Key sharing method, device, equipment, medium and program product

Abstract

The invention relates to a key sharing method and device, equipment, a medium and a program product. The method comprises the following steps: acquiring a key sharing request sent by a data provider; the key sharing request comprises a key identifier of an encryption key and a data demander of a data plaintext to be transmitted; sending shared data to the data demander in response to the key sharing request; wherein the shared data comprises a key identifier of a decryption key corresponding to the encryption key; acquiring a data decryption request sent by a data demander; the data decryption request comprises a key identifier of a decryption key; in response to the data decryption request, decrypting the to-be-transmitted data ciphertext according to the decryption key to obtain a to-be-transmitted data plaintext, and feeding back the to-be-transmitted data plaintext to the data demander; the to-be-transmitted data ciphertext is obtained by encrypting the to-be-transmitted data plaintext based on the encryption key. Through the above steps, the two parties do not need to hold corresponding key original texts, the risk of key original text leakage or interception is reduced, and the data security is improved.

Description

Technical Field

[0001] The present application relates to the field of data security, and in particular to a key sharing method, apparatus, device, medium and program product. Background Art

[0002] With the development of data security technology, key encryption technology is playing an increasingly important role in ensuring data security. In short, key encryption technology is to encrypt data with a specific key to ensure the integrity and security of information.

[0003] In traditional technology, the data provider encrypts the plaintext based on the encryption key to obtain the encrypted ciphertext, and sends the ciphertext to the data demander. The data demander decrypts the ciphertext based on the decryption key it holds to obtain the decrypted plaintext.

[0004] However, in the above method, both the data provider and the data demander need to hold the corresponding key, which poses a risk of key leakage or interception, and the data security is low. Summary of the invention

[0005] Based on this, it is necessary to provide a key sharing method, device, equipment, medium and program product that can improve data security in response to the above technical problems.

[0006] In a first aspect, the present application provides a key sharing method, comprising:

[0007] Obtaining a key sharing request sent by a data provider; wherein the key sharing request includes a key identifier of an encryption key and a data demander of plain text data to be transmitted;

[0008] In response to the key sharing request, the shared data is sent to the data requester; wherein the shared data includes a key identifier of the encryption key corresponding to the decryption key;

[0009] Obtaining a data decryption request sent by a data demander; wherein the data decryption request includes a key identifier of a decryption key;

[0010] In response to a data decryption request, the ciphertext of the data to be transmitted is decrypted according to the decryption key to obtain the plaintext of the data to be transmitted, and the plaintext of the data to be transmitted is fed back to the data demander; wherein the ciphertext of the data to be transmitted is obtained by encrypting the plaintext of the data to be transmitted based on the encryption key.

[0011] In one of the embodiments, the shared data also includes a calling credential used by the data demander to call a decryption key; the data decryption request also includes the calling credential; the ciphertext of the data to be transmitted is decrypted according to the decryption key to obtain the plaintext of the data to be transmitted, including: verifying the authority of the data demander according to the calling credential; if the verification is passed, decrypting the ciphertext of the data to be transmitted according to the decryption key to obtain the plaintext of the data to be transmitted.

[0012] In one of the embodiments, the key sharing method further includes: in response to a data decryption request, obtaining current access data of the data requester; identifying whether the data requester has abnormal access behavior based on the current access data; and performing exception handling if the data requester has abnormal access behavior.

[0013] In one of the embodiments, performing exception handling includes at least one of the following methods: interrupting the response to the data decryption request; updating the encryption key and decryption key corresponding to the plaintext data to be transmitted; replacing or canceling the call credentials of the data demander stored locally; limiting the key sharing authority of the data provider; and outputting an exception alarm.

[0014] In one of the embodiments, based on current access data, identifying whether the data demander has abnormal access behavior includes: extracting access feature data from the current access data; inputting the access feature data into an abnormal behavior identification model to obtain a behavior anomaly value; the behavior anomaly value is used to characterize the degree of difference between the access behavior of the data demander and the normal behavior; when the behavior anomaly value is greater than a first abnormal threshold, determining that the data demander has abnormal access behavior.

[0015] In one of the embodiments, before obtaining the key sharing request sent by the data provider, the key sharing method also includes: obtaining a data encryption request sent by the data provider; wherein the data encryption request includes plaintext data to be transmitted; in response to the data encryption request, encrypting the plaintext data to be transmitted according to the encryption key to obtain ciphertext data to be transmitted; and sending the ciphertext data to be transmitted and the key identifier of the encryption key to the data provider.

