A method and system for efficient and lossless automatic key updating

Abstract

The present invention relates to the field of encryption technology for data transmission, and more specifically, to a method and system for efficient and lossless automatic key update. The solution includes setting a client for permission management, a server for permission management, and a unified permission management system; obtaining the parameters of the request, the client classifies according to the needs of the server, and extracts the permission key from the unified permission management system; after the unified permission management system receives the data, the public parameter and the business parameter are fed back to the client; the client signs according to the public parameter and the business parameter; the server receives the signed data sent by the client and verifies the signature; the client for permission management, the server for permission management, and the unified permission management system update the key pair in the unified permission management system. The solution provides a set of standardized call rules and verification mechanisms to ensure the security of calls and privacy data, and the key is updated automatically and efficiently without loss, which improves the security of the system without affecting normal business.

Description

Technical Field

[0001] The present invention relates to the technical field of encryption of data transmission, and more specifically, to a method and system for automatically updating keys in an efficient and lossless manner. Background Art

[0002] In today's digital age, data security has become an important pillar for maintaining social stability and trust. With the increasing sophistication of cyber attacks, traditional static keys have become difficult to cope with the endless security threats. Therefore, it is particularly urgent and important to study efficient and lossless ways to automatically update keys. By adopting advanced algorithms and strategies, such as mechanisms based on quantum key distribution or leveraging the decentralized nature of blockchain technology, real-time and dynamic updates of keys can be achieved to ensure that the security and integrity of data transmission are not affected. This technology not only improves the adaptability and response speed of the encryption system, but also greatly enhances the defense capabilities against potential threats, providing a solid guarantee for protecting personal privacy and corporate confidential information.

[0003] Prior to the technology of the present invention, traditional key update methods usually require manual intervention. These processes are not only time-consuming and labor-intensive, but also increase the risk of privacy data leakage due to manual operations. During the transmission and update process of the key, manual negligence or erroneous operation may become a breakthrough for malicious attackers to invade. Attackers may intercept or tamper with key information, thereby threatening the security of the entire encryption system. At the same time, the complexity of manual management may also lead to poor key management, such as expired keys, insufficient backups, or confusing records, further exacerbating the risk of privacy data leakage. In addition, with the expansion of network scale and the increase in encryption needs, traditional key update methods may be difficult to adapt to large-scale or complex security application scenarios. Accordingly, due to its inherent limitations, traditional key update methods are difficult to adapt to these large-scale or complex security needs. Summary of the invention

[0004] In view of the above problems, the present invention proposes a method and system for efficient and lossless automatic key update, and provides a set of standardized API (Application Programming Interface) calling rules and verification mechanisms to ensure the security of API calls and privacy data. The keys are updated automatically and efficiently without loss, improving the security of the system without affecting normal business.

[0005] According to a first aspect of an embodiment of the present invention, a method for automatically updating a key efficiently and losslessly is provided.

[0006] In one or more embodiments, preferably, the method for efficiently and losslessly automatically updating keys includes:

[0007] Set up the client side of permission management, the server side of permission management and the unified permission management system;

[0008] After obtaining the requested parameters, the client classifies them according to the server's requirements and extracts the permission key from the unified permission management system;

[0009] After receiving the data, the unified authority management system will feed back the public and business parameters to the client;

[0010] The client signs based on public parameters and business parameters;

[0011] The server receives the signed data sent by the client and verifies the signature;

[0012] The permission management client, the permission management server and the unified permission management system update the key pair in the unified permission management system.

[0013] In one or more embodiments, preferably, the client for setting the rights management, the server for the rights management and the unified rights management system specifically include:

[0014] Set up a unified permission management system to issue permission keys corresponding to applications and permission keys corresponding to clients;

[0015] Set the client of the rights management to call the server interface of the rights management;

[0016] The server that sets the permission management is used to verify the signature of the parameters.

[0017] In one or more embodiments, preferably, the client classifies the parameters of the acquisition request according to the needs of the server and extracts the permission key from the unified permission management system, specifically including:

[0018] The request parameters are divided into public parameters and business parameters, wherein the public parameters are included in each request, and the business parameters are pre-agreed to determine the specific demand form according to the preset scenario;

[0019] The client extracts the corresponding permission key from the unified permission management system according to the corresponding requirements of the server.

[0020] In one or more embodiments, preferably, after the unified authority management system receives the data, feeding back the public parameters and business parameters to the client specifically includes:

[0021] When the reception is successful, the feedback public parameter includes at least a return code. When the return code is 1, it means that the transmission is successful;

[0022] When the return code is fed back, the service parameters are fed back to the client, and the service parameters at least include a feedback message and a return value.

[0023] In one or more embodiments, preferably, the client signs according to the public parameter and the business parameter, specifically including:

[0024] The client obtains the public parameters and business parameters and signs them;

[0025] When private data is transferred, apply for an SM2 key pair and use the public key of the data receiver for encryption and signing;

[0026] Submit public parameters, business parameters, signature values ​​and other data to the server.

