Key management method, device and electronic equipment

Abstract

Embodiments of the present application provide a key management method, device and electronic equipment. The method comprises: generating a shared key after establishing a communication connection with a second device; generating a first key pool according to the shared key; selecting a first key in the first key pool when performing encrypted transmission, and determining the selected first key as a current first key; and sending label information of the current first key to the second device via the communication connection. Embodiments of the present application can avoid the need to repeatedly generate a key each time encrypted transmission is performed by selecting a current key in a key pool, thereby reducing the time required for encrypted transmission and improving the efficiency of encrypted transmission.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of computer, and particularly relate to a key management method and device and electronic equipment. BACKGROUND

[0002] In network communication, in order to protect data from being stolen and tampered, the two parties of communication usually need to encrypt the network transmission data by using a key, so as to ensure the security of data transmission.

[0003] In order to ensure the security of data transmission, the action of handshaking and generating a key needs to be repeatedly performed each time of encrypted transmission, which increases resource consumption and data transmission time, and further affects the efficiency of encrypted communication. SUMMARY

[0004] Therefore, embodiments of the present application provide a key management method and device and electronic equipment to at least partially solve the above problems.

[0005] According to a first aspect of embodiments of the present application, a key management method is provided, applied to a first device, and the method comprises:

[0006] generating a shared key after establishing a communication connection with a second device;

[0007] generating a first key pool according to the shared key, wherein the first key pool comprises a plurality of first keys, and the first keys and the second keys are symmetric keys, used for encryption and decryption during encrypted transmission;

[0008] selecting the first key in the first key pool and determining the selected first key as a current first key during encrypted transmission;

[0009] sending label information of the current first key to the second device via the communication connection, wherein the label information is used to instruct the second device to determine a current second key corresponding to the current first key in a second key pool, and the second key pool comprises a plurality of second keys, which are generated by the second device according to the shared key.

[0010] In some embodiments, selecting the first key in the first key pool and determining the selected first key as a current first key during encrypted transmission comprises:

[0011] obtaining an arrangement order of the first keys in the first key pool during encrypted transmission;

[0012] selecting the first key with the first arrangement order as the current first key.

[0013] In some embodiments, the first key is a round key;

[0014] The generating of the first key pool comprising a plurality of first keys according to the shared key comprises:

[0015] The shared key is expanded into a plurality of first round keys according to a pre-stored key expansion algorithm;

[0016] The first key pool is generated by using the plurality of first round keys.

[0017] In some embodiments, after the first key is selected from the first key pool and the selected first key is determined as a current first key, the method further comprises:

[0018] The current first key is deleted from the first key pool to obtain an updated first key pool;

[0019] The number of the first keys in the updated first key pool is queried;

[0020] When the number of the first keys in the updated first key pool is lower than a preset threshold, at least one third key is generated according to the shared key;

[0021] The at least one third key is added to the updated first key pool, so that the number of the first keys in the updated first key pool is higher than the preset threshold.

[0022] In some embodiments, when the number of the first keys in the updated first key pool is higher than the preset threshold, the method further comprises:

[0023] It is detected whether a usage duration of the current first key reaches a first threshold, and / or whether a usage frequency of the current first key reaches a second threshold;

[0024] When the usage duration reaches the first threshold and / or the usage frequency reaches the second threshold, the first key is selected from the updated first key pool, and the re-selected first key is determined as an updated first key;

[0025] The updated first key is used to replace the current first key;

[0026] Label information of the updated first key is sent to the second device, so that the second device determines an updated second key corresponding to the updated first key in an updated second key pool, and uses the updated second key to replace the target second key, wherein the current second key is not included in the updated second key pool.

[0027] According to a second aspect of the embodiments of the present application, a key management method is provided, applied to a second device, and the method comprises:

[0028] generating a shared key after establishing a connection with the first device;

[0029] generating a second key pool comprising a plurality of second keys according to the shared key, wherein the first key and the second key are symmetric keys used for encryption and decryption during encrypted transmission;

[0030] in response to receiving label information of a current first key sent by the first device, determining a current second key corresponding to the current first key in the second key pool according to the label information.