[0016] In a second aspect, the present application also provides a key sharing device, including:

[0017] A first acquisition module is used to acquire a key sharing request sent by a data provider; wherein the key sharing request includes a key identifier of an encryption key and a data demander of plaintext data to be transmitted;

[0018] A first processing module, configured to send shared data to a data demander in response to a key sharing request; wherein the shared data includes a key identifier of a decryption key corresponding to an encryption key;

[0019] A second acquisition module is used to acquire a data decryption request sent by a data demander; wherein the data decryption request includes a key identifier of a decryption key;

[0020] The second processing module is used to respond to the data decryption request, decrypt the ciphertext of the data to be transmitted according to the decryption key, obtain the plaintext of the data to be transmitted, and feed back the plaintext of the data to be transmitted to the data demander; wherein the ciphertext of the data to be transmitted is obtained by encrypting the plaintext of the data to be transmitted based on the encryption key.

[0021] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0022] Obtaining a key sharing request sent by a data provider; wherein the key sharing request includes a key identifier of an encryption key and a data demander of plain text data to be transmitted;

[0023] In response to the key sharing request, the shared data is sent to the data requester; wherein the shared data includes a key identifier of the encryption key corresponding to the decryption key;

[0024] Obtaining a data decryption request sent by a data demander; wherein the data decryption request includes a key identifier of a decryption key;

[0025] In response to the data decryption request, the ciphertext of the data to be transmitted is decrypted according to the decryption key to obtain the plaintext of the data to be transmitted, and the plaintext of the data to be transmitted is fed back to the data demander;

[0026] The ciphertext of the data to be transmitted is obtained by encrypting the plaintext of the data to be transmitted based on the encryption key.

[0027] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0028] Obtaining a key sharing request sent by a data provider; wherein the key sharing request includes a key identifier of an encryption key and a data demander of plain text data to be transmitted;

[0029] In response to the key sharing request, the shared data is sent to the data requester; wherein the shared data includes a key identifier of the encryption key corresponding to the decryption key;

[0030] Obtaining a data decryption request sent by a data demander; wherein the data decryption request includes a key identifier of a decryption key;

[0031] In response to the data decryption request, the ciphertext of the data to be transmitted is decrypted according to the decryption key to obtain the plaintext of the data to be transmitted, and the plaintext of the data to be transmitted is fed back to the data demander;

[0032] The ciphertext of the data to be transmitted is obtained by encrypting the plaintext of the data to be transmitted based on the encryption key.

[0033] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0034] Obtaining a key sharing request sent by a data provider; wherein the key sharing request includes a key identifier of an encryption key and a data demander of plain text data to be transmitted;

[0035] In response to the key sharing request, the shared data is sent to the data requester; wherein the shared data includes a key identifier of the encryption key corresponding to the decryption key;

[0036] Obtaining a data decryption request sent by a data demander; wherein the data decryption request includes a key identifier of a decryption key;

[0037] In response to the data decryption request, the ciphertext of the data to be transmitted is decrypted according to the decryption key to obtain the plaintext of the data to be transmitted, and the plaintext of the data to be transmitted is fed back to the data demander;

[0038] The ciphertext of the data to be transmitted is obtained by encrypting the plaintext of the data to be transmitted based on the encryption key.

[0039] In the above-mentioned key sharing method, device, equipment, medium and program product, first, the data provider initiates a key sharing request to the key service provider, and the key sharing request contains the key identifier of the encryption key and the data demander of the plaintext data to be transmitted. The key service provider responds to the key sharing request and sends the key identifier of the decryption key corresponding to the encryption key to the data demander, thereby realizing the directional sharing of the key identifier. Secondly, the data demander initiates a data decryption request containing the key identifier of the decryption key to the key service provider, and the key service provider responds to the data decryption request, decrypts the ciphertext of the data to be transmitted according to the decryption key, and sends the decrypted plaintext of the data to be transmitted to the data demander, thereby realizing the decryption of the ciphertext of the data to be transmitted based on the key identifier. In the above steps, the key service provider builds a bridge between the data provider and the data demander to ensure data security. For the data provider, it is only necessary to obtain the key identifier of the encryption key for key sharing; for the data demander, it is only necessary to obtain the key identifier of the decryption key corresponding to the encryption key to decrypt the ciphertext of the data to be transmitted. There is no need for both parties to hold the corresponding key original text, which reduces the risk of key leakage or interception and improves data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 An application environment diagram of a key sharing method in an embodiment;

[0042] Figure 2 A schematic diagram of a key sharing method in one embodiment;

[0043] Figure 3 A schematic diagram of a flow chart of an exception handling step in an embodiment;

[0044] Figure 4 A schematic diagram of a key sharing method according to another embodiment;

[0045] Figure 5 is a structural block diagram of a key sharing device in an embodiment;

[0046] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0048] The key sharing method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the key service party 130 communicates with the data provider 110 and the data demander 120 respectively through the network. The data storage system can store the data that the key service party 130 needs to process. The data storage system can be integrated on the key service party 130, or it can be placed on the cloud, other network servers or terminals. The data provider 110 can be understood as the terminal corresponding to the provider of data or the system including the terminal and the server. The data demander 120 can be understood as the terminal corresponding to the demander of the data or the system including the terminal and the server. The key service party 130 can be understood as the server corresponding to the service provider providing key-related services or the system including the terminal and the server. The above-mentioned server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The above-mentioned terminals can be, but are not limited to, various personal computers, Internet of Things devices, laptops, tablet computers, etc.