[0027] In one or more embodiments, preferably, the server receives the signed data sent by the client and performs signature verification, which specifically includes:

[0028] The client adds a signature verification string to the header of the signed data sent;

[0029] The server receives the signed data and obtains the signature verification string from the client;

[0030] The server retrieves the ClientKey (signature verification key) corresponding to the signature verification string in the unified authority management system through the gateway according to the signature verification string;

[0031] The server generates local signature verification data through ClientKey and compares it with the request key in the request header. If they are consistent, the signature verification is considered successful, otherwise the signature verification fails;

[0032] Among them, the request key pair needs to be losslessly updated during the signature verification process. The specific process includes: main ClientKey and backup ClientKey; the main ClientKey is the clientKey in normal use. After the new main clientKey is generated, the client and the server need to request the unified permission management system to obtain the latest main clientKey. If it causes the signature verification to fail, the old clientKey becomes the backup clientKey after the new main clientKey is generated;

[0033] The main ClientKey includes three moments: TP0 is the moment when a main clientKey is generated; TP1 is the moment when the new main clientKey takes effect. The client must wait until TP1 to use the main clientKey, and the server must obtain the main clientKey before TP1; TP2 is set to expire at TP2 to ensure system security;

[0034] The standby ClientKey includes three moments, namely: TS0 is the generation moment of the standby clientKey, and TS0 is equal to TP0; TS1 is the expiration moment of the standby clientKey, where TP1 < TS1 < TP2. Before TS1 is reached, it is not allowed to update the primary clientKey.

[0035] Among them, the time difference agreement includes TP1 - TP0 > 30 minutes, TP2 - TP1 > 2 hours, and 10 minutes < TS1 - TP1 < 20 minutes.

[0036] In one or more embodiments, preferably, the client of the permission management, the server of the permission management, and the unified permission management system update the key pair within the unified permission management system, which specifically includes:

[0037] The unified permission management system distributes all clientKeys and synchronously updates the cache after each update.

[0038] Before the cache expiration period arrives, all primary clientKeys are updated, and the old clientKeys are placed into the standby clientKeys.

[0039] After the client starts, it requests the unified permission management system to obtain its own clientKey and stores it using two - level caching. The two - level caching includes local storage with a 10 - minute validity period and Redis cache with a 10 - minute validity period. When 20 minutes have passed, it requests the unified permission management system again to obtain its own clientKey. Among them, when the client requests the unified permission management system, it needs to provide the clientId, the public key of the national cryptography SM2, and sign the clientId using the national cryptography SM2. The unified permission management system compares the clientId and the public key, encrypts the result using the public key, and after the client receives the returned result, it decrypts it using the private key.

[0040] When the server receives the client's request, both the request parameters and the return parameters consist of public parameters and business parameters. The public parameters are required each time, and the business parameters are agreed according to specific scenarios. According to the clientId of the client, it calls the unified permission management system to obtain the clientKey of A. At this time, both the primary clientKey and the standby clientKey are obtained and cached in Redis. The cache validity period is 20 minutes, and the cache impact duration is 20 minutes < TP1 - TP0.

[0041] During signature verification, if the primary clientKey fails in signature verification, then the standby clientKey is used for signature verification.

[0042] Each application terminal corresponds to one clientId of the client.

[0043] According to a second aspect of an embodiment of the present invention, a system for automatically updating keys efficiently and losslessly is provided.

[0044] In one or more embodiments, preferably, the system for efficiently and losslessly automatically updating keys includes:

[0045] The structure setting module is used to set the client of permission management, the server of permission management and the unified permission management system;

[0046] The classification signature module is used to obtain the parameters of the request. The client classifies the request according to the needs of the server and extracts the permission key from the unified permission management system.

[0047] The public parameter feedback module is used to feedback public parameters and business parameters to the client after the unified authority management system receives the data;

[0048] Signature module, used by the client to sign based on public parameters and business parameters;

[0049] The signature verification module is used by the server to verify the signed data sent by the client.

[0050] Update the signature module, which is used by the permission management client, permission management server and unified permission management system to update the key pair in the unified permission management system.

[0051] According to a third aspect of an embodiment of the present invention, there is provided a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method as described in any one of the first aspect of the embodiment of the present invention is implemented.

[0052] According to a fourth aspect of an embodiment of the present invention, there is provided an electronic device, comprising a memory and a processor, wherein the memory is used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement any one of the methods described in the first aspect of the embodiment of the present invention.

[0053] The technical solution provided by the embodiments of the present invention may have the following beneficial effects:

[0054] In the scheme of the present invention, an automatic update technology is adopted to propose a technical means for automatically updating keys in an efficient and lossless manner, so as to reduce manual intervention and ensure the timeliness and accuracy of key updates.

[0055] In the solution of the present invention, API parameter agreement and signature verification as well as automatic key update method are adopted to solve the traditional password update method, and solve the problems of data integrity and security, credibility of request source, and key update security.

[0056] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0057] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0059] Figure 1 The present invention is a flowchart of a method for automatically updating keys in an efficient and lossless manner according to an embodiment of the present invention.

