Key management method, device and system

Abstract

The invention provides a secret key management method, device and system, and the method comprises the steps: generating a first secret key, and transmitting the first secret key to a requester and a service party, so as to enable the requester and the service party to generate a second secret key based on the first secret key; the second keys generated by the requester and the service party are the same; encrypting a second key generated in the requesting party and the service party; and importing the encrypted second key from the requester or the service party and storing the encrypted second key, so that the requester calls the stored encrypted second key to encrypt the communication data. According to the embodiment, the security of data and the transportability of key management can be improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a key management method, device and system. Background Art

[0002] In mobile terminals, the keys used to protect data security are usually stored in the software environment of the mobile terminal. When the mobile terminal is subject to physical attacks and malicious network threats, the security of the keys faces great challenges. Once the keys are leaked, the attacker can decrypt the data and perform malicious operations, affecting the data security of the mobile terminal. In addition, this method of storing the keys in the software environment of the mobile terminal is often not easy to transplant between different mobile terminals. Summary of the invention

[0003] In view of this, the embodiments of the present disclosure at least provide a key management method, device and system, which can improve data security and portability of key management.

[0004] In a first aspect, an embodiment of the present disclosure provides a key management method, including:

[0005] Generate a first key, and send the first key to the requester and the service party, so that the requester and the service party generate a second key based on the first key; the second key generated by the requester and the service party is the same;

[0006] Encrypting the second key generated by the requester and the service provider;

[0007] The encrypted second key is imported from the requester or the service provider and saved, so that the requester calls the saved encrypted second key to encrypt the communication data.

[0008] Optionally, before generating the first key, the method further includes:

[0009] Based on the received identity authentication request initiated by the requester and the verification information of the requester, the requester is authenticated and it is confirmed that the identity authentication of the requester is successful.

[0010] Optionally, before sending the first key to the requesting party and the service party, the method further includes:

[0011] When the validity verification of the service provider is passed, the first key is encrypted based on the received public key of the service provider.

[0012] Optionally, the second key is obtained based on the decrypted first key, the service party random number and the requesting party random number; the decrypted first key is obtained by decrypting the encrypted first key using the service party private key.

[0013] Optionally, encrypting the second key generated in the requester and the service provider includes:

[0014] Generate a key encryption public key and a key encryption private key;

[0015] Through a pre-established encryption interface, the second key generated in the requester and the service party is encrypted using a key encryption public key, and the key encryption private key is sent to the service party; wherein the key encryption private key is used to decrypt the second key encrypted by the key encryption public key.

[0016] In a second aspect, an embodiment of the present disclosure provides a key management device, including:

[0017] A generating module, configured to generate a first key, and send the first key to a requester and a service party, so that the requester and the service party generate a second key based on the first key; the second key generated by the requester and the service party is the same;

[0018] A session encryption module, used for encrypting the second key generated in the requester and the server;

[0019] The data encryption module imports the encrypted second key from the requester or the service provider and saves it, so that the requester calls the saved encrypted second key to encrypt the communication data.

[0020] In a third aspect, an embodiment of the present disclosure provides a key management system, including a protection module, a first terminal and a second terminal;

[0021] The protection module is used to generate a first key, send the first key to a first terminal and a second terminal, and the first terminal and the second terminal generate a second key based on the first key sent by the protection module; the second key generated by the first terminal is the same as the second terminal; the protection module encrypts the second key generated in the first terminal and the second terminal; the protection module imports the encrypted second key from the first terminal or the second terminal and saves it, and the first terminal calls the encrypted second key saved in the protection module to encrypt communication data.

[0022] In a fourth aspect, an embodiment of the present disclosure further provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the computer device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the above-mentioned first aspect, or the steps in any optional implementation of the first aspect are performed.

[0023] In a fifth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned first aspect, or any optional implementation of the first aspect are executed.

[0024] In a sixth aspect, an embodiment of the present disclosure further provides a computer program product, including a computer program, which implements the method of any of the above embodiments when executed by a processor.

