Key management method and device and electronic equipment

Abstract

The embodiment of the invention provides a key management method and device and electronic equipment. The method comprises the following steps: after establishing communication connection with second equipment, generating a shared key; generating a first key pool according to the shared key; when encryption transmission is carried out, a first secret key is selected from a first secret key pool, and the selected first secret key is determined as a current first secret key; and sending the label information of the current first secret key to the second equipment through the communication connection. According to the embodiment of the invention, the current secret key is selected from the secret key pool, so that the action of repeatedly generating the secret key during each encryption transmission can be avoided, the time required by the encryption transmission is shortened, and the encryption transmission efficiency is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a key management method, device and electronic device. Background Art

[0002] In order to protect data from being stolen and tampered with in network communications, the communicating parties usually need to use keys to encrypt network transmission data to ensure the security of data transmission.

[0003] In order to ensure the security of data transmission, each encrypted transmission requires repeated handshake and key generation actions, which increases resource consumption and data transmission time, and thus affects the efficiency of encrypted communication. Summary of the invention

[0004] In view of this, embodiments of the present application provide a key management method, device, and electronic device to at least partially solve the above problems.

[0005] According to a first aspect of an embodiment of the present application, a key management method is provided, which is applied to a first device, and the method includes:

[0006] After establishing a communication connection with the second device, generating a shared key;

[0007] Generate a first key pool according to the shared key, wherein the first key pool includes multiple first keys, and the first key and the second key are symmetric keys used for encryption and decryption during encrypted transmission;

[0008] When performing encrypted transmission, selecting the first key from the first key pool, and determining the selected first key as the current first key;

[0009] The tag information of the current first key is sent to the second device via the communication connection, and the tag information is used to instruct the second device to determine the current second key corresponding to the current first key in the second key pool, and the second key pool includes multiple second keys, which are generated by the second device according to the shared key.

[0010] In some embodiments, when performing encrypted transmission, selecting the first key from the first key pool, and determining the selected first key as the current first key, includes:

[0011] When performing encrypted transmission, obtaining an arrangement order of the first keys in the first key pool;

[0012] The first key with the first arrangement order is selected, and the first key with the first arrangement order is determined as the current first key.

[0013] In some embodiments, the first key is a round key;

[0014] The step of generating a first key pool including a plurality of first keys according to the shared key comprises:

[0015] According to a pre-stored key expansion algorithm, the shared key is expanded into a plurality of first-round keys;

[0016] The first key pool is generated using the plurality of first-round keys.

[0017] In some embodiments, after selecting the first key from the first key pool and determining the selected first key as the current first key, the method further includes:

[0018] Deleting the current first key from the first key pool to obtain an updated first key pool;

[0019] Querying the number of the first keys in the updated first key pool;

[0020] When the number of the first keys in the updated first key pool is lower than a preset threshold, generating at least one third key according to the shared key;

[0021] At least one of the third keys is added to the updated first key pool, so that the number of the first keys in the updated first key pool is higher than the preset threshold.

[0022] In some embodiments, when the number of the first keys in the updated first key pool is higher than the preset threshold, the method further includes:

[0023] Detecting whether the usage duration of the current first key reaches a first threshold, and / or whether the number of times the current first key is used reaches a second threshold;

[0024] When the usage duration reaches the first threshold and / or the number of usages reaches the second threshold, selecting the first key in the updated first key pool, and determining the reselected first key as the updated first key;

[0025] replacing the current first key with the updated first key;

[0026] The tag information of the updated first key is sent to the second device, so that the second device determines the updated second key corresponding to the updated first key in the updated second key pool, and replaces the target second key with the updated second key, wherein the updated second key pool does not include the current second key.

[0027] According to a second aspect of an embodiment of the present application, a key management method is provided, which is applied to a second device, and the method includes:

[0028] After establishing a connection with the first device, generating a shared key;

[0029] Generate a second key pool including multiple second keys according to the shared key, wherein the first key and the second key are symmetric keys used for encryption and decryption during encrypted transmission;

[0030] In response to receiving the tag information of the current first key sent by the first device, a current second key corresponding to the current first key is determined in the second key pool according to the tag information.