[0060] Figure 2 The invention is a flowchart of a client for setting authority management, a server for authority management and a unified authority management system in a method for efficient and lossless automatic key update in one embodiment of the invention.

[0061] Figure 3 This is a flowchart of obtaining request parameters in a method for efficient and lossless automatic key update in one embodiment of the present invention, in which the client classifies according to the needs of the server and extracts the permission key from the unified permission management system.

[0062] Figure 4 It is a flowchart of a method for efficient and lossless automatic key update in one embodiment of the present invention, in which public parameters and business parameters are fed back to the client after the unified authority management system receives data.

[0063] Figure 5 It is a flowchart of a method for efficient and lossless automatic key update in accordance with an embodiment of the present invention, in which a client signs according to public parameters and business parameters.

[0064] Figure 6 The present invention is a flowchart of a method for efficient and lossless automatic key update in which a server receives signed data sent by a client and verifies the signature.

[0065] Figure 7 The invention is a flowchart of a client of rights management, a server of rights management and a unified rights management system in a method for efficient and lossless automatic key update according to an embodiment of the present invention, in which a key pair in a unified rights management system is updated.

[0066] Figure 8 It is a structural diagram of a system for efficient and lossless automatic key update according to an embodiment of the present invention.

[0067] Fig. 9 It is a structural diagram of an electronic device in one embodiment of the present invention. DETAILED DESCRIPTION

[0068] In some of the processes described in the specification and claims of the present invention and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0069] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0070] In today's digital age, data security has become an important pillar for maintaining social stability and trust. With the increasing sophistication of cyber attacks, traditional static keys have become difficult to cope with the endless security threats. Therefore, it is particularly urgent and important to study efficient and lossless ways to automatically update keys. By adopting advanced algorithms and strategies, such as mechanisms based on quantum key distribution or leveraging the decentralized nature of blockchain technology, real-time and dynamic updates of keys can be achieved to ensure that the security and integrity of data transmission are not affected. This technology not only improves the adaptability and response speed of the encryption system, but also greatly enhances the defense capabilities against potential threats, providing a solid guarantee for protecting personal privacy and corporate confidential information.

[0071] Prior to the technology of the present invention, traditional key update methods usually require manual intervention. These processes are not only time-consuming and labor-intensive, but also increase the risk of privacy data leakage due to manual operations. During the transmission and update process of the key, manual negligence or erroneous operation may become a breakthrough for malicious attackers to invade. Attackers may intercept or tamper with key information, thereby threatening the security of the entire encryption system. At the same time, the complexity of manual management may also lead to poor key management, such as expired keys, insufficient backups, or confusing records, further exacerbating the risk of privacy data leakage. In addition, with the expansion of network scale and the increase in encryption needs, traditional key update methods may be difficult to adapt to large-scale or complex security application scenarios. Accordingly, due to its inherent limitations, traditional key update methods are difficult to adapt to these large-scale or complex security needs.

[0072] In an embodiment of the present invention, a method and system for automatically updating keys efficiently and losslessly are provided. The solution provides a set of standardized API (Application Programming Interface) calling rules and verification mechanisms to ensure the security of API calls and private data, and the keys are automatically updated efficiently and losslessly, thereby improving the security of the system without affecting normal business.

[0073] According to a first aspect of an embodiment of the present invention, a method for automatically updating a key efficiently and losslessly is provided.

[0074] Figure 1 The present invention is a flowchart of a method for automatically updating keys in an efficient and lossless manner according to an embodiment of the present invention.

[0075] In one or more embodiments, preferably, the method for efficiently and losslessly automatically updating keys includes:

[0076] S101, setting a rights management client, a rights management server and a unified rights management system;

[0077] S102, obtaining the requested parameters, the client classifies them according to the requirements of the server, and extracts the permission key from the unified permission management system;

[0078] S103. After receiving the data, the unified authority management system feeds back the public reference and business reference to the client;

[0079] S104. The client signs according to the public parameters and business parameters;

[0080] S105. The server receives the signed data sent by the client and verifies the signature.

[0081] S106: The rights management client, the rights management server and the unified rights management system update the key pair in the unified rights management system.

[0082] In an embodiment of the present invention, the secure distribution and management of keys are ensured by setting up a client, a server and a unified permission management system for permission management. The specific steps include: first, setting up a unified permission management system for issuing permission keys corresponding to applications and clients, and configuring the interface call relationship between the client and the server; then, the client classifies the request parameters according to the requirements and extracts the corresponding permission keys from the permission management system; then, the system feeds back the public parameters and business parameters to the client, and the client uses these parameters to sign and sends the signed data to the server for verification. During the verification process, the server uses the public key to generate local verification data and compares it with the request key in the request header to confirm the legitimacy of the data. Finally, by regularly updating the main clientKey and the backup clientKey, and adopting a two-level cache mechanism (local storage and Redis cache), the timeliness and security of the key are ensured. The entire scheme aims to improve the encryption adaptability and response speed of the system while ensuring the security and privacy of the data.

[0083] Figure 2 The invention is a flowchart of a client for setting authority management, a server for authority management and a unified authority management system in a method for efficient and lossless automatic key update in one embodiment of the invention.

