Key processing method, terminal, first device, storage medium and computer program product

Abstract

The embodiment of the invention discloses a key processing method, a terminal, first equipment, a storage medium and a computer program product. The key processing method applied to the terminal comprises the following steps: generating a second key based on one or more first keys in a first key resource pool in the terminal; and sending a first message to the first device, wherein the first message is used for generating the second key.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication security technology, and in particular, to a key processing method, a terminal, a first device, a storage medium, and a computer program product. Background Art

[0002] With the rapid development of Internet technology, the network security risks of information systems continue to increase, and the threat challenges are becoming increasingly severe. Cryptographic security is an important foundation for information security and can be used to effectively protect the data security of network information systems. Cryptographic technology is the core technology and important means to protect network information systems.

[0003] In order to improve the security of business systems, the use of security keys, such as quantum security keys, is a new solution. Quantum security keys are based on the principles of quantum mechanics and use the non-cloning and non-measurable characteristics of quantum states to achieve a new way of encrypted communication. By using quantum security keys, business systems can achieve unconditional secure communication, greatly improving the security of the system. At the same time, the distribution speed of quantum security keys is fast, which can achieve real-time encrypted communication and improve communication efficiency. The use of quantum security keys is an effective means to improve the security of business systems and can ensure the security of information and the efficiency of communication.

[0004] At present, in order to ensure the security of keys, keys are mainly charged on terminals, which are charged offline into their security environment at one time to construct a key resource pool. Business applications obtain and use keys from the resource pool.

[0005] However, the storage space of the security environment in the terminal is limited, and it is difficult to store a large number of keys to meet the one-time use requirements. Once the stored keys are used up, they need to be recharged. Repeated recharging of keys will also reduce the service life of the hardware that provides the storage space. Summary of the invention

[0006] The embodiments of the present application provide a key processing method, a terminal, a first device, a storage medium, and a computer program product, which make full use of the keys in the key resource pool to generate keys, which can not only reduce the requirements for the storage space size of the security environment in the terminal and reduce repeated key recharges, which is beneficial to extending the service life of the hardware providing the storage space, but also meet the business needs of massive one-time key.

[0007] The technical solution of the embodiment of the present application is implemented as follows:

[0008] The present invention provides a key processing method, which is applied to a terminal. The method includes:

[0009] generating a second key based on one or more first keys in a first key resource pool in the terminal;

[0010] A first message is sent to a first device, where the first message is used to generate the second key.

[0011] In the above method, the first key resource pool is stored by the first device in a secure environment of the terminal through a preconfiguration method.

[0012] In the above method, the generating the second key based on one or more first keys in the first key resource pool in the terminal includes:

[0013] Generate random numbers;

[0014] The second key is generated using the random number and the one or more first keys.

[0015] In the above method, the step of generating the second key by using the random number and the one or more first keys includes:

[0016] XOR the one or more first keys and the random number to generate the second key;

[0017] Alternatively, the one or more first keys and the random number are input as parameters into a key generation function KDF to generate the second key;

[0018] Alternatively, the one or more first keys and the random number are input as parameters into a hash function to generate the second key.

[0019] In the above method, the generating the second key based on one or more first keys in the first key resource pool in the terminal includes:

[0020] XOR the one or more first keys to generate the second key;

[0021] Alternatively, the one or more first keys are input as parameters into a key generation function KDF to generate the second key;

[0022] Alternatively, the one or more first keys are input as parameters into a hash function to generate the second key.

[0023] In the above method, the first message includes one or more of the following:

[0024] Service information, where the service information is encrypted and / or integrity protected based on the second key;

[0025] Terminal identification;

[0026] an identification of the one or more first keys;

[0027] The key generation method indication information is used to indicate the generation method of the second key;

[0028] Random numbers.

[0029] In the above method, it also includes:

[0030] The second key is used to perform secure communication with the first device.

[0031] The present application provides a key processing method, which is applied to a first device, and the method includes:

[0032] receiving a first message sent by a terminal;

[0033] A second key identical to that of the terminal is generated using the first message.