[0025] Any of the above aspects or any implementation of any of the aspects only uses the first key to generate the second key, so that the first key does not directly participate in the encryption of the communication data, so that even if the second key is leaked during the communication process, the first key will not be directly exposed. This separates the risk source to a certain extent, effectively reducing the possibility of the first key being attacked. Secondly, encrypting the second key and then persisting it further enhances the security and portability of key management. By encrypting the second key generated in the requester and the servicer and storing it in the execution subject of the embodiment of the present disclosure, even if the current system receives a malicious attack from an attacker, it cannot obtain the plaintext of the second key, and thus cannot decrypt the communication data encrypted by the second key. In addition, since the execution subject of the embodiment of the present disclosure can be independent of the terminal devices of the requester and the servicer, when it is necessary to replace the mobile terminal or other terminal devices that need to encrypt communication data, it is only necessary to transplant the execution subject of the embodiment of the present disclosure, thereby improving the portability of key management.

[0026] The effects of the above-mentioned key management device, system, electronic device and storage medium can be found in the description of the above-mentioned key management method, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following is a brief introduction to the drawings required for use in the embodiments. The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used together with the specification to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can also be obtained based on these drawings without creative work.

[0028] Figure 1 A flowchart of a key management method provided by an embodiment of the present disclosure is shown;

[0029] Figure 2 A schematic diagram showing the connection between the execution subject and the requesting party terminal device provided by the embodiment of the present disclosure;

[0030] Figure 3 A schematic diagram of a key management method provided by an embodiment of the present disclosure is shown;

[0031] Figure 4 A schematic diagram of a process for generating a second key provided by an embodiment of the present disclosure is shown;

[0032] Figure 5 A schematic diagram of a key management device provided by an embodiment of the present disclosure is shown;

[0033] Figure 6 An exemplary system architecture is shown in which embodiments of the present disclosure may be applied;

[0034] Figure 7 A schematic diagram of the structure of a computer system of a terminal device or a server used to implement an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0036] It should be noted that in the technical solution of the present invention, the collection, use, storage, sharing and transfer of user personal information involved are in compliance with the provisions of relevant laws and regulations, and it is necessary to inform the user and obtain the user's consent or authorization. When applicable, the user's personal information is de-identified and / or anonymized and / or encrypted.

[0037] The raising of the above problems and the solutions are the results obtained by the inventor after practice and careful research. The discovery process of the above problems and the solutions proposed for the above problems should be the contributions made by the inventor to the present disclosure during the disclosure process.

[0038] The technical solutions in the present disclosure will be clearly and completely described below in conjunction with the drawings in the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure claimed for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0039] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0040] To facilitate understanding of this embodiment, a key management method disclosed in the embodiment of the present disclosure is first introduced in detail. The execution subject of the key management method provided in the embodiment of the present disclosure is generally a computer device with certain computing capabilities, and the computer device includes, for example: a terminal device or a server or other processing device, and the terminal device can be a user equipment (User Equipment, UE), a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a personal digital assistant (Personal Digital Assistant, PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc. In some possible implementations, the key management method can be implemented by a processor calling a computer-readable instruction stored in a memory.

[0041] See also Figure 1 FIG. 1 is a flowchart of a key management method provided by an embodiment of the present disclosure, and the method includes S101 to S103, wherein:

[0042] S101: Generate a first key, and send the first key to a requester and a service party, so that the requester and the service party generate a second key based on the first key; the second key generated by the requester and the service party is the same.

[0043] In the embodiments of the present disclosure, the execution subject of the embodiments of the present disclosure can be any hardware device or software independent of the requesting terminal and the service terminal. Exemplarily, the execution subject of the embodiments of the present disclosure can be a small physical device with a built-in security chip, or a large cluster that can be responsible for encrypting communication data of multiple terminal devices at the same time; or, it can also be a software that can be implanted in any terminal device independent of the requesting terminal and the service terminal. The embodiments of the present disclosure do not specifically limit the specific form of the corresponding execution subject, and in actual applications, it can be set according to the actual situation to achieve its functions.

