Safety management method, device and system

Abstract

The invention provides a security management method, device and system, and the method comprises the steps: receiving a security management request initiated by an application program, generating a first public key, and transmitting the first public key to a service party, so as to enable the service party to generate a second public key based on the first public key; generating a first signature component and a message digest, and sending the first signature component and the message digest to a service party, so that the service party generates a second signature component based on the first signature component and the message digest; determining signature information according to the first signature component and a second signature component returned by the service party; and generating a security management container corresponding to the security management request according to the second public key and the signature information. According to the embodiment, the security of security management can be improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a security management method, device and system. Background Art

[0002] In the existing technology, security management usually relies on some traditional encryption algorithms to implement entity signature requirements. Most of these encryption algorithms are designed around a single key pair. This means that in the existing technology, the key will be concentrated on the terminal device of one of the parties involved in security management. Once the party is attacked or leaked, the security of the entire system will be threatened. Summary of the invention

[0003] In view of this, the embodiments of the present disclosure at least provide a security management method, device and system, which can improve the security of security management.

[0004] In a first aspect, an embodiment of the present disclosure provides a security management method, including:

[0005] Accepting a security management request initiated by an application, generating a first public key, and sending the first public key to a service provider so that the service provider generates a second public key based on the first public key;

[0006] Generate a first signature component and a message digest, and send the first signature component and the message digest to the service provider, so that the service provider generates a second signature component based on the first signature component and the message digest; determine the signature information according to the first signature component and the second signature component returned by the service provider;

[0007] A security management container corresponding to the security management request is generated according to the second public key and the signature information.

[0008] Optionally, generating a first public key includes:

[0009] Determining whether the target storage location stores the first private key component;

[0010] In response to the target storage location not storing the first private key component, the first private key component is determined according to the generated first random number, and a first public key is generated based on the first private key component.

[0011] Optionally, generating a first signature component and a message digest includes:

[0012] Generate a second random number, and generate a first signature component according to the second random number;

[0013] A hash operation is performed on the preset information to obtain a message digest corresponding to the preset information; the preset information is determined based on the security management requirements in the security management request; different preset information corresponds to different security management requirements.

[0014] Optionally, the second signature component includes a first intermediate component, a second intermediate component and a third intermediate component; the first intermediate component is generated based on the horizontal coordinate value corresponding to the first signature component and the message digest; the second intermediate component is generated based on the second public key; and the third intermediate component is generated based on the second public key and the first intermediate component.

[0015] Optionally, generating a security management container according to the second public key and the signature information includes:

[0016] The second public key, the signature information and other information are combined to generate a security management container corresponding to the security management request; wherein the other information is determined based on the security management requirements in the security management request.

[0017] In a second aspect, an embodiment of the present disclosure provides a security management device, including:

[0018] A public key generation module, used for receiving a security management request initiated by a program, generating a first public key, and sending the first public key to a service provider so that the service provider generates a second public key based on the first public key;

[0019] A signature generation module, configured to generate a first signature component and a message digest, and send the first signature component and the message digest to a service provider, so that the service provider generates a second signature component based on the first signature component and the message digest; and determine signature information according to the first signature component and the second signature component returned by the service provider;

[0020] The security management module is used to generate a security management container corresponding to the security management request according to the second public key and the signature information.

[0021] In a third aspect, an embodiment of the present disclosure provides a security management system, including an application module, a first terminal and a second terminal;

[0022] The application module is used to initiate a security management request to the first terminal; the security management request includes the security management requirement in any optional implementation manner of the first aspect above;

[0023] The first terminal is used to receive a security management request initiated by the application module, generate a first public key, and send the first public key to the service provider, so that the service provider generates a second public key based on the first public key; generate a first signature component and a message digest, and send the first signature component and the message digest to the service provider, so that the service provider generates a second signature component based on the first signature component and the message digest; determine the signature information according to the first signature component and the second signature component returned by the service provider; generate a security management container corresponding to the security management request according to the second public key and the signature information;

[0024] The second terminal is used to generate a second public key based on the first public key sent by the first terminal, and send the second public key to the first terminal; determine the second signature component based on the first signature component and the message digest sent by the first terminal, and send the second signature component to the first terminal.

