Key management method and device, storage medium and chip

Abstract

The present disclosure relates to a key management method, device, storage medium and chip, and relates to the technical field of communication encryption. The key management method comprises: in the case that a local device exists an original key for communicating with a peer device, determining a first candidate key meeting a first target device trust level from the original key, and authenticating the first candidate key; in the case that the first candidate key passes the authentication, determining the first candidate key as a target key for the local device and the peer device to communicate, wherein the first target device trust level is a current device trust level of the local device and the peer device, so that the selected target key can meet the current device trust level, and in the case that the first candidate key passes the authentication, it is determined that the first candidate key can be directly used by both sides, so that the communication security is ensured while the communication response speed is accelerated.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of communication encryption, and in particular, to a key management method and device, a storage medium and a chip. BACKGROUND

[0002] In the related art, in the communication process between a local device and a peer device, if the local device has original keys for communicating with the peer device, the local device sends key indexes corresponding to all the original keys to the peer device, and the peer device selects one of the key indexes as a target key for communication between the two devices. SUMMARY

[0003] To overcome the communication security problem in the related art, the present disclosure provides a key management method and device, a storage medium and a chip, different device trust levels correspond to different levels of keys, in the case where the local device has original keys for communicating with the peer device, a first candidate key that meets a first target device trust level is determined from the original keys, and the first candidate key is authenticated, in the case where the first candidate key passes the authentication, the first candidate key is determined as a target key for communication between the local device and the peer device, wherein the first target device trust level is the current device trust level of the local device and the peer device, so that the selected target key can meet the current device trust level and both devices can directly use it, thereby ensuring communication security while speeding up communication response.

[0004] According to a first aspect of an embodiment of the present disclosure, a key management method is provided, comprising:

[0005] In response to a communication request from a peer device, in the case where the local device has original keys for communicating with the peer device, if a first candidate key that meets a first target device trust level exists in the original keys, the first candidate key is authenticated, and the first target device trust level is the current device trust level of the local device and the peer device;

[0006] In the case where the first candidate key passes the authentication, the first candidate key is determined as a target key for communication between the local device and the peer device.

[0007] Optionally, the first candidate key is a symmetric key;

[0008] The authentication of the first candidate key comprises:

[0009] Sending authentication information to the peer device, the authentication information comprising a target key version number corresponding to the first candidate key, the target key version number being used by the peer device to find the first candidate key;

[0010] In a case where it is confirmed that the peer device finds the first candidate key, it is determined that the first candidate key passes authentication.

[0011] Optionally, the authentication information further includes first encrypted authentication data, which is obtained by encrypting the first original authentication data by the first candidate key.

[0012] Before determining that the first candidate key passes authentication in a case where it is confirmed that the peer device finds the first candidate key, the method further includes:

[0013] Obtaining decrypted authentication data, which is data obtained by decrypting the first encrypted authentication data by the second candidate key found by the peer device.

[0014] In a case where the decrypted authentication data matches the first original authentication data, it is confirmed that the second candidate key found by the peer device is the first candidate key.

[0015] Optionally, before determining that the first candidate key passes authentication in a case where it is confirmed that the peer device finds the first candidate key, the method further includes:

[0016] Receiving second encrypted authentication data, which is obtained by encrypting second original authentication data by a third candidate key found by the peer device.

[0017] In a case where the first candidate key is successfully used to decrypt the second encrypted authentication data, it is confirmed that the third candidate key found by the peer device is the first candidate key.

[0018] Optionally, the method further includes:

[0019] In a case where there is no original key for the peer device to communicate with the local device, or in a case where there is no first candidate key conforming to a first target device trust level in the original key, the local device authenticates with the peer device.

[0020] In a case where the authentication is successful, a key generated by the successful authentication is determined as the target key.

[0021] Optionally, the local device authenticates with the peer device, including:

[0022] Determining a device trust level existing between the local device and the peer device.

[0023] determine a second target device trust level according to the specified trust level and a device trust level existing between the local device and the peer device;

[0024] The local device and the peer device perform authentication according to an authentication manner corresponding to the second target device trust level.

[0025] Optionally, the determining the second target device trust level according to the specified trust level and the device trust level existing between the local device and the peer device comprises:

[0026] determining, as the second target device trust level, a device trust level that is the highest in the device trust levels existing between the local device and the peer device and that matches the specified trust level.