[0044] In the embodiments of the present disclosure, the execution subject of the embodiments of the present disclosure can be directly connected to the requesting party, specifically, it can be connected through a wired connection, such as a USB (Universal Serial Bus) connection, an Ethernet connection, etc.; it can also be connected through a wireless connection, such as a Wi-Fi (Wireless Fidelity) connection, a Bluetooth connection, etc.; it can also be connected to the requesting party through a mobile network connection, a proprietary protocol connection, a virtual connection, and other connection methods. Figure 2 A schematic diagram of connecting the execution subject of the embodiment of the present disclosure with the requester using a wired connection, such as Figure 2 As shown, when the terminal device of the requesting party is a mobile terminal and the execution subject of the embodiment of the present disclosure is a small physical device, the two can be connected via a wired USB, so that when the requesting party changes, the physical entity of the execution subject of the embodiment of the present disclosure can be connected to the new terminal device of the requesting party, thereby improving the portability of the key management method of the embodiment of the present disclosure. In a specific implementation, when the execution subject of the embodiment of the present disclosure is connected to the terminal device of the requesting party, the first key can be generated; or the first key can be generated after the identity authentication of the requesting party is passed.

[0045] In a possible implementation, the first key may be a pre-master key, and the second key may be a session key. A pre-master key is an intermediate key material used to negotiate a session key in an encryption communication protocol, such as Figure 2 As shown, the execution entity of the embodiment of the present disclosure can use its built-in random number generator to generate a pre-master key.

[0046] In a specific implementation, before generating the first key, a high entropy seed seat can be randomly obtained from a physical noise source or the entropy pool of the current system as the initial input of the random number generator to ensure the randomness and unpredictability of the pre-master key; after obtaining the high entropy seed, the pre-master key can be directly composed of the bit stream output by the random number generator. The number of bits of the generated pre-master key needs to be consistent with the key length requirement. The key length requirement here can be pre-defined, for example, AES-256 requires a 256-bit pre-master key. In addition, after the pre-master key is generated, the generated pre-master key can also be verified and entropy checked, thereby ensuring that there is no obvious pattern in the pre-master key, thereby ensuring the security of the pre-master key by ensuring the randomness of the pre-master key.

[0047] It should be noted that the above-mentioned specific method of generating a pre-master key using a random number generator is only used as an example of a possible implementation method in the embodiments of the present disclosure, and does not constitute an improper limitation on the present invention. In practical applications, the corresponding pre-master key generation method can be selected according to actual conditions. For example, the pre-master key can be generated by a multi-party computing protocol method, or by a quantum key distribution method. The embodiments of the present disclosure do not make specific limitations on this, and the ability to achieve its functions shall prevail.

[0048] In addition, when the first key is not a pre-master key but other types of keys, its specific generation method can be set according to the actual key type. The embodiment of the present disclosure does not specifically limit the key type of the first key. In addition to being a pre-master key, it can also be a master key, a root key, a session key, a key encryption key, etc., and its key type can be set according to the actual scenario.

[0049] In some scenarios, when the first key is a root key, it can be used as a high-security initial key to generate or encrypt the second key. In this case, the second key can be a transmission key for protecting the security of data transmission. Alternatively, the first key can be a key encryption key for encrypting the second key. In this case, the second key can be a content encryption key. The content encryption key can be used directly to encrypt data, while the key encryption key can be used to protect the security of the content encryption key. The combination of the first key and the second key in other scenarios will not be described in detail in the embodiments of this disclosure.

[0050] In the embodiments of the present disclosure, Figure 3 As shown, the requester may be a client and the service provider may be a server. Before generating the first key, the execution subject of the embodiment of the present disclosure may authenticate the requester. Specifically, optionally, before generating the first key, it includes: authenticating the requester based on the received authentication request initiated by the requester and the authentication information of the requester, and confirming that the authentication of the requester is passed.

[0051] In a specific implementation, when there is a need for data encryption, the requester may send an identity authentication request to the execution subject of the embodiment of the present disclosure. When receiving the identity authentication request, the execution subject of the embodiment of the present disclosure may obtain the corresponding PIN (Personal Identification Number) from the requester, and compare it with the built-in PIN in the execution subject of the embodiment of the present disclosure, thereby verifying the requester. Alternatively, the requester may also be authenticated through verification information such as the Internet Protocol address of the requester and the client certificate. The embodiment of the present disclosure does not specifically limit the method for authenticating the requester, and in actual applications it may be set according to actual conditions, subject to the ability to achieve its functions.