[0084] like Figure 2 As shown, in one or more embodiments, preferably, the client for setting the permission management, the server for the permission management and the unified permission management system specifically include:

[0085] S201, setting a unified authority management system for issuing authority keys corresponding to applications and authority keys corresponding to clients;

[0086] S202, setting an interface for the rights management client to call the rights management server;

[0087] S203: Setting the authority management server to verify the signature of the parameters.

[0088] In an embodiment of the present invention, the steps of setting up a client of permission management, a server of permission management and a unified permission management system are as follows: Setting up a unified permission management system: First, construct a unified permission management system, which is responsible for generating and issuing permission keys corresponding to applications and permission keys corresponding to clients. The unified permission management system is the core of the entire system, which ensures that each application and client has a unique key pair, which is used for subsequent encryption and signature verification operations. Specifically, the unified permission management system generates a pair of public and private keys, which are stored on the client and server, respectively, for encrypting and decrypting data. Setting up a client of permission management: Next, configure the client of permission management so that it can call the interface of the server of permission management. The client needs to have the following functions: send a request to the server to obtain or update the key; use the public key to encrypt data; send the encrypted data to the server for decryption. In order to achieve these functions, the client needs to store the public key of the storage client and its own private key. Setting up a server of permission management: Then, configure the server of permission management so that it can receive requests from the client and verify the parameters. The server needs to have the following functions: receive and process requests from the client; use the private key to decrypt the received encrypted data; verify whether the decrypted data is legal. In order to realize these functions, the server needs to store its own private key and the public key of the client. Through the above steps, the present invention realizes a method for efficient and lossless automatic key update, ensuring the security and privacy during data transmission. For example, when the client needs to communicate with the server, it will first use the public key of the server to encrypt the data, and then send the encrypted data to the server. After receiving the data, the server uses the private key to decrypt it and verify whether the decrypted data is legal. If the verification is passed, it means that the data is legal and the subsequent processing flow can continue; otherwise, the data is rejected. In this way, the present invention not only ensures the security of the data, but also improves the response speed of the system.

[0089] Figure 3 This is a flowchart of obtaining request parameters in a method for efficient and lossless automatic key update in one embodiment of the present invention, in which the client classifies according to the needs of the server and extracts the permission key from the unified permission management system.

[0090] like Figure 3 As shown, in one or more embodiments, preferably, the parameters of the acquisition request are classified by the client according to the needs of the server, and the authority key is extracted from the unified authority management system, specifically including:

[0091] S301, dividing the request parameters into public parameters and business parameters, wherein the public parameters are included in each request, and the business parameters are pre-agreed to determine the specific demand form according to the preset scenario;

[0092] S302: The client extracts the corresponding authority key of the client from the unified authority management system according to the corresponding requirements of the server.

[0093] In an embodiment of the present invention, the client obtains the parameters of the request and classifies them according to the needs of the server, and then extracts the corresponding authority key from the unified authority management system. The specific steps are as follows: Obtain the parameters of the request: The client first obtains the parameters of the request from the user input or other data sources. These parameters may include the user's personal information, operation request, timestamp, etc. Classify the request parameters: The client divides the parameters of the request into public parameters and business parameters according to the needs of the server. Public parameters are public parameters that are included in each request, such as user ID, timestamp, etc.; business parameters are parameters pre-agreed according to specific business scenarios, such as payment amount, order number, etc. Extract the authority key from the unified authority management system: The client uses the classified public parameters and business parameters to extract the corresponding authority key from the unified authority management system. The unified authority management system will determine whether the client has the authority to perform the corresponding operation based on these parameters and return the corresponding key. Extract the authority key corresponding to the client: After receiving the key returned by the unified authority management system, the client stores it locally or in the cache for use in subsequent operations. These keys will be used to encrypt and decrypt data to ensure the security of data transmission. Through the above steps, the client can obtain the corresponding authority key according to the needs of the server, thereby realizing access control for different businesses. For example, when a user needs to query the information of an order, the client will obtain the relevant parameters of the order (such as the order number), and then extract the permission key required to query the order from the unified permission management system. Only users with corresponding permissions can view the order information, thus ensuring the security of the data.

[0094] Figure 4 It is a flowchart of a method for efficient and lossless automatic key update in one embodiment of the present invention, in which public parameters and business parameters are fed back to the client after the unified authority management system receives data.

[0095] like Figure 4 As shown, in one or more embodiments, preferably, after the unified authority management system receives the data, the public parameters and business parameters are fed back to the client, specifically including:

[0096] S401, when the reception is successful, the feedback public parameter includes at least a return code, and when the return code is 1, it means that the transmission is successful;

[0097] S402: Feedback the service parameters to the client at the same time as the return code, where the service parameters at least include a feedback message and a return value.