[0027] Optionally, the method further comprises:

[0028] In a case where the first candidate key fails to pass the authentication, the local device and the peer device perform re-authentication;

[0029] In a case where the authentication succeeds, determining, as the target key, a key generated due to the authentication success.

[0030] Optionally, in the case where the authentication succeeds, the method further comprises:

[0031] generating, for the key generated due to the authentication success, a corresponding key version number, the key version number comprising a key index and a key serial number, a key serial number of a later-generated key being greater than a key serial number of an earlier-generated key, and the first candidate key being a key with the greatest key serial number among keys conforming to the first target device trust level.

[0032] According to a second aspect of the embodiments of the present disclosure, a key management apparatus is provided, comprising:

[0033] a first determining module configured to, in response to a communication request of a peer device, in a case where an original key for communicating with the peer device exists in a local device, if a first candidate key conforming to a first target device trust level exists in the original key, performing authentication on the first candidate key, the first target device trust level being a current device trust level between the local device and the peer device;

[0034] a second determining module configured to, in a case where the first candidate key passes the authentication, determining the first candidate key as a target key for communication between the local device and the peer device.

[0035] According to a third aspect of the embodiments of the present disclosure, a key management apparatus is provided, comprising:

[0036] a processor;

[0037] a memory for storing processor-executable instructions;

[0038] The processor is configured to perform the steps of the key management method provided by the first aspect of the present disclosure.

[0039] According to a fourth aspect of the embodiments of the present disclosure, a computer-readable storage medium is provided, which stores computer program instructions, and the program instructions are executed by a processor to implement the steps of the key management method provided by the first aspect of the present disclosure.

[0040] According to a fifth aspect of the embodiments of the present disclosure, a chip is provided, which comprises a processor and an interface; the processor is configured to read instructions to perform the key management method provided by the first aspect of the present disclosure.

[0041] The technical solutions provided by the embodiments of the present disclosure can include the following beneficial effects:

[0042] For different device trust levels, there are different levels of keys. In the case that there is an original key for communication with the opposite end device in the local device, a first candidate key conforming to the first target device trust level is determined from the original key, and the first candidate key is authenticated. In the case that the first candidate key passes the authentication, the first candidate key is determined as the target key for communication between the local device and the opposite end device, wherein the first target device trust level is the current device trust level of the local device and the opposite end device. Thus, the selected target key can conform to the current device trust level, and in the case that the first candidate key passes the authentication, it is determined that the first candidate key can be directly used by both parties, thereby ensuring the communication security while accelerating the communication response speed.

[0043] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0044] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present disclosure and, together with the specification, serve to explain the principles of the present disclosure.

[0045] Figure 1 is a schematic diagram of a communication scenario according to an exemplary embodiment.

[0046] Figure 2 is a flowchart of a key management method according to an exemplary embodiment.

[0047] Figure 3is a flow chart of a method of authenticating a first candidate key according to an example embodiment.

[0048] Figure 4 is a flow chart of a method of authenticating a local device and a peer device according to an example embodiment.

[0049] Figure 5 is a block diagram of a key management apparatus according to an example embodiment.

[0050] Figure 6 is a block diagram of another key management apparatus according to an example embodiment. DETAILED DESCRIPTION

[0051] The example embodiments will be described in detail herein with reference to the attached drawings. The following description is made with reference to the accompanying drawings in which like reference numerals refer to like elements or features. The following description is made with reference to the accompanying drawings in which like reference numerals refer to like elements or features. The following example embodiments described in the following description are not meant to represent all embodiments consistent with the present disclosure. Rather, they are merely examples with respect to apparatuses and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0052] It should be noted that all the actions of obtaining signals, information or data in the present disclosure are carried out in compliance with the corresponding data protection regulations and policies of the country where the device is located, and with the authorization given by the corresponding device owner.

[0053] In the process of communication between devices, it is usually necessary for both parties to authenticate first. In the process of authentication, both parties negotiate keys, and after the authentication is completed, each party saves the negotiated key, so as to use the negotiated key to encrypt the data in the process of communication, thereby improving the security of communication.

[0054] In the related art, in the process of communication between a local device and a peer device, if the local device has original keys for communication with the peer device, i.e., the local device saves the keys negotiated with the peer device, the local device will send all key indexes corresponding to the existing original keys to the peer device, and the peer device will select one as a target key for communication between the two parties. However, the process of selecting the target key is relatively cumbersome, resulting in a relatively long communication response time and the selected target key may be a relatively simple key, which does not meet the current security requirements of communication transmission between devices, resulting in relatively low security of communication between devices.

