Vehicle key management method and device, medium and program product
By deploying applications and containers in the key management system of the Internet of Vehicles system, and using user identification, application identification, container identification and target key to perform key services, the problem of degradation of key reliability under single key management is solved, and higher security and reliability are achieved.
Patent Information
- Application Number
- CN202411763549.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-03
- Publication Date
- 2025-03-28
AI Technical Summary
In the prior art, a single key is usually used in the Internet of Vehicles system to handle multiple security needs, resulting in a decrease in the reliability of the key, which in turn affects the security of the entire Internet of Vehicles system.
At least one application and at least one container are deployed in the key management system, and the key index corresponding to each application is stored in the at least one container. By generating a key processing request, including user ID, container ID and application ID of the target application, determine the target container and query the target key index, and finally perform the key service using the user ID, application ID, container ID and target key.
By using keys corresponding to different applications and containers, the security during key tasks is improved, the confidentiality of communication data is improved, and the security and reliability of the Internet of Vehicles system is enhanced.
Smart Images
Figure CN119728094A_ABST
Abstract
Description
Technical Field
[0001] One or more embodiments of the present application relate to the field of key technology, and in particular, to a vehicle key management method, device, medium, and program product. Background Art
[0002] With the widespread application of Internet of Vehicles technology, the security challenges it faces are becoming increasingly severe. Once the communication data involved in the Internet of Vehicles process is intercepted or tampered with by malicious attackers, serious consequences may occur.
[0003] In related technologies, keys are usually used to ensure the security of communication data in the process of Internet of Vehicles. However, for different key application scenarios, related technologies often use a single key to handle multiple security requirements. Although this approach simplifies the key management process, it brings security risks, because once the key is cracked or leaked, all communications that rely on it will be threatened. Therefore, this approach of using a single key may cause the reliability of the key to be significantly reduced, thereby affecting the security of the entire Internet of Vehicles system. Summary of the invention
[0004] The present application provides a vehicle key management method, device, medium and program product to address the deficiencies in the related art.
[0005] According to a first aspect of one or more embodiments of the present application, a vehicle key management method is provided, which is applied to a key management system, wherein the key management system is deployed with at least one application and at least one container, and a key index corresponding to each application is stored in at least one container, and the method includes:
[0006] In response to the key processing instruction, a key processing request is generated, wherein the key processing request includes a user identifier, a container identifier, and an application identifier of a target application, wherein the target application represents a key service requested by an initiator of the key processing instruction;
[0007] Determine a target container corresponding to the container identifier according to the key processing request, and search the target container for a target key index that matches the application identifier;
[0008] The target key corresponding to the target key index is queried, and the key service is performed using the user identifier, the application identifier, the container identifier and the target key.
[0009] Optionally, generating a key processing request in response to a key processing instruction includes any of the following methods: when the key processing instruction carries the container identifier and the service information of the key service, determining the user identity of the initiator in response to the key processing instruction, so as to determine the user identifier according to the user identity of the initiator, and determining the target application according to the service information of the key service, and generating the key processing request according to the application identifier of the target application, the container identifier and the user identifier; or, when the key processing instruction carries the container identifier, determining the user type and user identity of the initiator in response to the key processing instruction, so as to determine the key service requested by the initiator according to the user type of the initiator, and determining the target application according to the determined key service; and determining the user identifier according to the user identity of the initiator, and generating the key processing request according to the application identifier of the target application, the container identifier and the user identifier.
[0010] Optionally, a container usage certificate is stored in the key management system, and the certificate is used to record each user's permission to use the container; the method also includes: after determining the target container, calling the container usage certificate to authenticate the user identifier contained in the key processing request; if the authentication result shows that the initiator corresponding to the user identifier has the permission to use the target container, querying the target container for a target key index that matches the application identifier; if the authentication result shows that the initiator corresponding to the user identifier does not have the permission to use the target container, returning a prompt message to the initiator, and the prompt message is used to indicate that the key service cannot be executed.
[0011] Optionally, the use of the user identifier, the application identifier, the container identifier and the target key to perform the key service includes: when it is determined that the key service needs to generate a new key, generating a new key according to the user identifier, the application identifier, the container identifier and the target key, and using the new key to complete the key service.
[0012] Optionally, the key management system also includes a cryptographic machine, and the method also includes: storing the generated new key in the cryptographic machine to apply the new key to the next key processing request for the target application; and / or generating a new key index corresponding to the new key, and updating the key index corresponding to the target application to the new key index in the container corresponding to the target application.
