the access authentication credentials and the verification credential identifier, thereby illegally accessing the key management server, and the risk of key leakage is high. Based on this, the embodiment of the present disclosure provides a scheme for key authorization authentication based on the target process information of the target process that calls the key for encryption and decryption processing, which can improve the security of the key authorization authentication process and reduce the risk of key leakage.

[0134] It should be noted that the key authorization authentication method of the embodiment of the present disclosure is executed by the key management agent 120 .

[0135] like Figure 3 As shown, a key authorization authentication method according to an embodiment of the present disclosure may include:

[0136] Step 310: Obtain the authorization key on the target terminal and the authorization process information corresponding to the authorization key;

[0137] Step 320: receiving a key acquisition request from a target process on a target terminal;

[0138] Step 330: In response to the key acquisition request, obtain target process information of the target process;

[0139] Step 340: compare the target process information with the plurality of authorized process information to obtain matching authorized process information from the plurality of authorized process information;

[0140] Step 350: Return the authorization key corresponding to the matching authorization process information to the target process.

[0141] Steps 310 - 350 are briefly described below.

[0142] In step 310, an authorization key on the target terminal and authorization process information corresponding to the authorization key are obtained.

[0143] The authorization key is a confidential code or number that reads, modifies or verifies protected data. The authorization process information is the process information that is authorized and protected using the authorization key.

[0144] In one embodiment, in order to improve the efficiency of key authorization authentication, the authorization key on the target terminal and the authorization process information corresponding to the authorization key can be obtained once every preset time interval, wherein the preset time interval is set according to actual needs and is not limited.

[0145] In another embodiment, in order to maximize the number of keys used for key authorization authentication, the authorization key on the target terminal and the authorization process information corresponding to the authorization key may also be acquired in real time according to the data acquisition instruction issued by the target process. The data acquisition instruction is used to instruct the target process to acquire the authorization key and the authorization process information.

[0146] In step 320, a key acquisition request of a target process on a target terminal is received.

[0147] The target process is a computer program that is being executed or is about to be executed. The target process may include various service programs in operation, such as social service programs, shopping service programs, various financial service programs, etc. These service programs need to load the necessary keys when they are started or running in order to work properly. For example, in a financial service program, in order to ensure the security of financial transactions, objects need to be transferred to other objects. During the transfer process, the service process of the service program needs to obtain the transaction key input by the object or stored somewhere before it can continue to run.

[0148] A key acquisition request is a request generated by a target process that wants to obtain a key.

[0149] Specifically, when the target process on the target terminal wants to obtain a key, it sends a key acquisition request to the key management agent 120. At this time, the key management agent 120 receives the key acquisition request from the target process and determines whether to provide the key to the target process based on the key acquisition request.

[0150] In step 330, in response to the key acquisition request, target process information of the target process is acquired.

[0151] The target process information is the state information of the target process when it is running, and the target process information is used to indicate the specific running state of the target process.

[0152] Specifically, after the key management agent 120 receives the key acquisition request from the target process, the key management agent 120 needs to further obtain the target process information of the target process and use the target process information to determine whether to provide the key to the target process.

[0153] In step 340, the target process information is compared with the plurality of authorized process information to obtain matching authorized process information from the plurality of authorized process information.

[0154] The matching authorized process information is process information that is authorized by an authorization key and is consistent with the specific content of the target process information.

[0155] In some embodiments, for each authorization process information, the entire content of the authorization process information is compared with the entire content of the target process information. If the authorization process information is completely consistent with the target process information, the authorization process information is used as the matching authorization process information. This method can improve the information overlap between the matching authorization process information and the target process information.

[0156] In other embodiments, for each piece of authorization process information, the authorization process information is converted into a vector form to obtain an authorization process feature vector. Then, the target process information is converted into a vector form to obtain a target process feature vector. Further, a similarity algorithm is used to calculate the similarity between the authorization process feature vector and the authorization process feature vector, and the similarity is used as the matching degree between the authorization process information and the target process information. Finally, according to the size of the matching degree, the authorization process information with a matching degree higher than a preset threshold is used as the matching authorization process information. Alternatively, the authorization process information is sorted according to the level of the matching degree, and the authorization process information ranked in a predetermined front position is selected as the matching authorization process information. This method can better increase the number of matching authorization process information, thereby increasing the possibility of the target process obtaining the authorization key.

[0157] It should be noted that similarity algorithms include but are not limited to cosine similarity algorithm, Euclidean distance, Manhattan distance, etc. The specific value of the predetermined ranking is set according to the actual situation and is not limited.

[0158] In step 350, the authorization key corresponding to the matching authorization process information is returned to the target process in the following ways, including but not limited to:

[0159] (1) The key management agent 120 directly sends the authorization key to the target process. This method can improve the timeliness of the transmission of the authorization key.

[0160] (2) The key management agent 120 uses its own private key to encrypt the authorization key, so that the target process can decode the authorization key using the public key corresponding to the private key. The public key of the key management agent 120 can be published on a public platform, and the target process can obtain the public key of the key management agent 120 through the public platform. This method can further improve the transmission security of the authorization key and reduce the risk of key leakage while ensuring the transmission efficiency of the authorization key.

[0161] Through the above steps 310-350, the embodiment of the present disclosure does not use static credential information such as access identity authentication credentials and verification credential identifiers that are easily obtained by malicious personnel to perform key authorization authentication, but performs key authorization authentication based on the target process information of the target process that calls the key for encryption and decryption processing. It first obtains the authorization key on the target terminal and the authorization process information corresponding to the authorization key. When the target process information of the target process is obtained, the target process information is compared with multiple authorization process information to obtain matching authorization process information, and then the corresponding authorization key is obtained. The target process information varies with the specific process that calls the key for encryption and decryption processing. As long as the process is different, the information is different. Even if a malicious person wants to forge the same process information to obtain the key, it is difficult to forge a completely identical process, so it is difficult to obtain the same process information, and therefore it is difficult to obtain the key. The embodiment of the present disclosure greatly improves the security of the key authorization authentication process and reduces the risk of key leakage.

[0162] The above is a general description of steps 310 to 350. Since steps 320 and 350 have been described in detail in the above general description, the specific implementation of steps 310, 330 and 340 will be described in detail below.

[0163] Detailed description of step 310

[0164] In step 310, an authorization key on the target terminal and authorization process information corresponding to the authorization key are obtained.

[0165] Since the key management server 110 contains authorization keys corresponding to different target terminals, if the authorization keys are directly provided to each key management agent 120, there will be a greater risk of key leakage. In addition, if it is judged one by one whether each authorization key should be provided to the key management agent 120 of the target terminal, the judgment efficiency will be low. Based on this, the embodiment of the present disclosure provides a solution for obtaining the authorization key and the authorization process information corresponding to the authorization key based on the terminal address of the target terminal, which can effectively improve the data acquisition efficiency.

[0166] like Figure 4 As shown, in some embodiments, the process of obtaining the authorization key on the target terminal and the authorization process information corresponding to the authorization key includes but is not limited to the following steps 410 to 420.

[0167] Step 410: Send a first request to a key management server, where the first request includes a target terminal address of a target terminal;

[0168] Step 420: Receive the authorization key corresponding to the target terminal address and the authorization process information corresponding to the authorization key sent by the key management server in response to the first request.

[0169] Steps 410 - 420 are described in detail below.

[0170] The terminal address refers to the address code of a target terminal such as a mobile phone or desktop computer. The target terminal address of a target terminal is unique, that is, one target terminal corresponds to a unique target terminal address, and the target terminal addresses of different target terminals are different.

[0171] In step 410, the first request is triggered by the key management agent 120 wanting to obtain the authorization key and the authorization process information corresponding to the authorization key from the key management server 110. Specifically, when the key management agent 120 sends the first request to the key management server 110, it will send the target terminal address of the target terminal to the key management server 110 together.

[0172] In step 420, the key management server 110 pre-stores the correspondence between the terminal address and the authorization key, as well as the authorization key information corresponding to the authorization key. When the key management agent 120 sends the first request to the key management server 110, the key management server 110 first obtains the target terminal address from the first request. Then, according to the pre-stored correspondence, the authorization key corresponding to the target terminal address and the authorization process information corresponding to the authorization key are queried. Finally, the authorization key corresponding to the target terminal address and the authorization process information corresponding to the authorization key are sent to the key management service agent 120. Based on this, the key management agent 120 can receive the authorization key corresponding to the target terminal address and the authorization process information corresponding to the authorization key sent by the key management server 110 in response to the first request.

[0173] Through the above steps 410-420, the key management agent 120 of the embodiment of the present disclosure sends the target terminal address of the target terminal to the key management server 110. The key management server 110 uses the correspondence between the pre-stored terminal address and the authorization key, and the authorization key information corresponding to the authorization key to more conveniently query the authorization key corresponding to the target terminal address and the authorization process information corresponding to the authorization key, which can greatly improve data acquisition efficiency and data acquisition accuracy.

[0174] It should be noted that the authorization key corresponding to the target terminal address and the authorization process information corresponding to the authorization key are generated by the key management server 110 .

[0175] Combine the following Figure 5 , Fig. 6A-D describes in detail the process of the key management server 110 generating the authorization key and the authorization process information corresponding to the authorization key.

[0176] like Figure 5 As shown, in some embodiments, the process in which the key management server 110 generates an authorization key and authorization process information corresponding to the authorization key includes but is not limited to the following steps 510 to 530.

[0177] Step 510: Determine the target process group corresponding to the target terminal address based on the first correspondence table;

[0178] Step 520: Based on the second correspondence table, determine the authorization key corresponding to the target process group as the authorization key corresponding to the target terminal address;

[0179] Step 530: Based on the third correspondence table, determine the authorized process information corresponding to the target process group as the authorized process information corresponding to the authorization key.

[0180] Steps 510 - 530 are described in detail below.

[0181] A process group is a group consisting of one or more authorized process information. A process group has at least one authorized process information.

[0182] In step 510, since the first correspondence table indicates the first correspondence between the terminal address and the process group, all process groups corresponding to the target terminal address can be determined by querying the first correspondence table, and the queried process group is used as the target process group.

[0183] like Fig. 6A As shown, in the first correspondence, terminal address 1 corresponds to process group 1 and process group 2. Terminal address 2 corresponds to process group 1 and process group 3. Terminal address 3 corresponds to process group 2 and process group 3. Terminal address 4 corresponds to process group 2, process group 4, process group 5 and process group 6. Terminal address 5 corresponds to process group 10 and process group 6. When the target terminal address is terminal address 3, it can be known by querying the first correspondence table that the target process groups corresponding to the target terminal address are process group 2 and process group 3.

