Key synchronization method and system

Abstract

The invention relates to a key synchronization method and system. The synchronization method comprises the steps that an encryption end processes an encryption key to generate first verification information; generating a key message and sending the key message to a decryption end through a corresponding message queue; the decryption end obtains the decryption key from the dense management end and generates second verification information; and the decryption end determines whether the encryption key is consistent with the decryption key according to the first verification information and the second verification information, and stores the decryption key when the encryption key is consistent with the decryption key. According to the scheme, the message queue corresponding to the encryption stage is taken as the intermediate stage of data transmission, so that the encryption end and the decryption end are prevented from directly transmitting message information through an overhead channel, the situation that the message is covered due to untimely message processing is avoided, and meanwhile, after the decryption end requests to obtain the decryption key from the dense management end, the decryption time is shortened. The consistency of the keys at the two ends is verified through the verification information, the consistency of the keys distributed by external equipment is not needed, and the method has extremely high controllability and safety.

Description

Technical Field

[0001] The present invention belongs to the technical field of data encryption, and in particular, relates to a key synchronization method and system. Background Art

[0002] Driven by national policy and international situation, infrastructure including transmission encryption has become a major trend. The high security requirements of government, enterprise and financial customers are more urgent, and a complete security system needs to be built, including data transmission. Government, enterprise and financial customers refuse to use commercial encryption algorithms. International commercial encryption algorithms are basically derived from the United States, such as the AES-256 encryption algorithm.

[0003] Compared with the commercial encryption algorithms developed abroad, the encryption processing is performed by using the key distributed by the key management end combined with the business symmetric encryption algorithm, which is more in line with the high security requirements of customers. The key management end is responsible for the acquisition and distribution of the key, and the consistency of the key is controlled by an external device, which makes the security of the key dependent and unreliable. At the same time, the encryption end and the decryption end directly transmit message information through the overhead channel. The cache capacity of the overhead channel is limited. A large amount of information frequently interacts and requires high-performance CPU real-time processing. Once the processing is not timely, the message is easily overwritten and lost, resulting in a failure in the execution of the encryption state machine. If it is stuck in a certain state and cannot be executed to the next hop, it will affect the periodic update function of the key, and the business link will not be able to start the end-to-end encryption function normally. Once the keys of the encryption end and the decryption end issued by the key management end are inconsistent, it will cause business interruption and cause data security accidents. Summary of the invention

[0004] To solve the above problems, the present disclosure provides a key synchronization method and system. This solution uses a message queue as an intermediate stage for data transmission to avoid the situation where messages are not processed in time and are overwritten. It verifies the consistency of keys at both ends by verifying information, without relying on the consistency of keys distributed by external devices.

[0005] In order to solve the above technical problem, the first aspect of the present invention provides a key synchronization method, the method comprising:

[0006] After the encryption end obtains the encryption key from the key management end, the encryption end processes the encryption key through a preset algorithm to generate first verification information; and generates a key message based on the current encryption stage, the key association information and the first verification information, and sends it to the decryption end through the message queue corresponding to the encryption stage;

[0007] The decryption end obtains a decryption key from the key management end through the key association information based on the encryption stage in the key message, and processes the decryption key through the preset algorithm to generate second verification information;

[0008] The decryption end determines whether the encryption key is consistent with the decryption key according to the matching result of the first verification information and the second verification information, and stores the decryption key when the encryption key is consistent with the decryption key.

[0009] According to a preferred embodiment of the present invention, before the encryption end obtains the encryption key from the key management end, the synchronization method further includes:

[0010] The encryption end generates a handshake message during the encryption startup phase, and sends the message to the decryption end through the message queue corresponding to the encryption startup phase;

[0011] After receiving the handshake message, the decryption end sends a handshake confirmation message to the encryption end;

[0012] After the encryption end receives the handshake confirmation message, the encryption end and the decryption end shake hands successfully and confirm whether the overhead channel and the service are normal.

[0013] According to a preferred embodiment of the present invention, after storing the decryption key, the synchronization method further comprises:

[0014] The decryption end sends feedback information that the decryption key has been stored to the encryption end.