[0055] In view of the communication security problem in the prior art, the present disclosure provides a key management method and device, a storage medium and a chip. Different levels of keys correspond to different device trust levels. In the case that there is an original key for communication with a peer device in a local device, a first candidate key conforming to a first target device trust level is determined from the original key, and the first candidate key is authenticated. In the case that the first candidate key passes the authentication, the first candidate key is determined as a target key for communication between the local device and the peer device, wherein the first target device trust level is the current device trust level of the local device and the peer device. Thus, the selected target key can conform to the current device trust level, and in the case that the first candidate key passes the authentication, it is determined that the first candidate key can be directly used by both sides, thereby ensuring communication security while accelerating the communication response speed.

[0056] Figure 1 is a schematic diagram of a communication scenario according to an example embodiment, Figure 2 is a flowchart of a key management method according to an example embodiment, as shown in Figure 1 and Figure 2 , the method can be used in a terminal device and includes the following steps.

[0057] In step S201, in response to a communication request from a peer device, in the case that there is an original key for communication with the peer device in a local device, if there is a first candidate key conforming to a first target device trust level in the original key, the first candidate key is authenticated, and the first target device trust level is the current device trust level of the local device and the peer device.

[0058] In this embodiment, the local device can be a terminal device that initiates communication, and the method can be used in the local device. The peer device can be a target device that initiates communication from the local device. For example, as shown in Figure 1 , a user wants to transmit target data from a mobile phone to a computer, so the mobile phone is the local device and the computer is the peer device. For different devices or different communication scenarios, there can be different device trust levels between the local device and the peer device, and the number of levels can be set according to actual conditions. For example, there can be three device trust levels, namely a first device trust level, a second device trust level and a third device trust level. The first device trust level can be a same-account device, the second device trust level can be a point-to-point device, and the third device trust level can be a non-trusted device. For different device trust levels, different levels of authentication methods can be used in the authentication process between the two devices, thereby generating different levels of keys.

[0059] When a user uses the local device, if the user wants to communicate with the opposite device through the local device, for example, to transmit data, the user can issue a communication request to the local device by operating the local device. The local device can respond to the communication request with the opposite device, first determine whether the local device has an original key for communicating with the opposite device. The original key can be a key negotiated by the local device and the opposite device. If the local device has the original key for communicating with the opposite device, the local device further determines whether the original key has a first candidate key that meets a first target device trust level. If the original key has the first candidate key that meets the first target device trust level, the first candidate key is authenticated so that the first candidate key can be reused, and the local device and the opposite device do not need to be authenticated again. The first target device trust level is a current device trust level of the local device and the opposite device, so that the selected target key meets the current device trust level, that is, meets the encryption requirement of the current communication between the local device and the opposite device, and ensures the communication security.

[0060] In step S202, if the first candidate key is authenticated, the first candidate key is determined as a target key for the local device to communicate with the opposite device.

[0061] In the embodiment, if the first candidate key is authenticated, the first candidate key can be reused by the local device and the opposite device, and the first candidate key can be determined as the target key for the local device to communicate with the opposite device. In the process of the local device and the opposite device communicating, the target key can be used for data encryption and decryption.

[0062] In a possible implementation, the method for determining the current device trust level of the local device and the opposite device can include: obtaining basic feature information of the local device and the opposite device, and determining a connection relationship between the local device and the opposite device according to the basic feature information, so as to determine the current device trust level of the local device and the opposite device.

[0063] Figure 3 FIG. 3 is a flowchart of a method for authenticating a first candidate key according to an example embodiment. As shown in FIG. 3, in a possible implementation, the first candidate key is a symmetric key, that is, the key saved by the local device and the opposite device is the same after the authentication of the local device and the opposite device is completed. The authentication of the first candidate key can include the following steps. Figure 3

[0064] In step S301, authentication information is sent to the opposite device, and the authentication information includes a target key version number corresponding to the first candidate key. The target key version number is used by the opposite device to find the first candidate key.

[0065] ​In the embodiment, whether the first candidate key can pass the authentication can be verified by sending the target key version number corresponding to the first candidate key to the peer device. The local device can generate authentication information based on the target key version number corresponding to the first candidate key, and send the authentication information to the peer device. After receiving the authentication information, the peer device can search the locally stored keys according to the target key version number in the authentication information in response to the authentication information, so as to find the first candidate key corresponding to the target key version number.