[0184] In step 520, since the second correspondence table indicates the second correspondence between the process group and the authorization key, all authorization keys corresponding to the target process group can be determined by querying the second correspondence table, and all the queried authorization keys are used as the authorization keys corresponding to the target terminal address.

[0185] like Figure 6BAs shown, in the second correspondence table, the authorization keys include authorization key 1, authorization key 2, authorization key 3, authorization key 4, authorization key 5, etc.; the process groups include process group 1, process group 2, process group 3, process group 4, process group 5, etc. Among them, authorization key 1 corresponds to process group 1; authorization key 2 corresponds to process group 2; authorization key 3 corresponds to process group 3; authorization key 4 corresponds to process group 4; authorization key 5 corresponds to process group 5. When the target process groups corresponding to the target terminal address are process group 2 and process group 3, it can be known by querying the second correspondence table that the authorization key corresponding to process group 2 is authorization key 2, and the authorization key corresponding to process group 3 is authorization key 3. Therefore, authorization key 2 and authorization key 3 are used as the authorization keys corresponding to the target terminal address.

[0186] In step 530, since the third correspondence table indicates the third correspondence between the process group and the authorized process information of the process included in the process group, all the authorized process information corresponding to the target process group can be determined by querying the third correspondence table, and all the queried authorized process information is used as the authorized process information corresponding to the authorization key.

[0187] like Figure 6C As shown, in the third correspondence, the authorized process information under process group 1 includes authorized process information 1 and authorized process information 3. The authorized process information under process group 2 includes authorized process information 2 and authorized process information 4. The authorized process information under process group 3 includes authorized process information 5 and authorized process information 6. The authorized process information under process group 4 includes authorized process information 7, authorized process information 8 and authorized process information 9. The authorized process information under process group 5 includes authorized process information 10 and authorized process information 11. When the target process groups corresponding to the target terminal address are process group 2 and process group 3, it can be known by querying the third correspondence table that the authorized process information under process group 2 is authorized process information 2 and authorized process information 4, and it is determined that the authorized process information corresponding to authorization key 2 is authorized process information 2 and authorized process information 4. Similarly, it can be determined that the authorized process information corresponding to authorization key 3 is authorized process information 5 and authorized process information 6.

[0188] like Fig.6DAs shown in the figure, the key information of each key includes the key algorithm version, key identifier, effective time, expiration time, activation status, etc. Each process group corresponds to a terminal address list and an authorized process list. The terminal address list records the specific terminal address corresponding to the process group, and the authorized process list records the authorized process information under the process group. Each authorized process information includes the authorized process execution object identifier, authorized process name, authorized process execution path, and authorized process file summary. When a key is authorized to a process group, the key information of the authorized key and the terminal address and authorized process information corresponding to the process group will also have a corresponding relationship. According to these corresponding relationships, the authorized key and the authorized process information corresponding to the authorized key can be determined.

[0189] It should be noted that the key algorithm version is used to indicate the encryption algorithm version of the authorization key. The key algorithm version includes but is not limited to symmetric encryption algorithm, MD5 encryption algorithm, etc. The key identifier is a unique credential used to distinguish different authorization keys, that is, the key identifiers of different authorization keys are different, and each authorization key corresponds to a unique key identifier. The effective time and expiration time are used to indicate the validity period of the authorization key. If the current time is earlier than the effective time or later than the expiration time, the authorization key cannot be used normally. The activation status is used to indicate whether the authorization key is activated. If the authorization key is activated, the authorization key will be in the state of starting to be used.

[0190] Through the above steps 510-530, the embodiment of the present disclosure determines the target process group corresponding to the target terminal address through the mapping relationship between the terminal address and the process group in the first correspondence table. Further, the authorization key corresponding to the target terminal address is determined through the mapping relationship between the process group and the authorization key in the second correspondence table. Finally, the authorization process information corresponding to the authorization key is determined through the mapping relationship between the process group and the authorization process information in the third correspondence table. The correspondence between the authorization key and the authorization process information is determined through multiple mapping relationships between multiple information, which can make the association between the authorization key and the authorization process information more accurate and more reasonable. This series of correspondences can better improve the efficiency of information query, and then improve the efficiency of obtaining the authorization key on the target terminal and the authorization process information corresponding to the authorization key, so as to more quickly and accurately determine the authorization key that can be provided to the target process.

[0191] Combine the following Figure 7 , Figure 8 , Fig. 9 The process of the key management server 110 generating the first corresponding relationship is described in detail.

[0192] like Figure 7As shown, in some embodiments, the process of the key management server 110 generating the first corresponding relationship includes but is not limited to the following steps 710 to 740.

[0193] Step 710: Display the process group configuration interface;

[0194] Step 720: In the process group identifier input area, receive the input process group identifier;

[0195] Step 730: receiving the input terminal address in the terminal address input area;

[0196] Step 740: Store the process group corresponding to the input process group identifier and the input terminal address in correspondence as a first correspondence relationship.

[0197] Steps 710-740 are described in detail below.

[0198] The process group ID is the only credential used to distinguish different process groups. That is, the process group IDs of different process groups are different, and each process group corresponds to a unique process group ID.

[0199] In step 710, a process group configuration interface is displayed on the key management terminal 140 in the key management server 110. The process group configuration interface is used for objects to interact with each other to configure various information of the process group. The object refers to a person, intelligent assistant, etc. who wants to configure various information of the process group through interaction with the process group configuration interface. The process group configuration interface has a process group identifier input area and a process group application terminal address input area. Among them, the process group identifier input area is used to provide the object with input of the process group identifier. The process group application terminal address input area is used to provide the object with input of the terminal address.

[0200] Furthermore, the process group configuration interface also has an input area for inputting the Chinese name of the process group, an input area for inputting the responsible object, and an input area for inputting the department to which it belongs. The input area for the Chinese name of the process group is used for the object to input the Chinese name of the process group. The input area for the responsible object is used for the object to input the responsible object responsible for the management of the process group. The input area for the department to which it belongs is used for the object to input the department to which the process group belongs. The Chinese name of the process group, the responsible object, and the department to which it belongs can more conveniently realize the classification of process groups, and also help to improve the management of process groups, so that when the process group needs to be modified or information deleted, the corresponding responsible object and department to which it belongs can be found in time.

[0201] like Fig. 9 As shown, the process group configuration interface displays a process group identifier input area, a terminal address generation method selection control, a terminal address input area, and an "OK" button.

[0202] In step 720 , according to the input operation of the object in the process group identifier input area, the key management server 110 receives the input process group identifier.

[0203] In step 730 , according to the input operation of the object in the terminal address input area, the key management server 110 receives the input terminal address.

[0204] In step 740, the key management server 110 determines each process group according to the process group identifier, and constructs a correspondence between the process group and the terminal address, and stores the correspondence between all authorization keys and key identifiers in the form of a data table to obtain a first correspondence table.

[0205] It should be noted that, in the first correspondence table, one process group may correspond to multiple terminal addresses, and one terminal address may also correspond to multiple process groups.

[0206] like Fig. 9 As shown, in the process group configuration interface, according to the input operation of the object in the process group identifier input area, the key management server 110 receives the input process group identifier as "ABB". According to the input operation of the object in the process group Chinese name input area, the key management server 110 receives the input process group Chinese name as "Xxx". According to the input operation of the object in the responsibility attribution object input area, the key management server 110 receives the input responsibility attribution object as "Xx". According to the input operation of the object in the department input area, the key management server 110 receives the input department as "Xxxx Department". Further, according to the manual synchronization mode selected by the object using the terminal address generation mode selection control, the object enters the terminal address in the terminal address input area. The terminal addresses received by the key management server 110 are "terminal address 1", "terminal address 12", "terminal address 10" and "terminal address 6". Finally, the object clicks the "OK" button, and the key management server 110 generates the process group identifier of the process group and the terminal address corresponding to the process group according to the object's click operation.

[0207] Through the above steps 710-740, the key management server 110 of the embodiment of the present disclosure can determine the matching relationship between the process group identifier and the terminal address by receiving the input process group identifier and the terminal address, and construct a first correspondence table according to the matching relationship between the process group and the authorization key, so that the process group corresponding to each terminal address can be obtained according to the first correspondence table, thereby improving the efficiency of querying the process group corresponding to the terminal address.

[0208] like Figure 8 As shown, in some other embodiments, the process of the key management server 110 generating the first corresponding relationship includes but is not limited to the following steps 810 to 830.

[0209] Step 810: For each process group, send a second request to the process group deployment management node, where the second request includes the process group identifier of the process group;

[0210] Step 820: Receive a terminal address corresponding to the process group identifier sent by the process group deployment management node in response to the second request;

[0211] Step 830: Store the process group and the received terminal address as a first corresponding relationship.

[0212] Steps 810-830 are described in detail below.

[0213] In step 810, the process group deployment management node refers to a data node that stores multiple terminal addresses. The process group deployment management node can determine the terminal address corresponding to the process group according to the functions implemented by the process group. Specifically, according to the process group deployment management node synchronization method selected by the object using the terminal address generation method selection control in the process group configuration interface, the key management server 110 will send a second request to the process group deployment management node for each process group. The second request is a request for obtaining the terminal address from the process group deployment management node in response to the object's selection operation for synchronizing the process group deployment management node. The second request includes the process group identifier of the process group.

[0214] In step 820 , the process group deployment management node may query through the process group identifier sent in the second request, find the terminal address corresponding to the process group identifier, and return the terminal address to the key management agent 120 .

[0215] In step 830, the specific implementation process of storing the process group and the received terminal address as the first corresponding relationship is similar to the specific implementation process of storing the process group corresponding to the input process group identifier and the input terminal address as the first corresponding relationship in step 740. To save space, it will not be repeated.

[0216] Through the above steps 810-830, the embodiment of the present disclosure sends a second request to the process group deployment management node, so that the process group deployment management node can provide the corresponding terminal address according to the process group identifier, which can reduce input errors caused by object input terminal address, shorten the generation time of the terminal address, improve the generation efficiency of the terminal address, and thus improve the construction efficiency of the first correspondence table.

[0217] Combine the following Fig.10 , Fig.11A -B describes in detail the process of the key management server 110 generating the second corresponding relationship.

[0218] like Fig.10As shown, in some embodiments, the process of the key management server 110 generating the second corresponding relationship includes but is not limited to the following steps 1010 to 1040.