[0015] According to a preferred implementation manner of the present invention, the key message further includes: first identification information; the feedback information includes: second identification information corresponding to the key message;

[0016] The synchronization method further comprises:

[0017] If the encryption end does not receive the feedback information within a preset time interval after sending the key message to the decryption end, the encryption end obtains the encryption key from the key management end again;

[0018] If the encryption end receives the feedback information within a preset time interval after sending the key message to the decryption end, it is confirmed whether the second identification information in the feedback information is consistent with the first identification information. When the second identification information is consistent with the first identification information, it is confirmed that the encryption end and the decryption end have completed key synchronization.

[0019] According to a preferred implementation manner of the present invention, the key message further includes: key spare quantity information;

[0020] The synchronization method further comprises:

[0021] After the encryption end obtains the encryption key from the key management end, the encryption key is stored in the encryption end key address corresponding to the key reserve quantity information;

[0022] The decryption end stores the decryption key in the decryption end key address corresponding to the key reserve quantity information.

[0023] According to a preferred embodiment of the present invention, the synchronization method further includes:

[0024] When the storage time of the encryption key reaches a preset time limit, the encryption end confirms whether the feedback information has been received;

[0025] If the encryption end has received the feedback information, a key switching operation is performed and the key reserve quantity information is modified; the decryption end detects in real time whether the key reserve quantity information changes, and switches the decryption key when the key reserve quantity information changes;

[0026] If the encryption end has not received the feedback information, it reports an alarm message.

[0027] According to a preferred embodiment of the present invention, the synchronization method further comprises: when the decryption end detects that the key reserve quantity information changes, the decryption end changes the decryption end working state to an initial state;

[0028] The synchronization method further includes: after the decryption end stores the decryption key, the decryption end changes the working state of the decryption end from the initial state to the key writing state;

[0029] The synchronization method further includes: when the storage time of the encryption key reaches a preset time limit, if the encryption end does not receive the feedback information, the encryption end changes the encryption end working state to an initial state;

[0030] The synchronization method further includes: before the encryption end obtains the encryption key from the key management end, the encryption end determines whether the working state of the encryption end is an initial state, and when the working state of the encryption end is the initial state, the encryption end obtains the encryption key from the key management end;

[0031] The synchronization method further comprises: after the encryption end sends the key message to the decryption end, changing the working state of the encryption end from the initial state to the key writing state;

[0032] The synchronization method further includes: after the encryption end sends the key message to the decryption end, if the encryption end receives the feedback information, the encryption end changes the encryption end working state from the key writing state to the feedback receiving state.

[0033] According to a preferred embodiment of the present invention, the synchronization method further includes:

[0034] When the storage time of the encryption key reaches a preset time limit, the encryption end confirms whether the feedback information has been received by checking whether the working state of the encryption end is a feedback receiving state.

[0035] According to a preferred embodiment of the present invention, the synchronization method further includes:

[0036] When the encryption key is inconsistent with the decryption key, no processing is performed on the decryption key.

[0037] In order to solve the above technical problems, the second aspect of the present invention provides a key synchronization system, the synchronization system comprising: an encryption end, a decryption end and a key management end;

[0038] After the encryption end obtains the encryption key from the key management end, the encryption end processes the encryption key through a preset algorithm to generate first verification information; and generates a key message based on the current encryption stage, the key association information and the first verification information, and sends it to the decryption end through the message queue corresponding to the encryption stage;

[0039] The decryption end obtains a decryption key from the key management end through the key association information based on the encryption stage in the key message, and processes the decryption key through the preset algorithm to generate second verification information;

[0040] The decryption end determines whether the encryption key is consistent with the decryption key according to the matching result of the first verification information and the second verification information, and stores the decryption key when the encryption key is consistent with the decryption key.

[0041] Compared with the prior art, the present invention has the following advantages: after obtaining the encryption key, the encryption end in the present invention generates the first verification information based on the encryption key, and then generates the key message through the encryption stage, key association information and verification information, and sends it to the decryption end through the corresponding message queue. After receiving the key message, the decryption end determines the current encryption stage, and then applies for the decryption key from the key management end through the key association information, and also generates the second verification information by processing the decryption key through the preset algorithm. The decryption end verifies whether the key is consistent through the first verification information and the second verification information. After determining that they are consistent, the decryption key is stored to complete the key synchronization. This scheme uses the message queue corresponding to the encryption stage as the intermediate stage of data transmission to avoid the encryption end and the decryption end directly transmitting the message information through the overhead channel, and avoids the situation where the message processing is not timely covered. At the same time, after the decryption end requests the decryption key from the key management end, it verifies the consistency of the keys at both ends through the verification information, without relying on the consistency of the key distribution of the external device, and has extremely high controllability and security.

