Intelligent device key management system based on cloud service

Abstract

The invention provides a cloud service-based intelligent device key management system, which comprises a plurality of terminal devices, and is characterized in that the terminal devices are configured to perform encryption through public keys according to device serial numbers and timestamp data to generate real-time keys; each terminal device comprises a first storage module and a second storage module, and the first storage module is configured to store first key data reported successfully; the second storage module is configured to store the second key data which fails to be reported; the cloud server is configured to verify the real-time secret key through the public key and generate a secret key verification result; the secret key verification result is used for marking success or failure of real-time secret key reporting; and the key server is configured to store the successfully reported key data. According to the system, the problems of single derived key path, lack of a key log tracing function and incapability of real-time risk blocking in the existing key management technology are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of key management, and particularly relates to an intelligent device key management system based on cloud services. Background Art

[0002] With the rapid development of Internet of Things technology, intelligent devices are facing increasingly severe data security challenges in the process of realizing networked connections. The current mainstream device key management mechanism has significant technical defects. The core problem lies in the overly basic architecture design of the hardware security module, resulting in the lack of effective encryption protection for the data interaction interface between the device and the cloud. During the device network configuration stage, a large number of manufacturers use plaintext to transmit network configuration parameters, enabling attackers to intercept key interface information through means such as network packet capture, and then launch man-in-the-middle attacks or data tampering operations on the cloud service. Once such security vulnerabilities are exploited, it will not only cause large-scale paralysis of the cloud service system and abnormal business data, but may also lead to serious consequences such as user privacy leakage.

[0003] In the prior art, the device network configuration process generally adopts a one-way communication mechanism. The device directly requests network configuration information through a standard interface, without a two-way identity authentication system or a data encryption transmission layer design. This open transmission mode enables attackers to forge legitimate device identities to obtain network permissions, or inject malicious instructions into the transmission link to disrupt the device operation logic. Although some technical solutions attempt to improve security through public key matrices or combined key mechanisms, these methods have problems such as fixed key generation logic and high key matrix maintenance costs, and are difficult to adapt to the scenario of large-scale device dynamic access. For example, the combined key system based on the elliptic curve algorithm can avoid database dependence, but has defects such as a single key derivation path, inability to implement dynamic key rotation, and lack of a supporting mechanism for key lifecycle management.

[0004] At the device authorization and authentication level, existing solutions mostly focus on the one-time key binding between the device and the access point, without establishing a hierarchical key management system. Such technologies only complete the key distribution during the initial activation of the device, without setting up a collaborative verification mechanism for multi-level keys, nor constructing a full lifecycle management system covering key generation, storage, update, and destruction. Especially in the aspect of key emergency handling in the abnormal state of the device, the existing technology lacks both the active detection ability of key invalidation and the traceability and auditing function of key logs, resulting in the difficulty of timely discovery and blocking of key leakage risks.

[0005] Furthermore, existing security solutions generally neglect the design of a secure collaboration mechanism between the device and the cloud. Most technical solutions implement only one-way key distribution, lacking a key derivation mechanism based on device hardware characteristics or the coordinated protection of cloud-based key services and device security chips. This fragmented design allows attackers to bypass single-point protection modules and breach security defenses by forging device identities or tampering with communication protocols. Existing key management methods struggle to achieve fine-grained permission control and real-time risk mitigation, especially in high-risk operational scenarios such as device firmware upgrades and remote control. Summary of the Invention

[0006] The present application provides a cloud-based smart device key management system to solve the problems of existing key management technologies, such as a single key derivation path, a lack of key log tracing function, and an inability to perform real-time risk blocking.

[0007] The system comprises:

[0008] At least one terminal device, the terminal device being configured to generate a real-time key by encrypting the device serial number and timestamp data using a public key; each terminal device comprising a first storage module and a second storage module, the first storage module being configured to store first key data reported successfully; and the second storage module being configured to store second key data reported unsuccessfully;

[0009] A cloud server, the cloud server being connected to a network configuration of the terminal device, the cloud server being configured to verify the real-time key using the public key and generate a key verification result; the key verification result being used to mark success or failure of the real-time key reporting;

[0010] A key server is configured to store the successfully reported key data.