[0219] Step 1010: Receive a selection of an authorization key;

[0220] Step 1020, in response to a process group input instruction for the selected authorization key, displaying a process group input area;

[0221] Step 1030: In the process group input area, receiving the input process group;

[0222] Step 1040: Store the input process group and the authorization key as a second corresponding relationship.

[0223] Steps 1010-1040 are described in detail below.

[0224] In step 1010, when generating the second corresponding relationship, the object selects an authorization key on the display interface of the key management terminal 140 of the key management server 110. Based on the object's selection operation on the authorization key, the key management server 110 can more conveniently determine the key to be authorized and the key information of the authorization key.

[0225] like Fig.11A As shown, on the display interface of the key management terminal 140 of the key management server 110, the object clicks on the "Authorization Management" task bar, and an authorization key input area is displayed on the interface corresponding to the "Authorization Management" task bar. The object performs input operations in the authorization key input area, and the key management server 110 will receive the key identifier of the selected authorization key as "Xxxx".

[0226] In step 1020, after selecting the authorization key, the object will issue a process group input instruction to input the relevant information of the process group to be authorized through the process group input instruction. At this time, the key management server 110 displays a process group input area in response to the process group input instruction for the selected authorization key. The process group input area is used to provide the object with information about the process group to be authorized.

[0227] In step 1030 , when the relevant information of the process group is input in the process group input area, the key management server 110 receives the input specific information of the process group and determines the process group that needs to be authorized according to the specific information.

[0228] like Fig. 11BAs shown, after the object has selected the authorization key, a process group input instruction is issued. At this time, the key management server 110 will display a process group input area. In the process group input area, the object can enter the department and process group ID corresponding to the process group. According to the object's input operation on the department and process group ID, the key management server 110 determines the department of the process group to be authorized as "Xxxxxxx Department" and determines the process group ID of the process group to be authorized as "ABB". Further, according to the object's click operation on the "OK" button, the key management server 110 will determine to authorize the authorization key "Xxxx" to the process group with the process group ID "ABB".

[0229] In step 1040, the key management server 110 constructs a correspondence between the process group and the authorization key according to the authorization relationship between each process group and the authorization key, stores the correspondence between all the authorization keys and the process groups in the form of a data table, and obtains a second correspondence table.

[0230] Through the above steps 1010-1040, the key management server 110 of the embodiment of the present disclosure can determine the matching relationship between the process group and the authorization key by receiving the selection of the authorization key and the input process group, and can clearly authorize each key to the corresponding process group. At the same time, a second correspondence table is constructed according to the matching relationship between the process group and the authorization key, so that the process group corresponding to each authorization key can be obtained according to the second correspondence table, thereby improving the efficiency of querying the process group corresponding to the authorization key.

[0231] Combine the following Fig.12 , Fig.13 The process of the key management server 110 generating the third corresponding relationship is described in detail.

[0232] like Fig.12 As shown, in some embodiments, the process of the key management server 110 generating the third corresponding relationship includes but is not limited to the following steps 1210 to 1230.

[0233] Step 1210: In response to the authorization process information configuration instruction for the process under the process group, display the authorization process information configuration interface;

[0234] Step 1220: In the authorization process information configuration interface, receiving the input authorization process information;

[0235] Step 1230: Store the process group and the authorized process information as a third corresponding relationship.

[0236] Steps 1210 - 1230 are described in detail below.

[0237] The authorized process information configuration instruction is an instruction issued by the object to configure the authorized process information of the authorized process belonging to each process group.

[0238] The authorization process information configuration interface is used to provide objects with interactive operations to configure the specific content of each authorization process information.

[0239] In step 1210, according to the authorization process information configuration instruction issued by the object for the process under the process group, the key management server 110 will display the authorization process information configuration interface.

[0240] In step 1220, in the authorization process information configuration interface, the object can perform input operations in each information configuration input area in the authorization process information configuration interface, and the key management server 110 will receive the specific content of the input authorization process information and generate authorization process information for each process under the process group.

[0241] It should be noted that the authorization process information includes the authorization process version number, the authorization process name, the authorization process execution path, the authorization process execution object identifier, and the authorization process file summary. Among them, the authorization process version number is used to mark the current version of the authorization process. The authorization process name refers to the specific name of the authorization process, and the authorization process execution path is used to indicate the storage location of the authorization process file corresponding to the authorization process. The authorization process execution object identifier is used to identify the identity of the object that can run the authorization process. The authorization process file summary is the result of signing the authorization process information, and the authorization process file summary can reduce the risk of the authorization process information of the authorization process being stolen and tampered with.

[0242] In step 1230, the key management server 110 constructs a correspondence between the process group and the authorized process information according to the subordinate relationship between the process group and the authorized process information, stores the correspondence between all process groups and the authorized process information in the form of a data table, and obtains a third correspondence table.

[0243] like Fig.13As shown, in the authorization process information configuration interface, according to the input operation of the object in the authorization process version number input area, the key management server 110 will determine the authorization process version number as "Xxxx2". According to the input operation of the object in the authorization process name input area, the key management server 110 will determine the authorization process name as "m1". According to the input operation of the object in the authorization process execution path input area, the key management server 110 will determine the authorization process execution path as "D\xx1". According to the input operation of the object in the authorization process execution object identifier input area, the key management server 110 will determine the authorization process execution object identifier as "Yy1". According to the input authorization process execution path and authorization process name, the key management server 110 will query the specific authorization process file, and perform a summary operation on the authorization process file to obtain the authorization process file summary as "Qdq154". When the object has entered the authorization process information, click the "OK" button. The key management server 110 will complete the configuration of the authorization process information of the process under the process group in response to the object's selection operation.

[0244] Furthermore, in the authorized process information configuration interface, there are also prompts for inputting the authorized process name and the authorized process execution path. Specifically, below the authorized process name input area, there is a prompt field labeled "It is recommended to fill in the name of the process when it is running, otherwise any process has the right to access the key." Below the authorized process execution path input area, there is also a prompt field labeled "Fill in at least one of the authorized process name and the authorized process execution path." This series of prompt fields can guide the object to perform input operations, making the object's input information more reasonable.

[0245] Through the above steps 1210-1230, the key management server 110 of the embodiment of the present disclosure provides an authorization process information configuration interface, which can receive the specific content of the authorization process information of each process under the input process group through the authorization process information configuration interface, thereby generating complete authorization process information, which can effectively improve the accuracy and rationality of the authorization process information. Then, a third corresponding relationship table can be constructed according to the correspondence between the authorization process information and the process group, so that the authorization process information corresponding to each process group can be obtained according to the third corresponding relationship table, thereby improving the efficiency of querying the authorization process information corresponding to the authorization key.

[0246] Detailed description of step 330

[0247] In step 330, in response to the key acquisition request, target process information of the target process is acquired.

[0248] In the specific implementation of this embodiment, the key acquisition request includes a target process identifier, which is used to distinguish different target processes. The target process identifier is unique, that is, each target process corresponds to a target process identifier, and the process identifiers of different target processes are different. The target process identifier can be an identity identification number (Process Identity Document, PID) for the target process. One PID can mark one target process, and the value of the PID is usually a non-zero integer.

[0249] As Fig.14 As shown, in some embodiments, in response to a key acquisition request, a process of acquiring target process information of a target process includes but is not limited to steps 1410 to 1420.

[0250] Step 1410: Obtain the target process identifier from the key acquisition request;

[0251] Step 1420: Based on the target process identifier, obtain target process information.

[0252] Steps 1410-1420 are described in detail below.

[0253] In step 1410, since the key acquisition request is triggered when the target process needs to obtain the authorization key, different target processes often have different process tasks to be executed. In order to distinguish the identities of different target processes, when sending the key acquisition request, the target process often sends its own target process identifier to the key management agent 120 through a preset protocol. Therefore, the key management agent 120 can obtain the target process identifier used to represent the identity of the target process from the key acquisition request.

[0254] For example, when the target process sends a key acquisition request using the key management software, it often sends its own target process identifier to the key management agent 120 through the Unix sock protocol.

[0255] It should be noted that the key authorization authentication method is executed by the key management agent 120 having the permission to read the process running status. The process running status is used to indicate the resources required for the normal operation of the target process, and the process running status may include specific process information when the target process is running. The permission to read the process running status is used to restrict the key management agent 120 from reading the specific process information in the process running status.

[0256] Specifically, the target process information includes the target process execution object identifier, the target process name, the target process execution path, and the target process file summary. The target process execution object identifier is used to identify the identity of the object that can run the target process. The target process name refers to the specific name of the target process. The target process execution path is used to indicate the storage location of the target process file corresponding to the target process. The target process file summary is the result of signing the target process information. The target process file summary can reduce the risk of the target process information being stolen and tampered with, and can improve the security of the target process information.

[0257] Combine the following Fig.15 , Fig.16 A detailed description is given of the process of obtaining target process information based on the target process identifier.

[0258] like Fig.15 As shown, in some embodiments, based on the target process identifier, the process of obtaining the target process information includes but is not limited to the following steps 1510 to 1540.

[0259] Step 1510: Obtain a target process execution object identifier corresponding to the target process identifier;

[0260] Step 1520: Using the process running status reading permission, read the target process running status corresponding to the target process identifier;

[0261] Step 1530: Obtain the target process name and the target process execution path from the target process running status;

[0262] Step 1540: Obtain the target process file according to the target process name and the target process execution path, perform a digest operation on the target process file, and obtain a target process file digest.

[0263] Steps 1510-1540 are described in detail below.

[0264] In step 1510, since there is a mapping relationship between the target process identifier and the target process execution object identifier of the target process, the key service management 120 can query based on the target process identifier to obtain the target process execution object identifier corresponding to the target process identifier.

[0265] In step 1520, since the key service management 120 has the process running status reading permission, the process running status of each process and the process identifier have a corresponding relationship. Therefore, the key service management 120 can use the process running status reading permission to read the process running status of multiple processes, and determine the target process running status corresponding to the target process identifier from the read process running status. The target process running status includes the target process name and the target process execution path.

[0266] In step 1530, since the target process running status includes the target process name and the target process execution path, the key service management 120 can directly obtain the target process name and the target process execution path of the target process from the target process running status.

[0267] In step 1540, a file query is performed according to the target process execution path and the target process name, and the target process file is obtained at the storage location indicated by the target process execution path; then, a digest operation is performed on the target process file using a digest algorithm to obtain a digest of the target process file.