[0042] Other features and advantages of the present disclosure will be described in the following description, and partly become apparent from the description, or be understood by implementing the present disclosure. The purpose and other advantages of the present disclosure can be realized and obtained by the structures pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 A schematic diagram of a key synchronization method according to an embodiment of the present disclosure is shown;

[0045] Figure 2 A second schematic diagram of a key synchronization method according to an embodiment of the present disclosure is shown;

[0046] Figure 3 A schematic diagram of a data transmission method based on a message queue between an encryption end and a decryption end according to an embodiment of the present disclosure is shown;

[0047] Figure 4 A third schematic diagram of a key synchronization method according to an embodiment of the present disclosure is shown;

[0048] Figure 5 A block diagram of a key synchronization system according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0050] The same reference numerals in the drawings represent the same or similar elements, components or parts, and thus the repeated description of the same or similar elements, components or parts may be omitted below. It should also be understood that although the first, second, third and other attributives representing the numbers may be used herein to describe various devices, elements, components or parts, these devices, elements, components or parts should not be limited by these attributives. In other words, these attributives are only used to distinguish one from another. For example, the first device may also be called the second device, but it does not deviate from the essential technical solution of the present invention. In addition, the terms "and / or" and "and / or" refer to all combinations including any one or more of the listed items.

[0051] See also Figure 1 , Figure 1 This is a schematic diagram of a key synchronization method provided by the present invention. Figure 1 As shown, the method includes:

[0052] S11. After the encryption end obtains the encryption key from the key management end, it processes the encryption key through a preset algorithm to generate first verification information; and generates a key message based on the current encryption stage, key association information and the first verification information, and sends it to the decryption end through the message queue corresponding to the encryption stage.

[0053] In this embodiment, the key management terminal and key management system are one of the core devices in the field of information security, which involves multiple aspects such as key generation, storage, distribution, update and revocation. The key management terminal is usually a special system or device used to perform these key management tasks to ensure the security and effectiveness of the key.

[0054] In this embodiment, the encryption key is processed by a preset algorithm to obtain the first verification information, so that the key message can carry the verification data converted from the encryption key when the encryption end does not transmit the encryption key, wherein the preset algorithm can be a hash algorithm or a CRC algorithm. The hash algorithm is a mathematical function or algorithm that can convert data of any length (called a "message") into a string of fixed length (called a "hash value" or simply "hash"). This conversion process is achieved through a series of mathematical operations, including bit operations, modulus operations, shift operations, XOR operations, etc. The core idea of ​​the hash algorithm is to convert the input data into a fixed-length output that represents the input as uniquely as possible through a specific operation. The CRC (Cyc lic Redundancy Check) algorithm, i.e., cyclic redundancy check, is a fast algorithm that generates a short fixed-bit verification code based on data such as network data packets or computer files, and is mainly used to detect or verify errors that may occur after data transmission or storage.

[0055] In this embodiment, a key message is generated by the encryption stage, key-associated information and the first verification information and sent to the decryption end. Since the encryption end and the decryption end will constantly interact with each other and the encryption end and the decryption end will constantly interact with each other on the same data and requests due to the update of the key, the encryption stage is added to the key message in this scheme so that the decryption end can know the encryption stage, encryption action and encryption direction corresponding to the key message.

[0056] In this embodiment, the key association information is used by the decryption end to request the decryption key from the key management end. The key association information includes: key ID, key length, key sequence number and other information that can determine the key location or key status.

[0057] In this embodiment, the key message is sent to the decryption end through the message queue corresponding to the encryption stage, which can effectively solve the problem that if the communication between the two devices is not processed in time, the message is easily overwritten or lost, ensuring that data transmission is more efficient and secure.

[0058] In this embodiment, the key message indicates the encryption stage, encryption action, encryption direction, etc. to which the message belongs through the protocol header. The message content stores the message bytes that need to be transmitted. The following table gives the definition of each byte of the protocol header of the message protocol. Length: indicates the total byte length of the overhead message. Stage definition byte: corresponds to the different stages of the encryption state machine, and each stage corresponds to a message cache queue. Separately process the message messages of the corresponding stage. Command type: different action instructions for each encryption stage. For example, the stage 3 encryption startup process includes handshake negotiation, synchronous message sending after the encryption key is written, information feedback after the decryption key is written, encryption exception message transmission, etc. Encryption type: clarify the encryption direction.