[0034] In the above method, the first message includes one or more of the following:

[0035] Service information, where the service information is encrypted and / or integrity protected based on the second key;

[0036] Terminal identification;

[0037] an identification of one or more first keys;

[0038] The key generation method indication information is used to indicate the generation method of the second key;

[0039] Random numbers.

[0040] In the above method, the first message includes one or more first key identifiers and indication information of a key generation method, and the step of using the first message to generate a second key identical to that of the terminal includes:

[0041] obtaining the one or more first keys based on identifiers of the one or more first keys;

[0042] Based on the one or more first keys, the second key is generated in a generation manner indicated by the indication information.

[0043] In the above method, the step of generating the second key based on the one or more first keys and in accordance with the generation method indicated by the indication information includes:

[0044] XOR the one or more first keys to generate the second key;

[0045] Alternatively, the one or more first keys are input as parameters into a key generation function KDF to generate the second key;

[0046] Alternatively, the one or more first keys are input as parameters into a hash function to generate the second key.

[0047] In the above method, the first message includes a random number, and the generating the second key based on the one or more first keys and in accordance with the generation method indicated by the indication information includes:

[0048] XOR the one or more first keys and the random number to generate the second key;

[0049] Alternatively, the one or more first keys and the random number are input as parameters into a key generation function KDF to generate the second key;

[0050] Alternatively, the one or more first keys and the random number are input as parameters into a hash function to generate the second key.

[0051] In the above method, the first message includes a terminal identifier, and the acquiring one or more first keys based on the identifiers of the one or more first keys includes:

[0052] Searching a first key resource pool configured for the terminal based on the terminal identifier;

[0053] The one or more first keys are obtained from the first key resource pool based on identifiers of the one or more first keys.

[0054] In the above method, it also includes:

[0055] The second key is used to perform secure communication with the terminal.

[0056] In the above method, the first device includes a primary platform and a secondary platform, and the method further includes:

[0057] The first message is received through the secondary platform, and the information in the first message is sent to the primary platform, and the primary platform generates the second key.

[0058] In the above method, it also includes:

[0059] Sending the generated second key to the secondary platform through the primary platform;

[0060] The second key is used to perform secure communication between the secondary platform and the terminal.

[0061] An embodiment of the present application provides a first device, including: a first processor, a first memory, and a first communication bus;

[0062] The first communication bus is used to implement a communication connection between the first processor and the first memory;

[0063] The first processor is used to execute one or more computer programs stored in the first memory to implement a key processing method applied to the first device.

[0064] An embodiment of the present application provides a terminal, including: a second processor, a second memory, and a second communication bus;

[0065] The second communication bus is used to implement a communication connection between the second processor and the second memory;

[0066] The second processor is used to execute one or more computer programs stored in the second memory to implement the key processing method applied to the terminal.

[0067] An embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the key processing method applied to a terminal or the steps of the key processing method applied to a first device are implemented.

[0068] An embodiment of the present application provides a computer program product, including a computer program, which, when executed, implements the steps of the key processing method applied to a terminal, or the steps of the key processing method applied to a first device.

[0069] The embodiment of the present application provides a key processing method, a terminal, a first device, a storage medium and a computer program product. The key processing method applied to the terminal includes: generating a second key based on one or more first keys in a first key resource pool in the terminal; sending a first message to the first device, the first message is used to generate the second key. The technical solution provided by the embodiment of the present application makes full use of the keys in the key resource pool to generate keys, which can reduce the requirements for the storage space size of the security environment in the terminal, reduce repeated key filling, and is conducive to extending the service life of the hardware providing the storage space, and can also meet the business needs of massive one-time one-key. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 A schematic diagram of a key processing method provided in an embodiment of the present application Figure 1 ;

[0071] Figure 2 A schematic diagram of a key processing method provided in an embodiment of the present application Figure 2 ;

[0072] Figure 3An exemplary business processing and interaction diagram provided for an embodiment of the present application;

[0073] Figure 4 A schematic diagram of the structure of a first device provided in an embodiment of the present application Figure 1 ;

[0074] Figure 5 A schematic diagram of the structure of a first device provided in an embodiment of the present application Figure 2 ;