[0066] In step S302, if it is confirmed that the peer device finds the first candidate key, it is determined that the first candidate key passes the authentication.

[0067] In the embodiment, if it is confirmed that the peer device finds the first candidate key, it is proved that the peer device also stores the first candidate key, and then it is determined that the first candidate key passes the authentication. The local device and the peer device can use the first candidate key for encryption and decryption of communication data.

[0068] In a possible implementation, the authentication information further includes first encrypted authentication data, which is obtained by encrypting the first original authentication data by the first candidate key.

[0069] Before determining that the first candidate key passes the authentication in the case of confirming that the peer device finds the first candidate key, the method for confirming whether the peer device finds the first candidate key can be: obtaining decrypted authentication data, which is data obtained by decrypting the first encrypted authentication data by the second candidate key found by the peer device; and in the case of matching between the decrypted authentication data and the first original authentication data, confirming that the second candidate key found by the peer device is the first candidate key.

[0070] In the embodiment, the authentication information further comprises first encrypted authentication data, which is encrypted by the first original authentication data using the first candidate key, wherein the first original authentication data is any data, for example, a pre-set data or a temporarily generated arbitrary data. After the local device sends the authentication information to the peer device, the peer device, after receiving the authentication information, can search the stored keys according to the target key version number in the authentication information in response to the authentication information. If the key is found, the searched key is determined as the second candidate key, and the first encrypted data is decrypted using the second candidate key to obtain decrypted authentication data. The peer device returns the decrypted authentication data to the local device. After the local device receives the decrypted authentication data, the decrypted authentication data is matched with the first original authentication data. If the decrypted authentication data matches the first original authentication data, it is confirmed that the second candidate key searched by the peer device is the first candidate key, that is, the second candidate key searched by the peer device is the same as the first candidate key. Then it can be determined that the first candidate key passes the authentication. If the decrypted authentication data does not match the first original authentication data, it is confirmed that the second candidate key searched by the peer device is not the same as the first candidate key, and then it can be determined that the first candidate key fails the authentication.

[0071] If the key corresponding to the target key version number is not found, the search failure information can be returned. After the local device receives the search failure information, it is confirmed that the first candidate key fails the authentication. Alternatively, if the key corresponding to the target key version number is not found, the first encrypted authentication data is directly returned. After the local device receives the first encrypted authentication data, it is determined that the first original authentication data does not match, and it is confirmed that the first candidate key fails the authentication.

[0072] In a possible implementation, in the case where it is confirmed that the peer device searches for the first candidate key, before it is determined that the first candidate key passes the authentication, the method for confirming whether the peer device searches for the first candidate key can further comprise: receiving second encrypted authentication data, which is encrypted by the second original authentication data using the third candidate key searched by the peer device. In the case where the second encrypted authentication data is successfully decrypted using the first candidate key, it is confirmed that the third candidate key searched by the peer device is the first candidate key.

[0073] In the embodiment, after the authentication information is sent by the local device to the remote device, the remote device can find the key stored locally according to the target key version number in the authentication information in response to the authentication information, and if the key is found, the found key is determined as the third candidate key, and the second original authentication data is encrypted according to the third candidate key to obtain second encrypted authentication data, wherein the second original authentication data can be any piece of data. The remote device sends the obtained second encrypted authentication data to the local device, and after the second encrypted authentication data is received by the local device, the second encrypted authentication data is decrypted using the first candidate key, and if the decryption is successful, it is confirmed that the third candidate key found by the remote device is the first candidate key, that is, the third candidate key found by the remote device is the same as the first candidate key, and then it is determined that the first candidate key passes the authentication. If the decryption is not successful, it is confirmed that the third candidate key found by the remote device is not the same as the first candidate key, and then it is determined that the first candidate key fails the authentication.

[0074] In a possible implementation, the key management method further includes: in a case where the local device does not have an original key for communicating with the remote device, or in a case where the original key does not have a first candidate key meeting the first target device trust level, the local device authenticates with the remote device. In a case where the authentication is successful, a key generated due to the successful authentication is determined as the target key.

[0075] In the embodiment, if the local device does not have an original key for communicating with the remote device, or the original key does not have a first candidate key meeting the first target device trust level, there is no directly usable key for encrypting and decrypting the communication data between the local device and the remote device, and the local device can authenticate with the remote device, so that a key is generated for encrypting and decrypting the communication data between the local device and the remote device after the authentication is successful.