[0059]

[0060]

[0061] In this embodiment, before the encryption end obtains the encryption key from the key management end, the encryption end determines whether the working state of the encryption end is the initial state, and when the working state of the encryption end is the initial state, the encryption end obtains the encryption key from the key management end.

[0062] In this embodiment, after the encryption end sends the key message to the decryption end, the working state of the encryption end is changed from the initial state to the key writing state.

[0063] S12: The decryption end obtains a decryption key from the key management end through the key association information based on the encryption stage in the key message, and processes the decryption key through a preset algorithm to generate second verification information.

[0064] In this embodiment, the decryption end determines the operation corresponding to the current encryption stage through the encryption stage in the key message. Different encryption stages will have different operations, such as starting the encryption stage, the response stage after encryption is started, the encryption key writing stage, the encryption status reset stage, etc. Steps S11 and S12 of this scheme are the encryption key writing stage, that is, the encryption end has obtained the encryption key and completed the encryption key writing stage. At this time, after the decryption end determines the current encryption stage, it requests the decryption key from the key management end according to the key association information in the key message.

[0065] In this embodiment, the decryption end uses a preset algorithm consistent with that in the encryption end to process the decryption key to generate the second verification information. The preset algorithm can refer to the scheme in the above embodiment, and this scheme will not be described in detail here.

[0066] S13. The decryption end determines whether the encryption key is consistent with the decryption key according to the matching result of the first verification information and the second verification information, and stores the decryption key if the encryption key is consistent with the decryption key.

[0067] In this embodiment, the decryption end matches the first verification information with the second verification information to determine whether the first verification information and the second verification information are consistent. When the first verification information and the second verification information are consistent, the encryption key and the decryption key are consistent. At this time, the decryption key is stored. If the first verification information and the second verification information are inconsistent, it means that the encryption key and the decryption key are inconsistent. The decryption key can be discarded without processing, and the encryption end is waited for to resend the key message to ensure that the keys of the encryption end and the decryption end are consistent.

[0068] After obtaining the encryption key, the encryption end in the present disclosure generates the first verification information based on the encryption key, and then generates a key message through the encryption stage, key association information and verification information, and sends it to the decryption end through the corresponding message queue. After receiving the key message, the decryption end determines the current encryption stage, and then applies for the decryption key from the key management end through the key association information, and also generates the second verification information by processing the decryption key through the preset algorithm. The decryption end verifies whether the keys are consistent through the first verification information and the second verification information. After determining that they are consistent, the decryption key is stored to complete the key synchronization. This scheme uses the message queue corresponding to the encryption stage as the intermediate stage of data transmission to avoid the encryption end and the decryption end directly transmitting message information through the overhead channel, and avoids the situation where the message processing is not timely covered. At the same time, after the decryption end requests the decryption key from the key management end, it verifies the consistency of the keys at both ends through the verification information, without relying on the consistency of the key distribution of the external device, and has extremely high controllability and security.

[0069] In this embodiment, after the decryption end stores the decryption key, the decryption end changes the working state of the decryption end from the initial state to the key writing state.

[0070] Furthermore, in this solution, the key message also includes: first identification information. After storing the decryption key, the decryption end sends feedback information to the decryption end that the decryption key has been stored, wherein the feedback information includes: second identification information corresponding to the key message, i.e., the first identification information. That is, after obtaining the decryption key, the decryption end feeds back response information to the encryption end, letting the encryption end know that the decryption end has completed key acquisition and storage. At this time, the first identification information is added to the response information, allowing the encryption end to determine which key response this response information corresponds to. At the same time, the identification information can also be used as verification.

[0071] In this embodiment, the synchronization method further includes: if the encryption end does not receive feedback information within a preset time interval after sending the key message to the decryption end, the encryption end re-acquires the encryption key from the key management end. The preset time interval can be set by the staff, or it can be set as the preset time interval based on the longest time for the decryption end to feedback feedback information in past historical data.