[0031] In some embodiments, after the response to receiving the label information of the current first key sent by the first device, and determining the current second key corresponding to the current first key in the second key pool according to the label information, the method further comprises:

[0032] deleting the current second key in the second key pool to obtain an updated second key pool;

[0033] querying the number of second keys in the updated second key pool;

[0034] when the number of second keys in the updated second key pool is lower than a preset threshold, generating at least one fourth key according to the shared key;

[0035] adding at least one fourth key to the updated second key pool, so that the number of second keys in the updated second key pool is higher than the preset threshold.

[0036] In some embodiments, the method further comprises:

[0037] receiving label information of an updated first key sent by the first device;

[0038] determining an updated second key corresponding to the updated first key in the updated second key pool according to the label information of the updated first key;

[0039] replacing the current second key with the updated second key to update the key.

[0040] According to a third aspect of the embodiments of the present application, a key management device is provided, applied to a first device, and the device comprises:

[0041] a first generation module configured to generate a shared key after establishing a communication connection with a second device;

[0042] a second generation module, configured to generate a first key pool according to the shared key, wherein the first key pool comprises a plurality of first keys, and the first key and the second key are symmetric keys used for encryption and decryption in encrypted transmission;

[0043] a selection module, configured to select the first key from the first key pool in encrypted transmission, and determine the selected first key as a current first key;

[0044] a sending module, configured to send label information of the current first key to the second device via the communication connection, wherein the label information is used to instruct the second device to determine a current second key corresponding to the current first key in the second key pool, and the second key pool comprises a plurality of second keys and is generated by the second device according to the shared key.

[0045] According to a fourth aspect of the embodiments of the present application, an electronic device is provided, comprising a processor, a memory, a communication interface and a communication bus, the processor, the memory and the communication interface complete communication with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction causes the processor to perform operations corresponding to the key management method according to the first aspect.

[0046] According to a fifth aspect of the embodiments of the present application, a computer storage medium is provided, and the computer storage medium stores a computer program, and the program is executed by a processor to implement the key management method according to the first aspect.

[0047] According to the key management method provided by the embodiments of the present application, after the first device establishes a communication connection with the second device, the first device generates a shared key, and generates a first key pool comprising a plurality of first keys according to the shared key, the second device generates a second key pool comprising a plurality of second keys according to the shared key, and further, in encrypted transmission, a current first key used for encryption is selected from the first key pool, and label information of the current first key is sent to the second device, so that the second device selects a current second key corresponding to the current first key in the second key pool, thereby performing encrypted transmission. In the encrypted transmission of the first device and the second device according to the embodiments of the present application, the current key is selected from the key pool, which can avoid the action of repeatedly generating the key in each encrypted transmission, reduces the time required for encrypted transmission, and improves the efficiency of encrypted transmission. BRIEF DESCRIPTION OF DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art based on these drawings.

[0049] Figure 1 A step flow chart of a key management method according to an embodiment of the present application;

[0050] Figure 2 A step flow chart of a key management method according to an embodiment of the present application;

[0051] Figure 3 A structural block diagram of a key management device according to an embodiment of the present application;

[0052] Figure 4 A structural block diagram of a key management device according to an embodiment of the present application;

[0053] Figure 5 A structural schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the personnel in the art better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the embodiments of the present application, all other embodiments obtained by those skilled in the art should belong to the scope of protection of the embodiments of the present application.

[0055] The specific implementation of the embodiments of the present application will be further described below in combination with the drawings of the embodiments of the present application.

[0056] The present application provides a key management method, applied to a first device, the specific steps are as shown in Figure 1 The method comprises:

[0057] S101, after establishing a communication connection with a second device, a shared key is generated.

[0058] In the embodiments of the present application, when encryption transmission is needed, the first device first establishes a communication connection with the second device, and the first device generates a shared key after establishing the communication connection.

[0059] In one embodiment, when the first device generates the shared key, the shared key can be generated according to the SM2 elliptic curve public key cryptography algorithm, or the shared key can be generated according to the key exchange protocol.