[0013] Optionally, when the key service is requested for the first time, the target key is the initial key generated when the target application is created; when the key service is not requested for the first time, the target key is the most recently generated key in the historical request process of the key service.
[0014] Optionally, the key service includes any one of the following: signature service, signature verification service, encryption service, decryption service, and key generation service.
[0015] According to a second aspect of one or more embodiments of the present application, a key management system is provided, including:
[0016] An application layer, in which at least one application is deployed, and the application layer is used to generate a key processing request in response to a key processing instruction, wherein the key processing request includes a user identifier, a container identifier, and an application identifier of a target application, and the target application represents a key service requested by an initiator of the key processing instruction;
[0017] A container layer, in which at least one container is deployed, and a key index corresponding to each application is stored in at least one container, and the container layer is used to determine a target container corresponding to the container identifier according to the key processing request, and query the target container for a target key index that matches the application identifier;
[0018] The key management layer is used to query the target key corresponding to the target key index, and perform the key service using the user identifier, the application identifier, the container identifier and the target key.
[0019] Optionally, the system further includes: a cryptographic machine, for generating a new key according to the user identifier, the application identifier, the container identifier and the target key when it is determined that the key service needs to generate a new key.
[0020] According to a third aspect of one or more embodiments of the present application, a computer program product is provided, comprising a computer program and / or instructions, which, when executed by a processor, implement the steps of the method described in any one of the embodiments of the first aspect above.
[0021] It can be seen from the above technical solution that in one or more embodiments of the present application, at least one application and at least one container are deployed in the key management system to store the key index corresponding to each application in at least one container. Each application represents a different key service, and different key services correspond to different key application scenarios. When any user wants to call an application to implement a corresponding key service, a key processing instruction is sent to the vehicle. The key management system in the vehicle generates a key processing request based on the key processing instruction, and the key processing request carries a user identifier, a container identifier, and an application identifier of the target application. Then, the target key index that matches the application identifier is queried from the target container corresponding to the container identifier, and then the target key is determined according to the target key index. Finally, the key service represented by the target application is executed based on the user identifier, the application identifier, the container identifier, and the target key.
[0022] Since each application has its own corresponding key, and the container identifier is temporarily specified by the user when requesting the key service, it is random. Therefore, executing the key service based on the temporarily specified container identifier and the target key corresponding to the target application can effectively improve the security during the execution of the key task, thereby improving the confidentiality of the communication data contained in the key task. It can be seen that the present application scheme realizes the execution of key tasks using different container identifiers and target keys in different key application scenarios, which helps to flexibly meet the security requirements in different key application scenarios and improve the security and reliability of the Internet of Vehicles system.
[0023] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.
[0025] Figure 1 It is a schematic diagram of the architecture of a key management system provided by an exemplary embodiment.
[0026] Figure 2 It is a flowchart of a vehicle key management method provided by an exemplary embodiment.
[0027] Figure 3 is a schematic diagram of an application and a container provided by an exemplary embodiment.
[0028] Figure 4 It is a schematic diagram of executing a key service provided by an exemplary embodiment.
[0029] Figure 5aIt is a schematic diagram of a key management system provided by an exemplary embodiment.
[0030] Figure 5b is a schematic diagram of another key management system provided by an exemplary embodiment.
[0031] Figure 5c It is a schematic diagram of yet another key management system provided by an exemplary embodiment.
[0032] Figure 6 It is a schematic structural diagram of an electronic device provided by an exemplary embodiment.
[0033] Figure 7 It is a block diagram of a vehicle key management device provided by an exemplary embodiment. DETAILED DESCRIPTION
[0034] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.
[0035] Next, one or more embodiments of the present application are described in detail.
[0036] Figure 1 The following is a schematic diagram of the architecture of a key management system provided by an exemplary embodiment. Figure 1 As shown, the key management system may include a server 11, a network 12, and several vehicles, such as vehicles 13-14.
[0037] The server 11 may be a physical server including an independent host, or the server 11 may be a virtual server carried by a host cluster. During operation, the server 11 may run a server-side program of the key management system to realize the server end of the key management system, which may also be referred to as a corresponding key management platform.
[0038] The vehicles 13-14 may be any vehicles. The vehicles 13-14 and the server 11 may be directly or indirectly connected via wired communication or wireless communication, and this application does not impose any special restrictions.