[0075] Figure 6 A schematic diagram of the structure of a first device provided in an embodiment of the present application Figure 3 ;

[0076] Figure 7 A schematic diagram of a terminal structure provided in an embodiment of the present application Figure 1 ;

[0077] Figure 8 A schematic diagram of a terminal structure provided in an embodiment of the present application Figure 2 . DETAILED DESCRIPTION

[0078] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0079] The following will specifically describe the technical solution of the present application and how the technical solution of the present application solves the above technical problems through embodiments and in conjunction with the accompanying drawings. The following embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0080] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0081] The embodiment of the present application provides a key processing method, which is applied to a terminal. The embodiment of the present application does not limit the specific type of the terminal, which can be any electronic device.

[0082] Figure 1 A schematic diagram of a key processing method provided in an embodiment of the present application Figure 1 .like Figure 1 As shown, in an embodiment of the present application, the key processing method applied to the terminal mainly includes the following steps:

[0083] S101. Generate a second key based on one or more first keys in a first key resource pool in a terminal.

[0084] In an embodiment of the present application, the terminal may generate a second key based on one or more first keys in the first quantum key resource pool.

[0085] It should be noted that in an embodiment of the present application, the first key resource pool is stored by the first device in a secure environment of the terminal through a preconfiguration method, wherein the specific security environment may be a secure storage space of a Universal Subscriber Identity Module (USIM), which is not limited in the embodiment of the present application.

[0086] It should be noted that, in the embodiment of the present application, a certain number of first keys may be configured in the first key resource pool, and the terminal may select one or more first keys from the first key resource pool for generating the second key, wherein the number of the selected first keys is less than or equal to the total number of first keys contained in the first key resource pool. The one or more first keys used to generate the second key may be randomly selected from the first key resource pool, or may be selected according to certain rules. In addition, each first key in the first key resource pool may specifically be a quantum key, which is not limited in the embodiment of the present application.

[0087] In an embodiment of the present application, the terminal generates a second key based on one or more first keys in a first key resource pool in the terminal, including: generating a random number; and generating the second key using the random number and the one or more first keys.

[0088] In an embodiment of the present application, the terminal generates a second key using a random number and one or more first keys, including: performing an XOR operation on one or more first keys and a random number to generate a second key; or, inputting one or more first keys and a random number as parameters into a key generation function (Key Derivation Function, KDF) to generate a second key; or, inputting one or more first keys and a random number as parameters into a hash function (HASH) to generate a second key.

[0089] Exemplarily, in an embodiment of the present application, the number of first keys used to generate the second key is n, where n is a positive integer, and the n first keys are respectively represented as QK1, QK2, ..., QKn, and nonce represents a random number. The terminal can generate the second key in any of the following three ways:

[0090] Method 1: Qkey = QK1⊕QK2⊕…⊕QKn⊕nonce

[0091] Method 2: Qkey = KDF (QK1, QK2, ..., QKn, nonce)

[0092] Method 3: Qkey = Hash (QK1, QK2, ..., QKn, nonce)

[0093] Among them, Qkey represents the second key, the symbol ⊕ in method one represents XOR, KDF in method two represents the key generation function, and HASH in method three represents the hash function.

[0094] In an embodiment of the present application, the terminal generates a second key based on one or more first keys in a first key resource pool in the terminal, and may also include: XORing one or more first keys to generate a second key; or, inputting one or more first keys as parameters into a key generation function to generate a second key; or, inputting one or more first keys as parameters into a hash function to generate a second key.

[0095] It should be noted that in the embodiments of the present application, the terminal can not only add a random number to generate a second key on the basis of one or more first keys, but also generate the second key using only one or more first keys. The specific calculation method is similar to the above example, wherein one or more first keys are XORed to generate the second key. If there is only one first key, the first key is directly determined as the second key, or it can be XORed with other specific values, which is not limited in the embodiments of the present application. In addition, the terminal can also add other information to generate the second key on the basis of one or more first keys. The specific key generation method can be selected or set according to actual needs and application scenarios, which is not limited in the embodiments of the present application.