[0060] S102, generating a first key pool according to the shared key.

[0061] In the embodiment of the application, the first device generates a plurality of first keys according to the shared key when sending the shared key to the second device, and generates a first key pool using the plurality of first keys.

[0062] In one example, the first device can generate the first key pool according to a key derivation function when generating the second key pool according to the shared key.

[0063] In one example, the first device and the second device generate the key pool using the same algorithm, the number of keys in the first key pool is the same as the number of keys in the second key pool, the first key and the second key are symmetric keys, and are used for encryption and decryption when performing encrypted transmission.

[0064] S103, selecting a first key in the first key pool when performing encrypted transmission, and determining the selected first key as a current first key.

[0065] In the embodiment of the application, when the first device determines to perform encrypted transmission, the first device selects a first key in the key pool, and determines the selected first key as a current first key for the current encrypted transmission, so as to use the current first key for encryption.

[0066] S104, sending label information of the current first key to the second device via a communication connection.

[0067] In the embodiment of the application, after determining the current first key, the first device obtains label information of the current first key, and sends the label information of the current first key to the second device through the communication connection. After receiving the label information of the current first key, the second device determines a current second key corresponding to the current first key in the second key pool according to the label information of the current first key, and then the second device can use the current second key for decryption, thereby completing the encrypted transmission.

[0068] In one example, the label information of the embodiment of the application can be generation time information of the current first key, or can be position information of the current first key in the first key pool.

[0069] The key management method provided in the embodiments of the present application, after the first device establishes a communication connection with the second device, the first device generates a shared key, and generates a first key pool including a plurality of first keys according to the shared key, further, the first device sends the shared key to the second device, so that the second device generates a second key pool including a plurality of second keys according to the shared key, further, when performing encrypted transmission, a current first key is selected from the first key pool for encryption, and the label information of the current first key is sent to the second device, so that the second device selects a current second key corresponding to the current first key from the second key pool, thereby performing encrypted transmission. When the first device and the second device of the embodiments of the present application perform encrypted transmission, a current key is selected from the key pool, which can avoid the action of repeatedly generating a key each time encrypted transmission is performed, reduces the time required for encrypted transmission, and improves the efficiency of encrypted transmission.

[0070] Further, when performing encrypted transmission, selecting a first key from the first key pool and determining the selected first key as a current first key in the embodiments of the present application can include the following steps:

[0071] S1031, when performing encrypted transmission, obtaining the arrangement order of the first keys in the first key pool;

[0072] In the embodiments of the present application, when the first device performs encrypted transmission, the arrangement order of the first keys in the first key pool is first obtained, specifically, when the first keys are arranged, the arrangement order of the first keys in the first key pool can be determined according to the time order of generation of the first keys.

[0073] S1032, selecting the first key with the first arrangement order and determining the first key with the first arrangement order as a current first key.

[0074] In the embodiments of the present application, after the first device determines the arrangement order of the first keys in the first key pool, the first device selects the first key with the first arrangement order and determines the first key with the first arrangement order as a current first key.

[0075] The first device of the embodiments of the present application selects the first key with the first arrangement order as a current first key from the first key pool when performing encrypted transmission, which can avoid the action of repeatedly generating a key each time encrypted transmission is performed, reduces the time required for encrypted transmission, and improves the efficiency of encrypted transmission.

[0076] Further, the first key in the embodiments of the present application is a round key, and generating a first key pool including a plurality of first keys according to a shared key can include the following steps:

[0077] S1021, according to the pre-stored key expansion algorithm, the shared key is expanded into a plurality of first round keys.

[0078] In the embodiment, the first device first acquires the pre-stored key expansion algorithm when generating the first key pool, and expands the shared key multiple times by using the key expansion algorithm, and then expands the shared key into the first round keys, so as to obtain the plurality of first round keys.

[0079] In one embodiment, the key expansion algorithm of the embodiment can be a key derivation function.

[0080] S1022, the first key pool is generated by using the plurality of first round keys.

[0081] In the embodiment, the first device generates the first key pool by using the plurality of first round keys after obtaining the plurality of first round keys.