[0011] Preferably, the timestamp data includes the reporting time and generation time of the real-time key, the first key data includes the latest key and the device data of the terminal device; the second key data includes the last successfully reported key and log data.

[0012] Preferably, the terminal device further includes:

[0013] an instruction processing module, the instruction processing module being configured to encrypt the device serial number and timestamp data to be reported;

[0014] A network distribution module is configured to establish a network distribution connection with the cloud server.

[0015] Preferably, the terminal device is further configured to:

[0016] Perform network configuration registration with the cloud server;

[0017] Call the interface of the cloud server, including making an encrypted request to the cloud server according to the device serial number and timestamp data.

[0018] Preferably, the cloud server is further configured to:

[0019] Parse the real-time key to obtain the device serial number and the timestamp data;

[0020] Perform verification in sequence through the device serial number and the timestamp data.

[0021] Preferably, the cloud server is further configured to:

[0022] Judge whether the terminal device is registered through the device serial number;

[0023] If so, judge whether the timestamp of the real-time key exceeds the expiration date through the timestamp data;

[0024] If not, judge whether the real-time key meets the valid requirements;

[0025] If so, send the key data including the real-time key to the key server.

[0026] Preferably, judging whether the real-time key meets the valid requirements includes:

[0027] Query the key in the key server according to the real-time key to obtain the original key; the key situation of the original key includes two situations: no key exists and a key exists;

[0028] Judge whether the key situation of the original key is that no key exists;

[0029] If so, send the real-time key to the key server for storage;

[0030] If not, judge whether the real-time key is consistent with the original key;

[0031] If not, send the real-time key to the key server for key update and store the real-time key.

[0032] Preferably, the types of the log data include data corresponding to failed parsing instructions and data corresponding to failed interface calls.

[0033] Preferably, the terminal device is further configured to:

[0034] When the call to the cloud server interface fails, the log data of the call interface is sent to the second storage module;

[0035] The cloud server is further configured to:

[0036] Analyze the reason for the failure of the key report according to the log data to obtain an analysis result;

[0037] Call the latest key from the key server according to the analysis result and send it to the terminal device, or generate a key reset instruction; the key reset instruction is used to instruct the terminal device to report the key again.

[0038] Preferably, the terminal device is further configured to:

[0039] Write the latest key sent by the key server into the first storage module, and report data to the cloud server using the key stored in the first storage module;

[0040] Update the key in the first storage module to the second storage module, and record log data in the second storage module;

[0041] The terminal device is further configured to:

[0042] Generate a new key according to the key reset instruction, write the original key in the first storage module into the second storage module, and write the new key into the first storage module;

[0043] Report the new key and the corresponding log to the cloud server.

[0044] As can be seen from the above, the present application provides an intelligent device key management system based on cloud services. The system includes a plurality of terminal devices, and the terminal devices are configured to generate real-time keys by encrypting according to the device serial number and timestamp data through a public key; each of the terminal devices includes a first storage module and a second storage module, and the first storage module is configured to store the first key data reported successfully; the second storage module is configured to store the second key data reported failed; a cloud server, the cloud server is network-connected to the terminal device, and the cloud server is configured to verify the real-time key through the public key and generate the key verification result; the key verification result is used to mark the success or failure of the real-time key report; a key server, the key server is configured to store the reported successful key data. The present application solves the problems of single derived key path, lack of key log tracing function and inability to perform real-time risk blocking in the existing key management technology through the above system. Description of the Drawings

[0045] To more clearly illustrate the technical solutions of this application, the following will briefly introduce the drawings required for use in the embodiments. Obviously, for those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0046] Figure 1 It is a schematic diagram of an intelligent device key management system based on cloud services for this application. Specific implementation manners

[0047] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0048] It should be noted that the brief description of the terms in this application is only for the convenience of understanding the following described implementation manners, rather than intending to limit the implementation manners of this application. Unless otherwise specified, these terms should be understood in their ordinary and general meanings.