[0031] In some embodiments, after determining, in response to receiving the tag information of the first key sent by the first device, a current key corresponding to the current first key in the second key pool according to the tag information, the method further includes:

[0032] Deleting the current second key from the second key pool to obtain an updated second key pool;

[0033] Querying the number of the second keys in the updated second key pool;

[0034] When the number of the second keys in the updated second key pool is lower than a preset threshold, generating at least one fourth key according to the shared key;

[0035] At least one of the fourth keys is added to the updated second key pool, so that the number of the second keys in the updated second key pool is higher than the preset threshold.

[0036] In some embodiments, the method further comprises:

[0037] Receiving label information for updating the first key sent by the first device;

[0038] Determine, in the updated second key pool according to the tag information of the updated first key, an updated second key corresponding to the updated first key;

[0039] The updated second key is used to replace the current second key to update the key.

[0040] According to a third aspect of an embodiment of the present application, a key management apparatus is provided, applied to a first device, the apparatus comprising:

[0041] A first generating module, configured to generate a shared key after establishing a communication connection with a second device;

[0042] A second generating module, used to generate a first key pool according to the shared key, wherein the first key pool includes a plurality of first keys, and the first key and the second key are symmetric keys, which are used for encryption and decryption during encrypted transmission;

[0043] A selection module, configured to select the first key from the first key pool and determine the selected first key as the current first key when performing encrypted transmission;

[0044] A sending module, used to send the tag information of the current first key to the second device via the communication connection, the tag information is used to instruct the second device to determine the current second key corresponding to the current first key in the second key pool, the second key pool includes multiple second keys, which are generated by the second device based on the shared key.

[0045] According to the fourth aspect of an embodiment of the present application, there is provided an electronic device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the key management method described in the first aspect.

[0046] According to a fifth aspect of an embodiment of the present application, a computer storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the key management method as described in the first aspect is implemented.

[0047] According to the key management method provided in the embodiment of the present application, after the first device establishes a communication connection with the second device, the first device generates a shared key, and generates a first key pool including multiple first keys based on the shared key, and the second device generates a second key pool including multiple second keys based on the shared key. Further, when performing encrypted transmission, the current first key used for encryption is selected from the first key pool, and the tag information of the current first key is sent to the second device, so that the second device selects the current second key corresponding to the current first key in the second key pool, thereby performing encrypted transmission. In the embodiment of the present application, when performing encrypted transmission, the first device and the second device select the current key in the key pool, which can avoid the need to repeatedly generate keys each time encrypted transmission is performed, thereby reducing the time required for encrypted transmission and improving the efficiency of encrypted transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0049] Figure 1 A flowchart of a key management method according to an embodiment of the present application;

[0050] Figure 2 A flowchart of a key management method according to an embodiment of the present application;

[0051] Figure 3 is a structural block diagram of a key management device according to an embodiment of the present application;

[0052] Figure 4 is a structural block diagram of a key management device according to an embodiment of the present application;

[0053] Figure 5 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0055] The specific implementation of the embodiment of the present application is further explained below in conjunction with the accompanying drawings of the embodiment of the present application.

[0056] The present application embodiment provides a key management method applied to a first device, and the specific steps are as follows: Figure 1 As shown, the method includes:

[0057] S101, after establishing a communication connection with a second device, generating a shared key.

[0058] In an embodiment of the present application, when encrypted transmission is required, the first device first establishes a communication connection with the second device, and after the communication connection is established, the first device generates a shared key.

[0059] In one embodiment, when generating the shared key, the first device may generate the shared key according to the SM2 elliptic curve public key cryptography algorithm, or may generate the shared key according to a key exchange protocol.