[0039] based on Figure 1In the key management system shown, any of the vehicles 13 to 14 can obtain a key processing instruction initiated by a driver or passenger in the vehicle, and generate a key processing request based on the instruction, and then submit the generated key processing request to the server 11. The server 11 can parse the received key processing request to obtain the user identifier, container identifier, and application identifier of the target application carried in the key processing request. Then, the target key index matching the application identifier is obtained from the target container corresponding to the container identifier, and the target key corresponding to the target key index is queried. Finally, the key service is executed using the user identifier, application identifier, container identifier, and target key, and the execution result of the key service is returned to the vehicle that submitted the key processing request, so that the vehicle can display the execution result to the driver or passenger.
[0040] In another embodiment, the key management system may include only the vehicle. Figure 1 Taking vehicle 13 in the example, vehicle 13 can obtain the key processing instruction initiated by the driver and passenger in the vehicle, and generate a key processing request based on the key processing instruction, and the key processing request includes the user identifier, container identifier and application identifier of the target application. Then, the target key index matching the application identifier is obtained from the target container corresponding to the container identifier, and the target key corresponding to the target key index is queried. Finally, the key service is executed using the user identifier, application identifier, container identifier and target key, and the execution result of the key service is displayed to the driver and passenger.
[0041] Figure 2 A flowchart of a vehicle key management method is provided as an exemplary embodiment. The method can be applied to a key management system, which includes at least one application and at least one container. Figure 3 FIG. 1 is a schematic diagram of an application and a container provided by an exemplary embodiment. Figure 3 As shown, application 1 to application n and container 1 to container n are deployed in the key management system. The key index corresponding to any application is stored in multiple containers, and the key index is used to query the target key corresponding to any of the aforementioned applications. For example, key index 1 corresponding to application 1 can be stored in container 1 and container 2; key index 2 corresponding to application 2 can be stored in container 2 and container n. The number of key indexes stored in each container is not necessarily the same. The key index can be in the form of a key-value pair, a numerical value, or a string, etc., which is not limited in this application. By storing the key index corresponding to any application in multiple containers, when the user requests a key service, no matter which container is specified, the user can successfully obtain the required key service, which helps to meet the user's personalized needs, and because the container is randomly specified by the user, the security of the key service execution process is further improved.
[0042] Combination Figure 2, the vehicle key management method may include the following steps:
[0043] S201. In response to a key processing instruction, generate a key processing request, wherein the key processing request includes a user identifier, a container identifier, and an application identifier of a target application, wherein the target application represents a key service requested by an initiator of the key processing instruction.
[0044] Key services can be understood as services implemented using keys, such as services that use keys for encryption, services that use keys for decryption, and services that generate new keys. In other words, different key services correspond to different key application scenarios. In this embodiment, the key service is encapsulated in the form of an application and deployed in the key management system. When a user wants to call the key service for communication, a key processing instruction can be initiated to the vehicle. The key management system can generate a corresponding key processing request based on the key processing instruction, which will include a user identifier, a container identifier, and an application identifier of the target application. Among them, the user identifier refers to the identifier corresponding to the initiator of the key processing instruction, which can uniquely identify and distinguish different users, such as the user ID can be used as the user identifier. The container identifier is used to uniquely identify and distinguish different containers, and may include but is not limited to container names, container IDs, etc. The application identifier is used to uniquely identify and distinguish different applications, and may include but is not limited to application names, application IDs, etc. It should be noted that this application does not specifically limit the specific forms of user identifiers, container identifiers, and application identifiers. In this embodiment, the so-called target application can represent the key service requested by the initiator of the key processing instruction.
[0045] In one embodiment, a user may send a key processing instruction to a vehicle, and the key processing instruction carries service information of a key service requested by the user and a container identifier of a container specified by the user. The key management system determines the user identity of the initiator of the key processing instruction in response to the key processing instruction, and obtains the user identifier of the initiator based on the user identity. At the same time, the key management system may determine the target application based on the service information of the key service contained in the key processing instruction. Furthermore, the key management system may generate a key processing request based on the application identifier of the target application, the container identifier, and the user identifier of the initiator.