[0025] In a fourth aspect, an embodiment of the present disclosure further provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the computer device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the above-mentioned first aspect, or the steps in any optional implementation of the first aspect are performed.

[0026] In a fifth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned first aspect, or any optional implementation of the first aspect are executed.

[0027] In a sixth aspect, an embodiment of the present disclosure further provides a computer program product, including a computer program, which implements the method of any of the above embodiments when executed by a processor.

[0028] In any of the above aspects or any implementation methods of any of the aspects, the execution subject of the disclosed embodiment is used to generate a first public key according to the private key component corresponding to it, and other participants in the current system can generate a second public key according to the first public key generated by the execution subject and the private key component stored internally by themselves. By dividing the private key into multiple parts, each participant only holds a part of it. After the execution subject of the disclosed embodiment generates the first public key, other participants negotiate the second public key based on their own stored private key components and the first public key. In this way, even if one party in the system is attacked, it cannot obtain complete key information, and thus cannot obtain a complete security management container, thereby improving the security of the security management method. In addition, the signature information in the disclosed embodiment is also negotiated by multiple parties, which can reduce the time for processing multiple signature requests in actual applications, and can improve the generation efficiency of the security management container while ensuring the security of the system.

[0029] The effects of the above-mentioned security management device, system, electronic device and storage medium can be found in the description of the above-mentioned security management method, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following is a brief introduction to the drawings required for use in the embodiments. The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used together with the specification to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can also be obtained based on these drawings without creative work.

[0031] Figure 1 A flowchart of a security management method provided by an embodiment of the present disclosure is shown;

[0032] Figure 2 A schematic diagram of a process flow of a security management method provided by an embodiment of the present disclosure is shown;

[0033] Figure 3 A schematic diagram showing a process of applying the security management method provided by an embodiment of the present disclosure is shown;

[0034] Figure 4 A schematic diagram of a security management device provided by an embodiment of the present disclosure is shown;

[0035] Figure 5 An exemplary system architecture is shown in which embodiments of the present disclosure may be applied;

[0036] Figure 6 A schematic diagram of the structure of a computer system of a terminal device or a server used to implement an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0038] It should be noted that in the technical solution of the present invention, the collection, use, storage, sharing and transfer of user personal information involved are in compliance with the provisions of relevant laws and regulations, and it is necessary to inform the user and obtain the user's consent or authorization. When applicable, the user's personal information is de-identified and / or anonymized and / or encrypted.

[0039] The raising of the above problems and the solutions are the results obtained by the inventor after practice and careful research. The discovery process of the above problems and the solutions proposed for the above problems should be the contributions made by the inventor to the present disclosure during the disclosure process.

[0040] The technical solutions in the present disclosure will be clearly and completely described below in conjunction with the drawings in the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure claimed for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0041] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0042] To facilitate understanding of this embodiment, a security management method disclosed in the embodiment of the present disclosure is first introduced in detail. The execution subject of the security management method provided in the embodiment of the present disclosure is generally a computer device with certain computing capabilities, and the computer device includes, for example: a terminal device or a server or other processing device, and the terminal device can be a user equipment (User Equipment, UE), a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a personal digital assistant (Personal Digital Assistant, PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc. In some possible implementations, the security management method can be implemented by a processor calling a computer-readable instruction stored in a memory.

[0043] See also Figure 1 As shown, it is a flowchart of the security management method provided by the embodiment of the present disclosure, and the method includes S101-S103, wherein:

[0044] S101: accepting a security management request initiated by an application, generating a first public key, and sending the first public key to a service provider, so that the service provider generates a second public key based on the first public key.

[0045] Figure 2 The following is a flow chart of the security management method provided by the embodiment of the present disclosure. Figure 2 As shown, the application can initiate a security management request to the execution subject of the embodiment of the present disclosure. The security management request here can be defined based on any cryptographic standard, such as requesting to construct and interpret an encrypted or signed message, or requesting to generate a certificate signing request, etc. The embodiment of the present disclosure does not make specific limitations on this, and it can be set according to actual needs in actual applications.