[0060] S102: Generate a first key pool according to the shared key.

[0061] In the embodiment of the present application, while the first device sends the shared key to the second device, the first device generates multiple first keys according to the shared key, and generates a first key pool using the multiple first keys.

[0062] In an example, when the first device generates the second key pool according to the shared key, it may generate the first key pool according to a key derivation function.

[0063] In one example, the first device and the second device use the same algorithm to generate a key pool, the number of keys in the first key pool is the same as the number of keys in the second key pool, and the first key and the second key are symmetric keys used for encryption and decryption during encrypted transmission.

[0064] S103, when performing encrypted transmission, selecting a first key from the first key pool, and determining the selected first key as the current first key.

[0065] In an embodiment of the present application, when the first device determines to perform encrypted transmission, the first device selects a first key from the key pool, and determines the selected first key as the current first key for the current encrypted transmission, so as to use the current first key for encryption.

[0066] S104: Send the label information of the current first key to the second device via the communication connection.

[0067] In an embodiment of the present application, after the first device determines the current first key, the first device obtains the tag information of the current first key, and sends the tag information of the current first key to the second device through a communication connection. After receiving the tag information of the current first key, the second device determines the current second key corresponding to the current first key in the second key pool according to the tag information of the current first key, and then the second device can use the current second key for decryption, thereby completing the encrypted transmission.

[0068] In an example, the tag information of the embodiment of the present application may be generation time information of the current first key, or may be location information of the current first key in the first key pool.

[0069] In the key management method provided by the embodiment of the present application, after the first device establishes a communication connection with the second device, the first device generates a shared key, and generates a first key pool including multiple first keys based on the shared key. Further, the first device sends the shared key to the second device, so that the second device generates a second key pool including multiple second keys based on the shared key. Further, when performing encrypted transmission, the current first key used for encryption is selected from the first key pool, and the tag information of the current first key is sent to the second device, so that the second device selects the current second key corresponding to the current first key in the second key pool, thereby performing encrypted transmission. In the embodiment of the present application, when the first device and the second device perform encrypted transmission, by selecting the current key in the key pool, the action of repeatedly generating the key can be avoided in each encrypted transmission, thereby reducing the time required for encrypted transmission and improving the efficiency of encrypted transmission.

[0070] Furthermore, in the embodiment of the present application, when performing encrypted transmission, selecting a first key from the first key pool and determining the selected first key as the current first key may include the following steps:

[0071] S1031, when performing encrypted transmission, obtaining an arrangement order of first keys in a first key pool;

[0072] In an embodiment of the present application, when performing encrypted transmission, the first device first obtains the arrangement order of each first key in the first key pool. Specifically, when arranging the first keys, the arrangement order of the first keys in the first key pool can be determined according to the time sequence of generation of each first key.

[0073] S1032, selecting the first key that is ranked first in the arrangement order, and determining the first key that is ranked first in the arrangement order as the current first key.

[0074] In the embodiment of the present application, after determining the arrangement order of the first keys in the first key pool, the first device selects the first key with the first arrangement order, and determines the first key with the first arrangement order as the current first key.

[0075] The first device in the embodiment of the present application can avoid the need to repeatedly generate keys for each encrypted transmission by selecting the first key that is the first in the arrangement order in the first key pool as the current first key during encrypted transmission, thereby reducing the time required for encrypted transmission and improving the efficiency of encrypted transmission.

[0076] Furthermore, the first key in the embodiment of the present application is a round key, and generating a first key pool including multiple first keys according to a shared key may include the following steps:

[0077] S1021, according to a pre-stored key expansion algorithm, expand the shared key into multiple first-round keys.

[0078] In an embodiment of the present application, when generating the first key pool, the first device first obtains a pre-stored key expansion algorithm, and uses the key expansion algorithm to expand the shared key multiple times, and then expands the shared key into a first-round key, thereby obtaining multiple first-round keys.

[0079] In one embodiment, the key expansion algorithm of the embodiment of the present application may be a key derivation function.