[0098] In an embodiment of the present invention, after the unified authority management system receives the data, a feedback operation will be performed. The specific steps are as follows: Feedback public parameters and business parameters: After receiving the data sent by the client, the unified authority management system will first process the data. After the processing is completed, the system will generate a set of public parameters and business parameters. Public parameters are public parameters that are included in each data transmission and are used to verify the integrity and legality of the data; business parameters are parameters generated according to specific business scenarios and are used to perform specific business operations. Setting of return code: When the data is successfully processed and ready to be fed back to the client, the system will generate a return code. The return code is a digital code used to indicate the result status of the operation. In this system, when the return code is "1", it means that the transmission is successful, that is, the data has been successfully processed and can be used for subsequent operations. Feedback message and return value: In addition to the return code, the system will also send feedback messages and return values ​​to the client. The feedback message is a text description of the operation result, such as "operation successful", "data updated", etc.; the return value is specific business data or operation results, such as queried records, calculated values, etc. This information will help the client understand the details of the operation and perform corresponding processing. Example description: Assume that a user tries to log in to the system to obtain his / her personal information. After the user enters the username and password, the client sends this information to the unified permission management system for verification. After the system passes the verification, it generates a data set containing public parameters (such as timestamp, user ID, etc.) and business parameters (such as user name, role, etc.), and generates a return code "1" and a feedback message "Login successful". Then, this information is sent back to the client together. The client determines whether the login is successful based on the returned information and decides whether to load the user's personal information page.

[0099] Figure 5 It is a flowchart of a method for efficient and lossless automatic key update in accordance with an embodiment of the present invention, in which a client signs according to public parameters and business parameters.

[0100] like Figure 5 As shown, in one or more embodiments, preferably, the client signs according to the public parameter and the business parameter, specifically including:

[0101] S501, the client obtains public parameters and business parameters and signs them;

[0102] S502: When there is private data transfer, apply for an SM2 key pair and use the server's public key for encryption;

[0103] S503, submitting public parameters, business parameters, signature value and other data to the server.

[0104] In an embodiment of the present invention, the client signs after obtaining the public parameters and business parameters, and applies for an SM2 key pair and uses the public key of the server to encrypt when the private data is circulated. The specific steps are as follows: Obtain public parameters and business parameters: After the client receives the public parameters and business parameters from the unified authority management system, it first verifies these parameters to ensure their integrity and legitimacy. Public parameters are public parameters that are included in each data transmission and are used to verify the integrity and legitimacy of the data; business parameters are parameters generated according to specific business scenarios and are used to perform specific business operations. Signing: The client signs the public parameters and business parameters using the pre-stored ClientKey (signature verification key). Signing is an encryption technology that generates a unique digital signature by performing a national secret SM3 operation on the data. This digital signature will be used to verify the integrity and source of the data. Apply for an SM2 key pair: When there is private data circulation, such as sensitive data such as user personal information and payment information that needs to be transmitted in the network, the client will apply for an SM2 key pair from the unified authority management system. SM2 is an asymmetric encryption algorithm used to protect the confidentiality and integrity of data. Encryption using the server's public key: After the client obtains the SM2 key pair, it uses the server's public key to encrypt the private data. This encryption method ensures that only the server with the corresponding private key can decrypt and view the original data, thereby protecting the privacy of the data. At the same time, the client will also use the ClientKey (signature verification key) to sign the encrypted data to prove its identity and the integrity of the data. Submit public parameters, business parameters, and encrypted data to the server: Finally, the client sends the signed data to the server. After receiving the data, the server first uses the client's ClientKey (signature verification key) to verify the received data, and then uses its own private key to decrypt the received data. If the signature verification is successful, it means that the data is indeed sent by a legitimate client and has not been tampered with or forged during transmission.

[0105] Figure 6 The present invention is a flowchart of a method for efficient and lossless automatic key update in which a server receives signed data sent by a client and verifies the signature.

[0106] like Figure 6 As shown, in one or more embodiments, preferably, the server receives the signed data sent by the client and performs signature verification, which specifically includes:

[0107] S601. The client adds a signature verification string to the header of the signed data sent;

[0108] S602: The server receives the signed data and obtains the signature verification string from the client.

[0109] S603. The server retrieves the ClientKey (signature verification key) corresponding to the signature verification string in the unified permission management system through the gateway based on the signature verification string.

[0110] S604. The server generates local signature verification data using the ClientKey (signature verification key) and compares it with the request key in the request header. If they are the same, the signature verification is considered successful; otherwise, it fails.

[0111] S605. Among them, the request key for signature verification needs to be updated losslessly using the request key pair. The specific process includes: the primary ClientKey and the backup ClientKey; the primary ClientKey is the clientKey in normal use. After a new primary clientKey is generated, both the client and the server need to request the unified permission management system to obtain the latest primary clientKey. If the signature verification fails, after the new primary clientKey is generated, the old clientKey becomes the backup clientKey.

[0112] S606. The primary ClientKey includes three time points: TP0 is the time when a primary clientKey is generated; TP1 is the time when the new primary clientKey takes effect. The client has to wait until after TP1 to use the primary clientKey, and the server has to obtain the primary clientKey before TP1; TP2 is the time when the primary clientKey is set to expire to ensure system security.