[0046] In the embodiment of the present disclosure, before generating the first public key, it is possible to first check whether the corresponding private key component is stored in the execution subject of the embodiment of the present disclosure. Specifically, it is determined whether the first private key component is stored in the target storage location; in response to the first private key component not being stored in the target storage location, the first private key component is determined according to the generated first random number, and the first public key is generated based on the first private key component.

[0047] In a specific implementation, if a private key component is stored in the execution subject of the embodiment of the present disclosure, the private key component can be directly used to perform the subsequent public key generation step; if the private key component is not stored, a random number generator can be used to generate a random number, and the random number can be used as the private key component corresponding to the execution subject of the embodiment of the present disclosure; or, a private key component can be determined based on the random number. For example, the random number can be scrambled, such as XOR or combined with system parameters to generate a more complex private key component, and then the generated private key component is used to perform the subsequent public key generation step. It should be noted that the above method for determining the private key component is only used as an example of a possible implementation method of the embodiment of the present disclosure, and does not constitute an improper limitation on the present invention. In actual applications, the first private key component can be determined according to actual conditions and needs. The embodiment of the present disclosure does not make specific limitations on this, and its function can be realized.

[0048] In a possible implementation, after receiving the security management request sent by the application, the execution subject of the embodiment of the present disclosure can use a random number generator to generate a random number and use it as a private key component, and then calculate the first public key. Represents a random number, represents the first public key to be generated by the execution subject of the embodiment of the present disclosure, then the formula An inverse element calculation is performed to obtain the first public key; wherein G represents a base point, which is usually a predefined point or constant in the system.

[0049] For example, assuming the base point , random number , modulus . We can first calculate the inverse of the random number, that is , the solution is ; Then the first public key can be calculated . Thus, the first public key corresponding to the embodiment of the present disclosure is calculated. It should be noted that the above calculation process is only for the purpose of simply illustrating a public key calculation method that can be adopted by the embodiment of the present disclosure, and does not constitute an improper limitation on the present invention.

[0050] In another possible implementation, in addition to using the above-mentioned inverse element calculation method to obtain the first public key, other methods may be used to generate the first public key based on the private key component corresponding to the execution subject of the embodiment of the present disclosure. For example, the product between the random number and the base point may be used as the first public key through direct scalar multiplication; the private key component may also be subjected to a symmetric transformation operation to obtain the first public key; or the first public key may be generated from the private key component through a key derivation function expansion. The above method is only used as an example of a public key generation method that can be used in the embodiment of the present disclosure, and does not constitute an improper limitation on the present invention. In actual applications, a suitable public key generation method may be selected according to actual needs. The embodiment of the present disclosure does not make specific limitations on this, and its function shall prevail.

[0051] like Figure 2 As shown, after generating the first public key, the executing entity of the embodiment of the present disclosure can send the generated first public key to the server. After receiving the first public key, the server can use the second private key component stored internally and the received first public key to negotiate a second public key with the executing entity of the embodiment of the present disclosure. The second public key here is the public key between the two.

[0052] In specific implementation, the formula To calculate the second public key, here is the random number of the service provider, and The method described above is to obtain The method is similar to that of It should be noted that the above are only examples of several feasible methods for the embodiment of the present disclosure to enable the execution subject and the service provider of the embodiment of the present disclosure to negotiate a public key, and do not constitute an improper limitation of the present invention. In practical applications, they can be set according to actual needs to achieve their functions.

[0053] In the embodiment of the present disclosure, after the service party determines the second public key, it can send it to the execution subject of the embodiment of the present disclosure, and the execution subject of the embodiment of the present disclosure can save the negotiated second public key and the first private key component to generate a security management container in subsequent steps. The content of generating the security management container will be described in S103 and will not be repeated here.

[0054] S102: Generate a first signature component and a message digest, and send the first signature component and the message digest to the service provider, so that the service provider generates a second signature component based on the first signature component and the message digest; determine the signature information according to the first signature component and the second signature component returned by the service provider.

[0055] In this step, the first signature component and the message digest are generated by the execution entity of the embodiment of the present disclosure, and the second signature component may be generated by the server based on the first signature component and returned to the execution entity of the embodiment of the present disclosure.