[0080] S1022: Generate a first key pool using multiple first-round keys.

[0081] In the embodiment of the present application, after obtaining multiple first-round keys, the first device generates a first key pool using the multiple first-round keys.

[0082] In the embodiment of the present application, the first device expands the shared key into a round key through a key expansion algorithm, which can avoid the first device expanding the key during the data encryption process, save data encryption time, and thus improve the efficiency of encrypted transmission.

[0083] Furthermore, the key management method of the embodiment of the present application, after selecting the first key in the first key pool and determining the selected first key as the current first key, may further include the following steps:

[0084] S105, deleting the current first key in the first key pool to obtain an updated first key pool.

[0085] In an embodiment of the present application, after the first device determines the current first key in the first key pool, the first device deletes the current first key in the first key pool, and then updates the first key pool to obtain an updated first key pool. The first device can update the first key pool in a timely manner by deleting the current first key in the first key pool, thereby avoiding the first device selecting a used first key in the first key pool, thereby improving the security of encrypted transmission.

[0086] S106: Query and update the number of first keys in the first key pool.

[0087] In an embodiment of the present application, after the first device deletes the current first key to obtain an updated key pool, the first device queries the number of first keys in the updated first key pool, and compares the updated number of first keys in the first key pool with a preset threshold to ensure that the updated number of first keys in the first key pool is higher than or equal to the preset threshold.

[0088] S107: When the number of first keys in the updated first key pool is lower than a preset threshold, generate at least one third key according to the shared key.

[0089] In the embodiment of the present application, when the first device determines that the number of updated first keys in the first key pool is lower than a preset threshold, the first device generates at least one third key according to the shared key.

[0090] In an example, the preset threshold may be 80% of the number of first keys in the first key pool, or may be other values.

[0091] S108: Add at least one third key to the updated first key pool, so that the number of first keys in the updated first key pool is higher than a preset threshold.

[0092] In the embodiment of the present application, after the first device generates at least one third key, the first device adds the generated third key to the updated first key pool so that the number of first keys in the updated first key pool is higher than a preset threshold.

[0093] Furthermore, the key management method of the embodiment of the present application may further include the following steps when the number of first keys in the updated first key pool is higher than a preset threshold:

[0094] S109: Detect whether the current usage duration of the first key reaches a first threshold, and / or whether the current usage count of the first key reaches a second threshold.

[0095] In an embodiment of the present application, when the first device uses the current first key for encrypted transmission, the first device detects the usage time and number of uses of the current first key to determine whether the usage time of the current first key reaches a first threshold, and / or whether the number of uses of the current first key reaches a second threshold.

[0096] S110, when the usage duration reaches a first threshold and / or the number of usages reaches a second threshold, selecting a first key from an updated first key pool, and determining the reselected first key as an updated first key.

[0097] In an embodiment of the present application, when the first device determines that the usage time of the current first key reaches a first threshold and / or the number of uses reaches a second threshold, the first device determines that the key needs to be replaced, and then the first device selects a first key from the update key pool, and the first key selected from the update key pool is determined as the updated first key.

[0098] S111, using an updated first key to replace the current first key.

[0099] In the embodiment of the present application, after the first device determines to update the first key, the first device uses the updated first key to replace the current first key to complete the update of the key.

[0100] S112: Send the tag information of the updated first key to the second device, so that the second device determines the updated second key corresponding to the updated first key in the updated second key pool, and replaces the target second key with the updated second key.

[0101] In the embodiment of the present application, after the first device completes the update of the key, the first device sends the tag of the updated first key to the second device, so that the second device determines the updated second key corresponding to the updated first key in the updated second key pool, and replaces the current second key with the updated second key, so that the second device completes the update of the key. Specifically, the updated second key pool does not include the current second key.