[0049] In an exemplary embodiment, Figure 2 As shown, a key sharing method is provided, which is applied to a key service provider 130, and the method includes the following steps:

[0050] S210, obtaining a key sharing request sent by the data provider 110; wherein the key sharing request includes a key identifier of an encryption key and a data demander 120 of plain text data to be transmitted.

[0051] The encryption key is used to encrypt the plaintext data to be transmitted into the ciphertext data to be transmitted. The key identifier can be understood as an identifier used to distinguish different encryption keys and their usage or function. Exemplarily, the key identifier of the encryption key can be at least one of the key number, key name, key label and key identifier of the encryption key. The plaintext data to be transmitted can be understood as the original data to be transmitted that has not been encrypted.

[0052] In an optional embodiment, before obtaining the key sharing request sent by the data provider 110, it also includes: obtaining a data encryption request sent by the data provider 110; wherein the data encryption request includes the plaintext data to be transmitted; in response to the data encryption request, encrypting the plaintext data to be transmitted according to the encryption key to obtain the ciphertext data to be transmitted; and sending the ciphertext data to be transmitted and the key identifier of the encryption key to the data provider 110. Among them, the ciphertext data to be transmitted can be understood as the ciphertext after the plaintext data to be transmitted is encrypted. In the above steps, the data provider 110 encrypts the plaintext data to be transmitted through the key service provider, and there is no need to hold the original encryption key separately, which is conducive to improving the security of the data.

[0053] S220. In response to the key sharing request, send shared data to the data requester 120; wherein the shared data includes a key identifier of the encryption key corresponding to the decryption key.

[0054] The decryption key is used to decrypt the ciphertext of the data to be transmitted into the plaintext of the data to be transmitted. Exemplarily, the key identifier of the decryption key can be at least one of the key number, key name, key label and key identifier of the decryption key.

[0055] In an optional embodiment, the types of the encryption key and the decryption key may be symmetric keys. A symmetric key means that the same key is used in the encryption and decryption processes, that is, the encryption key and the decryption key are the same, and the key identifiers of the encryption key and the decryption key are the same. In another optional embodiment, the types of the encryption key and the decryption key may be asymmetric keys. An asymmetric key means that different keys are used in the encryption and decryption processes, that is, the encryption key and the decryption key are different, and the key identifiers of the encryption key and the decryption key are different.

[0056] In an optional embodiment, the key sharing request also includes the access credentials of the data provider 110. In response to the key sharing request, sending the shared data to the data demander 120 may include: in response to the key sharing request, sending the shared data to the data demander 120 when verifying that the access credentials of the data provider 110 have the access rights of the key service provider 130. Optionally, the key service provider 130 may store authentication information or identity verification data for verifying the access rights or call rights of the data provider 110 or the data demander 120. In the above steps, by introducing the access credentials, the access rights of the data provider 110 are verified, thereby improving the data security of the key sharing.

[0057] S230. Obtain a data decryption request sent by the data demander 120; wherein the data decryption request includes a key identifier of a decryption key.

[0058] S240. In response to the data decryption request, the ciphertext of the data to be transmitted is decrypted according to the decryption key to obtain the plaintext of the data to be transmitted, and the plaintext of the data to be transmitted is fed back to the data demander 120; wherein the ciphertext of the data to be transmitted is obtained by encrypting the plaintext of the data to be transmitted based on the encryption key.

[0059] In an optional embodiment, the data decryption request also includes ciphertext of the data to be transmitted.

[0060] In an optional embodiment, the shared data also includes a calling credential for the data demander 120 to call the decryption key, and the data decryption request also includes the calling credential. The ciphertext of the data to be transmitted is decrypted according to the decryption key to obtain the plaintext of the data to be transmitted, including: verifying the authority of the data demander 120 according to the calling credential; if the verification is passed, decrypting the ciphertext of the data to be transmitted according to the decryption key to obtain the plaintext of the data to be transmitted. By introducing the calling credential, it is convenient to verify the authority of the data demander 120, and avoid the unauthorized demander calling the decryption key to decrypt the ciphertext of the data to be transmitted.