[0076] Figure 4 FIG. 1 is a flowchart of a method for authenticating a local device and a remote device according to an example embodiment. Figure 4 As shown in FIG. 1, in a possible implementation, the method for authenticating the local device and the remote device can include the following steps.

[0077] In step S401, it is determined that there is a device trust level between the local device and the remote device.

[0078] In the embodiment, there can be multiple device trust levels between the local device and the peer device, for example, there can be same account connection, point-to-point connection and untrusted connection at the same time. The same account connection can be used for scenarios such as clipboard, the point-to-point connection can be used for scenarios such as wearable device and screen projection, and the untrusted connection can be used for scenarios such as file exchange and magic broadcast.

[0079] In step S402, a second target device trust level is determined according to the specified trust level and the device trust levels between the local device and the peer device.

[0080] In the embodiment, the specified trust level can be determined based on the default trust level of the current business function, or can be a trust level specified by the user. The specified trust level is the security authentication requirement level, for example, if the security authentication requirement is only the same account, the security authentication requirement level corresponds to the device trust level corresponding to the same account connection, and if the security authentication requirement is only trusted, the security authentication requirement level corresponds to the device trust level corresponding to the point-to-point connection.

[0081] The second target device trust level can be determined from the device trust levels between the local device and the peer device based on the specified trust level.

[0082] In step S403, the local device and the peer device are authenticated according to the authentication mode corresponding to the second target device trust level.

[0083] In the embodiment, after the second target device trust level for authenticating the local device and the peer device is determined, the authentication mode corresponding to the second target device trust level can be obtained, and the local device and the peer device are authenticated based on the authentication mode, so as to ensure the level requirement of authentication and improve communication security.

[0084] In one possible implementation, the method of determining the second target device trust level according to the specified trust level and the device trust levels between the local device and the peer device can be: determining the device trust level that is the highest in level and matches the specified trust level from the device trust levels between the local device and the peer device as the second target device trust level.

[0085] In the embodiment, the device trust level that matches the specified trust level can be determined from the device trust levels between the local device and the opposite device. The matching device trust level can be the device trust level that is currently available from the device trust levels between the local device and the opposite device, i.e. the device trust level that is less than or equal to the current device trust level from the device trust levels between the local device and the opposite device, and the device trust level with the highest level is determined as the second target device trust level, so that the level of authentication is improved as much as possible under the premise of using the device trust level that matches the current device connection form, thereby ensuring the security of authentication, and a secret key corresponding to the level is generated, wherein the higher the second target device trust level, the higher the level of the authentication method corresponding to the second target device trust level, and the higher the level of the generated secret key, so that the security of communication using the secret key is higher.

[0086] In a possible implementation, in the case that the first candidate secret key fails to pass the authentication, the local device and the opposite device re-authenticate, and in the case that the authentication is successful, the secret key generated by the successful authentication is determined as the target secret key.

[0087] In the embodiment, if the first candidate secret key fails to pass the authentication, it is confirmed that the local device and the opposite device cannot use the existing first candidate secret key for communication, and then re-authentication is performed to generate a new secret key as the target secret key to support the communication between the local device and the opposite device. The re-authentication method can be the same as the authentication method of the local device and the opposite device, and the related explanations of the authentication method of the local device and the opposite device can be referred to.

[0088] In a possible implementation, in order to facilitate the search of the secret key, a corresponding secret key version number can be generated for the secret key generated by the successful authentication, and the secret key version number can include a secret key index and a secret key serial number, wherein the secret key index can be used to search for the corresponding secret key, and the secret key serial number can be used for the distinction and selection of the secret key. The secret key serial number of the secret key generated later is greater than the secret key serial number of the secret key generated earlier, for example, the secret key serial number of each generated secret key is 1 plus the secret key serial number of the previous secret key. When the first candidate secret key is determined, the candidate secret key set that matches the first target device trust level can be determined from the original secret key. The candidate secret key set that matches the first target device trust level is the secret key generated by the authentication method corresponding to the first target device trust level. Then the secret key corresponding to the largest secret key serial number is determined as the first candidate secret key, wherein the secret key level of the secret key generated later is greater than or equal to the secret key level of the secret key generated earlier, so that the secret key that matches the current device trust level and is generated the latest can be found as the target secret key for the current data transmission.

[0089] Figure 5is a block diagram of a key management apparatus according to an exemplary embodiment. Referring to Figure 5 The key management apparatus includes a first determining module 501 and a second determining module 502.