[0096] It can be understood that in the embodiments of the present application, random numbers are introduced in the process of generating the second key in order to reduce the repetition rate of the generated second key. If the same one or more first keys are used for both key generation, the generated second keys can be different due to the introduction of different random numbers.

[0097] S102. Send a first message to a first device, where the first message is used to generate a second key.

[0098] In an embodiment of the present application, the terminal may send a first message to the first device, where the first message is used to generate a second key.

[0099] In an embodiment of the present application, the first message includes one or more of the following: business information, which is encrypted and / or integrity protected based on the second key; a terminal identifier; identifiers of one or more first keys; indication information of a key generation method, used to indicate a method for generating the second key; and a random number.

[0100] It is understandable that in an embodiment of the present application, the terminal can send the indication information including the key generation method and the identifier of one or more first keys to the first device through the first message, so that the first device can also generate the second key. The process of the first device generating the second key is detailed in the subsequent first device side method steps.

[0101] It should be noted that, in the embodiment of the present application, the indication information may specifically be a field, and the terminal may use the field to indicate the method for generating the second key.

[0102] It should be noted that, in an embodiment of the present application, each first key in the first key resource pool corresponds to an identifier, different first keys correspond to different identifiers, and the terminal can directly obtain the identifiers of one or more first keys used to generate the second key. Exemplarily, the number of first keys used to generate the second key is n, n is a positive integer, and the identifiers of the n first keys are QKID1, QKID2, ..., QKIDn respectively.

[0103] It can be understood that in an embodiment of the present application, as described in the above step S101, the terminal can not only use one or more first keys but also use random numbers when generating the second key. In this case, the first device also needs to know the random number when generating the second key. Based on this, the first message also includes a random number.

[0104] In an embodiment of the present application, the terminal generates a second key and sends a first message to the first device. The first message is used to generate the second key. Based on this, the first device can generate the second key. Both the terminal and the first device can obtain the second key. In this case, the terminal can also perform the following steps: use the second key to communicate securely with the first device.

[0105] It should be noted that, in the embodiments of the present application, the second key is used for secure communication between the terminal and the first device, including but not limited to the terminal and the first device both using the second key to encrypt and / or integrity protect the exchanged information.

[0106] An embodiment of the present application provides a key processing method, which is applied to a first device. Figure 2 A schematic diagram of a key processing method provided in an embodiment of the present application Figure 2 .like Figure 2 As shown, in an embodiment of the present application, the key processing method applied to the first device mainly includes the following steps:

[0107] S201: Receive a first message sent by a terminal.

[0108] In an embodiment of the present application, corresponding to the above-mentioned terminal side method, the first device can receive a first message sent by the terminal.

[0109] In an embodiment of the present application, the first message includes one or more of the following: business information, which is encrypted and / or integrity protected based on the second key; a terminal identifier; identifiers of one or more first keys; indication information of a key generation method, used to indicate a method for generating the second key; and a random number.

[0110] It should be noted that, in the embodiment of the present application, the relevant description of the various information contained in the first message is detailed in the above-mentioned terminal side method steps, and will not be repeated here.

[0111] S202: Generate a second key identical to that of the terminal using the first message.

[0112] In an embodiment of the present application, after receiving the first message, the first device may use the first message to generate the same second key as that of the terminal.

[0113] In an embodiment of the present application, the first message includes one or more identifiers of the first keys and indication information of the key generation method, and the first message is used to generate a second key that is the same as the terminal, including: obtaining one or more first keys based on the identifiers of one or more first keys; based on the one or more first keys, generating a second key according to the generation method indicated by the indication information.

[0114] In an embodiment of the present application, the first message includes a terminal identifier, and the first device obtains one or more first keys based on the identifiers of the one or more first keys, including: searching a first key resource pool configured for the terminal based on the terminal identifier; and obtaining one or more first keys from the first key resource pool based on the identifiers of the one or more first keys.