[0046] In addition, the key processing instruction sent by the user to the vehicle may also only include the container identifier of the container specified by the user. The key management system can determine the user type and user identity of the initiator in response to the key processing instruction. User types may include secure boot users, Secoc (Security Onboard Communication) users, and in-vehicle TLS (Transport Layer Security) users. Among them, secure boot users refer to users who start key processing instructions from trusted software; Secoc users refer to users who use or rely on SECOC chip technology for secure operations; in-vehicle TLS users refer to users who use TLS protocol for secure communication in the internal network of the vehicle. Usually, secure boot users are in the key application scenario of signing and require signing services; Secoc users and in-vehicle TLS are used in the key application scenario of key generation and require key generation services. In addition, there are signature verification users in the key application scenario of signature verification, which require signature verification services. After determining the user type of the initiator, the key service requested by the initiator can be determined according to the user type, and then the target application can be determined according to the determined key service. At the same time, the key management system can determine the user identifier of the initiator according to the user identity of the initiator, and then generate a key processing request according to the application identifier, container identifier and user identifier of the target application.
[0047] This embodiment supports users to initiate key processing instructions according to their specific needs. For example, users can decide the content of the key processing instructions themselves, and thus generate key processing requests in different ways according to the content of the key processing instructions, which helps to meet specific security requirements or user personalized needs.
[0048] In one embodiment, the key service may include but is not limited to a signature service, a signature verification service, an encryption service, a decryption service, and a key generation service.
[0049] S202: Determine a target container corresponding to the container identifier according to the key processing request, and search the target container for a target key index that matches the application identifier.
[0050] The key management system can determine the target container according to the container identifier included in the key processing request. Since each container stores key indexes corresponding to multiple applications, after determining the target container, it is necessary to query the target container for a target key index that matches the application identifier.
[0051] In one embodiment, a container usage certificate is stored in the key management system, and the certificate is used to record the use rights of each user to the container, so the container usage certificate can be used to verify whether the initiator of the key processing instruction has the right to use the container. Exemplarily, a container management module can be deployed in the key management system to manage multiple deployed containers and container usage certificates through the container management module, wherein the management operations for the container may include but are not limited to: creating a new container, deleting a container, and updating the key index stored in the container. After determining the target container, the container usage certificate can be called to authenticate the user identifier contained in the key processing request. If the authentication is successful, it means that the user corresponding to the user identifier (i.e., the initiator of the key processing instruction) has the right to use the target container and is a safe user, then the target key index matching the application identifier can be queried in the determined target container. If the authentication fails, it means that the initiator of the key processing instruction does not have the right to use the target container and may be a malicious attacker, then there is no need to perform subsequent operations, and a prompt message similar to "unable to call the target application" is directly returned to the user, so as to prompt the initiator of the key processing instruction that the key service requested by it cannot be executed based on the prompt message.
[0052] The above method uses the container to use the certificate to authenticate the user identity of the initiator of the key processing instruction, and only queries the target key index when the user identity is authenticated. This can avoid opening the right to query the key index in the container to malicious attackers, thereby preventing malicious attackers from obtaining the key, further improving the security of the Internet of Vehicles system.
[0053] S203: Query the target key corresponding to the target key index, and execute the key service using the user identifier, the application identifier, the container identifier and the target key.
[0054] The key management system stores the keys corresponding to each application, and the target key can be queried according to the target key index. Then, the key service represented by the target application is executed using the user identifier, application identifier, container identifier and target key.
[0055] Since each application has its own corresponding key, and the container identifier is temporarily specified by the user when requesting the key service, it is random. Therefore, executing the key service based on the temporarily specified container identifier and the target key corresponding to the target application can effectively improve the security during the execution of the key task, thereby improving the confidentiality of the communication data contained in the key task. It can be seen that the present application scheme realizes the execution of key tasks using different container identifiers and target keys in different key application scenarios, which helps to flexibly meet the security requirements in different key application scenarios and improve the security and reliability of the Internet of Vehicles system.
[0056] In one embodiment, the key service requested by the user may include the need to generate a new key, such as the key generation service, signature service and encryption service all include the need to generate a new key. In this case, a new key can be generated according to the user identifier, application identifier, container identifier and target key, and the key service can be completed using the generated new key. For example, user A wants to request a key generation service, and the specified container is container 3. Then, the key management system can respond to the key processing instruction initiated by user A, determine that the key generation service corresponds to application 2 and generate a corresponding key processing request, which carries the user identifier of user A, the container identifier of container 3 and the application identifier of application 2. Then, the key management system queries container 3 according to the container identifier of container 3, and calls the container to use the certificate to authenticate the user identifier of user A carried in the key processing request, so as to determine whether user A has the right to use container 3 based on the authentication result. Assuming that the authentication is passed, the target key index corresponding to the application identifier is queried in container 3. Then, the target key corresponding to the target key index is queried among the multiple keys stored in the key management system, and the target key, user identifier, application identifier, and container identifier are used as inputs of the preset key generation algorithm to generate a new key based on the preset key generation algorithm. The generated new key can be a symmetric key or an asymmetric key, which is related to the preset key generation algorithm. Those skilled in the art can set a specific preset key generation algorithm according to actual needs, and this application does not limit this.