[0268] It should be noted that the above digest algorithm may be the Poseidon hash algorithm, the MD5 digest algorithm, or other types of digest algorithms without limitation.

[0269] like Fig.16 As shown, first, the target process uses the key algorithm software to access the key management agent 120 through the protocol, and sends a key acquisition request to the key management agent 120. Then, the key management agent 120 obtains the target process identifier from the key acquisition request. Further, the key management agent 120 with the process running status reading permission reads the target process running status corresponding to the target process identifier. Further, the key management agent 120 calculates the target process execution object identifier, target process name, target process execution path, and target process file summary of the target process in real time according to the target process running status. Further, the key management service agent 120 compares the target process execution object identifier, target process name, target process execution path, and target process file summary of the target process with the authorized process execution object identifier, authorized process name, authorized process execution path, and authorized process file summary of the authorized process information one by one, and obtains matching authorized process information from multiple authorized process information. Finally, the authorization key corresponding to the matching authorized process information is sent to the target process.

[0270] Through the above steps 1510-1540, the key management agent of the embodiment of the present disclosure can obtain the target process identifier from the key acquisition request; further, by utilizing the process running status reading permission, the target process running status corresponding to the target process identifier is read, and based on the target process running status, the specific content of the target process information of the target process is obtained, which can effectively improve the efficiency of obtaining the target process information and the comprehensiveness of the information, and then realize the detailed comparison of the target process information and the authorized process information, thereby improving the accuracy of the information comparison.

[0271] Detailed description of step 340

[0272] In step 340, the target process information is compared with the plurality of authorized process information to obtain matching authorized process information from the plurality of authorized process information.

[0273] In the specific implementation of this embodiment, the target process information includes the target process execution object identifier, the target process name, the target process execution path, and the target process file summary, and the authorized process information includes the authorized process execution object identifier, the authorized process name, the authorized process execution path, and the authorized process file summary. Based on this, when comparing the target process information with multiple authorized process information, it is possible to select part of the target process information to compare with the authorized process information, or it is possible to select all the target process information to compare with the authorized process information.

[0274] In one embodiment, one or part of the target process execution object identifier, target process name, target process execution path, and target process file summary can be randomly selected from the target process information as a comparison item. Then, the corresponding authorized process execution object identifier, authorized process name, authorized process execution path, and authorized process file summary are selected from the authorized process information for process information comparison. If the information of the selected comparison items is all the same, the authorized process information is determined to match the authorized process information.

[0275] This method can effectively improve the efficiency of information comparison by selecting part of the target process information as comparison items and only comparing the comparison items.

[0276] In another embodiment, each information in the target process information and the authorized process information can be compared one by one. If the authorized process execution object identifier in one of the multiple authorized process information is the same as the target process execution object identifier, the authorized process name is the same as the target process name, the authorized process execution path is the same as the target process execution path, and the authorized process file summary is the same as the target process file summary, the authorized process information is determined to match the authorized process information.

[0277] This method can make the matching authorization process information and target process information have a high degree of information overlap by comparing each information in the target process information and the authorized process information one by one, thereby improving the accuracy of information comparison.

[0278] The process of comparing process information based on key identification

[0279] Since there are a large number of authorized process information, it often takes a lot of time to randomly compare the authorized process information with the target process information one by one, which will cause problems such as low comparison efficiency, affecting the efficiency of the target process obtaining the authorization key. Based on this, the embodiment of the present disclosure considers that the key identifier can uniquely identify the authorization key, and the embodiment of the present disclosure provides a solution for comparing the target process information with multiple authorized process information based on the key identifier, which can improve the information comparison efficiency, and thus improve the efficiency of the target process obtaining the authorization key.

[0280] In some embodiments, step 310 includes:

[0281] Obtain an authorization key on the target terminal, a key identifier corresponding to the authorization key, and authorization process information corresponding to the authorization key.

[0282] In the specific implementation of this embodiment, while obtaining the authorization key on the target terminal and the authorization process information corresponding to the authorization key, the key identifier corresponding to the authorization key is obtained. The specific implementation process of obtaining the key identifier corresponding to the authorization key is similar to the specific implementation process of obtaining the authorization key on the target terminal and the authorization process information corresponding to the authorization key in the above step 310. To save space, it will not be repeated.

[0283] In some embodiments, step 320 includes:

[0284] From the key acquisition request, obtain the target process ID and the target key ID.

[0285] In the specific implementation of this embodiment, while obtaining the target process identifier from the key acquisition request, the target key identifier is also obtained from the key acquisition request. The target key identifier refers to the key identifier corresponding to the target key required by the target process for encryption. The specific implementation process of obtaining the target key identifier from the key acquisition request is similar to the specific implementation process of obtaining the target process identifier from the key acquisition request in the above step 1410. To save space, it will not be repeated.

[0286] like Fig.17 As shown, in some embodiments, based on the key identification, the process of comparing the target process information with multiple authorized process information includes but is not limited to the following steps 1710 to 1720.

[0287] Step 1710: Obtain candidate authorization process information whose key identifier corresponding to the authorization key is consistent with the target key identifier from among multiple authorization process information;

[0288] Step 1720: If the target process information is consistent with the candidate authorization process information, the candidate authorization process information is determined as matching authorization process information.

[0289] Steps 1710-1720 are described in detail below.

[0290] In step 1710, since each authorization process information has a corresponding authorization key, the key identifier of the authorization key can be used as a basis for judging whether the authorization process information meets the requirements. Specifically, first, the key identifier corresponding to the authorization key is compared with the target key identifier; then, among multiple authorization process information, the authorization process information whose key identifier corresponding to the authorization key is consistent with the target key identifier is selected as the candidate authorization process information. Compared with the authorization process information whose key identifier corresponding to the authorization key is inconsistent with the target key identifier, the probability that the candidate authorization process information is the same as the target process information is higher.

[0291] In step 1720, the target process information may be compared with the candidate authorization process information; if the target process information is consistent with the candidate authorization process information, the candidate authorization process information is determined as the matching authorization process information. The specific implementation process of comparing the target process information with the candidate authorization process information is similar to the specific implementation process of comparing the specific content of the target process information with the specific content of the authorization process information described above. To save space, it will not be repeated.

[0292] In other embodiments, if the target process information is inconsistent with the candidate authorization process information, then in multiple authorization process information, the candidate authorization process information whose key identifier corresponding to the authorization key is inconsistent with the target key identifier is obtained; if the target process information is consistent with the candidate authorization process information, the candidate authorization process information is determined as the matching authorization process information. The specific implementation process of this embodiment is similar to the above steps 1710-1720, the difference is that this process is to compare the candidate authorization process information whose key identifier corresponding to the authorization key is inconsistent with the target key identifier with the target process information, and step 1720 is to compare the candidate authorization process information whose key identifier corresponding to the authorization key is consistent with the target key identifier with the target process information. To save space, it will not be repeated.

[0293] Through the above steps 1710-1720, the embodiment of the present disclosure takes into account that the key identifier of each authorization key is unique, and can preferentially obtain the candidate authorization process information whose key identifier of the authorization key is consistent with the target key identifier, and compare the candidate authorization process information with the target process information, so that the candidate authorization process information with a higher matching probability can be preferentially compared with the target process information. If the target process information is consistent with a certain candidate authorization process information, the candidate authorization process information is directly determined as the matching authorization process information, and there is no need to compare the authorization process information whose key identifier is inconsistent with the target key identifier with the target process information, which can reduce the amount of authorization process information that needs to be compared, effectively shorten the time for information comparison, and thus improve the efficiency of the target process in obtaining the authorization key.

[0294] It should be noted that the key identifier corresponding to the authorization key in the embodiment of the present disclosure is obtained based on the authorization key with reference to the fourth correspondence table. The fourth correspondence table is generated by the key management server 110, and the fourth correspondence table is used to indicate the fourth correspondence between the authorization key and the key identifier.

[0295] Combine the following Fig.18 , Fig.19A -C describes in detail the process of the key management server 110 generating the fourth corresponding relationship.

[0296] like Fig.18 As shown, in some embodiments, the process of the key management server 110 generating the fourth corresponding relationship includes but is not limited to the following steps 1810 to 1840.

[0297] Step 1810: display the authorization key configuration interface;

[0298] Step 1820: receiving the key identifier input in the key identifier input area;

[0299] Step 1830, in response to selecting a random generation method using the authorization key generation method selection control, randomly generating an authorization key;

[0300] Step 1840: Store the authorization key and the key identifier as a fourth corresponding relationship.

[0301] Steps 1810-1840 are described in detail below.

[0302] In step 1810, an authorization key configuration interface is displayed on the key management terminal 140 in the key management server 110. The authorization key configuration interface is used for interactive operations with an object, and the object refers to a person, an intelligent assistant, etc. who wants to construct key information of an authorization key through interactive operations with the authorization key configuration interface. The authorization key configuration interface includes a key identifier input area and an authorization key generation method selection control. The key identifier input area is used to provide the object with a key identifier, and the authorization key generation method selection control is used to provide the object with a selection of a specific authorization key generation method.

[0303] Furthermore, the authorization key configuration interface also includes a business input area and a responsible object input area. The business input area is used to provide the object with input of the business type and business sector to which the key is applied; the responsible object input area is used to provide the object with input of the person responsible for key management. By setting the business input area and the responsible object input area, it is relatively convenient to determine the business type to which the key is applicable and the person responsible for key management, so that when the key needs to be modified or deleted, the responsible object can be notified in time for processing.

[0304] like Fig.19A -B, there are two authorization key configuration interfaces. The first authorization key configuration interface includes a department input area, a key identifier input area, and a key acquisition method selection control. The second authorization key configuration interface includes a validity period selection control, a key algorithm version selection control, an authorization key generation method selection control, and a key value input area.

[0305] In step 1820 , according to the input operation of the object in the key identifier input area, the key management server 110 receives the input key identifier.

[0306] like Fig.19A As shown, in the first authorized key configuration interface, according to the input operation of the object in the key identifier input area, the key management server 110 receives the input key identifier as "Key21". Further, according to the input operation of the object in the department input area, the key management server 110 receives the input department as "Xxxx Department". Further, according to the input operation of the object in the business input area, the key management server 110 receives the input business as "Xxxx". Further, according to the input operation of the object in the responsible object input area, the key management server 110 receives the input responsible object as "XXx". According to the selection operation of the object in the key acquisition method selection control, the key management server 110 determines the key acquisition method as "Allow API direct acquisition". Finally, according to the selection operation of the object in the "Next" control, the key management server 110 will jump to the next authorized key configuration interface.