[0056] In an embodiment of the present disclosure, generating a first signature component and a message digest includes: generating a second random number, and generating a first signature component based on the second random number; performing a hash operation on preset information to obtain a message digest corresponding to the preset information; the preset information is determined based on the security management requirements in the security management request; and different preset information corresponds to different security management requirements.

[0057] In the specific implementation, a random number generator can be used to generate a random number , and then use the formula Calculate the first signature component ; Here is about random numbers The generation method and the first signature component The calculation method of can refer to the random number described above The generation method and calculation process of the first public key will not be repeated here.

[0058] A message digest is a message that compresses preset information of any length into an output value of fixed length through a hash function. In practical applications, the generated message digest cannot be used to reversely deduce the original information, and the digests generated by different input data are different, thereby ensuring the security of the preset information. In specific implementations, a message digest can be generated by performing a hash operation on the preset information. It should be noted that the preset information here can vary according to different security management requirements.

[0059] For example, it is assumed that the security management requirement indicates that the security management request initiated by the application is to generate a digital signature envelope. In this scenario, the preset information can be the data to be signed, and its specific form can be text, file or image, etc., and the input length can be any length. After determining the preset information, a suitable hash algorithm can be selected according to the security requirements of the system, and then the preset information can be preprocessed to ensure that its data format can adapt to the input requirements of the selected hash algorithm. Then the preset information can be padded so that its length meets the block size requirements of the selected hash algorithm, and the length information of the preset information can be added to the padded preset information to ensure the uniqueness of the algorithm process. Then the padded preset information can be divided into fixed-size data blocks, where the number of data blocks can be determined based on the input requirements of the selected hash algorithm, and each block can participate in the hash calculation independently, thereby improving the efficiency of generating the message digest. Finally, the pre-selected hash algorithm can be used to recursively calculate each data block, and the content of the blocks is gradually compressed into an intermediate result of a fixed length. After the calculation of the last data block, the output fixed-length result is the obtained message digest.

[0060] Exemplarily, assuming that the security management requirement indicates that the security management request initiated by the application is to generate a certificate signing request, in this scenario, the preset information may be subject information, public key information, and additional information. A certificate signing request is a data structure submitted to a certificate authority when applying for a digital certificate, wherein the subject information is usually the identity information of the applicant, and may include fields such as organization name, unit name, domain name, country, province, and city; the public key information may be the second public key generated by the execution subject of the embodiment of the present disclosure and the service provider in the aforementioned steps; the additional information may be the version number or extended information of the certificate signing request, such as purpose or constraint conditions. After determining the preset information, in order to ensure the standardization of the information, a specific coding structure may be used to serialize the preset information, and the specific serialization method is not described here, and may be selected according to the actual situation. After serializing the preset information, a suitable hash algorithm may be selected to perform a hash operation on the preset information, and the specific steps are similar to those in the previous text, and are not described here.

[0061] It should be noted that the above content is only an example of generating message digests under two different security management requirements in the embodiment of the present disclosure, and does not constitute an improper limitation on the present invention. In actual applications, the security management requirements may also indicate the generation of personal information exchange standards, encryption token interface standards, etc. Different preset information may be set for different security management requirements to generate message digests that meet the requirements. The embodiment of the present disclosure does not make specific limitations on this, and is based on the ability to achieve its functions.

[0062] like Figure 2As shown, after the execution subject of the embodiment of the present disclosure generates the first signature component and the message digest, it can send them to the service provider, and the service provider can generate the second signature component based on the first signature component and the message digest. Specifically, the second signature component includes the first intermediate component, the second intermediate component and the third intermediate component; the first intermediate component is generated based on the horizontal coordinate value corresponding to the first signature component and the message digest; the second intermediate component is generated based on the second public key; the third intermediate component is generated based on the second public key and the first intermediate component.