[0057] For example, you can deploy a cryptographic machine in a key management system, and the cryptographic machine has a preset key generation algorithm deployed on it. Figure 4 , the target key index, user ID, application ID, and container ID can be input into the cryptographic machine. The cryptographic machine determines the target key according to the target key index, and then generates a new key according to the target key, user ID, application ID, and container ID. The cryptographic machine can then return the new key to user A. Since the cryptographic machine can provide a highly secure environment, generating a new key and performing encryption, signing, and other processes in the cryptographic machine can effectively protect the confidentiality and integrity of the data.
[0058] The following describes the execution process of different key services:
[0059] (1) If the key service requested by the user is a key generation service, completing the key service using the generated new key is equivalent to returning the generated new key to the user.
[0060] (2) If the key service requested by the user is a signature service, the key processing instruction will contain the data that needs to be signed. Using the generated new key to perform the key service is equivalent to using the generated new key to sign the data that needs to be signed and returning the signature result to the user.
[0061] (3) If the key service requested by the user is an encryption service, the key processing request will include the data to be encrypted. Using the generated new key to perform the key service is equivalent to using the generated new key to encrypt the data to be encrypted and returning the encryption result to the user.
[0062] It should be noted that for the signature verification service and decryption service, there is no need to generate new keys. Therefore, the user ID, application ID, container ID, target key and data to be verified / data to be decrypted can be input into the cryptographic machine, so that the cryptographic machine can implement the signature verification service / decryption service and return the corresponding signature verification result / decryption result to the user.
[0063] In this embodiment, when the key service requested by the user requires the generation of a new key, a key can be generated in real time in response to a key processing instruction initiated by the user, and the key service requested by the user can be executed using the key generated in real time. Compared with a fixed key, the key generated in real time has higher confidentiality and randomness, so the above method can significantly improve the security and reliability of the Internet of Vehicles system.
[0064] In one embodiment, the key management system stores keys corresponding to each application. Any application can be called by multiple users. When the key service represented by the target application is requested for the first time (i.e., the target application is called for the first time), the target key queried based on the target key index is the initial key generated when the target application is created. In other words, when creating an application, the key management system can generate an initial key corresponding to each application, and store the key index corresponding to the initial key in a container. If an application is called for the first time, the corresponding initial key can be queried based on the key index corresponding to the application, and the key service represented by the application can be executed based on the initial key, application identifier, user identifier, and container identifier.
[0065] If a new key is generated during the execution of the key service represented by the target application, the new key can be used to replace the initial key, thereby dynamically updating the key corresponding to the target application. After updating the key corresponding to the target application, during the next call to the target application (i.e., the next request to the key service represented by the target application), the updated key can be queried according to the target key index corresponding to the target application, and then the key service represented by the target application can be executed according to the updated key. In other words, the key corresponding to the target application can be continuously updated during multiple calls to the target application. In this way, when the key service represented by the target application is not requested for the first time, the queried target key is not the initial key, but the latest key generated by the key service represented by the target application during the historical request process.
[0066] The above method realizes the dynamic update of each key stored in the key management system, which can reduce the risk of key being cracked or leaked and improve the security of communication data.
[0067] In one embodiment, the key management system may include a cryptographic machine, which can provide a highly secure environment to store keys corresponding to each application. Therefore, if a new key is generated in the process of executing the key service represented by the target application, the generated new key can be stored in the cryptographic machine so that the new key can be applied to the subsequent call process for the target application. And, as mentioned above, the cryptographic machine can be called to perform key services. Since the cryptographic machine can realize extremely fast communication between applications, the use of the cryptographic machine to perform the key service represented by the target application can fully cope with the strict real-time requirements during vehicle operation and improve the response speed of the key management system to key processing requests.