[0307] In step 1830, in the second authorization key configuration interface, the object can select the manual input mode or the random generation mode to generate the key using the authorization key generation mode selection control. Specifically, when the object selects the random generation mode using the authorization key generation mode selection control, the key management server 110 randomly generates an authorization key in the random generation mode in response to selecting the random generation mode using the authorization key generation mode selection control.

[0308] like Fig.19B As shown, when the object clicks the "Next" button in the first authorization key configuration interface, the key management server 110 will jump to the second authorization key configuration interface in response to the object's click operation. In the second authorization key configuration interface, a selection control for whether to fill in the key value is displayed; when the object chooses not to fill in the new key value, in response to the selection control for whether to fill in the key value, the object does not need to fill in other contents of the second authorization key configuration interface. When the object chooses to fill in the new key value, in response to the selection control for whether to fill in the key value, the key management server 110 will prompt the object to continue to fill in the relevant contents of the key value. Specifically, according to the date selection operation of the object in the effective period selection control, the key management server 110 will determine the effective time and expiration time of the authorization key. According to the object's selection operation in the key algorithm version selection control, the key management server 110 determines the key algorithm version of the authorization key as "Xxxx". According to the object's selection of the random generation method using the authorization key generation method selection control, the key management server 110 will randomly generate the key value "Qaz##58714". After the object has entered the key information of the authorization key, click the "Submit" button. The key management server 110 generates key information of the authorization key in response to the object selection operation.

[0309] Furthermore, in the second authorization key configuration interface, various prompt fields are also included. Specifically, below the validity period selection control, a prompt field is displayed that reads "Tip: The key cannot be obtained before the effective time point. (For the certificate key, please fill in the actual validity period of the certificate)". Below the key algorithm version selection control, a prompt field is displayed that reads "Tip: For the std algorithm, please choose manual input". Below the key value input area, a prompt field is displayed that reads "Tip: If you choose not to fill in a new key value for the time being, you do not need to fill in the above". In addition, a "How to choose?" selection control is also provided behind the key algorithm version selection control to provide the object with a guidance tutorial for selecting the key algorithm version in response to the object's click operation on the "How to choose?" selection control.

[0310] In step 1840, the key management server 110 constructs a one-to-one correspondence between the key identifier and the authorization key according to the key identifier in the key information of each authorization key, stores the correspondence between all authorization keys and key identifiers in the form of a data table, and obtains a fourth correspondence table.

[0311] like Fig.19C As shown, in the fourth corresponding relationship, the key identifier includes identifier 1, identifier 2, identifier 3, identifier 4, identifier 5, ..., identifier n; the authorization key includes authorization key 1, authorization key 2, authorization key 3, authorization key 4, authorization key 5, ..., authorization key n, and n is a positive integer greater than 5. Among them, identifier 1 corresponds to authorization key 1; identifier 2 corresponds to authorization key 2; identifier 3 corresponds to authorization key 3; identifier 4 corresponds to authorization key 4; identifier 5 corresponds to authorization key 5; identifier n corresponds to authorization key n.

[0312] Through the above steps 1810-1840, the key management server 110 of the embodiment of the present disclosure provides an authorization key configuration interface, which can receive the key identifier input by the object through the authorization key configuration interface, and generate a specific key value according to the authorization key generation method selected by the object, which can effectively improve the accuracy and rationality of the key information of the authorization key. Then, according to the correspondence between the authorization key and the key identifier, a fourth correspondence table can be generated, so that the key identifier of each authorization key can be obtained according to the fourth correspondence table, which improves the efficiency of obtaining the key identifier, and then can improve the efficiency of screening candidate authorization process information based on the key identifier and the target key identifier.

[0313] The process of selecting a license key based on its validity period

[0314] Since the authorization key has an expiration date, if the expiration date of the authorization key does not meet the time requirement of the target process, the authorization key often cannot meet the key authorization authentication requirement of the target process. Therefore, if the authorization process information corresponding to the authorization key is compared with the target process information one by one, a lot of time is often wasted, which will result in low efficiency in obtaining the authorization key. Based on this, the embodiment of the present disclosure also provides a solution for selecting authorization keys based on the expiration date, which can effectively filter out the authorization keys whose expiration dates do not meet the requirements, and the authorization process information corresponding to the authorization keys that do not meet the requirements, thereby improving the efficiency of information comparison.

[0315] In some embodiments, the process of selecting an authorization key based on the validity period of the authorization key includes, but is not limited to, the following steps:

[0316] Get the effective time and expiration time of each authorization key;

[0317] From a plurality of authorization keys, an authorization key whose effective time is earlier than the current time and whose expiration time is later than the current time, and authorization process information corresponding to the authorization key are selected.

[0318] In the specific implementation of this embodiment, since each authorization process information has a corresponding authorization key, the effective time and expiration time of the authorization key can be used as a basis for judging whether the authorization process information meets the requirements. Among them, the specific implementation process of obtaining the effective time and expiration time of the authorization key is similar to the specific implementation process of obtaining the authorization key on the target terminal and the authorization process information corresponding to the authorization key in the above step 310. In order to save space, it will not be repeated.

[0319] In some embodiments, the process of selecting, from a plurality of authorization keys, an authorization key having an effective time earlier than the current time and an expiration time later than the current time, and authorization process information corresponding to the authorization key includes but is not limited to the following steps:

[0320] Compare the effective time of each authorization key with the current time;

[0321] Filter out the authorization keys whose effective time is later than the current time to obtain the intermediate authorization key;

[0322] Compare the expiration time of each intermediate authorization key with the current time;

[0323] Filter out the intermediate authorization keys whose expiration time is earlier than the current time to obtain the filtered authorization key;

[0324] Obtain the filtered authorization key and the authorization process information corresponding to the filtered authorization key.

[0325] When this embodiment is specifically implemented, the effective time of the intermediate authorization key meets the requirements. The effective time and expiration time of the filtered authorization key both meet the requirements. First, the effective time of each authorization key is compared with the current time. If the effective time of the authorization key is later than the current time, it means that the authorization key is not yet effective, and the target process cannot use this authorization key for encryption. Therefore, the authorization keys with effective time later than the current time are filtered out to obtain the intermediate authorization key. Next, the expiration time of each intermediate authorization key is compared with the current time; if the expiration time of the intermediate authorization key is earlier than the current time, it means that the authorization key has expired, and the target process cannot use this authorization key for encryption. Therefore, the intermediate authorization key with expiration time earlier than the current time can be filtered out to obtain the filtered authorization key. Finally, the filtered authorization key and the authorization process information corresponding to the filtered authorization key are obtained; the authorization process information corresponding to the filtered authorization key is used as information for comparison with the target process information.

[0326] Through the above method, the embodiment of the present disclosure can utilize the effectiveness time and expiration time of the authorization key to screen the authorization key and the authorization process information, filter out the authorization keys whose validity period does not meet the requirements, and the authorization process information corresponding to the authorization keys that do not meet the requirements, reduce the number of authorization keys and authorization process information obtained from the key management server, effectively reduce the number of authorization process information that needs to be compared, and improve the efficiency of the target process in obtaining the authorization key.

[0327] Another detailed description of a process for obtaining matching authorization process information from multiple authorization process information

[0328] Since the authorized process information includes the authorized process execution object identifier, the authorized process name, and the authorized process execution path. The target process information includes the target process execution object identifier, the target process name, and the target process execution path. If each information in the target process information and the authorized process information is compared one by one, there will be a problem of low comparison efficiency. Therefore, the embodiment of the present disclosure provides a solution for obtaining matching authorized process information from multiple authorized process information based on matching scores, which can improve the efficiency of information comparison.

[0329] like Fig. 20 As shown, in some embodiments, the process of obtaining matching authorization process information from multiple authorization process information includes but is not limited to the following steps 2010-2040:

[0330] Step 2010: Determine a first matching score based on the target process execution object identifier and the authorized process execution object identifier;

[0331] Step 2020: Determine a second matching score based on the target process name and the authorized process name;

[0332] Step 2030: Determine a third matching score based on the target process execution path and the authorized process execution path;

[0333] Step 2040: Based on the first matching score, the second matching score, and the third matching score, obtain matching authorization process information from multiple authorization process information.

[0334] Steps 2010-2040 are described in detail below.

[0335] In step 2010, first determine whether the target process execution object identifier and the authorized process execution object identifier are the same. If the target process execution object identifier and the authorized process execution object identifier are consistent, the first matching score is determined as the first score. If the target process execution object identifier and the authorized process execution object identifier are inconsistent, determine whether the execution objects indicated by the target process execution object identifier and the authorized process execution object identifier belong to the same department. If the execution objects indicated by the target process execution object identifier and the authorized process execution object identifier belong to the same department, the first matching score is determined as the second score. If the execution objects indicated by the target process execution object identifier and the authorized process execution object identifier do not belong to the same department, the first matching score is determined as the third score. Among them, the first score is higher than the second score, and the second score is higher than the third score.

[0336] For example, if the target process execution object identifier and the authorized process execution object identifier are consistent, the first matching score is 1. If the target process execution object identifier and the authorized process execution object identifier are inconsistent, but the execution objects indicated by the target process execution object identifier and the authorized process execution object identifier belong to the same department, the first matching score is 0.5. If the target process execution object identifier and the authorized process execution object identifier are inconsistent, and the execution objects indicated by the target process execution object identifier and the authorized process execution object identifier do not belong to the same department, the first matching score is 0.

[0337] In step 220, first determine whether the target process name and the authorized process name are the same. If the target process name and the authorized process name are the same, the second matching score is determined as the fourth score. If the target process name and the authorized process name are not the same, determine whether the target process name and the authorized process name belong to the same process group. If the target process name and the authorized process name belong to the same process group, the second matching score is determined as the fourth score. If the target process name and the authorized process name do not belong to the same process group, the second matching score is determined as the sixth score. Among them, the fourth score is higher than the fifth score, and the fifth score is higher than the sixth score.

[0338] For example, if the target process name is consistent with the authorized process name, the second matching score is 1. If the target process name is inconsistent with the authorized process name, but the target process name and the authorized process name belong to the same process group, the second matching score is 0.8. If the target process name is inconsistent with the authorized process name, and the execution objects indicated by the target process execution object identifier and the authorized process execution object identifier do not belong to the same process group, the second matching score is 0.