[0061] Optionally, if the verification fails, an alarm message is generated, and if the call credentials are leaked, the call credentials are cancelled and / or the key sharing authority of the data provider 110 is cancelled. Exemplarily, after the alarm message is generated, the call credentials can be confirmed to be leaked by sending verification information to the data demander 120 and responding to the call credentials confirmation leak result fed back by the data demander 120.

[0062] In the key sharing method provided in the embodiment of the present application, first, the data provider 110 initiates a key sharing request to the key service provider 130, and the key sharing request contains the key identifier of the encryption key and the data demander 120 of the plain text data to be transmitted. The key service provider 130 responds to the key sharing request and sends the key identifier of the decryption key corresponding to the encryption key to the data demander 120, thereby realizing the directional sharing of the key identifier. Secondly, the data demander 120 initiates a data decryption request containing the key identifier of the decryption key to the key service provider 130. The key service provider 130 responds to the data decryption request, decrypts the ciphertext of the data to be transmitted according to the decryption key, and sends the decrypted plain text of the data to be transmitted to the data demander 120, thereby realizing the decryption of the ciphertext of the data to be transmitted based on the key identifier. In the above steps, the key service provider 130 builds a bridge between the data provider 110 and the data demander 120 to ensure data security. For the data provider 110, it only needs to obtain the key identifier of the encryption key for key sharing; for the data demander 120, it only needs to obtain the key identifier of the decryption key corresponding to the encryption key to decrypt the ciphertext of the data to be transmitted. There is no need for both parties to hold the corresponding original key text, which reduces the risk of key original text leakage or interception and improves data security.

[0063] Based on the technical solutions of the above embodiments, the present application also provides an optional embodiment, in which an exception handling step is added.

[0064] See also Figure 3 The exception handling steps shown include:

[0065] S310 . In response to a data decryption request, obtain current access data of the data requester 120 .

[0066] The current access data of the data demander 120 can be understood as the data record or information generated when the data demander 120 interacts with the key service provider 130 at the current time point or in the current time period. Exemplarily, the current access data includes at least one of the access time, access IP (Internet Protocol) and operation type of the data demander 120.

[0067] S320. Identify whether the data demander 120 has abnormal access behavior based on the current access data.

[0068] In an optional embodiment, identifying whether the data demander 120 has abnormal access behavior may include the following steps: extracting access feature data from current access data; inputting the access feature data into an abnormal behavior identification model to obtain a behavior abnormality value; the behavior abnormality value is used to characterize the degree of difference between the access behavior of the data demander 120 and the normal behavior; when the behavior abnormality value is greater than a first abnormal threshold, determining that the data demander 120 has abnormal access behavior. Through the above steps, it is possible to quickly and effectively determine whether the data demander 120 has abnormal access behavior, so that the corresponding abnormal processing can be performed in the first time to ensure the security of the data.

[0069] Optionally, the feature data may be an access feature vector, and the access features are used as dimensions of the feature vector. The access features may include at least one of access frequency, access time distribution, operation type distribution, operation time distribution, and the like.

[0070] Optionally, before extracting the access feature data from the current access data, the current access data is cleaned to remove duplicate, invalid or erroneous access data.

[0071] In an optional embodiment, the abnormal behavior recognition model can be obtained by the following steps: obtaining sample access data; extracting sample access feature vectors from the sample access data; clustering the sample access feature data based on a clustering algorithm with preset clustering parameters to obtain a cluster with a large number and a relatively concentrated distribution in the clustering result; calculating the mean of the sample access feature data in the cluster, and using it as the center point of the abnormal behavior recognition model. When in use, the access feature data (such as the access feature vector) in the current access data is input into the abnormal behavior recognition model, and the abnormal behavior recognition model calculates the distance between the access feature vector and the center point of the abnormal behavior recognition model to obtain the behavior abnormality value. The larger the behavior abnormality value, the greater the degree of difference from the normal behavior. When the behavior abnormality value is greater than the first abnormal threshold, it indicates that the data demander 120 has abnormal access behavior.

[0072] S330. When the data demander 120 has abnormal access behavior, perform exception handling.

[0073] In an optional embodiment, performing exception handling may include at least one of the following methods: interrupting the response to the data decryption request; updating the encryption key and decryption key corresponding to the plaintext data to be transmitted; replacing or canceling the call credentials of the data demander 120 stored locally; limiting the key sharing authority of the data provider 110; outputting an exception alarm. Among them, the exception alarm can be sent to the data provider 110, and / or the data provider 110; the exception alarm can also be displayed on the key service provider 130 interface, and / or stored in the storage module of the key service provider, and / or sent to the technicians of the key service provider 130.