[0113] S607. The backup ClientKey includes three time points: TS0 is the time when the backup clientKey is generated, and TS0 is equal to TP0; TS1 is the time when the backup clientKey expires, where TP1 < TS1 < TP2. Before TS1, it is not allowed to update the primary clientKey.

[0114] S608. Among them, the time difference convention includes TP1 - TP0 > 30 minutes, TP2 - TP1 > 2 hours, and 10 minutes < TS1 - TP1 < 20 minutes.

[0115] In the embodiment of the present invention, after the server receives the signed data sent by the client, it performs signature verification to ensure the integrity and source of the data. The specific steps are as follows: Obtain the signature verification string of the client: The server first extracts the signature verification string added by the client from the received data. This string contains information for verifying the integrity of the data. Invoke the ClientKey (signature verification key) in the unified permission management system: The server invokes the unified permission management system through the gateway according to the signature verification string to obtain the ClientKey (signature verification key) corresponding to the string. This ClientKey (signature verification key) is the key used by the client for signature operation on the data. Generate local signature verification data and compare it with the request key in the request header: The server uses the obtained ClientKey (signature verification key) of the client to perform signature operation on the received data and generate local signature verification data. Then, compare the local signature verification data with the request key in the request header. If the two are consistent, it indicates that the signature verification is successful; otherwise, the signature verification fails. Lossless update of the primary ClientKey and the secondary ClientKey: During the request signature verification process, lossless update using the request key pair is required. The primary ClientKey is the clientKey in normal use. After the new primary clientKey is generated, both the client and the server need to request the unified permission management system to obtain the latest primary clientKey. If the signature verification fails, after the new primary clientKey is generated, the old clientKey becomes the secondary clientKey. Time difference convention: To ensure the security of the system, the expiration time TP2 of the primary ClientKey is set, and at the same time, the expiration time TS1 of the secondary clientKey needs to be after TP1 and before TP2. In addition, certain time difference conventions need to be met, such as TP1 - TP0 > 30 minutes, TP2 - TP1 > 2 hours, 10 minutes < TS1 - TP1 < 20 minutes, etc. Through the above steps, the server can effectively verify the signature of the data sent by the client to ensure the integrity and source of the data. At the same time, by losslessly updating the primary ClientKey and the secondary ClientKey and setting reasonable time difference conventions, the security and stability of the system are improved.

[0116] Figure 7 It is a flowchart of updating the key pair in the unified permission management system by the client for permission management, the server for permission management, and the unified permission management system in a method for efficiently and losslessly automatically updating keys in an embodiment of the present invention.

[0117] As Figure 7 shown, in one or more embodiments, preferably, the client for permission management, the server for permission management, and the unified permission management system update the key pair in the unified permission management system, specifically including:

[0118] S701. The unified rights management system issues all clientKeys and updates the cache synchronously after each update;

[0119] S702, before the cache validity period expires, update all primary clientKeys and put the old clientKeys into the backup clientKey;

[0120] S703, after the client is started, it requests the unified authority management system to obtain its own clientKey, and adopts two-level cache storage, which includes local storage with a validity period of 10 minutes and Redis cache with a validity period of 10 minutes. When 20 minutes are reached, it requests the unified authority management system again to obtain its own clientKey; wherein, when the client requests the unified authority management system, it needs to provide clientId, the public key of the national secret SM2, and use the national secret SM2 to sign the clientId; the unified authority management system compares the clientId and the public key, encrypts the result with the public key, and after the client receives the returned result, it uses the private key to decrypt it;

[0121] S704, when the server receives the request from the client, the request parameters and return parameters are composed of public parameters and business parameters. The public parameters are required every time, and the business parameters are agreed upon according to the specific scenario; according to the client's clientId, the unified permission management system is called to obtain A's clientKey. At this time, the primary clientKey and the backup clientKey are obtained at the same time and cached to Redis. The cache is valid for 20 minutes, and the cache impact duration is 20 minutes <TP1-TP0;

[0122] S705: During the signature verification, if the primary clientKey fails to verify the signature, the backup clientKey is used for signature verification;

[0123] S706. The clientId of the client corresponds to one for each application terminal.