[0082] In the embodiment, the first device expands the shared key into the round keys by using the key expansion algorithm, which can avoid the expansion of the key by the first device in the process of encrypting data, save the time of data encryption, and further improve the efficiency of encrypted transmission.

[0083] Further, the key management method of the embodiment can further include the following steps after selecting the first key from the first key pool and determining the selected first key as the current first key:

[0084] S105, the current first key is deleted from the first key pool to obtain an updated first key pool.

[0085] In the embodiment, the first device deletes the current first key from the first key pool after determining the current first key in the first key pool, and then updates the first key pool to obtain an updated first key pool. The first device deletes the current first key from the first key pool, which can update the first key pool in time, avoid selecting the used first key in the first key pool, and improve the security of encrypted transmission.

[0086] S106, the number of first keys in the updated first key pool is queried.

[0087] In the embodiment, the first device queries the number of first keys in the updated first key pool after deleting the current first key to obtain the updated first key pool, and compares the number of first keys in the updated first key pool with a preset threshold to ensure that the number of first keys in the updated first key pool is higher than or equal to the preset threshold.

[0088] S107, generating at least one third key according to the shared key when the number of the first keys in the updated first key pool is below the preset threshold.

[0089] In the embodiments of the present application, when the first device determines that the number of the first keys in the updated first key pool is below the preset threshold, the first device generates at least one third key according to the shared key.

[0090] In one example, the preset threshold can be 80% of the number of the first keys in the first key pool, or can be other values.

[0091] S108, adding the at least one third key to the updated first key pool, so that the number of the first keys in the updated first key pool is higher than the preset threshold.

[0092] In the embodiments of the present application, after the first device generates the at least one third key, the first device adds the generated third key to the updated first key pool, so that the number of the first keys in the updated first key pool is higher than the preset threshold.

[0093] Further, the key management method of the embodiments of the present application can further include the following steps when the number of the first keys in the updated first key pool is higher than the preset threshold:

[0094] S109, detecting whether the use duration of the current first key reaches a first threshold, and / or whether the use times of the current first key reaches a second threshold.

[0095] In the embodiments of the present application, when the first device uses the current first key for encrypted transmission, the first device detects the use duration and the use times of the current first key, to determine whether the use duration of the current first key reaches a first threshold, and / or whether the use times of the current first key reaches a second threshold.

[0096] S110, selecting a first key in the updated first key pool and determining the selected first key as an updated first key when the use duration reaches the first threshold and / or the use times reaches the second threshold.

[0097] In the embodiments of the present application, when the first device determines that the use duration of the current first key reaches the first threshold and / or the use times reaches the second threshold, the first device determines that the key needs to be replaced, and then the first device selects a first key in the updated key pool and determines the selected first key in the updated key pool as an updated first key.

[0098] S111, replacing the current first key with the updated first key.

[0099] In the embodiment of the present application, after determining the updated first key, the first device replaces the current first key with the updated first key to complete the update of the key.

[0100] In the embodiment of the present application, after determining the updated first key, the first device replaces the current first key with the updated first key to complete the update of the key.

[0101] In the embodiment of the present application, after completing the update of the key, the first device sends the label of the updated first key to the second device, so that the second device determines the updated second key corresponding to the updated first key in the updated second key pool and replaces the current second key with the updated second key, thereby enabling the second device to complete the update of the key. Specifically, the updated second key pool does not include the current second key.

[0102] In the embodiment of the present application, the first device can accurately determine whether the current first key needs to be updated by detecting the usage time and usage frequency of the current first key, thereby improving the security of encrypted transmission, and when the current first key needs to be updated, the first device can select an updated first key in the updated first key pool, thereby avoiding the need to repeatedly generate a key when updating the key, reducing the time required for encrypted transmission, and improving the efficiency of encrypted transmission.

[0103] Further, the embodiment of the present application provides a key management method applied to a second device, and the specific steps are as shown in Figure 2 The method comprises the following steps:

[0104] S201, after establishing a connection with the first device, generating a shared key.