[0074] In an optional embodiment, when the data demander 120 has abnormal access behavior, performing exception processing may include: when the behavior abnormality value is greater than or equal to the second abnormality threshold, determining that the data demander 120 has severe abnormal access behavior; wherein the second abnormality threshold is greater than the first abnormality threshold; when the behavior abnormality value is greater than the first abnormality threshold and less than the second abnormality threshold, determining that the data demander 120 has ordinary abnormal access behavior; performing exception processing according to the abnormal behavior type of the abnormal access behavior of the data demander 120; wherein the abnormal behavior type is severe abnormal access behavior or ordinary abnormal access behavior.

[0075] Among them, the first abnormal threshold and the second abnormal threshold can be set by technicians according to needs or experience, or determined through a large number of experiments, and this application does not impose any limitations on this.

[0076] Exemplarily, when the data demander 120 has a serious abnormal access behavior, an alarm message is output and the response to the data decryption request is interrupted to prevent the data demander 120 with the serious abnormal access behavior from obtaining the plaintext of the data to be transmitted.

[0077] Exemplarily, in the case where the data demander 120 has normal abnormal access behavior, an alarm message is output, and when it is confirmed again that the data demander 120 has abnormal access behavior, the encryption key and decryption key corresponding to the plaintext of the data to be transmitted are updated and / or the call credentials of the data demander stored locally are replaced or cancelled. Among them, the staff can reconfirm whether the data demander 120 has abnormal access behavior, or the key service provider 130 can reconfirm whether the data demander 120 has abnormal access behavior. Optionally, when the staff reconfirms that the data demander 120 does not have abnormal access behavior, the access data of the data demander 120 in the alarm message is used as sample access data to adjust the abnormal behavior recognition model.

[0078] Exemplarily, the encryption key and the decryption key corresponding to the plaintext data to be transmitted are updated. The update logic of the encryption key and the decryption key can be manually triggered or automatically triggered, and the data provider 110 and the data demander 120 are unaware of the key update.

[0079] In an optional embodiment, in response to a timeout in executing exception handling, the encryption key and decryption key corresponding to the plaintext data to be transmitted are automatically or manually replaced, and / or the calling credentials of the data demander stored locally are replaced or cancelled.

[0080] The exception handling step provided in the embodiment of the present application identifies whether there is abnormal access behavior by the current access data of the data demander 120, and performs exception handling when there is abnormal access behavior by the data demander 120. This prevents the data demander 120 with abnormal access behavior from decrypting the ciphertext to be transmitted, thereby improving the security of the data.

[0081] In an optional embodiment, the key sharing method further includes: in response to the data encryption request, obtaining the current access data of the data provider 110; identifying whether the data provider 110 has abnormal access behavior according to the current access data of the data provider 110; and performing abnormal processing when the data provider 110 has abnormal access behavior. The data provider 110 with abnormal access behavior is prevented from encrypting the plaintext to be transmitted and obtaining the key identifier corresponding to the encryption key, thereby improving the security of the key.

[0082] Exemplarily, in the event that the data provider 110 has abnormal access behavior, performing exception handling may include at least one of the following methods: interrupting the response to the data encryption request; updating the encryption key and decryption key corresponding to the plaintext data to be transmitted; restricting the key sharing authority of the data provider 110; and outputting an exception alarm.

[0083] Based on the technical solutions of the above embodiments, the present application also provides an optional embodiment, in which another specific implementation of the key sharing method is provided.

[0084] See also Figure 4 The key sharing method shown includes:

[0085] S410: The data provider 110 sends a data encryption request to the key service provider 130, where the data encryption request includes the plaintext data to be transmitted.

[0086] S420. The key service provider 130 responds to the data encryption request and encrypts the plaintext data to be transmitted according to the encryption key to obtain the ciphertext data to be transmitted.

[0087] S430 . Send the ciphertext of the data to be transmitted and the key identifier of the encryption key to the data provider 110 .

[0088] S440, the data provider 110 sends a key sharing request to the key service provider 130; wherein the key sharing request includes the key identifier of the encryption key and the data demander 120 of the plaintext data to be transmitted.

[0089] S450. The key service provider 130 sends shared data to the data requester 120 in response to the key sharing request; wherein the shared data includes a key identifier of the encryption key corresponding to the decryption key.

[0090] S460. The data demander 120 sends a data decryption request to the key service provider 130. The data decryption request includes a key identifier of the decryption key.

[0091] S470. The key service provider 130 obtains the current access data of the data requester in response to the data decryption request; identifies whether the data requester has abnormal access behavior based on the current access data; and performs exception handling if the data requester has abnormal access behavior.

[0092] S480. The key service provider 130 responds to the data decryption request and decrypts the ciphertext of the data to be transmitted according to the decryption key to obtain the plaintext of the data to be transmitted.

[0093] S490 , feeding back the plain text of the data to be transmitted to the data demander 120 .