[0068] Usually, the cryptographic machine can be called through the cryptographic machine interface. The cryptographic machine can provide an interface to the system outside it (hereinafter referred to as the "external system"), so that the external system can easily use the security services it provides without having to deeply understand the internal working mechanism of the cryptographic machine. Therefore, the cryptographic machine interface layer can be deployed in the key management system. In this way, when the cryptographic machine meets the interface standard of the cryptographic machine interface layer, the cryptographic machine can be directly connected to the key management system to achieve rapid development and adaptation.
[0069] In addition, a database can be deployed in the key management system to store various configuration files, such as container configuration files, application configuration files, etc. This method of storing keys and configuration files separately (i.e., storing keys in the cryptographic machine and configuration files in the database) can ensure the security of the keys on the one hand, and reduce the storage overhead of the cryptographic machine on the other.
[0070] Regarding key indexes, the key indexes corresponding to each application may include three types: 1) an index used to represent the key storage location; 2) an index used to represent the key information itself; 3) an index used to represent the key storage location and the key information itself;
[0071] In the case where the target key index is of the first type, if a new key corresponding to the target application is generated, the new key needs to be stored in the storage location represented by the target key index. In this case, there is no need to update the target key index stored in the container.
[0072] In the case where the target key index is of the second type described above, if a new key corresponding to the target application is generated, a new key index needs to be regenerated based on the new key, and the new key index needs to be stored in the container corresponding to the target application to update the original key index. For example, the target application is application 2, and the target key index corresponding to application 2 is stored in containers 2, 3, and 4. Then, after the new key index is generated, the target key index corresponding to application 2 in containers 2, 3, and 4 needs to be updated to the new key index.
[0073] In the case where the target key index is of the third type, if a new key corresponding to the target application is generated, the new key needs to be stored in the storage location represented by the target key index, and a new key index needs to be regenerated based on the new key and the storage location. Also, the target key index stored in the container corresponding to the target application is updated to the new key index.
[0074] In this way, after generating a new key corresponding to the target application, updating the corresponding key index in a timely manner helps ensure that when the target application is subsequently called, the correct target key is queried according to the correct key index, thereby ensuring the smooth execution of the key service.
[0075] In one embodiment, a management interface may be deployed in the key management system so that the administrator of the key management system can monitor and adjust the operation of the key management system through the information displayed on the management interface. The information displayed on the management interface may include, but is not limited to: information of each application contained in the key management system (such as the name of each application, application identification, key services represented by each application, etc.), information of each container (such as container name, container identification, number of containers, key index information stored in each container, etc.), data stored in the database, cryptographic machine interface information, cryptographic machine configuration information, and information of each key stored in the cryptographic machine.
[0076] By visually displaying relevant information of the key management system on the management interface, it is helpful to intuitively and clearly display the complex operating conditions within the key management system through data forms such as charts, so that managers can quickly understand the status of the key management system, discover and solve problems in a timely manner, and reduce downtime.
[0077] Figure 5a FIG. 1 is a schematic diagram of a key management system provided by an exemplary embodiment. Figure 5a As shown, the key management system includes an application layer, a container layer, and a key management layer. The application layer is deployed with at least one application, the container layer is deployed with at least one container, and the key index corresponding to each application is stored in at least one container. The key management layer is used to manage the keys corresponding to each application.
[0078] based on Figure 5a The process of implementing the solution of the present application in the key management system shown is as follows: the application layer can obtain the key processing instruction initiated by the user through the communication interface between the user and the key management system. The application layer generates a key processing request in response to the key processing instruction and sends the key processing request to the container layer. The key processing request carries the user identifier, the container identifier and the application identifier of the target application. Exemplarily, in order to facilitate the management of each application in the application layer, an application management module can also be set. The application management module can be responsible for creating new applications, deleting old applications, updating application versions, etc.
[0079] The container layer also includes a container interface. The container layer determines the target container based on the container identifier included in the key processing request, and then calls the container to authenticate the user identifier included in the key processing request using the certificate. If the authentication is successful, the target key index that matches the application identifier is queried in the target container through the container interface, and the queried target key index, container identifier, application identifier, and user identifier are sent to the key management layer. Exemplarily, in order to facilitate the management of each container in the container layer, a container management module can also be set. The container management module can be responsible for creating new containers, deleting old containers, updating information stored in containers, etc.
[0080] The key management layer is used to query the target key corresponding to the target key index among the stored multiple keys, and perform key services using the user identifier, application identifier, container identifier and target key.