[0115] It should be noted that, in an embodiment of the present application, one or more first keys come from a first key resource pool, which is stored by the first device in a secure environment of the terminal through a preconfigured method. The first device itself can obtain the first key resource pool, and a corresponding relationship can be established between the terminal identifier and the first key resource pool. Based on this, the first device can use the terminal identifier to quickly find the first key resource pool, that is, quickly locate the storage location of one or more first keys, so that one or more first keys can be quickly obtained from the first key resource pool based on the identifiers of one or more first keys.

[0116] Exemplarily, in an embodiment of the present application, the first message includes n first key identifiers, where n is a positive integer, and the key identifiers of the n first keys are QKID1, QKID2, ..., QKIDn, respectively. Based on this, the first device can obtain the corresponding n first keys QK1, QK2, ..., QKn from the first quantum key resource pool.

[0117] It should be noted that in an embodiment of the present application, as described in the above-mentioned terminal side method, the second key can be generated by any one of XOR processing, using KDF, and using a hash function. The indication information indicates the generation method of the second key. Based on this, the first device can generate the second key based on one or more first keys according to the generation method indicated by the indication information.

[0118] In an embodiment of the present application, the first device generates a second key based on one or more first keys in accordance with the generation method indicated by the indication information, including: XORing one or more first keys to generate a second key; or, inputting one or more first keys as parameters into a key generation function to generate a second key; or, inputting one or more first keys as parameters into a hash function to generate a second key.

[0119] In an embodiment of the present application, the first message also includes a random number, and the first device generates a second key based on one or more first keys in a generation method indicated by the indication information, including: generating a second key by XORing one or more first keys and a random number; or, inputting one or more first keys and the random number as parameters into a key generation function to generate a second key; or, inputting one or more first keys and a random number as parameters into a hash function to generate a second key.

[0120] It should be noted that in the embodiments of the present application, as described in the above-mentioned terminal side method, the second key can be generated directly based on one or more first keys, or it can be generated by adding a random number on the basis of one or more first keys. The generation process of the second key by the first device is consistent with that on the terminal side, and will not be repeated here.

[0121] In an embodiment of the present application, after the first device generates the second key, since both the terminal and the first device obtain the second key, based on this, the first device can also perform the following steps: use the second key to communicate securely with the terminal.

[0122] It should be noted that, in the embodiments of the present application, the second key is used for secure communication between the first device and the terminal, including but not limited to the first device and the terminal both using the second key to encrypt and / or integrity protect the exchanged information.

[0123] In an embodiment of the present application, the first device may include two parts, namely a primary platform and a secondary platform. The secondary platform is used to communicate and interact with the terminal, the secondary platform is connected to the primary platform, and the primary platform is used to generate keys. Based on this, the first device can perform the following steps: receive the first message through the secondary platform, and send the information in the first message to the primary platform, and generate a second key by the primary platform.

[0124] It should be noted that in an embodiment of the present application, the first-level platform is used for key generation. The first-level platform can send the terminal identifier, indication information, one or more identifiers of the first key, and a random number in the first message to the first-level platform, so that the first-level platform can execute the above-mentioned steps for generating the second key to realize the generation of the second key.

[0125] In an embodiment of the present application, the first device may further perform the following steps: sending the generated second key to the secondary platform through the primary platform; and performing secure communication between the secondary platform and the terminal using the second key.

[0126] The following combines the key processing method of the above terminal and the first device, Figure 3 , illustrating the relevant business processing and interaction process by way of example.

[0127] like Figure 3 As shown, the following steps are mainly involved between the terminal, the primary platform in the first device, and the secondary platform:

[0128] S301. The terminal generates a second key Qkey based on n first keys in a first key resource pool and a random number nonce, and uses Qkey to protect business information to obtain a ciphertext of the business information; wherein n is a positive integer.

[0129] It should be noted that the method of generating Qkey from n first keys and nonce can be to XOR the n first keys and nonce, to input the n first keys and nonce as parameters into KDF, or to input the n first keys and nonce as parameters into a hash function.

[0130] S302, the terminal sends a service request to the secondary platform; the service request includes service information, terminal identification, QKID1, QKID2, ..., QKIDn, indication information indicating the generation method of Qkey, nonce;

[0131] It should be noted that the service request is equivalent to the above-mentioned first message, wherein QKID1, QKID2, ..., QKIDn are identifiers of n first keys, and the service information is encrypted and / or integrity protected based on Qkey.