[0090] The first determining module 501 is configured to, in response to a communication request from a peer device, if there is an original key for communicating with the peer device in the local device, authenticate a first candidate key in the original key, if the first candidate key meets a first target device trust level, the first target device trust level being a current device trust level between the local device and the peer device.

[0091] The second determining module 502 is configured to, if the first candidate key passes the authentication, determine the first candidate key as a target key for communication between the local device and the peer device.

[0092] Optionally, the first candidate key is a symmetric key.

[0093] The first determining module 501 includes:

[0094] The sending sub-module is configured to send authentication information to the peer device, the authentication information including a target key version number corresponding to the first candidate key, the target key version number being used by the peer device to find the first candidate key.

[0095] The first determining sub-module is configured to, if it is confirmed that the peer device finds the first candidate key, determine that the first candidate key passes the authentication.

[0096] Optionally, the authentication information further includes first encrypted authentication data, the first encrypted authentication data being obtained by encrypting first original authentication data by the first candidate key.

[0097] The key management apparatus 500 further includes:

[0098] The obtaining module is configured to obtain decrypted authentication data, the decrypted authentication data being data obtained by decrypting the first encrypted authentication data by a second candidate key found by the peer device.

[0099] The first confirming module is configured to, if the decrypted authentication data matches the first original authentication data, confirm that the second candidate key found by the peer device is the first candidate key.

[0100] Optionally, the key management apparatus 500 further includes:

[0101] a receiving module configured to receive second encrypted authentication data, the second encrypted authentication data being obtained by encrypting second original authentication data using the third candidate key found by the peer device;

[0102] a second confirming module configured to, in a case where the second encrypted authentication data is successfully decrypted using the first candidate key, confirm that the third candidate key found by the peer device is the first candidate key.

[0103] Optionally, the key management apparatus 500 further comprises:

[0104] a first authentication module configured to, in a case where the local device does not have an original key for communicating with the peer device, or in a case where the original key does not have a first candidate key that meets a first target device trust level, authenticate the local device with the peer device.

[0105] a third determining module configured to, in a case where the authentication is successful, determine a key generated by the successful authentication as the target key.

[0106] Optionally, the first authentication module comprises:

[0107] a second determining submodule configured to determine a device trust level existing between the local device and the peer device;

[0108] a third determining submodule configured to determine a second target device trust level according to a specified trust level and the device trust level existing between the local device and the peer device;

[0109] an authentication submodule configured to authenticate the local device with the peer device according to an authentication manner corresponding to the second target device trust level.

[0110] Optionally, the third determining submodule comprises:

[0111] a determining subunit configured to determine, as the second target device trust level, a device trust level that is the highest in the device trust levels existing between the local device and the peer device and that matches the specified trust level.

[0112] Optionally, the key management apparatus 500 further comprises:

[0113] a second authentication module configured to, in a case where the first candidate key fails the authentication, re-authenticate the local device with the peer device;

[0114] a fourth determining module configured to, in a case where the authentication is successful, determine a key generated by the successful authentication as the target key.

[0115] Optionally, the key management apparatus 500 further comprises:

[0116] a generating module, configured to generate a key version number corresponding to the key generated in the case of successful authentication, the key version number comprising a key index and a key serial number, the key serial number of a later generated key being greater than the key serial number of an earlier generated key, the first candidate key being a key with the largest key serial number among the keys meeting the first target device trust level.

[0117] With reference to the apparatuses in the above embodiments, specific manners in which various modules perform operations have been described in detail in the embodiments of the method, and thus will not be described here in detail.

[0118] The present disclosure also provides a computer readable storage medium having stored thereon computer program instructions, which, when executed by a processor, implement the steps of the key management method provided by the present disclosure.

[0119] Figure 6 is a block diagram of still another key management apparatus according to an exemplary embodiment. For example, the key management apparatus 600 can be a mobile phone, computer, digital broadcast terminal, messaging device, game console, tablet device, medical device, fitness device, personal digital assistant, and the like.

[0120] With reference to Figure 6 , the key management apparatus 600 can include one or more of the following components: a processing component 602, a memory 604, a power supply component 606, a multimedia component 608, an audio component 610, an input / output (I / O) interface 612, a sensor component 614, and a communication component 616.