[0081] In one embodiment, see Figure 5b , the key management system may also include a cryptographic machine. The key management layer may store the keys corresponding to each application in the cryptographic machine. During the implementation of the present application scheme, the key management layer may input the user identifier, application identifier, container identifier and target key index from the container layer into the cryptographic machine by calling the cryptographic machine interface, so that the cryptographic machine can query the target key and execute the key service requested by the user. It should be noted that if the key service requested by the user requires the generation of a new key, the cryptographic machine will first determine the target key based on the target key index, and then generate a new key based on the user identifier, application identifier, container identifier and target key, and use the new key to execute the key service. In addition, a database may be deployed in the key management system to store various configuration files, such as container configuration files, application configuration files, etc.
[0082] In one embodiment, see Figure 5c The key management system may also include a management interface. The management interface may display key index information stored in each container, each key information stored in the cryptographic machine, and other information (such as container information, application information) to the staff of the key management system.
[0083] Figure 6 is a schematic diagram of the structure of an electronic device according to an exemplary embodiment of the present application. Figure 6 At the hardware level, the electronic device includes a processor 602, an internal bus 604, a network interface 606, a memory 608, and a non-volatile memory 610, and may also include hardware required for other services. The processor 602 reads the corresponding computer program from the non-volatile memory 610 into the memory 608 and then runs it. Of course, in addition to the software implementation, this application does not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.
[0084] Corresponding to the above method embodiment, the present application also provides an embodiment of a vehicle key management device.
[0085] Figure 7 This is a block diagram of a vehicle key management device according to an exemplary embodiment of the present application. The device can be applied to a key management system, in which at least one application and at least one container are deployed, and a key index corresponding to each application is stored in at least one container. Figure 7 , the device includes a generating unit 701, a container determining unit 702 and a key determining unit 703, wherein:
[0086] The generating unit 701 is configured to generate a key processing request in response to the key processing instruction, wherein the key processing request includes a user identifier, a container identifier, and an application identifier of a target application, wherein the target application represents a key service requested by an initiator of the key processing instruction;
[0087] A container determining unit 702 is configured to determine a target container corresponding to the container identifier according to the key processing request, and search the target container for a target key index that matches the application identifier;
[0088] The key determination unit 703 is configured to query the target key corresponding to the target key index, and perform the key service using the user identifier, the application identifier, the container identifier and the target key.
[0089] Optionally, the generation unit 701 is specifically used to: when the key processing instruction carries the container identifier and the service information of the key service, determine the user identity of the initiator in response to the key processing instruction, so as to determine the user identifier according to the user identity of the initiator, and determine the target application according to the service information of the key service, and generate the key processing request according to the application identifier of the target application, the container identifier and the user identifier; or, when the key processing instruction carries the container identifier, determine the user type and user identity of the initiator in response to the key processing instruction, so as to determine the key service requested by the initiator according to the user type of the initiator, and determine the target application according to the determined key service; and determine the user identifier according to the user identity of the initiator, and generate the key processing request according to the application identifier of the target application, the container identifier and the user identifier.
[0090] Optionally, the key management system stores a container usage certificate, which is used to record each user's permission to use the container; the device also includes:
[0091] The authentication unit 704 is configured to, after determining the target container, call the container to use the certificate to authenticate the user identifier included in the key processing request; if the authentication result shows that the initiator corresponding to the user identifier has the right to use the target container, query the target container for a target key index that matches the application identifier; if the authentication result shows that the initiator corresponding to the user identifier does not have the right to use the target container, return a prompt message to the initiator, where the prompt message is used to indicate that the key service cannot be executed.
[0092] Optionally, the key determination unit 703 is specifically used to: when it is determined that the key service needs to generate a new key, generate a new key corresponding to the key processing request according to the user identifier, the application identifier, the container identifier and the target key, and use the new key to complete the key service.
[0093] Optionally, the key management system further includes a cryptographic machine, and the device further includes:
[0094] The update unit 705 is configured to store the generated new key to the cryptographic machine so as to apply the new key to the next key processing request for the target application; and / or to generate a new key index corresponding to the new key, and update the key index corresponding to the target application to the new key index in the container corresponding to the target application.
[0095] Optionally, when the key service is requested for the first time, the target key is the initial key generated when the target application is created; when the key service is not requested for the first time, the target key is the most recently generated key in the historical request process of the key service.
[0096] Optionally, the key service includes any one of the following: signature service, signature verification service, encryption service, decryption service, and key generation service.
[0097] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here.
[0098] The devices or modules described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device, or a combination of any of these devices.