[0132] S303, the secondary platform sends a key acquisition request to the primary platform through a secure channel; the key acquisition request includes a terminal identifier, QKID1, QKID2, ..., QKIDn, indication information indicating a Qkey generation method, and nonce;

[0133] S304, the first-level platform obtains n first keys QK1, QK2, ..., QKn corresponding to QKID1, QKID2, ..., QKIDn, and generates Qkey based on QK1, QK2, ..., QKn and nonce in accordance with the generation method indicated by the instruction information;

[0134] S305, the first-level platform sends Qkey to the second-level platform;

[0135] S306, the secondary platform uses Qkey to process the business information and generates business response information encrypted and / or integrity protected based on Qkey;

[0136] S307, the secondary platform sends the business response information to the terminal;

[0137] S308: The terminal uses Qkey to process the service response information.

[0138] Based on the key processing methods on the above-mentioned terminal side and the first device side, it can be known that the technical solution provided in the embodiment of the present application, first, can make full use of the keys in the key resource pool to generate a large number of keys, thereby reducing the requirements for the storage space size of the security environment in the terminal and reducing operator costs; second, a large number of keys can be generated based on limited keys to meet the business needs of massive one-time secret keys; third, the frequency of recharging can be greatly reduced, which greatly reduces the frequency of repeated writing of keys, which is beneficial to extending the service life of the hardware that provides storage space.

[0139] This embodiment of the present application provides a first device. Figure 4 As shown, in one embodiment of the present application, the first device includes:

[0140] The first communication module 401 is used to receive a first message sent by a terminal;

[0141] The first generating module 402 is configured to generate a second key identical to that of the terminal using the first message.

[0142] In an embodiment of the present application, the first message includes one or more of the following:

[0143] Service information, where the service information is encrypted and / or integrity protected based on the second key;

[0144] Terminal identification;

[0145] an identification of one or more first keys;

[0146] The key generation method indication information is used to indicate the generation method of the second key;

[0147] Random numbers.

[0148] In one embodiment of the present application, the first message includes one or more identifiers of the first keys and indication information of the key generation method, and the first generation module 402 is used to obtain the one or more first keys based on the identifiers of the one or more first keys; based on the one or more first keys, generate the second key according to the generation method indicated by the indication information.

[0149] In one embodiment of the present application, the first generation module 402 is used to perform an XOR operation on the one or more first keys to generate the second key; or, input the one or more first keys as parameters into a key generation function KDF to generate the second key; or, input the one or more first keys as parameters into a hash function to generate the second key.

[0150] In one embodiment of the present application, the first message includes a random number, and the first generation module 402 is used to generate the second key by performing an XOR operation on the one or more first keys and the random number; or, input the one or more first keys and the random number as parameters into a key generation function KDF to generate the second key; or, input the one or more first keys and the random number as parameters into a hash function to generate the second key.

[0151] In one embodiment of the present application, the first message includes a terminal identifier, and the first generation module 402 is used to search for a first key resource pool configured for the terminal based on the terminal identifier; and obtain the one or more first keys from the first key resource pool based on the identifiers of the one or more first keys.

[0152] In an embodiment of the present application, the first communication module 401 is further configured to perform secure communication with the terminal using the second key.

[0153] Based on the same inventive concept, Figure 5 As shown, in one embodiment of the present application, the first device includes a primary platform 501 and a secondary platform 502, wherein;

[0154] The secondary platform 502 is used to receive the first message and send the information in the first message to the primary platform 501;

[0155] The first-level platform 501 is used to generate the second key.

[0156] It should be noted that in the embodiments of the present application, in combination with the above embodiments, the process of generating the second key by the first-level platform 501 is consistent with the above-mentioned first generation module 402. Specifically, the above-mentioned first key generation module 402 can be deployed on the first-level platform 501, and the above-mentioned first communication module 401 can be deployed on the second-level platform 402.