[0124] In an embodiment of the present invention, the client of the rights management, the server of the rights management and the unified rights management system work together to update the key pair in the unified rights management system. The specific steps are as follows: the unified rights management system issues all clientKeys: the unified rights management system is responsible for generating and managing the clientKeys of all clients. Whenever a new clientKey needs to be updated, the system will synchronously update the clientKey information in the cache. Update the main clientKey and the backup clientKey: before the cache validity period expires, the system will update all the main clientKeys and put the old clientKeys into the backup clientKey. This ensures that the backup clientKey can continue to be used before the main clientKey expires. The client requests to obtain its own clientKey: after the client is started, it requests to obtain its own clientKey from the unified rights management system. In order to improve performance, the client adopts two-level cache storage, including local storage with a validity period of 10 minutes and Redis cache with a validity period of 10 minutes. When 20 minutes are reached, the client requests to obtain its own clientKey from the unified rights management system again. The client authenticates the identity with the unified rights management system: when requesting the unified rights management system, the client needs to provide the clientId, the public key of the national secret SM2, and sign the clientId with the national secret SM2. The unified permission management system compares the clientId and the public key and encrypts the result with the public key. After the client receives the return result, it uses the private key to decrypt it. The server obtains the client's clientKey: When the server receives the client's request, it calls the unified permission management system according to the client's clientId to obtain the corresponding clientKey. At this time, the server will obtain the primary clientKey and the backup clientKey at the same time and cache them in Redis. The cache is valid for 20 minutes. Signature verification process: During the signature verification process, if the primary clientKey signature fails, the server will try to use the backup clientKey for signature verification. This ensures that the system can still operate normally even if the primary clientKey is not effective. Client's clientId: Each application corresponds to a unique clientId, which is used to identify different clients. Through the above steps, an efficient and lossless method of automatically updating keys is implemented, ensuring the security and privacy during data transmission. At the same time, the response speed and stability of the system are improved through a two-level cache mechanism and a reasonable time difference agreement.

[0125] According to a second aspect of an embodiment of the present invention, a system for automatically updating keys efficiently and losslessly is provided.

[0126] Figure 8It is a structural diagram of a system for efficient and lossless automatic key update according to an embodiment of the present invention.

[0127] In one or more embodiments, preferably, the system for efficiently and losslessly automatically updating keys includes:

[0128] The structure setting module 801 is used to set the client of the rights management, the server of the rights management and the unified rights management system;

[0129] Classification signature module 802, used to obtain the parameters of the request, the client classifies according to the needs of the server, and extracts the authority key from the unified authority management system;

[0130] The public parameter feedback module 803 is used to feedback the public parameter and business parameter to the client after the unified authority management system receives the data;

[0131] Signature module 804, used for the client to sign according to public parameters and business parameters;

[0132] The signature verification module 805 is used for the server to verify the signed data received from the client;

[0133] The updating signature module 806 is used for the rights management client, the rights management server and the unified rights management system to update the key pair in the unified rights management system.

[0134] In the embodiment of the present invention, a system suitable for different structures is realized through a series of modular designs. The system can achieve closed-loop, reliable and efficient execution through collection, analysis and control.

[0135] According to a third aspect of an embodiment of the present invention, there is provided a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method as described in any one of the first aspect of the embodiment of the present invention is implemented.

[0136] According to a fourth aspect of an embodiment of the present invention, an electronic device is provided. Fig. 9 It is a structural diagram of an electronic device in one embodiment of the present invention. Fig. 9The electronic device shown is a general-purpose, efficient, lossless, automatic key update device, which includes a general-purpose computer hardware structure, which at least includes a processor 901 and a memory 902. The processor 901 and the memory 902 are connected via a bus 903. The memory 902 is suitable for storing instructions or programs executable by the processor 901. The processor 901 can be an independent microprocessor or a collection of one or more microprocessors. Thus, the processor 901 executes the instructions stored in the memory 902 to execute the method flow of the embodiment of the present invention as described above to realize the processing of data and the control of other devices. The bus 903 connects the above-mentioned multiple components together, and at the same time connects the above-mentioned components to the display controller 904 and the display device and the input / output (I / O) device 905. The input / output (I / O) device 905 can be a mouse, a keyboard, a modem, a network interface, a touch input device, a somatosensory input device, a printer, and other devices known in the art. Typically, the input / output device 905 is connected to the system through an input / output (I / O) controller 906.

[0137] The technical solution provided by the embodiments of the present invention may have the following beneficial effects:

[0138] In the scheme of the present invention, an automatic update technology is adopted to propose a technical means for automatically updating keys in an efficient and lossless manner, so as to reduce manual intervention and ensure the timeliness and accuracy of key updates.

[0139] In the solution of the present invention, API parameter agreement and signature verification as well as automatic key update method are adopted to solve the traditional password update method, and solve the problems of data integrity and security, credibility of request source, and key update security.

[0140] It should be understood by those skilled in the art that the embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program codes.