[0121] The processing component 602 usually controls overall operations of the key management apparatus 600, such as operations associated with displaying, making phone calls, data communications, camera operations, and recording operations. The processing component 602 can include one or more processors 620 to execute instructions to complete all or part of steps of the above-described key management method. In addition, the processing component 602 can include one or more modules so as to facilitate interaction between the processing component 602 and other components. For example, the processing component 602 can include a multimedia module to facilitate the interaction between the multimedia component 608 and the processing component 602.

[0122] The memory 604 is configured to store various types of data to support the operation of the key management device 600. Examples of such data include instructions for any application or methods operating on the key management device 600, contact data, phonebook data, messages, pictures, videos, and the like. The memory 604 can be implemented by any type of volatile or nonvolatile storage devices or a combination thereof such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0123] The power supply component 606 supplies power for the various components of the key management device 600. The power supply component 606 can include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the key management device 600.

[0124] The multimedia component 608 includes a screen providing an output interface between the key management device 600 and a user. In some embodiments, the screen includes a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, swiping, and gestures on the touch panel. The touch sensors can not only sense a boundary of a touch or swiping action, but also detect duration and pressure related to the touch or swiping action. In some embodiments, the multimedia component 608 includes a front camera and / or a rear camera. The front and / or rear camera can receive external multimedia data when the key management device 600 is in an operation mode, such as a shooting mode or a video mode. Each of the front and rear camera can be a fixed optical lens system or have a focal length and optical zoom capability.

[0125] The audio component 610 is configured to output and / or input audio signals. For example, the audio component 610 includes a microphone (MIC) that is configured to receive external audio signals when the key management device 600 is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signals can be further stored in the memory 604 or transmitted via the communication component 616. In some embodiments, the audio component 610 also includes a speaker for outputting audio signals.

[0126] The input / output interface 612 provides an interface between the processing component 602 and peripheral interface modules, which can be a keyboard, a click wheel, buttons, and the like. The buttons can include, but are not limited to, a home button, a volume button, a start button, and a lock button.

[0127] The sensor component 614 includes one or more sensors to provide status assessment of various aspects of the key management device 600. For example, the sensor component 614 can detect the open / closed status of the key management device 600, the relative positioning of components, such as a display and keypad of the key management device 600, the sensor component 614 can also detect changes in the position of the key management device 600 or a component of the key management device 600, the presence or absence of user contact with the key management device 600, the orientation or acceleration / deceleration of the key management device 600, and changes in the temperature of the key management device 600. The sensor component 614 can include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor component 614 can also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor component 614 can also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0128] The communication component 616 is configured to facilitate wired or wireless communication between the key management device 600 and other devices. The key management device 600 can access a wireless network based on a communication standard, such as WiFi, 2G, or 3G, or a combination thereof. In an example embodiment, the communication component 616 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an example embodiment, the communication component 616 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0129] In an example embodiment, the key management device 600 can be implemented with one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, micro-controllers, microprocessors, or other electronic elements to perform the key management methods described above.

[0130] In an example embodiment, a non-transitory computer-readable storage medium including instructions, such as the memory 604 including instructions, is also provided, which can be executed by the processor 620 of the key management device 600 to perform the key management methods described above. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disc, and an optical data storage device, etc.

[0131] The apparatus described above can be a part of an independent electronic device, for example, in an embodiment, the apparatus can be an integrated circuit (IC) or a chip, wherein the integrated circuit can be one IC or a collection of multiple ICs; the chip can include but is not limited to the following types: GPU (Graphics Processing Unit), CPU (Central Processing Unit), FPGA (Field Programmable Gate Array), DSP (Digital Signal Processor), ASIC (Application Specific Integrated Circuit), SOC (System on Chip, SoC, System on a Chip or System Level Chip), etc. The integrated circuit or chip described above can be used to execute executable instructions (or code) to implement the key management method described above. The executable instructions can be stored in the integrated circuit or chip, or obtained from other devices or equipment, for example, the integrated circuit or chip includes a processor, a memory, and an interface for communication with other devices. The executable instructions can be stored in the memory, and when the executable instructions are executed by the processor, the key management method described above is implemented; or the integrated circuit or chip can receive executable instructions through the interface and transmit them to the processor for execution to implement the key management method described above.

[0132] In another exemplary embodiment, a computer program product is also provided, which contains a computer program executable by a programmable apparatus, the computer program having code portions for performing the key management method described above when executed by the programmable apparatus.