[0157] In one embodiment of the present application, the primary platform 501 is further used to send the generated second key to the secondary platform 502;

[0158] The secondary platform 502 is further configured to perform secure communication with the terminal using the second key.

[0159] Based on the same inventive concept, Figure 6 As shown, in one embodiment of the present application, the first device includes: a first processor 601, a first memory 602 and a first communication bus 603;

[0160] The first communication bus 603 is used to implement a communication connection between the first processor 601 and the first memory 602;

[0161] The first processor 601 is configured to execute one or more computer programs stored in the first memory 602 to implement a key processing method applied to a first device.

[0162] The present application embodiment provides a terminal. Figure 7 As shown, in one embodiment of the present application, the terminal includes:

[0163] A second generating module 701, configured to generate a second key based on one or more first keys in a first key resource pool in the terminal;

[0164] The second communication module 702 is configured to send a first message to a first device, where the first message is used to generate the second key.

[0165] In an embodiment of the present application, the first key resource pool is stored by the first device in a security environment of the terminal through a preconfiguration method.

[0166] In an embodiment of the present application, the second generation module 701 is used to generate a random number; and generate the second key using the random number and the one or more first keys.

[0167] In one embodiment of the present application, the second generation module 701 is used to generate the second key by performing an XOR operation on the one or more first keys and the random number; or, input the one or more first keys and the random number as parameters into a key generation function KDF to generate the second key; or, input the one or more first keys and the random number as parameters into a hash function to generate the second key.

[0168] In one embodiment of the present application, the second generation module 701 is also used to perform an XOR operation on the one or more first keys to generate the second key; or, input the one or more first keys as parameters into a key generation function KDF to generate the second key; or, input the one or more first keys as parameters into a hash function to generate the second key.

[0169] In an embodiment of the present application, the first message includes one or more of the following:

[0170] Service information, where the service information is encrypted and / or integrity protected based on the second key;

[0171] Terminal identification;

[0172] an identification of the one or more first keys;

[0173] The key generation method indication information is used to indicate the generation method of the second key;

[0174] Random numbers.

[0175] In an embodiment of the present application, the second communication module 702 is further configured to perform secure communication with the first device using the second key.

[0176] Based on the same inventive concept, Figure 8 As shown, in one embodiment of the present application, the terminal includes: a second processor 801, a second memory 802, and a second communication bus 803;

[0177] The second communication bus 803 is used to implement a communication connection between the second processor 801 and the second memory 802;

[0178] The second processor 801 is configured to execute one or more computer programs stored in the second memory 802 to implement a key processing method applied to a terminal.

[0179] An embodiment of the present application provides a computer program product, including a computer program, which, when executed, implements the steps of the key processing method applied to a terminal, or the steps of the key processing method applied to a first device.

[0180] The embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps described in the key processing method applied to the terminal are implemented, or the steps described in the key processing method applied to the first device are implemented. The computer-readable storage medium can be a volatile memory (volatile memory), such as a random access memory (Random-Access Memory, RAM); or a non-volatile memory (non-volatile memory), such as a read-only memory (Read-Only Memory, ROM), a flash memory (flash memory), a hard disk (Hard Disk Drive, HDD) or a solid-state drive (SSD); or it can be a respective device including one or any combination of the above memories, such as a mobile phone, a computer, a tablet device, a personal digital assistant, etc.

[0181] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of hardware embodiments, software embodiments, or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0182] The present application is described with reference to implementation flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0183] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which is implemented in the implementation flow diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A function specified in one or more boxes.

[0184] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing the steps in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0185] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with the technical field within the technical scope disclosed in the utility application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A key processing method, characterized in that: Applied to a terminal, the method comprises: generating a second key based on one or more first keys in a first key resource pool in the terminal; A first message is sent to a first device, where the first message is used to generate the second key.

2. The method according to claim 1, characterized in that The first key resource pool is stored by the first device in a security environment of the terminal through a preconfiguration method.

3. The method according to claim 1, characterized in that The generating the second key based on one or more first keys in the first key resource pool in the terminal includes: Generate random numbers; The second key is generated using the random number and the one or more first keys.