[0063] In a specific implementation, after receiving the message digest and the first signature component sent by the execution subject of the embodiment of the present disclosure, the service party can first generate a random number , and then based on the random number calculate ; Here Represents an intermediate quantity used to calculate the second signature component. After that, you can use the random number generator to generate a random number ,Will With the first signature component Dot product, and then After adding, we can get a new point, the coordinates of which can be expressed as .get After that, we can use the following formula , the horizontal axis Add it to the message digest e and take the modulus of n to calculate the first intermediate component r. Then the second intermediate component can be calculated using the following formula With the third intermediate component :

[0064]

[0065]

[0066] The first intermediate component r and the second intermediate component , the third intermediate component Together they constitute the second signature component, and then the service provider can use the first intermediate component r and the second intermediate component With the third intermediate component The first signature component is sent to the execution subject of the embodiment of the present disclosure, and the execution subject of the embodiment of the present disclosure can calculate the complete signature information according to the first signature component and the second signature component returned by the service provider.

[0067] In a specific implementation, the complete signature information s can be calculated according to the following formula:

[0068]

[0069] It should be noted that the above method for determining complete signature information is only illustrated as a possible implementation method in the embodiment of the present disclosure, and does not constitute an improper limitation on the present invention. In practical applications, the final complete signature information can also be obtained by simple concatenation or linear transformation of the first signature component and the second signature component. The embodiment of the present disclosure does not make specific limitations on this and can be selected according to actual conditions and needs to achieve its functions.

[0070] S103: Generate a security management container corresponding to the security management request according to the second public key and the signature information.

[0071] In this step, after the signature information is determined, the final security management container can be generated according to the second public key and the signature information. The security management container here can be different in different security management requirement scenarios. For example, if the security management requirement indicates the generation of a digital signature envelope, then the security management container is the digital signature envelope; if the security management requirement indicates the generation of a certificate signing request, then the security management container can be a certificate signing request.

[0072] In the embodiment of the present disclosure, the specific steps of generating the security management container may be different for different security management requirements. Specifically, generating the security management container according to the second public key and the signature information includes: combining the second public key, the signature information and other information according to the encapsulation format corresponding to the security management requirement to generate the security management container; wherein the other information is determined based on the security management requirement in the security management request.

[0073] For example, assume that the security management requirement indicates that the security management request initiated by the application is to generate a digital signature envelope. In this scenario, the other information may be the data to be signed, that is, the second public key, the signature information and the data to be signed may be packaged to finally obtain a digital signature envelope. Figure 3As shown, a digital summary can be generated based on the original information using a pre-selected encryption algorithm, and then the digital summary can be digitally signed using the second public key jointly negotiated by the requester and the service provider. Then the digital signature containing the signature can be encrypted using the service provider's public key to generate a digital envelope, and finally the envelope structure constructed by the second public key and the envelope data is sent to the service provider. After receiving the digital signature envelope, the service provider can first use the service provider's private key to decrypt the digital envelope to obtain the original information and digital signature, and then use the second public key to decrypt the digital signature to obtain the digital summary, and compare it with the hash value of the original information calculated by itself. If the two are the same, it means that the data has been tampered with during the transmission process, and the security management process verification is successful; if they are different, that is, the same operation on the information that should be the same is different, it means that the data has been tampered with during the transmission process, and the security management process verification fails. In the prior art, the digital signature envelope often needs to be embedded in the envelope of the requester and the service provider to ensure the legitimacy of the identities of both parties. The disclosed embodiment can use the second public key jointly negotiated by the requester and the service provider to construct a digital signature envelope, thereby ensuring the legitimacy of the identities of both parties and the security of the data to be signed, and can also reduce the size of the digital signature envelope structure, thereby saving resource consumption.

[0074] For example, it is assumed that the security management requirement indicates that the security management request initiated by the program is to generate a certificate signing request. In this scenario, the other information may be subject information and additional information. The specific content that may be included in the subject information and additional information is similar to the content of the above example, and will not be repeated here. At this time, the second public key, signature information, subject information and additional information may be packaged to generate a final certificate signing request.

[0075] In the embodiment of the present disclosure, after the corresponding security management container is generated, the verification steps corresponding to the security management container can be performed. For example, after the certificate signing request is generated, the certificate signing request can be sent to the certificate authority, and the certificate authority verifies the request. When the verification passes, the corresponding certificate can be generated. The application of the corresponding security management container generated in other scenarios will not be described in detail in the embodiment of the present disclosure.