[0072] In this embodiment, after the encryption end sends the key message to the decryption end, if no feedback information is received within a preset time interval, it means that there is a problem with the decryption key obtained by the decryption end. It is also possible that the key message is not transmitted to the decryption end, that is, there is a problem with the data transmission channel. In these cases, the decryption end has not completed obtaining the correct key, and the encryption end re-obtains the encryption key and generates a new key message and sends it to the decryption end for key synchronization.

[0073] In this embodiment, the synchronization method further includes: if the encryption end receives feedback information within a preset time interval after sending the key message to the decryption end, confirming whether the second identification information in the feedback information is consistent with the first identification information, and when the second identification information is consistent with the first identification information, confirming that the encryption end and the decryption end have completed key synchronization. The encryption end receives feedback information within a preset time interval, and when the second identification information in the feedback information is consistent with the first identification information in the key message, confirming that the key synchronization is completed. If the first identification information and the second identification information are inconsistent, you can choose to continue waiting.

[0074] In this embodiment, the key message also includes key reserve quantity information, which is used to indicate which group of reserve keys.

[0075] In this embodiment, after the encryption end obtains the encryption key from the key management end, it stores the encryption key in the encryption end key address corresponding to the key reserve quantity information; the decryption end stores the decryption key in the decryption end key address corresponding to the key reserve quantity information. In this solution, the key reserve quantity information can be key address information, and the encryption end and the decryption end store the encryption key and the decryption key in the corresponding key addresses respectively.

[0076] In this embodiment, after the encryption end stores the encryption key, it confirms whether the storage time of the encryption key reaches a preset period, which can be a fixed update time of the key. When the storage time of the encryption key reaches the preset period, it means that the key needs to be updated. At this time, the encryption end confirms whether it has received feedback information to confirm whether the decryption end has written the key.

[0077] If the encryption end has received feedback information, it will perform a key switching operation and modify the key reserve quantity information, wherein the key switching operation can be to directly discard the encryption key and re-synchronize the key. After the encryption end sends the key message to the decryption end, if the encryption end receives feedback information, the encryption end changes the encryption end working state from the key writing state to the feedback receiving state.

[0078] At this time, since the key reserve quantity information has been modified, the key address corresponding to the key reserve quantity information has also changed. The decryption end can know that the key address has changed, and the decryption end also discards the decryption key and waits for the encryption end to resend the key message. When the decryption end detects that the key reserve quantity information has changed, the decryption end changes the decryption end working state to the initial state.

[0079] If the encryption end has not received any feedback information, an alarm message will be sent to the management personnel, so that the staff can check the data transmission between the decryption end and the encryption end and the key management end to determine whether there is a problem with the decryption end. When the storage time of the encryption key reaches the preset period, if the encryption end has not received any feedback information, the encryption end will change the encryption end working state to the initial state.

[0080] Specifically, this solution provides a specific embodiment, such as Figure 2 The second flowchart of the key synchronization method shown in the figure is as follows: 1. After the encryption function is used, the encryption end sends a link detection handshake message to the decryption end. The message format is shown in the following table message a. After receiving the message, the decryption end sends a response message to the encryption end. The message format is shown in the following table message b. After the encryption end receives the message, the handshake negotiation is successful. The state changes to INIT.

[0081] 2. When the encryption state is INIT, the encryption end applies for the encryption key from the key management system, writes the key storage address corresponding to the current ki, and sends key_i nfo, ki, key_i ndex, key_tx_crc information to the decryption end. The message format is shown in message c in the table below. The state changes to WRITE_KEY.

[0082] key_i nfo: used by the decryption end to request the key, including key_id, key_sn, key_length. This part should be adjusted according to the requirements of the key management system used.

[0083] ki: indicates the backup key group.

[0084] key_i ndex: A custom unique index used for message matching between both ends.

[0085] key_tx_crc: Encryption key calculation crc, used for key consistency verification at both ends.

[0086] 3. The decryption end receives the key information and the state changes to RECV_OH. According to key_i nfo, it applies for the decryption key from the key management system, calculates key_rx_crc, and determines whether key_rx_crc is consistent with key_tx_crc. If they are inconsistent, no processing is done, and the decryption state changes to INIT, waiting for the next key information to be sent by the encryption end. If they are consistent, the key storage address corresponding to ki is written according to the ki value sent by the other end. At the same time, the encryption end is sent a feedback that the key has been written. The message format is shown in the message d in the table below. The received key_i ndx is attached in the message to achieve information matching on the encryption end. The decryption state changes to WRITE_KEY.