[0105] In the embodiment of the present application, after establishing a communication connection with the first device, the second device generates a shared key in the second device by using the same shared key generation algorithm as the first device.

[0106] S202, generating a second key pool according to the shared key.

[0107] In the embodiment of the present application, after receiving the shared key, the second device expands the shared key into a plurality of second keys according to a pre-stored key expansion algorithm, and then generates a second key pool by using the plurality of second keys.

[0108] In one example, the pre-stored key expansion algorithm in the second device is a key derivation function, and the number of keys in the first key pool and the second key pool is the same.

[0109] S203, in response to receiving the label information of the current first key sent by the first device, determining the current second key corresponding to the current first key in the second key pool according to the label information.

[0110] In the embodiments of the present application, when the second device receives the label information of the current first key sent by the first device, the second device determines the current second key corresponding to the current first key by using the label information, so as to decrypt by using the current second key during encrypted transmission.

[0111] In the key management method provided in the embodiments of the present application, after the second device establishes the communication connection with the first device, the second device generates the second key pool including a plurality of second keys according to the shared key, and selects the current second key corresponding to the current first key in the second key pool during encrypted transmission, so as to perform encrypted transmission. In the encrypted transmission of the first device and the second device, the current key is selected in the key pool, so that the action of repeatedly generating the key during each encrypted transmission can be avoided, the time required for encrypted transmission is reduced, and the efficiency of encrypted transmission is improved.

[0112] Further, the key management method of the embodiments of the present application, in response to receiving the label information of the current first key sent by the first device, determining the current key corresponding to the current first key in the second key pool according to the label information, can further include the following steps:

[0113] S204, deleting the current second key in the second key pool to obtain an updated second key pool.

[0114] In the embodiments of the present application, after the second device determines the current first key in the second key pool, the second device deletes the current second key in the second key pool, and then updates the second key pool to obtain an updated second key pool. By deleting the current second key in the second key pool, the second device can update the second key pool in time, and improve the security of encrypted transmission.

[0115] S205, querying the number of second keys in the updated second key pool.

[0116] In the embodiments of the present application, after the second device deletes the current second key to obtain the updated key pool, the second device queries the number of second keys in the updated second key pool, and compares the number of second keys in the updated second key pool with a preset threshold, so as to ensure that the number of second keys in the updated second key pool is higher than or equal to the preset threshold.

[0117] S206, when the number of second keys in the updated second key pool is lower than the preset threshold, generating at least one fourth key according to the shared key.

[0118] In the embodiment of the present application, the second device adds the generated fourth key to the updated second key pool to make the number of second keys in the updated second key pool higher than the preset threshold.

[0119] S207, adding the at least one fourth key to the updated second key pool to make the number of second keys in the updated second key pool higher than the preset threshold.

[0120] In the embodiment of the present application, after the second device generates the at least one fourth key, the second device adds the generated fourth key to the updated second key pool to make the number of second keys in the updated second key pool higher than the preset threshold.

[0121] Further, the key management method of the embodiment of the present application can further include the following steps:

[0122] S208, receiving the label information of the updated first key sent by the first device.

[0123] In the embodiment of the present application, after the first device determines the updated first key, the first device sends the label information of the updated first key to the second device, and then the second device receives the label information of the updated first key.

[0124] S209, determining the updated second key corresponding to the updated first key in the updated second key pool according to the label information of the updated first key.

[0125] In the embodiment of the present application, after the second device receives the label information of the updated first key, the second device determines the updated second key corresponding to the updated first key in the updated second key pool according to the label information of the updated first key.

[0126] S210, replacing the current second key with the updated second key to update the key.

[0127] In the embodiment of the present application, after the second device determines the updated second key, the second device replaces the updated first key with the updated second key to complete the key update.

[0128] In the embodiment of the present application, when the second device updates the key, by selecting the updated second key in the updated second key pool, the action of repeatedly generating the key when updating the key can be avoided, the time required for encrypted transmission is reduced, and the efficiency of encrypted transmission is improved.