[0052] In the disclosed embodiment, in addition to authenticating the requesting party, the service provider may also be authenticated. In a specific implementation, the service provider may send its own service provider certificate to the requesting party, and the requesting party may verify the validity of its certificate. The service provider certificate may include the certificate version, serial number, signature algorithm, certificate issuer, certificate validity period, holder information, public key information, etc. After the requesting party passes the validity verification of the service provider certificate, the subsequent key management steps may be performed. If the validity verification of the service provider certificate fails, the process may be terminated.

[0053] In the disclosed embodiment, the generated first key may also be encrypted. Specifically, before sending the first key to the requester and the service provider, the method further includes: encrypting the first key based on the received service provider public key when the service provider passes the validity verification.

[0054] In a specific implementation, after receiving the service party certificate sent by the service party and determining that its validity verification has passed, the requester can send the public key information in the service party certificate to the execution subject of the embodiment of the present disclosure, so that the execution subject of the embodiment of the present disclosure uses the service party public key to encrypt the first key and send it to the service party. Since the service party stores a private key that can decrypt the service party public key, the service party can decrypt the encrypted first key after receiving the encrypted first key, and then use the decrypted first key, the service party random number and the requester random number to generate the second key. As a result, the first key will not be transmitted in plain text between the execution subject, the requester and the service party of the embodiment of the present disclosure, so that even if the current system is attacked maliciously, the attacker cannot obtain the plain text of the pre-master key, thereby improving the security of the current system.

[0055] It should be noted that if the first key is encrypted using the service party's public key, the requesting party cannot directly decrypt the encrypted first key, and thus cannot directly generate the second key based on the decrypted first key. In order to solve the above problem, the session key generated by the service party can be transmitted to the requesting party through the requesting party's public key or other secure channels. The key negotiation mechanism can also be used. After the service party decrypts the encrypted first key, a shared second key is generated according to the decrypted first key and the derivation algorithm. Then the service party can use the service party's public key and the client's random number to generate a derived value and send it to the requesting party. The requesting party can use the same derivation algorithm to combine the requesting party's random number and the received derived value to generate the same second key. Alternatively, when the execution subject of the embodiment of the present disclosure encrypts the first key, the first key encrypted using the requesting party's public key can also be sent to the requesting party, and the first key encrypted using the service party's public key can be sent to the service party; the service party can also directly send the decrypted first key to the requesting party so that the requesting party generates the second key based on the decrypted first key.

[0056] It should be noted that the above-mentioned method of generating the same second key by the requester and the service provider is only used as an example of a feasible implementation method of the embodiment of the present disclosure, and does not constitute an improper limitation on the present invention. In practical applications, a suitable method can be selected or set according to actual needs and circumstances. The embodiment of the present disclosure does not make specific limitations on this, and the ability to achieve its functions shall prevail.

[0057] In a specific implementation, when the identity authentication of the requesting party is passed, the requesting party can generate a requesting party random number and send it to the service party; and when the service party sends the service party certificate to the requesting party, it can also send the service party random number generated by it to the requesting party. Then the service party and the requesting party can generate the second key based on the common first key, the service party random number and the requesting party random number. The following takes the first key as the pre-master key and the second key as the session key as an example to illustrate the process of generating the second key.

[0058] like Figure 4 As shown in the figure, the pre-master key, the service random number and the request random number can be combined to generate the master key through a pseudorandom function (PRF). PRF is a cryptographic function used in encryption protocols that can generate seemingly random outputs based on inputs. When the same input is given, the same output can always be obtained using the PRF derivation algorithm. When the input is different, the output is unpredictable. Figure 4As shown, the form of PRF is usually expressed as PRF (secert, label, seed), and the three parameters in the brackets represent the key, label, and seed respectively. Secert represents the key or confidential information. In the process of generating the master key, secert can be the pre-master key; label is usually a string used to identify the type or purpose of the pseudo-random output. Different labels can be used to generate different keys; seed is usually a combination of the requester's random number and the service's random number, which is used to ensure that each generated master key is unique to prevent replay attacks and key reuse. The formula for generating the master key can be as follows:

[0059] Master Secret=PRF(PreMaster Secret,Client Random,Server Random)

[0060] Among them, Master Secret represents the master key, PreMaster Secret represents the pre-master key, ClientRandom represents the requester's random number, and Server Random represents the server's random number. After the master key is generated, the requester and server can continue to use the master key to generate the session key. The generation formula of the session key can be as follows:

[0061] Session Key = PRF(Master Key, Client Random, Server Random)

[0062] Among them, Session Key represents the session key, Master Key represents the master key, Client Random represents the requesting party random number, and Server Random represents the service party random number. Thus, the session key is obtained based on the pre-master key. It should be noted that the above description of using the pre-master key as the first key and the session key as the second key is only a possible implementation method of the embodiment of the present disclosure. As described above, the first key and the second key can also be other combinations in other scenarios. When the first key and the second key are other combinations, the method of generating the second key will also be different. In actual applications, it can be selected and set according to actual conditions. The embodiment of the present disclosure does not make specific limitations on this and will not be repeated.

[0063] S102: Encrypt the second key generated by the requester and the service provider.

[0064] In the disclosed embodiment, a key encryption public key and a key encryption private key may be generated to encrypt the second key. Specifically, encrypting the second key generated in the requester and the service provider includes: generating a key encryption public key and a key encryption private key; encrypting the second key generated in the requester and the service provider using the key encryption public key through a pre-established encryption interface, and sending the key encryption private key to the service provider; wherein the key encryption private key is used to decrypt the second key encrypted by the key encryption public key.

[0065] In a specific implementation, the execution subject of the embodiment of the present disclosure can generate a key encryption public key and a key encryption private key. After the second key is generated, an encryption interface can be created between the execution subject of the embodiment of the present disclosure and the requester and the service party, and the encryption interface can help the execution subject of the embodiment of the present disclosure to accurately encrypt the second key generated in the requester and the service party. The structure can be created in advance or immediately after the requester and the service party generate the second session. The embodiment of the present disclosure does not specifically limit this, and its function can be realized. After the execution subject of the embodiment of the present disclosure generates the key encryption public key and the key encryption private key, the key encryption public key can be derived, and the second key generated by the requester and the service party can be encrypted through the created encryption interface. The encrypted second key can be imported into the execution subject of the embodiment of the present disclosure and stored in the local storage space of the execution subject of the embodiment of the present disclosure. As a result, the second key will not appear in the current system in plain text. Even if the attacker maliciously attacks the current system, the plain text of the second key cannot be obtained, and the communication data encrypted by the second key cannot be decrypted, thereby improving the security of key management.

[0066] In another possible implementation, the key encryption public key and the key encryption private key can also be pre-generated based on a preset encryption algorithm. The preset encryption algorithm here can be selected according to the actual situation. For example, if the current key needs to meet the national secret detection requirements, then the preset encryption algorithm here can be set to the SM2 algorithm that meets the national secret detection requirements. The disclosed embodiment does not make specific limitations on this. In actual applications, it can be set according to actual needs. It will not be repeated what kind of preset encryption algorithm can be selected in other scenarios. Similarly, the derived algorithm here can also be selected according to actual conditions and needs, mainly to achieve its function.

[0067] S103: Importing the encrypted second key from the requester or the service provider and saving it, so that the requester calls the saved encrypted second key to encrypt the communication data.

[0068] In this step, after the execution subject of the embodiment of the present disclosure encrypts the second key generated in the requester and the service side, since the second keys in the requester and the service side are the same, the encrypted second key in the requester or the service side can be imported into the execution subject of the embodiment of the present disclosure and saved, so that the requester can call the encrypted second key saved in the execution subject of the embodiment of the present disclosure to encrypt the communication data.

[0069] In the embodiment of the present disclosure, when the requesting party needs to encrypt the communication data, the requesting party may send a data encryption request to the executing entity of the embodiment of the present disclosure. After receiving the data encryption request sent by the requesting party, the executing entity of the embodiment of the present disclosure may enable the requesting party to call the encrypted second key stored in the embodiment of the present disclosure to encrypt the communication data.

[0070] In a specific implementation, the requester can call the encrypted second key stored in the execution subject of the embodiment of the present disclosure to encrypt the communication data, and then send the encrypted data to the service party. The service party can then use the key encryption private key corresponding to the key encryption public key to decrypt the encrypted second key, and then use the second key to decrypt and obtain the plaintext communication data. The execution subject of the embodiment of the present disclosure can use the service party's private key to encrypt the key encryption private key and send it to the service party, so that the service party can use the service party's private key to decrypt and obtain the key encryption private key to decrypt the second key encrypted by the key encryption public key.