[0087] 4. When the encryption status is WRITE_KEY, determine whether the key has been written to the decryption end within the specified message timeout period after sending the message in step 2. If not, the status changes to INIT and step 2 is executed again. If the message feedback is received within the timeout period, determine whether key_i ndex is consistent with the key_i ndex transmitted in the message. If they are consistent, it means that the keys at both ends have been written and the status changes to RECV_REQ. Otherwise, continue to wait.

[0088] 5. The encryption end determines whether the key period has expired. If it has expired and the status is RECV_REQ, the key switching operation is performed. If it has expired and the status is not RECV_REQ, it indicates a timeout, an alarm is reported, and the status changes to INIT.

[0089] 6. The encryption end executes the key switch, and the ki of the decryption end will change accordingly. Once the decryption end detects the change of ki, it means that the key has been switched and the state changes to INIT.

[0090] The messages between the encryption end and the decryption end during the key synchronization method include the following contents:

[0091]

[0092]

[0093] like Figure 3As shown, this scheme provides a data transmission method based on message queue between the encryption end and the decryption end. A data transmission processor is set between the encryption end and the decryption end to perform message distribution tasks. The processor reads the PS I overhead. The overhead of PS I (Private Set Interception) mainly includes calculation overhead and communication overhead. PS I is a protocol used to compare the elements of two private sets and determine the intersection of the two sets without revealing the identity of the set members. When implementing PS I, there are several main technical routes, including encryption-based PS I, perturbation-based PS I and hash-based PS I. These technical routes each have their own advantages and disadvantages. Among them, although the encryption-based PS I can ensure the privacy of participants, it has a high computational cost; parse the message protocol header, determine the current stage according to the protocol header, and distribute the message to the corresponding message queue, including the authentication stage message queue, which is used for quantum device authentication processing, that is, the encryption end and decryption end authentication process in this scheme, the exchange stage message queue, which is used for public key transfer processing, that is, the key acquisition process of the encryption end and decryption end in this scheme, and the encryption startup process message queue, which is used for encrypted information interaction processing between devices, that is, the encrypted information interaction process between the encryption end and the decryption end in this scheme, and delay one second to process the next PS I overhead after the distribution is completed.

[0094] See also Figure 4 , Figure 4 The third is a flow chart of a key synchronization method provided by the present invention. Figure 4 As shown, before step S11, the synchronization method further includes:

[0095] S21. The encryption end generates a handshake message when starting the encryption phase, and sends it to the decryption end through the message queue corresponding to the encryption phase.

[0096] In this embodiment, before the encryption end requests the encryption key from the key management end, it needs to first confirm the interaction with the decryption end, that is, to start the encryption phase. In this solution, a handshake message is generated accordingly and sent to the decryption end through the message queue corresponding to the start encryption phase.

[0097] In this embodiment, the startup encryption phase and the encryption phase in the above embodiment correspond to different message queues, so that different message queues transmit different messages, avoiding the situation where messages are not processed in time and are overwritten.

[0098] In this embodiment, the structure of the handshake message may be consistent with that of the key message in the above embodiment. In addition to the handshake related information, the key message may also carry prompt information for starting the encryption phase.

[0099] S22. After receiving the handshake message, the decryption end sends a handshake confirmation message to the encryption end.

[0100] In this embodiment, after the decryption end receives the handshake message, it feeds back a handshake confirmation message to the encryption end. In this scheme, since the decryption end will also send other message data to the encryption end during key synchronization and other processes, at this time, the transmission of messages between the decryption end and the encryption end can also be completed through the corresponding queues in different stages.

[0101] S23. After the encryption end receives the handshake confirmation message, the encryption end and the decryption end handshake successfully and confirm whether the overhead channel and the service are normal.

[0102] In this embodiment, after receiving the handshake confirmation message, the encryption end can proceed to the subsequent steps. The encryption end requests the encryption key from the key management end. At the same time, whether the handshake message and the handshake confirmation message can be used to confirm whether the overhead channel and data transmission service between the encryption end and the decryption end are normal.

[0103] See also Figure 5 , Figure 5 is a block diagram of a key synchronization system provided by the present invention, such as Figure 5 As shown, the synchronization system includes: an encryption end, a decryption end and a key management end.