[0102] The first device in the embodiment of the present application can accurately determine whether the current first key needs to be updated by detecting the usage time and frequency of use of the current first key to improve the security of encrypted transmission. When the current first key needs to be updated, the first key can be updated by selecting the updated first key in the updated first key pool. This can avoid the need to repeatedly generate the key when updating the key, thereby reducing the time required for encrypted transmission and improving the efficiency of encrypted transmission.

[0103] Furthermore, the embodiment of the present application provides a key management method, which is applied to a second device, and the specific steps are as follows: Figure 2 As shown, the method includes:

[0104] S201, after establishing a connection with a first device, generating a shared key.

[0105] In an embodiment of the present application, after the second device establishes a communication connection with the first device, the second device uses the same shared key generation algorithm as the first device to generate a shared key that is the same as the shared key of the first device and is located in the second device.

[0106] S202: Generate a second key pool according to the shared key.

[0107] In the embodiment of the present application, after receiving the shared key, the second device expands the shared key into multiple second keys according to a pre-stored key expansion algorithm, and then generates a second key pool using the multiple second keys.

[0108] In one example, the key expansion algorithm pre-stored in the second device is a key derivation function, and the number of keys in the first key pool and the second key pool is the same.

[0109] S203: In response to receiving the tag information of the current first key sent by the first device, determine a current second key corresponding to the current first key in the second key pool according to the tag information.

[0110] In an embodiment of the present application, when the second device receives the tag information of the current first key sent by the first device, the second device uses the tag information to determine the current second key corresponding to the current first key, so as to use the current second key for decryption during encrypted transmission.

[0111] In the key management method provided in the embodiment of the present application, after the second device establishes a communication connection with the first device, the second device generates a second key pool including multiple second keys based on the shared key, and when performing encrypted transmission, the second device selects the current second key corresponding to the current first key in the second key pool, thereby performing encrypted transmission. In the embodiment of the present application, when the first device and the second device are transmitting encrypted data, by selecting the current key in the key pool, it is possible to avoid the need to repeatedly generate keys each time encrypted transmission is performed, thereby reducing the time required for encrypted transmission and improving the efficiency of encrypted transmission.

[0112] Furthermore, the key management method of the embodiment of the present application, in response to receiving the tag information of the current first key sent by the first device, after determining the current key corresponding to the current first key in the second key pool according to the tag information, may also include the following steps:

[0113] S204, deleting the current second key in the second key pool to obtain an updated second key pool.

[0114] In an embodiment of the present application, after the second device determines the current first key in the second key pool, the second device deletes the current second key in the second key pool, and then updates the second key pool to obtain an updated second key pool. The second device can update the second key pool in a timely manner by deleting the current second key in the second key pool, thereby improving the security of encrypted transmission.

[0115] S205: Query and update the number of second keys in the second key pool.

[0116] In an embodiment of the present application, after the second device deletes the current second key to obtain an updated key pool, the second device queries the number of second keys in the updated second key pool, and compares the updated number of second keys in the second key pool with a preset threshold to ensure that the number of second keys in the updated second key pool is higher than or equal to the preset threshold.

[0117] S206: When the number of second keys in the updated second key pool is lower than a preset threshold, generate at least one fourth key according to the shared key.

[0118] In the embodiment of the present application, when the second device determines that the number of updated second keys in the second key pool is lower than a preset threshold, the second device generates at least one fourth key according to the shared key.

[0119] S207: Add at least one fourth key to the updated second key pool, so that the number of second keys in the updated second key pool is higher than a preset threshold.

[0120] In the embodiment of the present application, after the second device generates at least one fourth key, the second device adds the generated fourth key to the updated second key pool so that the number of second keys in the updated second key pool is higher than a preset threshold.

[0121] Furthermore, the key management method of the embodiment of the present application may also include the following steps:

[0122] S208: Receive label information for updating the first key sent by the first device.

[0123] In the embodiment of the present application, after the first device determines to update the first key, the first device sends the tag information of updating the first key to the second device, and then the second device receives the tag information of updating the first key.