[0129] Further, the embodiment of the present application provides another key management method, which specifically includes:

[0130] The first device establishes a communication connection with the second device, the first device generates a shared key and sends the shared key to the second device, the second device expands the shared key into a plurality of second round keys according to a key expansion algorithm, and generates a second key pool using the plurality of second round keys.

[0131] The first device expands the shared key into a plurality of first round keys according to a key expansion algorithm, and generates a first key pool using the plurality of first round keys, further selects a first round key with a first arrangement order in the first key pool, and determines the first round key with the first arrangement order as a current first key.

[0132] The first device sends label information of the current first key to the second device after determining the current first key, the second device selects a second round key with a first arrangement order in the second key pool according to the label information of the current first key, and determines the second round key with the first arrangement order as a current second key.

[0133] The first device deletes the current first key in the first key pool after determining the current first key, to obtain an updated first key pool, the first device queries a number of first keys in the updated first key pool after deleting the current first key to obtain the updated key pool, and determines that the number of first keys in the updated first key pool is lower than a preset threshold, the first device generates at least one third key according to the shared key, and adds the generated third key to the updated first key pool, so that the number of first keys in the updated first key pool is higher than the preset threshold.

[0134] The second device deletes the current second key in the second key pool after determining the current first key, to update the second key pool and obtain an updated second key pool, and queries a number of second keys in the updated second key pool, and determines that the number of second keys in the updated second key pool is lower than a preset threshold, the second device generates at least one fourth key according to the shared key, and adds the generated fourth key to the updated second key pool, so that the number of second keys in the updated second key pool is higher than the preset threshold.

[0135] The first device detects a use time and a use frequency of the current first key, and determines that the key needs to be replaced when the use time of the current first key reaches a first threshold and / or the use frequency of the current first key reaches a second threshold, the first device selects a first key in the updated key pool, and determines the selected first key in the updated key pool as an updated first key, and uses the updated first key to replace the current first key after determining the updated first key, to complete updating of the key, and further, the first device sends label information of the updated first key to the second device.

[0136] The second device determines, according to the label information of the updated first key, an updated second key corresponding to the updated first key in an updated second key pool after receiving the label information of the updated first key, and replaces a current second key with the updated second key to update the key.

[0137] Further, the application further provides a key management device, which is applied to a first device and specifically Figure 3 As shown in the figure, the device comprises:

[0138] The first generation module 301 is configured to generate a shared key after establishing a communication connection with a second device.

[0139] The second generation module 302 is configured to generate a first key pool comprising a plurality of first keys according to the shared key, wherein the first key and the second key are symmetric keys used for encryption and decryption during encrypted transmission.

[0140] The selection module 303 is configured to select a first key from the first key pool during encrypted transmission and determine the selected first key as a current first key.

[0141] The second sending module 304 is configured to send label information of the current first key to the second device via the communication connection, wherein the label information is used to instruct the second device to determine a current second key corresponding to the current first key in a second key pool, and the second key pool comprises a plurality of second keys and is generated by the second device according to the shared key.

[0142] Further, the application further provides a key management device, which is applied to a second device and specifically Figure 4 As shown in the figure, the device comprises:

[0143] The receiving module 401 is configured to receive a shared key sent by a first device after establishing a connection with the first device, wherein the shared key is used by the first device to generate a first key pool comprising a plurality of first keys according to the shared key.

[0144] The generation module 402 is configured to generate a second key pool comprising a plurality of second keys according to the shared key, wherein the first key and the second key are symmetric keys used for encryption and decryption during encrypted transmission.

[0145] The determination module 403 is configured to determine, in response to receiving label information of a current first key sent by the first device, a current second key corresponding to the current first key in a second key pool according to the label information.

[0146] The key management apparatus of the embodiment is used for implementing the corresponding key management method in the plurality of method embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here. In addition, the functions of each module in the key management apparatus of the embodiment can be implemented by referring to the description of the corresponding part in the foregoing method embodiments, which will not be repeated here either.

[0147] Referring to Figure 5 , a structural schematic diagram of an electronic device according to an embodiment of the present application is shown, and the specific implementation of the electronic device is not limited in the embodiments of the present application.