[0141] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0142] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0143] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0144] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for automatically updating keys efficiently and losslessly, characterized in that: The method includes: Setting up a client for permission management, a server for permission management, and a unified permission management system; Obtaining the parameters of the request, classifying them by the client according to the requirements of the server, and extracting the permission key from the unified permission management system; After the unified permission management system receives the data, it feeds back the public parameters and service parameters to the client; The client signs according to the public parameters and service parameters; After receiving the signed data sent by the client, the server verifies the signature; The client for permission management, the server for permission management, and the unified permission management system update the key pair in the unified permission management system; Among them, when the server receives the signed data sent by the client and verifies the signature, it specifically includes: The client adds a signature verification string to the header of the signed data sent; After receiving the signed data, the server obtains the signature verification string of the client; The server calls the ClientKey corresponding to the signature verification string in the unified permission management system through the gateway according to the signature verification string; The server generates local signature verification data through the ClientKey and compares it with the request key in the request header. If they are the same, the signature verification is considered successful; otherwise, the signature verification fails; Among them, the request key pair needs to be updated losslessly during the signature verification process. The specific process includes: a primary ClientKey and a backup ClientKey; the primary ClientKey is the clientKey in normal use. After the new primary clientKey is generated, both the client and the server need to request the unified permission management system to obtain the latest primary clientKey. If the signature verification fails, after the new primary clientKey is generated, the old clientKey becomes the backup clientKey; The primary ClientKey includes 3 time points, namely: TP0 is the time point when a primary clientKey is generated; TP1 is the time point when the new primary clientKey becomes effective. The client can use the primary clientKey only after TP1, and the server needs to obtain the primary clientKey before TP1; TP2 is the time point when the primary clientKey is set to expire to ensure system security; The backup ClientKey includes 3 time points, namely: TS0 is the generation time point of the backup clientKey, and TS0 is equal to TP0; TS1 is the expiration time point of the backup clientKey, TP1 < TS1 < TP2. Before TS1, the primary clientKey is not allowed to be updated; Among them, the time difference agreement includes TP1 - TP0 > 30 minutes, TP2 - TP1 > 2 hours, and 10 minutes < TS1 - TP1 < 20 minutes.

2. The method for efficient and lossless automatic key update according to claim 1, characterized in that: The setting up of the client for permission management, the server for permission management, and the unified permission management system specifically includes: Setting up a unified permission management system for issuing the permission key corresponding to the application and the permission key corresponding to the client; Setting up a client for permission management for calling the interface of the server for permission management; Setting up a server for permission management for verifying the signature of the parameters.

3. The method for efficient and lossless automatic key update according to claim 1, characterized in that: The client classifies the parameters of the acquisition request according to the needs of the server and extracts the permission key from the unified permission management system, specifically including: The request parameters are divided into public parameters and business parameters, wherein the public parameters are included in each request, and the business parameters are pre-agreed to determine the specific demand form according to the preset scenario; The client extracts the corresponding permission key from the unified permission management system according to the corresponding requirements of the server.

4. The method for efficient and lossless automatic key update according to claim 1, characterized in that: After receiving the data, the unified authority management system feeds back the public reference and business reference to the client, specifically including: When the reception is successful, the feedback public parameter includes at least a return code. When the return code is 1, it means that the transmission is successful; When the return code is fed back, the service parameters are fed back to the client, and the service parameters at least include a feedback message and a return value.

5. The method for efficient and lossless automatic key update according to claim 1, characterized in that: The client signs according to the public parameters and business parameters, including: The client obtains the public parameters and business parameters and signs them; When private data is transferred, apply for an SM2 key pair and use the public key of the data receiving end for encryption; Submit public parameters, business parameters and signature values ​​to the server.

6. The method for efficient and lossless automatic key update according to claim 1, characterized in that: The client of the rights management, the server of the rights management and the unified rights management system update the key pair in the unified rights management system, specifically including: The unified permission management system issues all clientKeys, and the cache is updated synchronously after each update; Before the cache validity period expires, update all primary clientKeys and put the old clientKeys into the backup clientKeys; After the client is started, it requests the unified authority management system to obtain its own clientKey, and adopts two-level cache storage, which includes local storage with a validity period of 10 minutes and Redis cache with a validity period of 10 minutes. When 20 minutes are reached, it requests the unified authority management system again to obtain its own clientKey; wherein, when the client requests the unified authority management system, it needs to provide clientId, the public key of the national secret SM2, and use the national secret SM2 to sign the clientId; the unified authority management system compares the clientId and the public key, and encrypts the result with the public key. After the client receives the returned result, it uses the private key to decrypt it; When the server receives a request from the client, the request parameters and return parameters are composed of public parameters and business parameters. Public parameters are required every time, and business parameters are agreed upon according to specific scenarios. The unified permission management system is called according to the client's clientId to obtain A's clientKey. At this time, the primary clientKey and backup clientKey are obtained at the same time and cached to Redis. The cache is valid for 20 minutes and the cache impact duration is 20 minutes. <TP1-TP0; During signature verification, if the primary clientKey fails to verify the signature, the backup clientKey will be used for verification; The clientId of the client corresponds to one for each application terminal.

7. A system for efficient and lossless automatic key update, characterized in that: The system is used to implement the method according to any one of claims 1 to 6, and the system comprises: The structure setting module is used to set the client of permission management, the server of permission management and the unified permission management system; The classification signature module is used to obtain the parameters of the request. The client classifies the request according to the needs of the server and extracts the permission key from the unified permission management system. The public parameter feedback module is used to feedback public parameters and business parameters to the client after the unified authority management system receives the data; Signature module, used by the client to sign based on public parameters and business parameters; The signature verification module is used by the server to verify the signed data sent by the client. Update the signature module, which is used by the permission management client, permission management server and unified permission management system to update the key pair in the unified permission management system.

8. A computer-readable storage medium storing computer program instructions, characterized in that: The computer program instructions implement the method according to any one of claims 1 to 6 when executed by a processor.

9. An electronic device, comprising a memory and a processor, characterized in that: The memory is used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method according to any one of claims 1-6.

Images