4. The method according to claim 3, characterized in that The generating the second key by using the random number and the one or more first keys comprises: XOR the one or more first keys and the random number to generate the second key; Alternatively, the one or more first keys and the random number are input as parameters into a key generation function KDF to generate the second key; Alternatively, the one or more first keys and the random number are input as parameters into a hash function to generate the second key.

5. The method according to claim 1, characterized in that The generating the second key based on one or more first keys in the first key resource pool in the terminal includes: XOR the one or more first keys to generate the second key; Alternatively, the one or more first keys are input as parameters into a key generation function KDF to generate the second key; Alternatively, the one or more first keys are input as parameters into a hash function to generate the second key.

6. The method according to claim 1, characterized in that The first message includes one or more of the following: Service information, where the service information is encrypted and / or integrity protected based on the second key; Terminal identification; an identification of the one or more first keys; The key generation method indication information is used to indicate the generation method of the second key; Random numbers.

7. The method according to claim 1, characterized in that: The method further comprises: The second key is used to perform secure communication with the first device.

8. A key processing method, characterized in that: Applied to a first device, the method includes: receiving a first message sent by a terminal; A second key identical to that of the terminal is generated using the first message.

9. The method according to claim 8, characterized in that The first message includes one or more of the following: Service information, where the service information is encrypted and / or integrity protected based on the second key; Terminal identification; an identification of one or more first keys; The key generation method indication information is used to indicate the generation method of the second key; Random numbers.

10. The method according to claim 8 or 9, characterized in that: The first message includes one or more first key identifiers and indication information of a key generation method, and the step of using the first message to generate a second key identical to that of the terminal includes: obtaining the one or more first keys based on identifiers of the one or more first keys; Based on the one or more first keys, the second key is generated in a generation manner indicated by the indication information.

11. The method according to claim 10, characterized in that The generating the second key based on the one or more first keys and in accordance with the generation method indicated by the indication information includes: XOR the one or more first keys to generate the second key; Alternatively, the one or more first keys are input as parameters into a key generation function KDF to generate the second key; Alternatively, the one or more first keys are input as parameters into a hash function to generate the second key.

12. The method according to claim 10, characterized in that The first message includes a random number, and the generating the second key based on the one or more first keys and in a generation manner indicated by the indication information includes: XOR the one or more first keys and the random number to generate the second key; Alternatively, the one or more first keys and the random number are input as parameters into a key generation function KDF to generate the second key; Alternatively, the one or more first keys and the random number are input as parameters into a hash function to generate the second key.

13. The method according to claim 10, characterized in that The first message includes a terminal identifier, and the acquiring one or more first keys based on the identifiers of the one or more first keys includes: Searching a first key resource pool configured for the terminal based on the terminal identifier; The one or more first keys are obtained from the first key resource pool based on identifiers of the one or more first keys.

14. The method according to claim 8, characterized in that The method further comprises: The second key is used to perform secure communication with the terminal.

15. The method according to any one of claims 9 to 14, characterized in that: The first device includes a primary platform and a secondary platform, and the method further includes: The first message is received through the secondary platform, and the information in the first message is sent to the primary platform, and the primary platform generates the second key.

16. The method according to claim 15, characterized in that The method further comprises: Sending the generated second key to the secondary platform through the primary platform; The second key is used to perform secure communication between the secondary platform and the terminal.

17. A first device, characterized in that: include: a first processor, a first memory, and a first communication bus; The first communication bus is used to implement a communication connection between the first processor and the first memory; The first processor is used to execute one or more computer programs stored in the first memory to implement the key processing method described in any one of claims 8-16.

18. A terminal, characterized in that: include: a second processor, a second memory, and a second communication bus; The second communication bus is used to realize the communication connection between the second processor and the second memory; The second processor is used to execute one or more computer programs stored in the second memory to implement the key processing method according to any one of claims 1 to 7.

19. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the key processing method as described in any one of claims 1 to 16 is implemented.

20. A computer program product comprising a computer program, characterized in that When the computer program is executed, the key processing method according to any one of claims 1 to 16 is implemented.

Images