[0148] As Figure 5 shown, the electronic device can include a processor 502, a communications interface 504, a memory 506, and a communications bus 508.

[0149] Among them:

[0150] The processor 502, the communications interface 504, and the memory 506 complete the communication with each other through the communications bus 508.

[0151] The communications interface 504 is configured to communicate with other electronic devices or servers.

[0152] The processor 502 is configured to execute the program 510, and specifically can execute the related steps in the foregoing key management method embodiments.

[0153] Specifically, the program 610 can include program code, and the program code includes computer operation instructions.

[0154] The processor 502 can be a central processing unit CPU, or an application specific integrated circuit ASIC, or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the smart device can be the same type of processor, such as one or more CPUs; or can be different types of processors, such as one or more CPUs and one or more ASICs.

[0155] The memory 506 is configured to store the program 510. The memory 606 can include a high-speed RAM memory, and can also include a non-volatile memory, for example, at least one disk memory.

[0156] The program 510 can be specifically used to cause the processor 502 to perform the following operations:

[0157] In an alternative implementation, the program 510 is further configured to cause the processor 502 to perform the steps in the program 510. The specific implementation of the steps in the program 510 can refer to the corresponding description in the above-mentioned embodiments of the key management method, and will not be described herein. It can be clearly understood by those skilled in the art that, for the convenience and brevity of description, the specific working processes of the devices and modules described above can refer to the corresponding process description in the foregoing method embodiments, and will not be described herein.

[0158] The embodiments of the present application also provide a computer program product, comprising computer instructions, which instruct a computing device to perform operations corresponding to any of the key management methods in the above-mentioned method embodiments.

[0159] It should be noted that, according to the needs of implementation, each component / step described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or part of the operations of the components / steps can be combined into a new component / step, to achieve the purpose of the embodiments of the present application.

[0160] The above-mentioned method according to the embodiments of the present application can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium such as a CD ROM, a RAM, a floppy disk, a hard disk or an optical disk, or be implemented by computer code originally stored in a remote recording medium or a non-transitory machine-readable medium and downloaded to a local recording medium, so that the method described herein can be processed by such software on a recording medium using a general-purpose computer, a special-purpose processor or programmable or special-purpose hardware such as an ASIC or an FPGA. It can be understood that the computer, the processor, the microprocessor controller or the programmable hardware includes a storage component (for example, RAM, ROM, flash memory, etc.) that can store or receive software or computer code, when the software or computer code is accessed and executed by the computer, the processor or the hardware, the key management method described herein is implemented. In addition, when the general-purpose computer accesses the code for implementing the key management method shown herein, the execution of the code will convert the general-purpose computer into a special-purpose computer for executing the key management method shown herein.

[0161] Those of ordinary skill in the art can realize that the units and method steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether the functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of the present application.

[0162] The above embodiments are only used for describing the present application, and are not intended to limit the present application. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the present application. Therefore, all equivalent technical solutions belong to the scope of the present application, and the patent protection scope of the present application should be defined by the claims.

Claims

1. A key management method characterized by comprising: The method applied to a first device comprises: generating a shared key after establishing a communication connection with a second device; generating a first key pool according to the shared key, wherein the first key pool comprises a plurality of first keys, the first keys and second keys are symmetric keys, used for encryption and decryption during encrypted transmission; wherein the first key is a round key; the generating of the first key pool comprising a plurality of first keys according to the shared key comprises: expanding the shared key into a plurality of first round keys according to a pre-stored key expansion algorithm; and generating the first key pool by using the plurality of first round keys; selecting the first key in the first key pool during encrypted transmission, and determining the selected first key as a current first key; sending label information of the current first key to the second device via the communication connection, and sending the shared key to the second device, wherein the label information is used to instruct the second device to determine a current second key corresponding to the current first key in a second key pool, and the second key pool comprises a plurality of second keys, which are expanded from the shared key into a plurality of second keys according to a pre-stored key expansion algorithm by the second device after receiving the shared key, and then generated by using the plurality of second keys.