[0339] In step 2030, since both the target process execution path and the authorized process execution path are character strings, first, the target process execution path and the authorized process execution path are vectorized to obtain the target process execution path and the authorized process execution path in vector form. Then, the similarity between the target process execution path and the authorized process execution path in vector form is calculated, and the similarity is used as the third matching score.

[0340] Furthermore, when the cosine similarity algorithm is used to calculate the similarity between the target process execution path in vector form and the authorized process execution path, the similarity is directly used as the third matching score. When the Euclidean distance method is used to calculate the similarity between the target process execution path in vector form and the authorized process execution path, since the smaller the Euclidean distance, the higher the similarity of the vector, the reciprocal of the Euclidean distance between the target process execution path in vector form and the authorized process execution path is used as the similarity, thereby obtaining the third matching score.

[0341] In step 2040, the matching authorization process information may be obtained from the plurality of authorization process information according to one of the first matching score, the second matching score, and the third matching score. Alternatively, the matching authorization process information may be obtained from the plurality of authorization process information according to a combination of two of the first matching score, the second matching score, and the third matching score. Alternatively, the matching authorization process information may be obtained from the plurality of authorization process information according to the first matching score, the second matching score, and the third matching score together. No limitation is made.

[0342] Through the above steps 2010-2040, the embodiment of the present disclosure determines a first matching score through the target process execution object identifier and the authorized process execution object identifier; determines a second matching score through the target process name and the authorized process name, and determines a third matching score through the target process execution path and the authorized process execution path, thereby achieving the effect of obtaining matching authorized process information from multiple authorized process information based on the matching score, which can effectively improve the efficiency of information comparison. In addition, by quantifying the matching status of the target process information and the authorized process information through the matching score, the accuracy of the information comparison can be improved, thereby improving the accuracy of the obtained matching authorized process information.

[0343] Since obtaining matching authorization process information from multiple authorization process information based solely on the first matching score, or based solely on the second matching score, or based solely on the third matching score, all of them will fail to fully reflect the matching situation of the target process information and the authorization process information, which will result in inaccurate matching authorization process information. Based on this, the embodiment of the present disclosure provides a solution for obtaining matching authorization process information from multiple authorization process information by combining the first matching score, the second matching score, and the third matching score, which can more comprehensively quantify the matching situation of the target process information and the authorization process information, and improve the accuracy of information comparison.

[0344] like Fig.21 As shown, in some embodiments, based on the first matching score, the second matching score, and the third matching score, the process of obtaining matching authorization process information from multiple authorization process information includes but is not limited to the following steps 2110-2120:

[0345] Step 2110: Perform a weighted sum operation on the first matching score, the second matching score, and the third matching score to obtain a total matching score;

[0346] Step 2120: Based on the total matching score, obtain matching authorization process information from multiple authorization process information.

[0347] Steps 2110-2120 are described in detail below.

[0348] In step 2110, first, a first weight corresponding to the first matching score, a second weight corresponding to the second matching score, and a third weight corresponding to the third matching score are set. The first weight is used to characterize the importance of the process execution object identifier in the information comparison; the second weight is used to characterize the importance of the process name in the information comparison; and the third weight is used to characterize the importance of the process execution path in the information comparison. Next, the first weight is multiplied by the first matching score to obtain a first weighted matching score; the second weight is multiplied by the second matching score to obtain a second weighted matching score; and the third weight is multiplied by the third matching score to obtain a third weighted matching score. Finally, the first weighted matching score, the second weighted matching score, and the third weighted matching score are added to obtain a total matching score.

[0349] In step 2120, based on the total matching score, a method of obtaining matching authorization process information from multiple authorization process information includes but is not limited to the following methods:

[0350] Method 1: According to the total matching score, among the authorization process information whose total matching score is higher than a preset threshold, a number of authorization process information are randomly selected as matching authorization process information, wherein the preset threshold is determined according to actual business needs and is not restricted.

[0351] Method 2: Arrange the authorization process information in descending order according to the total matching score, and randomly select a number of authorization process information from the authorization process information with a predetermined top ranking as the matching authorization process information, wherein the predetermined ranking is determined according to actual business needs and is not restricted.

[0352] Through the above steps 2110-2120, the embodiment of the present disclosure obtains matching authorization process information from multiple authorization process information based on the first matching score, the second matching score, and the third matching score, and can more comprehensively reflect the matching situation of the target process information and the authorization process information from the matching situation of multiple information, thereby improving the accuracy of information comparison and the accuracy of the obtained matching authorization process information.

[0353] A detailed description of a process for comparing encryption algorithm versions of authorization keys according to an embodiment of the present disclosure

[0354] Since the encryption versions used by different authorization keys are different, different target processes will have different requirements for encryption algorithms when performing data encryption. If the encryption version used by the authorization key does not meet the actual requirements of the target process, the target process will not be able to use the authorization key normally for data encryption, which will affect the normal operation of the target process. Based on this, the embodiment of the present disclosure provides a solution for comparing the encryption algorithm version of the authorization key, which can effectively determine whether the encryption algorithm version of the authorization key is consistent with the encryption algorithm version used by the authorization key, thereby improving the working stability of the target process.

[0355] In order to improve the query efficiency of the encryption algorithm version applied by the authorization key, first, while obtaining the authorization key on the target terminal and the authorization process information corresponding to the authorization key, the first encryption algorithm version corresponding to the authorization key is obtained. The specific implementation process of the first encryption algorithm version corresponding to the authorization key is similar to the specific implementation process of obtaining the authorization key on the target terminal and the authorization process information corresponding to the authorization key in the above step 310. To save space, it will not be repeated.

[0356] It should be noted that the first encryption algorithm version is the encryption algorithm used when data is encrypted using the authorization key.

[0357] like Fig. 22 As shown, in some embodiments, the process of comparing the encryption algorithm version of the authorization key includes but is not limited to the following steps 2210 to 2220.

[0358] Step 2210: receiving an encryption algorithm version verification request from the target process during encryption using the authorization key;

[0359] Step 2220: If the second encryption algorithm version is consistent with the first encryption algorithm version, send an encryption algorithm version verification success response to the target process.

[0360] Steps 2210-2220 are described in detail below.

[0361] In step 2210, the encryption algorithm version verification request is triggered by the target process wanting to verify the encryption algorithm version of the authorization key. The encryption algorithm version verification request contains the second encryption algorithm version of the authorization key application, which is the encryption algorithm that the target process wants to use when encrypting data.

[0362] When the target process uses the authorized key for encryption, it often needs to determine whether the encryption algorithm version of the authorized key meets the requirements. Therefore, when the target process uses the authorized key for encryption, the target process will send an encryption algorithm version verification request to the key management agent, so that the key management agent verifies whether the encryption algorithm version of the authorized key meets the requirements based on the received encryption algorithm version verification request.

[0363] In step 2220, the key management agent compares the first encryption algorithm version and the second encryption algorithm version. If the second encryption algorithm version is inconsistent with the first encryption algorithm version, it indicates that the encryption algorithm that the authorized key can provide does not meet the encryption requirements of the target process. At this time, the key management agent sends a failed encryption algorithm version verification response to the target process. If the second encryption algorithm version is consistent with the first encryption algorithm version, it indicates that the encryption algorithm that the authorized key can provide meets the encryption requirements of the target process. At this time, the key management agent sends a successful encryption algorithm version verification response to the target process.

[0364] Through the above steps 2210-2220, the embodiment of the present disclosure can more conveniently compare the second encryption algorithm version applied by the authorization key with the first encryption version of the authorization key according to the encryption algorithm version verification request sent by the target process, can effectively detect the application of the authorization key, and send a verification response to the target process in a timely manner according to the comparison results, which can improve the working stability of the target process using the authorization key for encryption.

[0365] Detailed description of the implementation details of the key authorization authentication embodiment of the present disclosure

[0366] Refer to the following Fig.23 , details a specific implementation process of the key authorization authentication method of the embodiment of the present disclosure, which includes but is not limited to the following steps 2301 to 2319.

[0367] Step 2301, the subject inputs a key identifier;

[0368] Step 2302, random generation method of object selection control;

[0369] Step 2303: The key management server randomly generates an authorization key in response to the random generation method of the control selected by the object;

[0370] Step 2304: The key management server generates a fourth correspondence table based on the authorization key and the key identifier;

[0371] Step 2305, the object inputs the process group identifier;

[0372] Step 2306: The key management server sends a second request to the process group deployment node;

[0373] Step 2307: The process group deployment node sends the terminal address to the key management server in response to the second request.

[0374] Step 2308: The key management server generates a first correspondence table based on the process group identifier and the terminal address;

[0375] Step 2309: The object selects an authorization key;

[0376] Step 2310, the object enters the authorized process group;

[0377] Step 2311: The key management server generates a second correspondence table based on the authorization key and the process group;

[0378] Step 2312, the subject inputs authorization process information;

[0379] Step 2313: The key service manager generates a third correspondence table based on the process group and the authorized process information;

[0380] Step 2314: The key management agent requests the key management server to obtain the authorization key and the authorization process information corresponding to the authorization key according to the terminal address;

[0381] Step 2315: The key management server queries the first correspondence table, the second correspondence table, and the third correspondence table according to the terminal address, and sends the authorization key corresponding to the terminal address and the authorization process information corresponding to the authorization key to the key management agent;

[0382] Step 2316: The target process sends a key acquisition request to the key management agent;

[0383] Step 2317: The key management agent obtains target process information of the target process in response to the key acquisition request;

[0384] Step 2318: The key management agent compares the target process information with the plurality of authorized process information to obtain matching authorized process information;

[0385] Step 2319: The key management agent sends the authorization key corresponding to the matching authorization process information to the target process.

[0386] It can be understood that the specific process of steps 2301-2304 is similar to steps 1810-1840 in the above embodiment. The specific process of steps 2305-2308 is similar to steps 710-740 in the above embodiment. The specific process of steps 2309-2311 is similar to steps 1010-1040 in the above embodiment. The specific process of steps 2312-2313 is similar to steps 1210-1230 in the above embodiment. The specific process of step 2314 is similar to step 310 in the above embodiment. The specific process of step 2315 is similar to steps 510-530 in the above embodiment. The specific process of step 2316 is similar to step 320 in the above embodiment. The specific process of step 2317 is similar to step 330 in the above embodiment. The specific process of step 2318 is similar to step 340 in the above embodiment. The specific process of step 2319 is similar to step 350 in the above embodiment. In order to save space, it will not be repeated here.