[0104] In this embodiment, after the encryption end obtains the encryption key from the key management end, it processes the encryption key through a preset algorithm to generate first verification information; and generates a key message based on the current encryption stage, key association information and the first verification information, and sends it to the decryption end through the message queue corresponding to the encryption stage;

[0105] In this embodiment, the decryption end obtains the decryption key from the key management end through the key association information based on the encryption stage in the key message, and processes the decryption key through a preset algorithm to generate second verification information.

[0106] In this embodiment, the decryption end determines whether the encryption key is consistent with the decryption key according to the matching result of the first verification information and the second verification information, and stores the decryption key when the encryption key is consistent with the decryption key.

[0107] In this embodiment, the encryption end generates a handshake message when starting the encryption phase, and sends it to the decryption end through a message queue corresponding to the encryption phase.

[0108] In this embodiment, after receiving the handshake message, the decryption end sends a handshake confirmation message to the encryption end.

[0109] In this embodiment, after the encryption end receives the handshake confirmation message, the encryption end and the decryption end handshake successfully and confirm whether the overhead channel and the service are normal.

[0110] In this embodiment, the decryption end sends feedback information that the decryption key has been stored to the encryption end. The key message also includes: first identification information; the feedback information includes: second identification information corresponding to the key message.

[0111] In this embodiment, if the encryption end does not receive feedback information within a preset time interval after sending the key message to the decryption end, the encryption end obtains the encryption key from the key management end again.

[0112] In this embodiment, if the encryption end receives feedback information within a preset time interval after sending the key message to the decryption end, it confirms whether the second identification information in the feedback information is consistent with the first identification information. When the second identification information is consistent with the first identification information, it confirms that the encryption end and the decryption end have completed key synchronization.

[0113] In this embodiment, the key message also includes: key spare quantity information; after the encryption end obtains the encryption key from the key management end, it stores the encryption key in the encryption end key address corresponding to the key spare quantity information.

[0114] In this embodiment, the decryption end stores the decryption key in the decryption end key address corresponding to the key reserve quantity information.

[0115] In this embodiment, when the storage time of the encryption key reaches a preset period, the encryption end confirms whether it has received feedback information; if the encryption end has received feedback information, it performs a key switching operation and modifies the key reserve quantity information; the decryption end detects in real time whether the key reserve quantity information has changed, and switches the decryption key when the key reserve quantity information changes; if the encryption end has not received feedback information, it reports an alarm message.

[0116] In this embodiment, when the decryption end detects that the key reserve quantity information changes, the decryption end changes the working state of the decryption end to the initial state.

[0117] In this embodiment, after the decryption end stores the decryption key, the decryption end changes the working state of the decryption end from the initial state to the key writing state.

[0118] In this embodiment, when the storage time of the encryption key reaches a preset period, if the encryption end does not receive feedback information, the encryption end changes the encryption end working state to an initial state.

[0119] In this embodiment, before the encryption end obtains the encryption key from the key management end, the encryption end determines whether the working state of the encryption end is the initial state, and when the working state of the encryption end is the initial state, the encryption end obtains the encryption key from the key management end.

[0120] In this embodiment, after the encryption end sends the key message to the decryption end, the working state of the encryption end is changed from the initial state to the key writing state.

[0121] In this embodiment, after the encryption end sends the key message to the decryption end, if the encryption end receives feedback information, the encryption end changes the encryption end working state from the key writing state to the feedback receiving state.

[0122] In this embodiment, when the storage time of the encryption key reaches a preset period, the encryption end confirms whether the feedback information has been received by checking whether the working state of the encryption end is a feedback receiving state.

[0123] In this embodiment, when the encryption key and the decryption key are inconsistent, the decryption end does not process the decryption key.

[0124] Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure.

Claims

1. A key synchronization method, characterized in that: The synchronization method comprises: After the encryption end obtains the encryption key from the key management end, the encryption end processes the encryption key through a preset algorithm to generate first verification information; and generates a key message based on the current encryption stage, the key association information and the first verification information, and sends it to the decryption end through the message queue corresponding to the encryption stage; The decryption end obtains a decryption key from the key management end through the key association information based on the encryption stage in the key message, and processes the decryption key through the preset algorithm to generate second verification information; The decryption end determines whether the encryption key is consistent with the decryption key according to the matching result of the first verification information and the second verification information, and stores the decryption key when the encryption key is consistent with the decryption key.