[0094] The detailed technical contents of the above steps S410 - S490 have been recorded in the above embodiments and will not be repeated here.

[0095] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0096] Based on the same inventive concept, the embodiment of the present application also provides a key sharing device for implementing the key sharing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more key sharing device embodiments provided below can refer to the limitations on the key sharing method above, and will not be repeated here.

[0097] In an exemplary embodiment, Figure 5 As shown, a key sharing device is provided, including: a first acquisition module 510, a first processing module 520, a second acquisition module 530 and a second processing module 540, wherein:

[0098] The first acquisition module 510 is used to acquire a key sharing request sent by a data provider; wherein the key sharing request includes a key identifier of an encryption key and a data demander of plaintext data to be transmitted;

[0099] The first processing module 520 is used to send shared data to the data requester in response to the key sharing request; wherein the shared data includes a key identifier of the encryption key corresponding to the decryption key;

[0100] The second acquisition module 530 is used to acquire a data decryption request sent by a data demander; wherein the data decryption request includes a key identifier of a decryption key;

[0101] The second processing module 540 is used to respond to the data decryption request, decrypt the ciphertext of the data to be transmitted according to the decryption key, obtain the plaintext of the data to be transmitted, and feed back the plaintext of the data to be transmitted to the data demander; wherein the ciphertext of the data to be transmitted is obtained by encrypting the plaintext of the data to be transmitted based on the encryption key.

[0102] In one embodiment, the shared data also includes a calling credential used by the data requester to call the decryption key; the data decryption request also includes the calling credential; the second processing module 540 includes: a verification unit, used to verify the authority of the data requester based on the calling credential; a decryption unit, used to decrypt the ciphertext of the data to be transmitted according to the decryption key to obtain the plaintext of the data to be transmitted when the verification is passed.

[0103] In one embodiment, the key sharing device also includes: a third acquisition module, used to obtain the current access data of the data requester in response to a data decryption request; an identification module, used to identify whether the data requester has abnormal access behavior based on the current access data; and a third processing module, used to perform exception processing when the data requester has abnormal access behavior.

[0104] In one embodiment, the third processing module performs exception processing including at least one of the following methods: interrupting the response to the data decryption request; updating the encryption key and decryption key corresponding to the plaintext data to be transmitted; replacing or canceling the call credentials of the data demander stored locally; limiting the key sharing authority of the data provider; and outputting an exception alarm.

[0105] In one embodiment, the identification module includes: an extraction unit, used to extract access feature data from current access data; a calculation unit, used to input the access feature data into an abnormal behavior identification model to obtain a behavior anomaly value; the behavior anomaly value is used to characterize the degree of difference between the access behavior of the data demander and the normal behavior; a determination unit, used to determine that the data demander has abnormal access behavior when the behavior anomaly value is greater than a first abnormal threshold.

[0106] In one embodiment, the key sharing device also includes: a fourth acquisition module, used to obtain a data encryption request sent by a data provider; wherein the data encryption request includes plaintext data to be transmitted; an encryption module, used to respond to the data encryption request, encrypt the plaintext data to be transmitted according to an encryption key, and obtain ciphertext data to be transmitted; and a sending module, used to send the ciphertext data to be transmitted and the key identifier of the encryption key to the data provider.

[0107] Each module in the above-mentioned key sharing device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0108] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store key identification data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a key sharing method is implemented.

[0109] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0110] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0111] Obtaining a key sharing request sent by a data provider; wherein the key sharing request includes a key identifier of an encryption key and a data demander of plain text data to be transmitted;

[0112] In response to the key sharing request, the shared data is sent to the data requester; wherein the shared data includes a key identifier of the encryption key corresponding to the decryption key;

[0113] Obtaining a data decryption request sent by a data demander; wherein the data decryption request includes a key identifier of a decryption key;

[0114] In response to a data decryption request, the ciphertext of the data to be transmitted is decrypted according to the decryption key to obtain the plaintext of the data to be transmitted, and the plaintext of the data to be transmitted is fed back to the data demander; wherein the ciphertext of the data to be transmitted is obtained by encrypting the plaintext of the data to be transmitted based on the encryption key.

[0115] In one embodiment, when the processor executes the computer program, the following steps are also implemented: the authority of the data requester is verified based on the calling credentials; if the verification is passed, the ciphertext of the data to be transmitted is decrypted based on the decryption key to obtain the plaintext of the data to be transmitted; the shared data also includes the calling credentials used by the data requester to call the decryption key; and the data decryption request also includes the calling credentials.

[0116] In one embodiment, when the processor executes the computer program, the following steps are also implemented: in response to a data decryption request, the current access data of the data requester is obtained; based on the current access data, whether the data requester has abnormal access behavior; if the data requester has abnormal access behavior, exception handling is performed.