2. The method of claim 1, wherein, The selecting of the first key in the first key pool during encrypted transmission, and the determining of the selected first key as a current first key, comprises: obtaining an arrangement order of the first keys in the first key pool during encrypted transmission; selecting the first key with the first arrangement order as the current first key.

3. The method of claim 1, wherein, After the selecting of the first key in the first key pool during encrypted transmission, and the determining of the selected first key as a current first key, the method further comprises: deleting the current first key in the first key pool to obtain an updated first key pool; inquiring the number of the first keys in the updated first key pool; generating at least one third key according to the shared key when the number of the first keys in the updated first key pool is lower than a preset threshold; adding the at least one third key to the updated first key pool, so that the number of the first keys in the updated first key pool is higher than the preset threshold.

4. The method of claim 3, wherein, When the number of the first keys in the updated first key pool is higher than the preset threshold, the method further comprises: detecting whether a use duration of the current first key reaches a first threshold, and / or whether a use frequency of the current first key reaches a second threshold; selecting the first key in the updated first key pool and determining the reselected first key as an updated first key when the use duration reaches the first threshold and / or the use frequency reaches the second threshold; replacing the current first key with the updated first key. The label information of the updated first key is sent to the second device, so that the second device determines an updated second key corresponding to the updated first key in an updated second key pool, and replaces the current second key with the updated second key, wherein the current second key is not included in the updated second key pool.

5. A key management method characterized by comprising: The method applied to the second device comprises: After establishing a connection with the first device, receiving the shared key sent by the first device; According to the shared key, a second key pool is generated, wherein the second key pool includes a plurality of second keys, the first key and the second key are symmetric keys, and are used for encryption and decryption during encrypted transmission; the second key pool is generated by the second device according to a pre-stored key expansion algorithm after receiving the shared key, expanding the shared key into a plurality of second keys, and then generating the second key pool by using a plurality of second keys; In response to receiving the label information of the current first key sent by the first device, a current second key corresponding to the current first key is determined in the second key pool according to the label information.

6. The method of claim 5, wherein, After the response to receiving the label information of the current first key sent by the first device, the current second key corresponding to the current first key is determined in the second key pool according to the label information, the method further comprises: Deleting the current second key in the second key pool to obtain an updated second key pool; Querying the number of second keys in the updated second key pool; When the number of second keys in the updated second key pool is lower than a preset threshold, at least one fourth key is generated according to the shared key; At least one fourth key is added to the updated second key pool, so that the number of second keys in the updated second key pool is higher than the preset threshold.

7. The method of claim 6, wherein, The method further comprises: Receiving the label information of the updated first key sent by the first device; According to the label information of the updated first key, an updated second key corresponding to the updated first key is determined in the updated second key pool; The current second key is replaced with the updated second key to update the key.

8. A key management apparatus characterized by comprising: The device applied to the first device comprises: A first generation module is configured to generate a shared key after establishing a communication connection with a second device; A second generation module is configured to generate a first key pool according to the shared key, wherein the first key pool includes a plurality of first keys, the first key and the second key are symmetric keys, and are used for encryption and decryption during encrypted transmission; wherein the first key is a round key; correspondingly, the second generation module is further configured to expand the shared key into a plurality of first round keys according to a pre-stored key expansion algorithm; and the first key pool is generated by using the plurality of first round keys; A selection module is configured to select the first key in the first key pool during encrypted transmission, and determine the selected first key as a current first key; The sending module is configured to send label information of the current first key to the second device via the communication connection, and send the shared key to the second device, the label information being used to instruct the second device to determine a current second key corresponding to the current first key in a second key pool, the second key pool including a plurality of second keys, and the second device being configured to, after receiving the shared key, expand the shared key into the plurality of second keys according to a pre-stored key expansion algorithm, and then generate the plurality of second keys.

9. An electronic device comprising: The processor, the memory, the communication interface and the communication bus are in communication with each other through the communication bus; The memory is configured to store at least one executable instruction, and the executable instruction is configured to enable the processor to perform operations corresponding to the key management method in any one of claims 1-7.

Images