[0387] Description of the apparatus and device of the present disclosure

[0388] It is to be understood that, although the steps in the above-mentioned flowcharts are sequentially displayed according to the characterization of arrows, these steps are not necessarily executed in sequence according to the order of arrow characterization. Unless there is a clear description in the present embodiment, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the above-mentioned flowcharts can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the steps or stages in other steps.

[0389] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to the characteristics of the target object such as the target object attribute information or attribute information set, the permission or consent of the target object will be obtained first, and the collection, use and processing of these data will comply with relevant laws, regulations and standards. In addition, when the embodiment of the present application needs to obtain the attribute information of the target object, the separate permission or separate consent of the target object will be obtained through a pop-up window or jump to a confirmation page. After clearly obtaining the separate permission or separate consent of the target object, the necessary target object-related data used to enable the normal operation of the embodiment of the present application is obtained.

[0390] Fig.24The structure diagram of the key authorization authentication device 2400 provided in the embodiment of the present disclosure. The key authorization authentication device 2400 includes:

[0391] The first acquisition unit 2410 is used to acquire the authorization key on the target terminal and the authorization process information corresponding to the authorization key;

[0392] The first receiving unit 2420 is used to receive a key acquisition request from a target process on a target terminal;

[0393] The second acquisition unit 2430 is used to acquire target process information of the target process in response to the key acquisition request;

[0394] The third acquisition unit 2440 is used to compare the target process information with the multiple authorized process information to obtain matching authorized process information from the multiple authorized process information;

[0395] The returning unit 2450 is used to return the authorization key corresponding to the matching authorization process information to the target process.

[0396] Optionally, the first acquiring unit 2410 is specifically configured to:

[0397] Sending a first request to a key management server, the first request including a target terminal address of a target terminal;

[0398] The authorization key corresponding to the target terminal address and the authorization process information corresponding to the authorization key are received and sent by the key management server in response to the first request.

[0399] Optionally, the authorization key corresponding to the target terminal address and the authorization process information corresponding to the authorization key are determined by the key management server in the following manner:

[0400] Determine a target process group corresponding to the target terminal address based on a first correspondence table, the first correspondence table indicating a first correspondence between the terminal address and the process group;

[0401] Based on the second correspondence table, determining the authorization key corresponding to the target process group as the authorization key corresponding to the target terminal address, the second correspondence table indicating a second correspondence between the process group and the authorization key;

[0402] Based on the third correspondence table, the authorized process information corresponding to the target process group is determined as the authorized process information corresponding to the authorization key, and the third correspondence table indicates a third correspondence between the process group and the authorized process information of the processes included in the process group.

[0403] Optionally, the first corresponding relationship is pre-generated in the key management server in the following manner:

[0404] Display the process group configuration interface, which has a process group ID input area and a terminal address input area for the process group application;

[0405] In the process group identifier input area, receive the input process group identifier;

[0406] In the terminal address input area, receive the input terminal address;

[0407] The process group corresponding to the input process group identifier and the input terminal address are stored in correspondence as a first corresponding relationship.

[0408] Optionally, the first corresponding relationship is pre-generated in the key management server in the following manner:

[0409] For each process group, sending a second request to the process group deployment management node, where the second request includes a process group identifier of the process group;

[0410] receiving a terminal address corresponding to the process group identifier sent by the process group deployment management node in response to the second request;

[0411] The process group and the received terminal address are stored as a first correspondence.

[0412] Optionally, the second corresponding relationship is pre-generated in the key management server in the following manner:

[0413] receiving a selection of an authorization key;

[0414] In response to a process group input instruction for a selected authorization key, displaying a process group input area;

[0415] In the process group input area, the process group that receives the input;

[0416] The input process group and the authorization key are stored as a second correspondence.

[0417] Optionally, the third corresponding relationship is pre-generated in the key management server in the following manner:

[0418] In response to an authorization process information configuration instruction for a process under the process group, displaying an authorization process information configuration interface;

[0419] In the authorization process information configuration interface, receiving the input authorization process information;

[0420] The process group and the authorized process information are stored as a third corresponding relationship.

[0421] Optionally, the key acquisition request includes a target process identifier, and the second acquisition unit 2430 includes:

[0422] A process identification acquisition unit (not shown), used to acquire a target process identification from a key acquisition request;

[0423] The process information acquisition unit (not shown) is used to acquire target process information based on the target process identifier.

[0424] Optionally, the key authorization authentication method is executed by a key management agent having the process running status reading permission, and the target process information includes the target process execution object identifier, the target process name, the target process execution path, and the target process file summary; the process information acquisition unit (not shown) is specifically used to:

[0425] Obtain a target process execution object identifier corresponding to the target process identifier;

[0426] Using the process running status reading permission, read the target process running status corresponding to the target process identifier, the target process running status includes the target process name and the target process execution path;

[0427] Get the target process name and target process execution path from the target process running status;

[0428] According to the target process name and the target process execution path, the target process file is obtained, and a summary operation is performed on the target process file to obtain a summary of the target process file.

[0429] Optionally, the authorization process information includes an authorization process execution object identifier, an authorization process name, an authorization process execution path, and an authorization process file summary;

[0430] The third acquisition unit 2440 is specifically used for:

[0431] If among multiple authorized process information, one of the authorized process information has an authorized process execution object identifier that is the same as the target process execution object identifier, an authorized process name that is the same as the target process name, an authorized process execution path that is the same as the target process execution path, and an authorized process file digest that is the same as the target process file digest, the authorized process information is determined to be matching authorized process information.

[0432] Optionally, the first acquisition unit 2410 is used to: acquire an authorization key on the target terminal, a key identifier corresponding to the authorization key, and authorization process information corresponding to the authorization key;

[0433] The process identification acquisition unit (not shown) is used to:

[0434] Obtain a target process identifier and a target key identifier from the key acquisition request;

[0435] The third acquisition unit 2440 is specifically used for:

[0436] From the plurality of authorization process information, obtain candidate authorization process information whose key identifier corresponding to the authorization key is consistent with the target key identifier;

[0437] If the target process information is consistent with the candidate authorization process information, the candidate authorization process information is determined as matching authorization process information.

[0438] Optionally, the key identifier corresponding to the authorization key is obtained based on the authorization key with reference to a fourth correspondence table, and the fourth correspondence table indicates a fourth correspondence between the authorization key and the key identifier;

[0439] The fourth correspondence table is pre-generated on the key management server in the following manner:

[0440] Display the authorization key configuration interface, which includes a key identifier input area and an authorization key generation method selection control;

[0441] In the key identifier input area, receiving the key identifier input;

[0442] In response to selecting a random generation method using the authorization key generation method selection control, randomly generating an authorization key;

[0443] The authorization key and the key identifier are stored as a fourth corresponding relationship.

[0444] Optionally, the first acquiring unit 2410 is used to:

[0445] Get the effective time and expiration time of each authorization key;

[0446] From a plurality of authorization keys, an authorization key whose effective time is earlier than the current time and whose expiration time is later than the current time, and authorization process information corresponding to the authorization key are selected.

[0447] Optionally, the first acquisition unit 2410 is further used to: acquire an authorization key on the target terminal, a first encryption algorithm version corresponding to the authorization key, and authorization process information corresponding to the authorization key;

[0448] The key authorization authentication device further includes a comparison unit (not shown), which is used to:

[0449] Receiving an encryption algorithm version verification request from a target process during encryption using an authorization key, the encryption algorithm version verification request having a second encryption algorithm version applied by the authorization key;

[0450] If the second encryption algorithm version is consistent with the first encryption algorithm version, an encryption algorithm version verification success response is sent to the target process.

[0451] Optionally, the authorization process information includes an authorization process execution object identifier, an authorization process name, and an authorization process execution path;

[0452] The third acquisition unit 2440 further includes:

[0453] A first matching unit (not shown), configured to determine a first matching score based on the target process execution object identifier and the authorized process execution object identifier;

[0454] A second matching unit (not shown), configured to determine a second matching score based on the target process name and the authorized process name;

[0455] A third matching unit (not shown), configured to determine a third matching score based on the target process execution path and the authorized process execution path;

[0456] A screening unit (not shown) is used to obtain matching authorization process information from a plurality of authorization process information based on the first matching score, the second matching score, and the third matching score.

[0457] Optionally, a screening unit (not shown) is used to:

[0458] Performing a weighted sum operation on the first matching score, the second matching score, and the third matching score to obtain a total matching score;

[0459] Based on the total matching score, matching authorization process information is obtained from the plurality of authorization process information.

[0460] Reference Fig.25 , Fig.25 The structural block diagram of the terminal part for implementing the key authorization authentication method of the embodiment of the present disclosure is as follows: the terminal includes: a radio frequency (RF) circuit 2510, a memory 2515, an input unit 2530, a display unit 2540, a sensor 2550, an audio circuit 2560, a wireless fidelity (WiFi) module 2570, a processor 2580, and a power supply 2590. Those skilled in the art can understand that Fig.25 The terminal structure shown does not constitute a limitation on the mobile phone or computer, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0461] RF circuit 2510 can be used for receiving and sending signals during information transmission or calls. In particular, after receiving the downlink information from the base station, it is sent to processor 2580 for processing; in addition, the designed uplink data is sent to the base station.

[0462] The memory 2515 may be used to store software programs and modules. The processor 2580 executes various functional applications and data processing of the target terminal by running the software programs and modules stored in the memory 2515 .

[0463] The input unit 2530 may be used to receive input digital or character information and generate key signal input related to the setting and function control of the target terminal. Specifically, the input unit 2530 may include a touch panel 2531 and other input devices 2525 .

[0464] The display unit 2540 may be used to display input information or provided information and various menus of the target terminal. The display unit 2540 may include a display panel 2541.

[0465] The audio circuit 2560, the speaker 2561, and the microphone 2562 can provide an audio interface.

[0466] In this embodiment, the processor 2580 included in the terminal can execute the key authorization authentication method of the previous embodiment.

[0467] The terminals of the embodiments of the present disclosure include but are not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, aircraft, etc. The embodiments of the present invention can be applied to various scenarios, including but not limited to identity authentication, blockchain, data security, key authentication, etc.

[0468] Fig.26 A block diagram of the structure of a portion of a server for implementing the key authorization authentication method of an embodiment of the present disclosure. The server may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPUs) 3252 (for example, one or more processors) and a memory 2625, and one or more storage media 2630 (for example, one or more mass storage devices) storing application programs 2642 or data 2644. Among them, the memory 2625 and the storage medium 2630 can be short-term storage or permanent storage. The program stored in the storage medium 2630 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Furthermore, the central processing unit 3252 can be configured to communicate with the storage medium 2630 and execute a series of instruction operations in the storage medium 2630 on the server.