[0049] It should be noted that in this application, words such as "exemplary" or "for example" are used to represent examples, illustrations or explanations. Any embodiment or design solution described as "exemplary" or "for example" in this application should not be construed as being more preferred or having more advantages than other embodiments or design solutions. Exactly speaking, using words such as "exemplary" or "for example" aims to present relevant concepts in a specific manner.

[0050] Figure 1 It is a schematic diagram of an intelligent device key management system based on cloud services for this application.

[0051] See Figure 1 It can be known that this embodiment provides an intelligent device key management system based on cloud services, and the system includes:

[0052] At least one terminal device 100, the terminal device 100 is configured to encrypt through a public key according to the device serial number and timestamp data to generate a real-time key; each terminal device 100 includes a first storage module 110 and a second storage module 120, the first storage module 110 is configured to store the first key data reported successfully; the second storage module 120 is configured to store the second key data reported unsuccessfully.

[0053] Specifically, in this embodiment, the terminal device 100 may be a smart device such as a smart phone, a tablet, and a computer. Among them, the first storage module 110 and the second storage module 120 are local devices built into the terminal device 100, that is, the key and the relevant data after the key verification fails are stored locally.

[0054] Among them, the terminal device 100 is also used for encryption. The encryption method is to encrypt according to the device serial number and the timestamp data of the terminal device 100 itself, and the encryption is based on the public key.

[0055] Among them, the timestamp data applied in the encryption process can be understood as setting a time identifier for the encryption process, so that the time when the key is generated and the time when the key remains in an effective state can be quickly known.

[0056] It should be noted that the terminal device 100 may be a combination of one or more of the smart devices such as the smart phone, the tablet, and the computer, that is, the keys of the smart phone, the tablet, and the computer are managed simultaneously.

[0057] The system further includes:

[0058] A cloud server 200, which is connected to the terminal device 100 through network configuration. The cloud server 200 is configured to verify the real-time key through the public key and generate the key verification result; the key verification result is used to mark the success or failure of the real-time key reporting.

[0059] Specifically, in this embodiment, the cloud server 200 is used to parse and verify the key sent by the terminal device 100, so as to know whether the key currently sent by the terminal device 100 is valid.

[0060] Among them, before the cloud server 200 performs the parsing and verification of the key, it needs to be connected to the terminal device 100 through network configuration first, and perform relevant key processing on the basis of the network configuration connection.

[0061] It should be noted that for the network configuration connection between the cloud server 200 and the terminal device 100, the terminal device 100 needs to register with the cloud server 200 first and establish a network configuration connection.

[0062] Among them, after the cloud server 200 completes the processing of the key, it generates the corresponding key verification result and feeds it back to the terminal device 100, so as to inform the terminal device 100 whether the key is valid, and the terminal device 100 stores the key-related data based on the key verification result.

[0063] It should be noted that in the process of the cloud server 200 further processing the key, it does not necessarily perform complete parsing and verification, that is, there are cases where subsequent verification is not performed in case of parsing failure, cases where subsequent verification fails after successful parsing, and cases where subsequent verification is also successful after successful parsing.

[0064] The system further includes:

[0065] A key server 300, which is configured to store the reported successful key data.

[0066] Specifically, in this embodiment, the key server 300 is used to store the key successfully authenticated by the cloud server 200. By this means, in the case where the terminal device 100 requests to access the cloud server 200, the cached key can be directly obtained from the key server 300, thereby avoiding the problem of re-performing cumbersome key authentication between the terminal device 100 and the cloud server 200.

[0067] Further, in some embodiments, the timestamp data includes the reporting time and the generation time of the real-time key, the first key data includes the latest key and the device data of the terminal device 100; the second key data includes the previously reported successful key and the log data.

[0068] Specifically, in this embodiment, after the terminal device 100 knows the result of key reporting, it needs to store the relevant data of the key differently according to the reporting result. If the key reporting is successful, only the successfully verified key needs to be stored in the first storage module 110. If the key verification fails, the previously verified successful key and the relevant log data generated by this key verification failure need to be stored in the second storage module 120.