[0124] S209: Determine an updated second key corresponding to the updated first key in the updated second key pool according to the tag information of the updated first key.

[0125] In the embodiment of the present application, after the second device receives the tag information of the updated first key, the second device determines the updated second key corresponding to the updated first key in the updated second key pool according to the tag information of the updated first key.

[0126] S210: Use the updated second key to replace the current second key to update the key.

[0127] In the embodiment of the present application, after determining to update the second key, the second device uses the updated second key to replace the updated first key to complete the key update.

[0128] When the second device in the embodiment of the present application updates the key, by selecting to update the second key in the second key pool, it is possible to avoid the need to repeatedly generate the key when updating the key, thereby reducing the time required for encrypted transmission and improving the efficiency of encrypted transmission.

[0129] Furthermore, the embodiment of the present application provides another key management method, which specifically includes:

[0130] The first device establishes a communication connection with the second device, generates a shared key, and sends the shared key to the second device, the second device expands the shared key into multiple second-round keys according to a key expansion algorithm, and generates a second key pool using the multiple second-round keys.

[0131] The first device expands the shared key into multiple first-round keys according to the key expansion algorithm, generates a first key pool using the multiple first-round keys, further selects the first-round key with the first arrangement order in the first key pool, and determines the first-round key with the first arrangement order as the current first key.

[0132] After determining the current first key, the first device sends the tag information of the current first key to the second device. The second device selects the second-round key with the first arrangement order in the second key pool according to the tag information of the current first key, and determines the second-round key with the first arrangement order as the current second key.

[0133] After determining the current first key, the first device deletes the current first key in the first key pool to obtain an updated first key pool. After deleting the current first key to obtain the updated key pool, the first device queries the number of first keys in the updated first key pool. When it is determined that the number of first keys in the updated first key pool is lower than a preset threshold, the first device generates at least one third key based on the shared key, and the first device adds the generated third key to the updated first key pool so that the number of first keys in the updated first key pool is higher than the preset threshold.

[0134] After the second device determines the current first key in the second key pool, the second device deletes the current second key in the second key pool, and then updates the second key pool to obtain an updated second key pool, and queries the number of second keys in the updated second key pool. When it is determined that the number of second keys in the updated second key pool is lower than a preset threshold, the second device generates at least one fourth key based on the shared key, and adds the generated fourth key to the updated second key pool, so that the number of second keys in the updated second key pool is higher than the preset threshold.

[0135] The first device detects the usage time and the number of times the current first key is used. When it is determined that the usage time of the current first key reaches a first threshold and / or the number of times the key is used reaches a second threshold, the first device determines that the key needs to be replaced, and then the first device selects a first key from the update key pool, and determines the first key selected in the update key pool as the updated first key. After determining to update the first key, the first device replaces the current first key with the updated first key to complete the key update. Further, the first device sends a label of the updated first key to the second device.

[0136] After receiving the tag information of the updated first key, the second device determines the updated second key corresponding to the updated first key in the updated second key pool according to the tag information of the updated first key, and replaces the current second key with the updated second key to update the key.

[0137] Furthermore, the present application also provides a key management device, which is applied to the first device, specifically Figure 3 As shown, the device comprises:

[0138] A first generating module 301, configured to generate a shared key after establishing a communication connection with a second device;

[0139] A second generating module 302, configured to generate a first key pool including a plurality of first keys according to a shared key, wherein the first key and the second key are symmetric keys, and are used for encryption and decryption during encrypted transmission;

[0140] A selection module 303 is used to select a first key from a first key pool and determine the selected first key as a current first key when performing encrypted transmission;

[0141] The second sending module 304 is used to send the tag information of the current first key to the second device via the communication connection, and the tag information is used to instruct the second device to determine the current second key corresponding to the current first key in the second key pool. The second key pool includes multiple second keys, which are generated by the second device based on the shared key.