[0076] According to a second aspect of the embodiment of the present disclosure, Figure 4 As shown, a security management device 400 is provided, including:

[0077] A public key generation module 401 is used to receive a security management request initiated by a program, generate a first public key, and send the first public key to a service provider so that the service provider generates a second public key based on the first public key;

[0078] The signature generation module 402 is used to generate a first signature component and a message digest, and send the first signature component and the message digest to the service provider, so that the service provider generates a second signature component based on the first signature component and the message digest; and determine the signature information according to the first signature component and the second signature component returned by the service provider;

[0079] The security management module 403 is used to generate a security management container corresponding to the security management request according to the second public key and the signature information.

[0080] Optionally, the public key generation module 401 is specifically used for:

[0081] Determining whether the target storage location stores the first private key component;

[0082] In response to the target storage location not storing the first private key component, the first private key component is determined according to the generated first random number, and a first public key is generated based on the first private key component.

[0083] Optionally, the signature generation module 402 is specifically used for:

[0084] Generate a second random number, and generate a first signature component according to the second random number;

[0085] A hash operation is performed on the preset information to obtain a message digest corresponding to the preset information; the preset information is determined based on the security management requirements in the security management request; different preset information corresponds to different security management requirements.

[0086] Optionally, the second signature component includes a first intermediate component, a second intermediate component and a third intermediate component; the first intermediate component is generated based on the horizontal coordinate value corresponding to the first signature component and the message digest; the second intermediate component is generated based on the second public key; and the third intermediate component is generated based on the second public key and the first intermediate component.

[0087] Optionally, the security management module 403 is specifically used for:

[0088] The second public key, the signature information and other information are combined to generate a security management container corresponding to the security management request; wherein the other information is determined based on the security management requirements in the security management request.

[0089] According to a third aspect provided by an embodiment of the present disclosure, there is provided a security management system, including an application module, a first terminal and a second terminal;

[0090] The application module is used to initiate a security management request to the first terminal; the security management request includes the security management requirement in any optional implementation manner of the first aspect above;

[0091] The first terminal is used to receive a security management request initiated by the application module, generate a first public key, and send the first public key to the service provider, so that the service provider generates a second public key based on the first public key; generate a first signature component and a message digest, and send the first signature component and the message digest to the service provider, so that the service provider generates a second signature component based on the first signature component and the message digest; determine the signature information according to the first signature component and the second signature component returned by the service provider; generate a security management container corresponding to the security management request according to the second public key and the signature information;

[0092] The second terminal is used to generate a second public key based on the first public key sent by the first terminal, and send the second public key to the first terminal; determine the second signature component based on the first signature component and the message digest sent by the first terminal, and send the second signature component to the first terminal.

[0093] According to the fourth aspect of an embodiment of the present disclosure, a security-managed electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement the method provided by the first aspect of the embodiment of the present invention.

[0094] According to a fifth aspect of an embodiment of the present disclosure, a computer-readable medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method provided by the first aspect of the embodiment of the present disclosure is implemented.

[0095] According to a sixth aspect of an embodiment of the present invention, there is provided a computer program product, including a computer program, which implements the method of any of the above embodiments when executed by a processor.

[0096] Figure 5 An exemplary system architecture 500 to which the security management method or security management apparatus implemented by the present disclosure can be applied is shown.

[0097] like Figure 5 As shown, the system architecture 500 may include terminal devices 501, 502, 503, a network 504 and a server 505. The network 504 is used to provide a medium for communication links between the terminal devices 501, 502, 503 and the server 505. The network 504 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0098] Users can use terminal devices 501, 502, 503 to interact with server 505 through network 504 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 501, 502, 503, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0099] The terminal devices 501 , 502 , and 503 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0100] The server 505 may be a server that provides various services, such as a background management server (only an example) that provides support for shopping websites browsed by users using the terminal devices 501, 502, and 503. The background management server may process the received security management request and feed back the processing result (only an example) to the terminal device.

[0101] It should be noted that the security management method provided in the embodiment of the present invention is generally executed by the server 505, and accordingly, the security management device is generally set in the server 505. The security management method provided in the embodiment of the present invention can also be executed by the terminal devices 501, 502, 503, and accordingly, the security management device can be set in the terminal devices 501, 502, 503.