[0069] It should be noted that if this key authentication is the first time, there is no need to store the key in the second storage module 120, and only the relevant log data of the key verification failure needs to be stored.

[0070] Further, in some embodiments, the terminal device 100 further includes:

[0071] An instruction processing module 130, which is configured to encrypt the device serial number and the timestamp data to be reported;

[0072] A network configuration module 140, which is configured to establish a network configuration connection with the cloud server 200.

[0073] Specifically, in this embodiment, in the system, instruction sending tasks such as registering with the cloud server 200 and network configuration are all completed by the instruction processing module 130, and key encryption is also completed by the instruction processing module 130; after the instruction processing module 130 makes a network configuration request, a network configuration connection with the cloud server 200 is established through the network configuration module 140.

[0074] Furthermore, in some embodiments, the terminal device 100 is further configured to:

[0075] Perform network configuration registration with the cloud server 200;

[0076] Invoke the interface of the cloud server 200, including making an encryption request to the cloud server 200 according to the device serial number and timestamp data.

[0077] Specifically, in this embodiment, before the terminal device 100 performs network configuration, it needs to first perform network configuration registration with the cloud server 200. The network configuration registration can be understood as registering the terminal device 100 at the port of the cloud server 200; after the network configuration registration is completed, the terminal device 100 invokes the interface of the cloud server 200, and in this process, makes an encryption request to the cloud server 200 according to the device serial number and timestamp data, that is, makes an encrypted request to the cloud server 200 for the device parameters of the terminal device 100 in a way of attaching a time identifier; the cloud server 200 authenticates the terminal device 100 according to the device serial number sent by the terminal device 100 and the previously registered relevant parameters, and feeds back the feedback information of the encryption request to the terminal device 100, so that key encryption can be performed on the terminal device 100 and key parsing and verification can be performed on the cloud server 200.

[0078] Furthermore, in some embodiments, the cloud server 200 is further configured to:

[0079] Parse and process the real-time key to obtain the device serial number and the timestamp data;

[0080] Perform verification in sequence through the device serial number and the timestamp data.

[0081] Specifically, in this embodiment, the cloud server 200 parses the key sent by the terminal device 100 through the public key, and thus obtains the device serial number and the timestamp data included in the key, and performs verification on the device serial number and the timestamp data in sequence, so as to complete the verification.

[0082] It should be noted that completing the verification does not mean that the entire verification process is completed. There may be a situation where the verification fails in the first step of verification using the device serial number, and in this case, the subsequent verification is not continued.

[0083] Further, in some embodiments, the cloud server 200 is further configured to:

[0084] Determine whether the terminal device 100 is registered based on the device serial number;

[0085] If so, determine whether the timestamp of the real-time key exceeds the expiration date based on the timestamp data;

[0086] If not, determine whether the real-time key meets the valid requirements;

[0087] If so, send the key data including the real-time key to the key server 300.

[0088] Specifically, in this embodiment, the process of the cloud server 200 verifying the key mainly includes three steps. The first step is to verify whether the terminal device 100 was previously registered on the cloud server 200. The judgment method for this step is to determine whether the device serial number in the key sent by the terminal device 100 exists in the cloud server 200, that is, whether it was previously registered. The second step is to verify whether the key sent by the terminal device 100 has an expiration date. The judgment method for this step is to determine based on the timestamp data and the expiration limit in the key sent by the terminal device 100.

[0089] Further, in some embodiments, determining whether the real-time key meets the valid requirements includes:

[0090] Query the key in the key server 300 according to the real-time key to obtain the original key; the key situation of the original key includes two situations: no key exists and a key exists;

[0091] Determine whether the key situation of the original key is that no key exists;

[0092] If so, send the real-time key to the key server 300 for storage;

[0093] If not, determine whether the real-time key is consistent with the original key;

[0094] If not, send the real-time key to the key server 300 for key update and store the real-time key.