[0142] Furthermore, the present application also provides a key management device, which is applied to the second device, as shown in FIG. Figure 4 As shown, the device comprises:

[0143] The receiving module 401 receives a shared key sent by the first device after establishing a connection with the first device, where the shared key is used by the first device to generate a first key pool including a plurality of first keys according to the shared key;

[0144] A generating module 402 generates a second key pool including a plurality of second keys according to the shared key, wherein the first key and the second key are symmetric keys used for encryption and decryption during encrypted transmission;

[0145] The determination module 403, in response to receiving the tag information of the current first key sent by the first device, determines the current second key corresponding to the current first key in the second key pool according to the tag information.

[0146] The key management device of this embodiment is used to implement the corresponding key management methods in the aforementioned multiple method embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here. In addition, the functional implementation of each module in the key management device of this embodiment can refer to the description of the corresponding parts in the aforementioned method embodiments, which will not be repeated here.

[0147] Reference Figure 5 , shows a schematic diagram of the structure of an electronic device according to an embodiment of the present application. The specific embodiment of the present application does not limit the specific implementation of the electronic device.

[0148] like Figure 5 As shown, the electronic device may include: a processor (processor) 502, a communication interface (Communications Interface) 504, a memory (memory) 506, and a communication bus 508.

[0149] in:

[0150] The processor 502 , the communication interface 504 , and the memory 506 communicate with each other via a communication bus 508 .

[0151] The communication interface 504 is used to communicate with other electronic devices or servers.

[0152] The processor 502 is used to execute the program 510, and specifically can execute the relevant steps in the above-mentioned key management method embodiment.

[0153] Specifically, the program 610 may include program codes, which include computer operation instructions.

[0154] The processor 502 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the smart device may be processors of the same type, such as one or more CPUs; or may be processors of different types, such as one or more CPUs and one or more ASICs.

[0155] The memory 506 is used to store the program 510. The memory 506 may include a high-speed RAM memory, and may also include a non-volatile memory, such as at least one disk memory.

[0156] The program 510 may be specifically configured to enable the processor 502 to perform the following operations:

[0157] In an optional implementation, the program 510 is also used to enable the processor 502 to implement each step in the program 510. The specific implementation can refer to the corresponding descriptions in the corresponding steps and units in the above-mentioned key management method embodiment, which will not be repeated here. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the above-described devices and modules can refer to the corresponding process description in the above-mentioned method embodiment, which will not be repeated here.

[0158] An embodiment of the present application also provides a computer program product, including computer instructions, which instruct a computing device to execute operations corresponding to any key management method in the above-mentioned multiple method embodiments.

[0159] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present application.

[0160] The above-mentioned method according to the embodiment of the present application can be implemented in hardware, firmware, or implemented as software or computer code that can be stored in a recording medium (such as a CD ROM, RAM, floppy disk, hard disk or magneto-optical disk), or implemented as a computer code originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded through a network and to be stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a dedicated processor or programmable or dedicated hardware (such as an AS IC or FPGA). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, the key management method described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the key management method shown here, the execution of the code converts the general-purpose computer into a dedicated computer for executing the key management method shown here.

[0161] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.

[0162] The above implementation methods are only used to illustrate the embodiments of the present application, and are not limitations on the embodiments of the present application. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application. Therefore, all equivalent technical solutions also belong to the scope of the embodiments of the present application. The scope of patent protection of the embodiments of the present application should be limited by the claims.

Claims

1. A key management method, characterized in that: Applied to a first device, the method includes: After establishing a communication connection with the second device, generating a shared key; Generate a first key pool according to the shared key, wherein the first key pool includes multiple first keys, and the first key and the second key are symmetric keys used for encryption and decryption during encrypted transmission; When performing encrypted transmission, selecting the first key from the first key pool, and determining the selected first key as the current first key; The tag information of the current first key is sent to the second device via the communication connection, and the tag information is used to instruct the second device to determine the current second key corresponding to the current first key in the second key pool, and the second key pool includes multiple second keys, which are generated by the second device according to the shared key.