[0102] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0103] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system 600 of a terminal device suitable for implementing an embodiment of the present invention. Figure 6 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0104] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0105] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0106] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present invention are executed.

[0107] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0108] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0109] The modules involved in the embodiments of the present invention may be implemented in software or hardware. The modules described may also be set in a processor. For example, a processor includes a public key generation module, a signature generation module, and a security management module, wherein the names of these modules do not constitute a limitation on the modules themselves in certain circumstances. For example, the public key generation module may also be described as a "first public key generation module".

[0110] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs. When the above one or more programs are executed by a device, the device implements the following method: accepting a security management request initiated by an application, generating a first public key, and sending the first public key to a service provider so that the service provider generates a second public key based on the first public key; generating a first signature component and a message digest, and sending the first signature component and the message digest to the service provider so that the service provider generates a second signature component based on the first signature component and the message digest; determining the signature information based on the first signature component and the second signature component returned by the service provider; generating a security management container corresponding to the security management request based on the second public key and the signature information.

[0111] Finally, it should be noted that the above embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure is described in detail with reference to the above embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above embodiments within the technical scope disclosed in the present disclosure, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A safety management method, characterized in that: include: Receiving a security management request initiated by an application, generating a first public key, and sending the first public key to a service provider, so that the service provider generates a second public key based on the first public key; Generate a first signature component and a message digest, and send the first signature component and the message digest to a service provider, so that the service provider generates a second signature component based on the first signature component and the message digest; Determine signature information according to the first signature component and the second signature component returned by the service provider; A security management container corresponding to the security management request is generated according to the second public key and the signature information.

2. The method according to claim 1, characterized in that Generate the first public key, including: Determining whether the target storage location stores the first private key component; In response to the target storage location not storing the first private key component, the first private key component is determined according to the generated first random number, and the first public key is generated based on the first private key component.

3. The method according to claim 1, characterized in that Generate a first signature component and a message digest, including: Generate a second random number, and generate the first signature component according to the second random number; A hash operation is performed on the preset information to obtain a message digest corresponding to the preset information; the preset information is determined based on the security management requirements in the security management request; different preset information corresponds to different security management requirements.

4. The method according to claim 1, characterized in that: The second signature component includes a first intermediate component, a second intermediate component and a third intermediate component; the first intermediate component is generated based on the abscissa value corresponding to the first signature component and the message digest; the second intermediate component is generated based on the second public key; The third intermediate component is generated based on the second public key and the first intermediate component.

5. The method according to any one of claims 1 to 4, characterized in that: Generating a security management container according to the second public key and the signature information, including: The second public key, signature information and other information are combined to generate a security management container corresponding to the security management request; wherein the other information is determined based on the security management requirements in the security management request.

6. A security management device, characterized in that: include: A public key generation module, used to receive a security management request initiated by an application, generate a first public key, and send the first public key to a service provider so that the service provider generates a second public key based on the first public key; a signature generation module, configured to generate a first signature component and a message digest, and send the first signature component and the message digest to a service provider, so that the service provider generates a second signature component based on the first signature component and the message digest; Determine signature information according to the first signature component and the second signature component returned by the service provider; A security management module is used to generate a security management container corresponding to the security management request according to the second public key and the signature information.

7. A digital signature envelope generation system, characterized in that: It includes an application module, a first terminal and a second terminal; The application module is used to initiate a security management request to the first terminal; the security management request includes the security management requirement described in any one of claims 1 to 5; The first terminal is used to receive a security management request initiated by the application module, generate a first public key, and send the first public key to the service provider so that the service provider generates a second public key based on the first public key; Generate a first signature component and a message digest, and send the first signature component and the message digest to the service provider, so that the service provider generates a second signature component based on the first signature component and the message digest; Determine signature information according to the first signature component and the second signature component returned by the service provider; generating a security management container corresponding to the security management request according to the second public key and the signature information; The second terminal is used to generate the second public key based on the first public key sent by the first terminal, and send the second public key to the first terminal; A second signature component is determined based on the first signature component sent by the first terminal and the message digest, and the second signature component is sent to the first terminal.

8. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

9. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

10. A computer program product, comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 5.

Images