[0117] In one embodiment, the processor also implements the following steps when executing the computer program: executing exception handling includes at least one of the following methods: interrupting the response to the data decryption request; updating the encryption key and decryption key corresponding to the plaintext data to be transmitted; replacing or canceling the call credentials of the data demander stored locally; limiting the key sharing authority of the data provider; outputting an exception alarm.

[0118] In one embodiment, when the processor executes the computer program, the following steps are also implemented: extracting access feature data from current access data; inputting the access feature data into an abnormal behavior recognition model to obtain a behavior anomaly value; the behavior anomaly value is used to characterize the degree of difference between the access behavior of the data demander and the normal behavior; when the behavior anomaly value is greater than a first abnormal threshold, it is determined that the data demander has abnormal access behavior.

[0119] In one embodiment, when the processor executes the computer program, the following steps are also implemented: before obtaining the key sharing request sent by the data provider, obtaining the data encryption request sent by the data provider; wherein the data encryption request includes the plaintext data to be transmitted; in response to the data encryption request, encrypting the plaintext data to be transmitted according to the encryption key to obtain the ciphertext data to be transmitted; and sending the ciphertext data to be transmitted and the key identifier of the encryption key to the data provider.

[0120] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0121] Obtaining a key sharing request sent by a data provider; wherein the key sharing request includes a key identifier of an encryption key and a data demander of plain text data to be transmitted;

[0122] In response to the key sharing request, the shared data is sent to the data requester; wherein the shared data includes a key identifier of the encryption key corresponding to the decryption key;

[0123] Obtaining a data decryption request sent by a data demander; wherein the data decryption request includes a key identifier of a decryption key;

[0124] In response to a data decryption request, the ciphertext of the data to be transmitted is decrypted according to the decryption key to obtain the plaintext of the data to be transmitted, and the plaintext of the data to be transmitted is fed back to the data demander; wherein the ciphertext of the data to be transmitted is obtained by encrypting the plaintext of the data to be transmitted based on the encryption key.

[0125] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: the authority of the data requester is verified based on the calling credentials; if the verification is passed, the ciphertext of the data to be transmitted is decrypted based on the decryption key to obtain the plaintext of the data to be transmitted; the shared data also includes the calling credentials used by the data requester to call the decryption key; and the data decryption request also includes the calling credentials.

[0126] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: in response to a data decryption request, the current access data of the data requester is obtained; based on the current access data, whether the data requester has abnormal access behavior; if the data requester has abnormal access behavior, exception handling is performed.

[0127] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: performing exception handling includes at least one of the following methods: interrupting the response to the data decryption request; updating the encryption key and decryption key corresponding to the plaintext data to be transmitted; replacing or canceling the call credentials of the data demander stored locally; limiting the key sharing authority of the data provider; and outputting an exception alarm.

[0128] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: extracting access feature data from current access data; inputting the access feature data into an abnormal behavior recognition model to obtain a behavior anomaly value; the behavior anomaly value is used to characterize the degree of difference between the access behavior of the data demander and the normal behavior; when the behavior anomaly value is greater than a first abnormal threshold, it is determined that the data demander has abnormal access behavior.

[0129] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: before obtaining the key sharing request sent by the data provider, obtaining the data encryption request sent by the data provider; wherein the data encryption request includes the plaintext data to be transmitted; in response to the data encryption request, encrypting the plaintext data to be transmitted according to the encryption key to obtain the ciphertext data to be transmitted; and sending the ciphertext data to be transmitted and the key identifier of the encryption key to the data provider.

[0130] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0131] Obtaining a key sharing request sent by a data provider; wherein the key sharing request includes a key identifier of an encryption key and a data demander of plain text data to be transmitted;

[0132] In response to the key sharing request, the shared data is sent to the data requester; wherein the shared data includes a key identifier of the encryption key corresponding to the decryption key;

[0133] Obtaining a data decryption request sent by a data demander; wherein the data decryption request includes a key identifier of a decryption key;

[0134] In response to a data decryption request, the ciphertext of the data to be transmitted is decrypted according to the decryption key to obtain the plaintext of the data to be transmitted, and the plaintext of the data to be transmitted is fed back to the data demander; wherein the ciphertext of the data to be transmitted is obtained by encrypting the plaintext of the data to be transmitted based on the encryption key.

[0135] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: the authority of the data requester is verified based on the calling credentials; if the verification is passed, the ciphertext of the data to be transmitted is decrypted based on the decryption key to obtain the plaintext of the data to be transmitted; the shared data also includes the calling credentials used by the data requester to call the decryption key; and the data decryption request also includes the calling credentials.

[0136] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: in response to a data decryption request, the current access data of the data requester is obtained; based on the current access data, whether the data requester has abnormal access behavior; if the data requester has abnormal access behavior, exception handling is performed.