[0099] In a typical configuration, a computer includes one or more processors, including a central processing unit (CPU) and a graphics processing unit (GPU), an input / output interface, a network interface, and a memory. The CPU is used for computing simulations, and the GPU is used for outputting high-quality 3D images.
[0100] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.
[0101] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.
[0102] Corresponding to the embodiments of the aforementioned method, the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the steps of any embodiment of the aforementioned method are implemented.
[0103] Corresponding to the embodiments of the aforementioned method, the present application also provides a computer program product, including a computer program and / or instructions, which implement the steps of any embodiment of the aforementioned method when executed by a processor.
[0104] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.
Claims
1. A method for managing a vehicle key, characterized in that: Applied to a key management system, the key management system is deployed with at least one application and at least one container, and a key index corresponding to each application is stored in at least one container, the method includes: In response to the key processing instruction, a key processing request is generated, wherein the key processing request includes a user identifier, a container identifier, and an application identifier of a target application, wherein the target application represents a key service requested by an initiator of the key processing instruction; Determine a target container corresponding to the container identifier according to the key processing request, and search the target container for a target key index that matches the application identifier; The target key corresponding to the target key index is queried, and the key service is performed using the user identifier, the application identifier, the container identifier and the target key.
2. The method according to claim 1, characterized in that: The generating of the key processing request in response to the key processing instruction includes any of the following methods: In a case where the key processing instruction carries the container identifier and the service information of the key service, determining the user identity of the initiator in response to the key processing instruction, determining the user identifier according to the user identity of the initiator, and determining the target application according to the service information of the key service, and generating the key processing request according to the application identifier of the target application, the container identifier and the user identifier; or In the case where the container identifier is carried in the key processing instruction, determining the user type and user identity of the initiator in response to the key processing instruction, so as to determine the key service requested by the initiator according to the user type of the initiator, and determining the target application according to the determined key service; The user identifier is determined according to the user identity of the initiator, and the key processing request is generated according to the application identifier of the target application, the container identifier and the user identifier.
3. The method according to claim 1, characterized in that The key management system stores a container use certificate, which is used to record each user's permission to use the container; the method further includes: After determining the target container, calling the container to use the certificate to authenticate the user identifier included in the key processing request; If the authentication result indicates that the initiator corresponding to the user identifier has the right to use the target container, querying the target container for a target key index that matches the application identifier; If the authentication result indicates that the initiator corresponding to the user identifier does not have the right to use the target container, a prompt message is returned to the initiator, where the prompt message is used to indicate that the key service cannot be executed.
4. The method according to claim 1, characterized in that: The performing the key service by using the user identifier, the application identifier, the container identifier and the target key includes: When it is determined that the key service needs to generate a new key, a new key is generated according to the user identifier, the application identifier, the container identifier and the target key, and the key service is completed using the new key.
5. The method according to claim 4, characterized in that The key management system further includes a cryptographic machine, and the method further includes: storing the generated new key in the cryptographic machine so as to apply the new key to the next key processing request for the target application; and / or, A new key index corresponding to the new key is generated, and the key index corresponding to the target application is updated to the new key index in the container corresponding to the target application.
6. The method according to claim 1, characterized in that When the key service is requested for the first time, the target key is an initial key generated when the target application is created; When the key service is not requested for the first time, the target key is the most recently generated key in the process of historically requesting the key service.
7. The method according to claim 1, characterized in that The key service includes any one of the following: signature service, signature verification service, encryption service, decryption service, and key generation service.
8. A key management system, characterized in that: include: An application layer, in which at least one application is deployed, and the application layer is used to generate a key processing request in response to a key processing instruction, wherein the key processing request includes a user identifier, a container identifier, and an application identifier of a target application, and the target application represents the key service requested by the initiator of the key processing instruction; A container layer, in which at least one container is deployed, and a key index corresponding to each application is stored in at least one container, and the container layer is used to determine a target container corresponding to the container identifier according to the key processing request, and query the target container for a target key index that matches the application identifier; The key management layer is used to query the target key corresponding to the target key index, and perform the key service using the user identifier, the application identifier, the container identifier and the target key.
9. The system according to claim 8, characterized in that Also includes: The cryptographic machine is used to generate a new key according to the user identifier, the application identifier, the container identifier and the target key when it is determined that the key service needs to generate a new key.
10. A computer program product, characterized in that The method comprises a computer program and / or instructions, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 7.