2. The key synchronization method according to claim 1, characterized in that: Before the encryption end obtains the encryption key from the key management end, the synchronization method further includes: The encryption end generates a handshake message during the encryption startup phase, and sends the message to the decryption end through the message queue corresponding to the encryption startup phase; After receiving the handshake message, the decryption end sends a handshake confirmation message to the encryption end; After the encryption end receives the handshake confirmation message, the encryption end and the decryption end shake hands successfully and confirm whether the overhead channel and the service are normal.

3. The key synchronization method according to claim 1, characterized in that: After storing the decryption key, the synchronization method further comprises: The decryption end sends feedback information that the decryption key has been stored to the encryption end.

4. The key synchronization method according to claim 3, characterized in that: The key message also includes: first identification information; the feedback information includes: second identification information corresponding to the key message; The synchronization method further comprises: If the encryption end does not receive the feedback information within a preset time interval after sending the key message to the decryption end, the encryption end obtains the encryption key from the key management end again; If the encryption end receives the feedback information within a preset time interval after sending the key message to the decryption end, it is confirmed whether the second identification information in the feedback information is consistent with the first identification information. When the second identification information is consistent with the first identification information, it is confirmed that the encryption end and the decryption end have completed key synchronization.

5. The synchronization method according to claim 4, characterized in that: The key message also includes: key spare quantity information; The synchronization method further comprises: After the encryption end obtains the encryption key from the key management end, the encryption key is stored in the encryption end key address corresponding to the key reserve quantity information; The decryption end stores the decryption key in the decryption end key address corresponding to the key reserve quantity information.

6. The synchronization method according to claim 5, characterized in that: The synchronization method further comprises: When the storage time of the encryption key reaches a preset time limit, the encryption end confirms whether the feedback information has been received; If the encryption end has received the feedback information, a key switching operation is performed and the key reserve quantity information is modified; the decryption end detects in real time whether the key reserve quantity information changes, and switches the decryption key when the key reserve quantity information changes; If the encryption end has not received the feedback information, it reports an alarm message.

7. The synchronization method according to claim 6, characterized in that: The synchronization method further includes: when the decryption end detects that the key reserve quantity information changes, the decryption end changes the working state of the decryption end to an initial state; The synchronization method further includes: after the decryption end stores the decryption key, the decryption end changes the working state of the decryption end from the initial state to the key writing state; The synchronization method further includes: when the storage time of the encryption key reaches a preset time limit, if the encryption end does not receive the feedback information, the encryption end changes the encryption end working state to an initial state; The synchronization method further includes: before the encryption end obtains the encryption key from the key management end, the encryption end determines whether the working state of the encryption end is an initial state, and when the working state of the encryption end is the initial state, the encryption end obtains the encryption key from the key management end; The synchronization method further comprises: after the encryption end sends the key message to the decryption end, changing the working state of the encryption end from the initial state to the key writing state; The synchronization method further includes: after the encryption end sends the key message to the decryption end, if the encryption end receives the feedback information, the encryption end changes the encryption end working state from the key writing state to the feedback receiving state.

8. The synchronization method according to claim 7, characterized in that: The synchronization method further comprises: When the storage time of the encryption key reaches a preset time limit, the encryption end confirms whether the feedback information has been received by checking whether the working state of the encryption end is a feedback receiving state.

9. The synchronization method according to any one of claims 1 to 7, characterized in that: The synchronization method further comprises: When the encryption key is inconsistent with the decryption key, no processing is performed on the decryption key.

10. A key synchronization system, characterized in that: The synchronization system includes: an encryption end, a decryption end and a secret management end; After the encryption end obtains the encryption key from the key management end, the encryption end processes the encryption key through a preset algorithm to generate first verification information; and generates a key message based on the current encryption stage, the key association information and the first verification information, and sends it to the decryption end through the message queue corresponding to the encryption stage; The decryption end obtains a decryption key from the key management end through the key association information based on the encryption stage in the key message, and processes the decryption key through the preset algorithm to generate second verification information; The decryption end determines whether the encryption key is consistent with the decryption key according to the matching result of the first verification information and the second verification information, and stores the decryption key when the encryption key is consistent with the decryption key.

Images