[0137] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: performing exception handling includes at least one of the following methods: interrupting the response to the data decryption request; updating the encryption key and decryption key corresponding to the plaintext data to be transmitted; replacing or canceling the call credentials of the data demander stored locally; limiting the key sharing authority of the data provider; and outputting an exception alarm.

[0138] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: extracting access feature data from current access data; inputting the access feature data into an abnormal behavior recognition model to obtain a behavior anomaly value; the behavior anomaly value is used to characterize the degree of difference between the access behavior of the data demander and the normal behavior; when the behavior anomaly value is greater than a first abnormal threshold, it is determined that the data demander has abnormal access behavior.

[0139] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: before obtaining the key sharing request sent by the data provider, obtaining the data encryption request sent by the data provider; wherein the data encryption request includes the plaintext data to be transmitted; in response to the data encryption request, encrypting the plaintext data to be transmitted according to the encryption key to obtain the ciphertext data to be transmitted; and sending the ciphertext data to be transmitted and the key identifier of the encryption key to the data provider.

[0140] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0141] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0142] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A key sharing method, characterized in that: Applied to a key service provider, the method includes: Obtaining a key sharing request sent by a data provider; wherein the key sharing request includes a key identifier of an encryption key and a data demander of plaintext data to be transmitted; In response to the key sharing request, sending shared data to the data demander; wherein the shared data includes a key identifier of a decryption key corresponding to the encryption key; Obtaining a data decryption request sent by the data demander; wherein the data decryption request includes a key identifier of the decryption key; In response to the data decryption request, decrypt the ciphertext of the data to be transmitted according to the decryption key to obtain the plaintext of the data to be transmitted, and feed back the plaintext of the data to be transmitted to the data demander; The ciphertext of the data to be transmitted is obtained by encrypting the plaintext of the data to be transmitted based on the encryption key.

2. The key sharing method according to claim 1, characterized in that: The shared data also includes a calling credential used by the data demander to call the decryption key; the data decryption request also includes the calling credential; Decrypting the ciphertext of the data to be transmitted according to the decryption key to obtain the plaintext of the data to be transmitted includes: Performing authority verification on the data requester according to the calling credential; When the verification is passed, the ciphertext of the data to be transmitted is decrypted according to the decryption key to obtain the plaintext of the data to be transmitted.

3. The key sharing method according to claim 1, characterized in that: The method further comprises: In response to the data decryption request, obtaining current access data of the data demander; According to the current access data, identifying whether the data demander has abnormal access behavior; In the event that the data demander has abnormal access behavior, exception handling is performed.

4. The key sharing method according to claim 3, characterized in that: The execution of exception handling includes at least one of the following methods: interrupting the response to the data decryption request; Updating the encryption key and decryption key corresponding to the plaintext of the data to be transmitted; Replace or cancel the locally stored call credentials of the data requester; Limiting the key sharing authority of the data provider; Output abnormal alarm.

5. The key sharing method according to claim 3, characterized in that: The identifying, according to the current access data, whether the data demander has abnormal access behavior includes: Extracting access feature data from the current access data; Inputting the access feature data into an abnormal behavior recognition model to obtain a behavior abnormality value; the behavior abnormality value is used to characterize the degree of difference between the access behavior of the data demander and the normal behavior; When the behavior abnormality value is greater than the first abnormality threshold, it is determined that the data demander has abnormal access behavior.

6. The key sharing method according to any one of claims 1 to 5, characterized in that: Before obtaining the key sharing request sent by the data provider, the method further includes: Obtaining a data encryption request sent by the data provider; wherein the data encryption request includes the plaintext of the data to be transmitted; In response to the data encryption request, encrypt the plaintext data to be transmitted according to the encryption key to obtain the ciphertext data to be transmitted; The ciphertext of the data to be transmitted and the key identifier of the encryption key are sent to the data provider.

7. A key sharing device, characterized in that: The device comprises: A first acquisition module is used to acquire a key sharing request sent by a data provider; wherein the key sharing request includes a key identifier of an encryption key and a data demander of plaintext data to be transmitted; A first processing module, configured to send shared data to the data demander in response to the key sharing request; wherein the shared data includes a key identifier of a decryption key corresponding to the encryption key; A second acquisition module is used to acquire a data decryption request sent by the data demander; wherein the data decryption request includes a key identifier of the decryption key; The second processing module is used to respond to the data decryption request, decrypt the ciphertext of the data to be transmitted according to the decryption key, obtain the plaintext of the data to be transmitted, and feed back the plaintext of the data to be transmitted to the data demander; wherein the ciphertext of the data to be transmitted is obtained by encrypting the plaintext of the data to be transmitted based on the encryption key.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images