[0071] In another possible implementation, the service party's public key can be used to directly encrypt the second key, and then the encrypted second key can be used to encrypt the communication data, so that the service party can use the service party's private key and the second key to decrypt the plaintext communication data. Alternatively, the service party can also access the key encryption private key through authentication or authority verification, and can use the key encryption private key to decrypt the encrypted second key if the verification is successful.

[0072] In a specific implementation, the encrypted second key saved in the embodiment of the present disclosure may be valid for the communication data within the current session round; or a corresponding security period may be set for the encrypted second key according to different session scenarios; for example, in scenarios with high security requirements such as financial transactions and confidential communications, the key validity period may be set to 2 minutes; and for some scenarios with lower security requirements, the key validity period may be set to 2 hours. It should be noted that the above setting of the key validity period is only used as an example of a feasible implementation method in the embodiment of the present disclosure, and does not constitute an improper limitation on the present invention. In actual applications, it can be set according to actual needs. The embodiment of the present disclosure does not make specific limitations on this, and its function can be realized.

[0073] According to a second aspect of the embodiment of the present disclosure, Figure 5 As shown, a key management device 500 is provided, including:

[0074] A generating module 501 is used to generate a first key, and send the first key to a requester and a service provider, so that the requester and the service provider generate a second key based on the first key; the second key generated by the requester and the service provider is the same;

[0075] The session encryption module 502 is used to encrypt the second key generated by the requester and the service provider;

[0076] The data encryption module 503 is used to import the encrypted second key from the requester or the service provider and save it, so that the requester can use the saved encrypted second key to encrypt the communication data.

[0077] Optionally, the generating module 501 is further used for:

[0078] Based on the received identity authentication request initiated by the requester and the verification information of the requester, the requester is authenticated and it is confirmed that the identity authentication of the requester is successful.

[0079] Optionally, the generating module 501 is further used for:

[0080] When the validity verification of the service provider is passed, the first key is encrypted based on the received public key of the service provider.

[0081] Optionally, the second key is obtained based on the decrypted first key, the service party random number and the requesting party random number; the decrypted first key is obtained by decrypting the encrypted first key using the service party private key.

[0082] Optionally, the session encryption module 502 is specifically used for:

[0083] Encrypting the second key generated in the requester and the server, including:

[0084] Generate a key encryption public key and a key encryption private key;

[0085] Through a pre-established encryption interface, the second key generated in the requester and the service party is encrypted using a key encryption public key, and the key encryption private key is sent to the service party; wherein the key encryption private key is used to decrypt the second key encrypted by the key encryption public key.

[0086] According to a third aspect of an embodiment of the present disclosure, there is provided a key management system, including a protection module, a first terminal and a second terminal;

[0087] The protection module is used to generate a first key, send the first key to a first terminal and a second terminal, and the first terminal and the second terminal generate a second key based on the first key sent by the protection module; the second key generated by the first terminal is the same as the second terminal; the protection module encrypts the second key generated in the first terminal and the second terminal; the protection module imports the encrypted second key from the first terminal or the second terminal and saves it, and the first terminal calls the encrypted second key saved in the protection module to encrypt communication data.

[0088] According to the fourth aspect of an embodiment of the present disclosure, a key management electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by one or more processors, the one or more processors implement the method provided by the first aspect of the embodiment of the present invention.

[0089] According to a fifth aspect of an embodiment of the present disclosure, a computer-readable medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method provided by the first aspect of the embodiment of the present disclosure is implemented.

[0090] According to a sixth aspect of an embodiment of the present invention, there is provided a computer program product, including a computer program, which implements the method of any of the above embodiments when executed by a processor.

[0091] Figure 6 An exemplary system architecture 600 is shown to which the key management method or key management apparatus implemented by the present disclosure can be applied.

[0092] like Figure 6 As shown, system architecture 600 may include terminal devices 601, 602, 603, network 604 and server 605. Network 604 is used to provide a medium for communication links between terminal devices 601, 602, 603 and server 605. Network 604 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0093] The user can use the terminal devices 601, 602, 603 to interact with the server 605 through the network 604 to receive or send messages, etc. Various communication client applications can be installed on the terminal devices 601, 602, 603, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0094] The terminal devices 601 , 602 , and 603 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers, etc.