2. The method according to claim 1, characterized in that The step of selecting the first key from the first key pool during encrypted transmission, and determining the selected first key as the current first key, comprises: When performing encrypted transmission, obtaining an arrangement order of the first keys in the first key pool; The first key with the first arrangement order is selected, and the first key with the first arrangement order is determined as the current first key.

3. The method according to claim 1 or 2, characterized in that: The first key is a round key; The step of generating a first key pool including a plurality of first keys according to the shared key comprises: According to a pre-stored key expansion algorithm, the shared key is expanded into a plurality of first-round keys; The first key pool is generated using the plurality of first-round keys.

4. The method according to claim 1, characterized in that When performing encrypted transmission, after selecting the first key from the first key pool and determining the selected first key as the current first key, the method further includes: Deleting the current first key from the first key pool to obtain an updated first key pool; Querying the number of the first keys in the updated first key pool; When the number of the first keys in the updated first key pool is lower than a preset threshold, generating at least one third key according to the shared key; At least one of the third keys is added to the updated first key pool, so that the number of the first keys in the updated first key pool is higher than the preset threshold.

5. The method according to claim 4, characterized in that When the number of the first keys in the updated first key pool is higher than the preset threshold, the method further includes: Detecting whether the usage duration of the current first key reaches a first threshold, and / or whether the number of times the current first key is used reaches a second threshold; [HZTC-HXJMJJ241014][HS2411179CCN]When the usage duration reaches the first threshold and / or the number of usages reaches the second threshold, selecting the first key in the updated first key pool, and determining the reselected first key as the updated first key; replacing the current first key with the updated first key; The tag information of the updated first key is sent to the second device, so that the second device determines the updated second key corresponding to the updated first key in the updated second key pool, and replaces the target second key with the updated second key, wherein the updated second key pool does not include the current second key.

6. A key management method, characterized in that: Applied to the second device, the method includes: After establishing a connection with the first device, generating a shared key; Generate a second key pool according to the shared key, wherein the second key pool includes multiple second keys, and the first key and the second key are symmetric keys used for encryption and decryption during encrypted transmission; In response to receiving the tag information of the current first key sent by the first device, a current second key corresponding to the current first key is determined in the second key pool according to the tag information.

7. The method according to claim 6, characterized in that After, in response to receiving the tag information of the current first key sent by the first device, determining the current key corresponding to the current first key in the second key pool according to the tag information, the method further includes: Deleting the current second key from the second key pool to obtain an updated second key pool; Querying the number of the second keys in the updated second key pool; When the number of the second keys in the updated second key pool is lower than a preset threshold, generating at least one fourth key according to the shared key; At least one of the fourth keys is added to the updated second key pool, so that the number of the second keys in the updated second key pool is higher than the preset threshold.

8. The method according to claim 7, characterized in that The method further comprises: Receiving label information for updating a first key sent by the first device; Determine, in the updated second key pool according to the tag information of the updated first key, an updated second key corresponding to the updated first key; The updated second key is used to replace the current second key to update the key.

9. A key management device, characterized in that: Applied to a first device, the apparatus comprises: A first generating module, configured to generate a shared key after establishing a communication connection with a second device; A second generating module, used to generate a first key pool according to the shared key, wherein the first key pool includes multiple first keys, and the first key and the second key are symmetric keys used for encryption and decryption during encrypted transmission; [HZTC-HXJMJJ241014][HS2411179CCN] A selection module, used for selecting the first key from the first key pool when performing encrypted transmission, and determining the selected first key as the current first key; A sending module, used to send the tag information of the current first key to the second device via the communication connection, the tag information is used to instruct the second device to determine the current second key corresponding to the current first key in the second key pool, the second key pool includes multiple second keys, which are generated by the second device based on the shared key.

10. An electronic device comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the key management method according to any one of claims 1-8.

Images