[0095] Specifically, in this embodiment, during the process of determining whether the real-time key meets the valid requirements, the following two situations are mainly included:

[0096] In the first situation, this key authentication is the first key authentication. Therefore, there is no key corresponding to the terminal device 100 stored in the key server 300. In this case, it is only necessary to store the key reported this time in the key server 300.

[0097] In the second situation, this key authentication is not the first key authentication. Since it is not the first key authentication, the key of the terminal device 100 is stored in the key server 300. And because the terminal device 100 has the situation of updating the key, it is necessary to use the key reported this time to update the key corresponding to the terminal device 100 stored in the key server 300.

[0098] Further, in some embodiments, the types of the log data include the data corresponding to the failure of parsing the instruction and the data corresponding to the failure of calling the interface.

[0099] Specifically, in this embodiment, the situations of key reporting failure mainly include the failure of parsing the instruction and the failure of calling the interface. Therefore, it is necessary to classify the log data of the key reporting failure caused by different reasons and store them in the second storage module 120.

[0100] Further, in some embodiments, the terminal device 100 is further configured to:

[0101] When there is a situation of failure in calling the interface of the cloud server 200, send the log data of the calling interface to the second storage module 120;

[0102] The cloud server 200 is further configured to:

[0103] Analyze the reason for the key reporting failure according to the log data to obtain an analysis result;

[0104] Call the latest key from the key server 300 according to the analysis result and send it to the terminal device 100, or generate a key reset instruction; the key reset instruction is used to instruct the terminal device 100 to report the key again.

[0105] Specifically, in this embodiment, when there is a situation of failure in calling the interface of the cloud server 200, it is necessary to send the relevant log data generated by the calling interface to the second storage module 120 for storage, and analyze the reason for the reporting failure in the cloud server 200 to provide feedback information for the terminal device 100.

[0106] Among them, the analysis of the reported failure reason is based on the relevant log data generated by the key reporting failure, and is automatically analyzed by the cloud server 200. However, if the analysis fails, that is, when the result of the key reporting failure cannot be obtained, manual intervention is required, that is, the log data is analyzed manually.

[0107] But after the analysis of the key reporting failure is successful, the cloud server 200 calls the latest key from the key server 300 and sends it to the terminal device 100, or generates the key reset instruction to instruct the terminal device 100 to report the key again. This situation is caused by an error during the key encryption process of the terminal device 100.

[0108] Further, in some embodiments, the terminal device 100 is further configured to:

[0109] Write the latest key sent by the key server 300 into the first storage module 110, and use the key stored in the first storage module 110 to report data to the cloud server 200;

[0110] Update the key in the first storage module 110 to the second storage module 120, and record the log data in the second storage module 120;

[0111] The terminal device 100 is further configured to:

[0112] Generate a new key according to the key reset instruction, write the original key in the first storage module 110 into the second storage module 120, and write the new key into the first storage module 110;

[0113] Report the new key and the corresponding log to the cloud server 200.

[0114] Specifically, in this embodiment, when the terminal device 100 receives the latest key stored in the key server 300, it needs to store the key in the first storage module 110. If there is a key in the first storage module 110 before, it is updated with the latest key, and the relevant log data of this reporting failure and the latest key are stored in the second storage module 120; when the terminal device 100 receives the key reset instruction sent by the cloud server 200, it needs to re-encrypt the key to generate a new key, store the reported failed key in the second storage module 120, store the new key in the first storage module 110, and report the new key and the corresponding log to the cloud server 200 to re-parse and verify the key.

[0115] The present embodiment has the following advantages:

[0116] Under specific circumstances, the present embodiment can distribute keys through the above-mentioned first storage module 110, the second storage module 120, or the key server 300, thereby solving the problem of the single key distribution path in the existing key management technology.

[0117] By setting the log storage function for key reporting failure, a data basis is provided for subsequent tracing of key logs.

[0118] Detect and update keys in real time to achieve real-time risk blocking.