[0133] Other embodiments of the present disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the present disclosure. The present disclosure is intended to cover any variations, uses, or adaptations of the present disclosure following the general principles thereof and including such departures from the present disclosure that come within known, accepted, and customary practice in the art to which the present disclosure pertains. The specification and examples are to be regarded as illustrative only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0134] It should be understood that the present disclosure is not limited to the precise structures described and shown in the drawings, and that various modifications and changes can be made without departing from the scope of the present disclosure. The scope of the present disclosure is limited only by the claims appended hereto.

Claims

1. A key management method characterized by comprising: The method comprises: In response to a communication request from a peer device, if there is an original key for communication with the peer device in the local device, and if there is a first candidate key in the original key that meets a first target device trust level, authenticating the first candidate key, the first target device trust level being a current device trust level between the local device and the peer device; If the first candidate key passes the authentication, determining the first candidate key as a target key for communication between the local device and the peer device.

2. The key management method according to claim 1, characterized by, The first candidate key is a symmetric key. The authentication of the first candidate key comprises: sending authentication information to the peer device, the authentication information comprising a target key version number corresponding to the first candidate key, the target key version number being used by the peer device to find the first candidate key; If the peer device finds the first candidate key, determining that the first candidate key passes the authentication.

3. The key management method according to claim 2, characterized by, The authentication information further comprises first encrypted authentication data, the first encrypted authentication data being obtained by encrypting first original authentication data using the first candidate key; Before determining that the first candidate key passes the authentication, if the peer device finds the first candidate key, the method further comprises: obtaining decrypted authentication data, the decrypted authentication data being data obtained by decrypting the first encrypted authentication data using a second candidate key found by the peer device; If the decrypted authentication data matches the first original authentication data, confirming that the second candidate key found by the peer device is the first candidate key.

4. The key management method of claim 2, wherein, Before determining that the first candidate key passes the authentication, if the peer device finds the first candidate key, the method further comprises: receiving second encrypted authentication data, the second encrypted authentication data being obtained by encrypting second original authentication data using a third candidate key found by the peer device; If the second encrypted authentication data is successfully decrypted using the first candidate key, confirming that the third candidate key found by the peer device is the first candidate key.

5. The key management method according to any one of claims 1 to 4, characterized by, The method further comprises: If there is no original key for communication with the peer device in the local device, or if there is no first candidate key in the original key that meets a first target device trust level, authenticating the local device and the peer device; If the authentication is successful, determining a key generated by the successful authentication as the target key.

6. The key management method of claim 5, wherein, The authentication of the local device and the peer device comprises: determining a device trust level between the local device and the peer device; determining a second target device trust level according to a specified trust level and the device trust level between the local device and the peer device; The local device and the opposite device perform authentication according to an authentication mode corresponding to the second target device trust level.

7. The key management method of claim 6, wherein, The second target device trust level is determined according to a specified trust level and a device trust level existing between the local device and the opposite device. The device trust level existing between the local device and the opposite device that matches the specified trust level and has the highest level is determined as the second target device trust level.

8. The key management method according to claim 5, wherein, The method further comprises: In the case that the first candidate key fails to pass authentication, the local device and the opposite device perform re-authentication; In the case that authentication succeeds, a key generated due to successful authentication is determined as the target key.

9. The key management method according to claim 5, wherein, In the case that authentication succeeds, the method further comprises: A corresponding key version number is generated for the key generated due to successful authentication, the key version number comprises a key index and a key serial number, the key serial number of a later generated key is greater than the key serial number of an earlier generated key, and the first candidate key is a key with the largest key serial number among keys that meet the first target device trust level.

10. A key management apparatus characterized by comprising: Comprise: A first determination module is configured to, in response to a communication request of an opposite device, in the case that a local device has an original key for communicating with the opposite device, if the original key has a first candidate key that meets a first target device trust level, the first target device trust level being a current device trust level between the local device and the opposite device, performing authentication on the first candidate key. A second determination module is configured to, in the case that the first candidate key passes authentication, determine the first candidate key as a target key for communication between the local device and the opposite device.

11. A key management apparatus characterized by comprising: Comprise: A processor; A memory for storing processor executable instructions; The processor is configured to implement the steps of the key management method of any one of claims 1-9 when executed.

12. A computer-readable storage medium having stored thereon computer program instructions, wherein, The program instructions are executed by the processor to implement the steps of the key management method of any one of claims 1-9.

13. A chip, characterized by Comprise a processor and an interface; the processor is used to read instructions to execute the key management method of any one of claims 1-9.

Images