[0095] The server 605 may be a server that provides various services, such as a background management server (only an example) that provides support for shopping websites browsed by users using the terminal devices 601, 602, and 603. The background management server may process the received key management request and feed back the processing result (only an example) to the terminal device.

[0096] It should be noted that the key management method provided in the embodiment of the present invention is generally executed by the server 605, and accordingly, the key management device is generally set in the server 605. The key management method provided in the embodiment of the present invention can also be executed by the terminal devices 601, 602, and 603, and accordingly, the key management device can be set in the terminal devices 601, 602, and 603.

[0097] It should be understood that Figure 6 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0098] Reference below Figure 7 , which shows a schematic diagram of the structure of a computer system 700 of a terminal device suitable for implementing an embodiment of the present invention. Figure 7 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0099] like Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other through a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0100] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0101] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above-mentioned functions defined in the system of the present invention are executed.

[0102] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0103] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0104] The modules involved in the embodiments of the present invention may be implemented by software or hardware. The modules described may also be set in a processor. For example, a processor includes a generation module, a session encryption module, and a data encryption module. The names of these modules do not constitute limitations on the modules themselves in some cases. For example, the generation module may also be described as a "first key generation module."

[0105] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device implements the following method: generating a first key, sending the first key to a requester and a service party, so that the requester and the service party generate a second key based on the first key; the second key generated by the requester and the service party is the same; encrypting the second key generated by the requester and the service party; importing the encrypted second key from the requester or the service party and saving it, so that the requester calls the saved encrypted second key to encrypt the communication data.

[0106] Finally, it should be noted that the above embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure is described in detail with reference to the above embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above embodiments within the technical scope disclosed in the present disclosure, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A key management method, characterized in that: include: Generate a first key, and send the first key to a requester and a service provider, so that the requester and the service provider generate a second key based on the first key; The second key generated by the requesting party and the service party is the same; Encrypting the second key generated in the requester and the servicer; The encrypted second key is imported from the requester or the service provider and saved, so that the requester calls the saved encrypted second key to encrypt the communication data.

2. The method according to claim 1, characterized in that Before generating the first key, the following steps are also included: Based on the received identity authentication request initiated by the requester and the verification information of the requester, the requester is authenticated and it is confirmed that the identity authentication of the requester is passed.

3. The method according to claim 1, characterized in that Before sending the first key to the requester and the server, the method further includes: When the validity verification of the service provider is passed, the first key is encrypted based on the received public key of the service provider.

4. The method according to claim 3, characterized in that: The second key is obtained based on the decrypted first key, the service party random number and the requesting party random number; the decrypted first key is obtained by decrypting the encrypted first key using the service party private key.

5. The method according to claim 1, characterized in that Encrypting the second key generated in the requester and the server, including: Generate a key encryption public key and a key encryption private key; Through a pre-established encryption interface, the second key generated in the requester and the service party is encrypted using a key encryption public key, and the key encryption private key is sent to the service party; wherein the key encryption private key is used to decrypt the second key encrypted by the key encryption public key.

6. A key management device, characterized in that: include: A generating module, configured to generate a first key, and send the first key to a requesting party and a service party, so that the requesting party and the service party generate a second key based on the first key; The second key generated by the requesting party and the service party is the same; A session encryption module, used for encrypting the second key generated in the requester and the servicer; The data encryption module imports and saves the encrypted second key from the requester or the service provider, so that the requester calls the saved encrypted second key to encrypt the communication data.

7. A key management system, characterized in that: It includes a protection module, a first terminal and a second terminal; The protection module is used to generate a first key, and send the first key to a first terminal and a second terminal, wherein the first terminal and the second terminal generate a second key based on the first key sent by the protection module; the second key generated by the first terminal and the second terminal is the same; the protection module encrypts the second key generated in the first terminal and the second terminal; The protection module imports and stores the encrypted second key from the first terminal or the second terminal, and the first terminal uses the encrypted second key stored in the protection module to encrypt the communication data.

8. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

9. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

10. A computer program product, comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 5.

Images