[0469] The server may also include one or more power supplies 3256, one or more wired or wireless network interfaces 2650, one or more input and output interfaces 2658, and / or one or more operating systems 2641, such as Windows ServerTM, Mac OS XTM, UnixTM, Li nuxTM, FreeBSDTM, etc.

[0470] The central processor 3252 in the server can be used to execute the key authorization authentication method of the embodiment of the present disclosure.

[0471] The embodiment of the present disclosure further provides a computer-readable storage medium, which is used to store program codes, and the program codes are used to execute the key authorization authentication methods of the aforementioned embodiments.

[0472] The embodiment of the present disclosure also provides a computer program product, which includes a computer program. A processor of a computer device reads and executes the computer program, so that the computer device executes and implements the key authorization authentication method.

[0473] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can, for example, be implemented in an order other than those illustrated or described herein. In addition, the terms "comprises" and "comprising" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0474] It should be understood that in the present disclosure, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0475] It should be understood that in the description of the embodiments of the present disclosure, the meaning of multiple (or multiple items) is more than two, greater than, less than, exceed, etc. are understood to not include the number, and above, below, within, etc. are understood to include the number.

[0476] In the several embodiments provided in the present disclosure, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0477] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0478] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0479] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present disclosure. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store program codes.

[0480] It should also be understood that the various implementations provided in the embodiments of the present disclosure can be combined arbitrarily to achieve different technical effects.

[0481] The above is a specific description of the implementation methods of the present disclosure, but the present disclosure is not limited to the above implementation methods. Technical personnel familiar with the art can also make various equivalent modifications or substitutions without violating the spirit of the present disclosure. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present disclosure.

Claims

1. A key authorization authentication method, characterized in that: include: Acquire an authorization key on a target terminal and authorization process information corresponding to the authorization key; Receiving a key acquisition request from a target process on the target terminal; In response to the key acquisition request, acquiring target process information of the target process; Comparing the target process information with the plurality of authorized process information to obtain matching authorized process information from the plurality of authorized process information; An authorization key corresponding to the matching authorization process information is returned to the target process.

2. The key authorization authentication method according to claim 1, characterized in that: The obtaining of the authorization key on the target terminal and the authorization process information corresponding to the authorization key includes: Sending a first request to a key management server, wherein the first request includes a target terminal address of the target terminal; The authorization key corresponding to the target terminal address and the authorization process information corresponding to the authorization key are received and sent by the key management server in response to the first request.

3. The key authorization authentication method according to claim 2, characterized in that: The authorization key corresponding to the target terminal address and the authorization process information corresponding to the authorization key are determined by the key management server in the following manner: Determining a target process group corresponding to the target terminal address based on a first correspondence table, wherein the first correspondence table indicates a first correspondence between a terminal address and a process group; Based on a second correspondence table, determining the authorization key corresponding to the target process group as the authorization key corresponding to the target terminal address, the second correspondence table indicating a second correspondence between the process group and the authorization key; Based on a third correspondence table, the authorized process information corresponding to the target process group is determined as the authorized process information corresponding to the authorization key, and the third correspondence table indicates a third correspondence between the process group and the authorized process information of the process included in the process group.

4. The key authorization authentication method according to claim 3, characterized in that: The first corresponding relationship is pre-generated in the key management server in the following manner: Display a process group configuration interface, wherein the process group configuration interface has a process group identifier input area and a terminal address input area for the process group application; In the process group identifier input area, receiving an input process group identifier; In the terminal address input area, receiving an input terminal address; The process group corresponding to the input process group identifier and the input terminal address are stored in correspondence as the first corresponding relationship.

5. The key authorization authentication method according to claim 3, characterized in that: The first corresponding relationship is pre-generated in the key management server in the following manner: For each process group, sending a second request to the process group deployment management node, where the second request includes a process group identifier of the process group; receiving a terminal address corresponding to the process group identifier sent by the process group deployment management node in response to the second request; The process group and the received terminal address are stored as the first corresponding relationship.

6. The key authorization authentication method according to claim 3, characterized in that: The second corresponding relationship is pre-generated in the key management server in the following manner: receiving a selection of the authorization key; In response to a process group input instruction for the selected authorization key, displaying a process group input area; In the process group input area, receiving an input process group; The input process group and the authorization key are stored as the second corresponding relationship.

7. The key authorization authentication method according to claim 3, characterized in that: The third corresponding relationship is pre-generated in the key management server in the following manner: In response to an authorization process information configuration instruction for a process under the process group, displaying an authorization process information configuration interface; In the authorization process information configuration interface, receiving input authorization process information; The process group and the authorized process information are stored as the third corresponding relationship.

8. The key authorization authentication method according to claim 1, characterized in that: The key acquisition request includes a target process identifier, and the step of acquiring target process information of the target process in response to the key acquisition request includes: Obtaining the target process identifier from the key acquisition request; Based on the target process identifier, the target process information is acquired.

9. The key authorization authentication method according to claim 8, characterized in that: The key authorization authentication method is executed by a key management agent with the process running status reading authority, and the target process information includes the target process execution object identifier, the target process name, the target process execution path, and the target process file summary; The acquiring the target process information based on the target process identifier includes: Obtaining the target process execution object identifier corresponding to the target process identifier; Using the process running status reading permission, read the target process running status corresponding to the target process identifier, the target process running status including the target process name and the target process execution path; Acquire the target process name and the target process execution path from the target process running state; According to the target process name and the target process execution path, the target process file is obtained, and a digest operation is performed on the target process file to obtain a digest of the target process file.

10. The key authorization authentication method according to claim 9, characterized in that: The authorization process information includes the authorization process execution object identifier, the authorization process name, the authorization process execution path, and the authorization process file summary; The comparing the target process information with the plurality of authorized process information to obtain matching authorized process information from the plurality of authorized process information includes: If, among the multiple authorized process information, there is one authorized process information in which the authorized process execution object identifier is the same as the target process execution object identifier, the authorized process name is the same as the target process name, the authorized process execution path is the same as the target process execution path, and the authorized process file digest is the same as the target process file digest, the authorized process information is determined as the matching authorized process information.

11. The key authorization authentication method according to claim 8, characterized in that: The obtaining of the authorization key on the target terminal and the authorization process information corresponding to the authorization key comprises: obtaining the authorization key on the target terminal, the key identifier corresponding to the authorization key, and the authorization process information corresponding to the authorization key; The acquiring the target process identifier from the key acquisition request comprises: acquiring the target process identifier and the target key identifier from the key acquisition request; The comparing the target process information with the plurality of authorized process information to obtain matching authorized process information from the plurality of authorized process information includes: From the plurality of authorization process information, obtain candidate authorization process information whose key identifier corresponding to the authorization key is consistent with the target key identifier; If the target process information is consistent with the candidate authorization process information, the candidate authorization process information is determined as the matching authorization process information.

12. The key authorization authentication method according to claim 11, characterized in that: The key identifier corresponding to the authorization key is obtained based on the authorization key with reference to a fourth correspondence table, wherein the fourth correspondence table indicates a fourth correspondence between the authorization key and the key identifier; The fourth correspondence table is pre-generated in the key management server in the following manner: Displaying an authorization key configuration interface, wherein the authorization key configuration interface includes a key identifier input area and an authorization key generation method selection control; In the key identifier input area, receiving the key identifier input; In response to selecting a random generation method using the authorization key generation method selection control, randomly generating the authorization key; The authorization key and the key identifier are stored as the fourth corresponding relationship.

13. The key authorization authentication method according to claim 1, characterized in that: The obtaining of the authorization key on the target terminal and the authorization process information corresponding to the authorization key includes: Get the effective time and expiration time of each authorization key; From the plurality of authorization keys, the authorization key whose effective time is earlier than the current time and whose expiration time is later than the current time and the authorization process information corresponding to the authorization key are selected.

14. The key authorization authentication method according to claim 1, characterized in that: The obtaining of the authorization key on the target terminal and the authorization process information corresponding to the authorization key includes: Acquire an authorization key on a target terminal, a first encryption algorithm version corresponding to the authorization key, and authorization process information corresponding to the authorization key; After returning the authorization key corresponding to the matching authorization process information to the target process, the method further includes: receiving an encryption algorithm version verification request from the target process during encryption using the authorization key, the encryption algorithm version verification request having a second encryption algorithm version applied by the authorization key; If the second encryption algorithm version is consistent with the first encryption algorithm version, an encryption algorithm version verification success response is sent to the target process.

15. The key authorization authentication method according to claim 1, characterized in that: The authorization process information includes the authorization process execution object identifier, the authorization process name, and the authorization process execution path; The comparing the target process information with the plurality of authorized process information to obtain matching authorized process information from the plurality of authorized process information includes: Determining a first matching score based on the target process execution object identifier and the authorized process execution object identifier; Determining a second matching score based on the target process name and the authorized process name; Determining a third matching score based on the target process execution path and the authorized process execution path; Based on the first matching score, the second matching score, and the third matching score, the matching authorization process information is obtained from the plurality of authorization process information.

16. The key authorization authentication method according to claim 15, characterized in that: The obtaining matching authorization process information from the plurality of authorization process information based on the first matching score, the second matching score, and the third matching score includes: Performing a weighted sum operation on the first matching score, the second matching score, and the third matching score to obtain a total matching score; Based on the total matching score, the matching authorization process information is obtained from the plurality of authorization process information.

17. A key authorization authentication device, characterized in that: include: A first acquisition unit, configured to acquire an authorization key on a target terminal and authorization process information corresponding to the authorization key; A first receiving unit, configured to receive a key acquisition request from a target process on the target terminal; A second acquisition unit, configured to acquire target process information of the target process in response to the key acquisition request; a third acquiring unit, configured to compare the target process information with the plurality of authorized process information to acquire matching authorized process information from the plurality of authorized process information; The returning unit is used to return the authorization key corresponding to the matching authorization process information to the target process.

18. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the key authorization authentication method according to any one of claims 1 to 16 is implemented.

19. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the key authorization authentication method according to any one of claims 1 to 16 is implemented.

20. A computer program product, comprising a computer program, wherein the computer program is read and executed by a processor of a computer device, so that the computer device executes the key authorization authentication method according to any one of claims 1 to 16.

Images