[0119] For the sake of convenience in explanation, the above description has been made in conjunction with specific embodiments. However, the above discussion in some embodiments is not intended to be exhaustive or to limit the embodiments to the specific forms disclosed above. According to the above teachings, various modifications and variations can be obtained. The selection and description of the above embodiments are for better explaining the content of the present disclosure, so that those skilled in the art can better use the embodiments.

Claims

1. An intelligent device key management system based on cloud services, characterized in that, The system includes: At least one terminal device (100), which is configured to encrypt according to the device serial number and timestamp data through a public key to generate a real-time key; each terminal device (100) includes a first storage module (110) and a second storage module (120), the first storage module (110) is configured to store the first key data reported successfully; the second storage module (120) is configured to store the second key data reported unsuccessfully; A cloud server (200), which is networked with the terminal device (100), and the cloud server (200) is configured to verify the real-time key through the public key and generate the key verification result; the key verification result is used to mark the success or failure of the real-time key reporting; A key server (300), which is configured to store the reported successful key data.

2. The intelligent device key management system based on cloud service according to claim 1, characterized in that, The timestamp data includes the reporting time and generation time of the real-time key, the first key data includes the latest key and the device data of the terminal device (100); the second key data includes the key reported successfully last time and log data.

3. An intelligent device key management system based on cloud services according to claim 1, characterized in that, The terminal device (100) further includes: An instruction processing module (130), which is configured to encrypt the device serial number and timestamp data to be reported; A networking module (140), which is configured to establish a networking connection with the cloud server (200).

4. An intelligent device key management system based on cloud services according to claim 1, characterized in that, The terminal device (100) is further configured to: Perform networking registration with the cloud server (200); Call the interface of the cloud server (200), including making an encrypted request to the cloud server (200) according to the device serial number and timestamp data.

5. An intelligent device key management system based on cloud services according to claim 4, characterized in that, The cloud server (200) is further configured to: Parse and process the real-time key to obtain the device serial number and the timestamp data; Perform verification in sequence through the device serial number and the timestamp data.

6. The intelligent device key management system based on cloud service according to claim 5, wherein The cloud server (200) is further configured to: Judge whether the terminal device (100) is registered through the device serial number; If so, judge whether the timestamp of the real-time key exceeds the deadline through the timestamp data; If not, judge whether the real-time key meets the valid requirements; If so, send the key data including the real-time key to the key server (300).

7. An intelligent device key management system based on cloud services according to claim 6, characterized in that, The judgment of whether the real-time key meets the valid requirements includes: Query the key in the key server (300) according to the real-time key to obtain the original key; the key situation of the original key includes two situations: no key exists and a key exists; Judge whether the key situation of the original key is that no key exists; If so, send the real-time key to the key server (300) for storage; If not, judge whether the real-time key is consistent with the original key; Otherwise, send the real-time key to the key server (300) for key update and store the real-time key.

8. The intelligent device key management system based on cloud service according to claim 2, wherein The types of the log data include data corresponding to failed parsing instructions and data corresponding to failed interface calls.

9. The intelligent device key management system based on cloud service according to claim 8, characterized in that, The terminal device (100) is further configured to: When a situation where the interface of the cloud server (200) fails to be called occurs, send the log data of the interface call to the second storage module (120) and the cloud server (200); The cloud server (200) is further configured to: Analyze the reason for the failure of key reporting according to the log data to obtain an analysis result; Call the latest key from the key server (300) according to the analysis result and send it to the terminal device (100), or generate a key reset instruction; the key reset instruction is used to instruct the terminal device (100) to report the key again.

10. An intelligent device key management system based on cloud service according to claim 9, characterized in that, The terminal device (100) is further configured to: Write the latest key sent by the key server (300) into the first storage module (110), and report data to the cloud server (200) using the key stored in the first storage module (110); Update the key in the first storage module (110) to the second storage module (120), and record log data in the second storage module (120); The terminal device (100) is further configured to: Generate a new key according to the key reset instruction, write the original key in the first storage module (110) into the second storage module (120), and write the new key into the first storage module (110); Report the new key and the corresponding log to the cloud server (200).

Images