A semi-distributed key management method

Abstract

The specification discloses a kind of semi-distributed key management methods, it is related to cryptography technical field;Including the following steps: the original key of encryption device is separated into complete key entity and multiple key sub-privileges, based on ZigBee communication, only one key sub-privilege is stored on each authentication information edge node;Key authentication edge node stores complete key entity centrally;All authentication information edge nodes periodically send key sub-privileges to central computing node;Front-end device sends the calling request instruction of encryption device original key, central computing node compares the calling request instruction of encryption device original key with all key sub-privileges, when reaching the use permission level of the decryption of encryption device after comparison, key authentication edge node finds corresponding encryption device complete key entity according to use permission level;Complete key entity is used to decrypt encryption device;The application enhances the security guarantee and reliable performance of key permission.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cryptography, in particular to a semi-distributed secret key management method. BACKGROUND

[0002] With the rapid development of information technology, data security has become a core issue in the field of information technology. In the traditional centralized key management system, the key is usually stored in a single device, such as the encryption scheme used in computer level examination encryption system, which integrates the key system in a single hardware device and relies on the way of improving the key complexity to strengthen the system security. However, in practical application, it is found that the central key system has loopholes in personnel supervision mechanism, which leads to multiple security risks of the system: on the one hand, the hardware device may be maliciously cloned or directly copied, so that the key system as a whole is exposed to risk; on the other hand, the attacker can track the data interaction process to realize decryption through the debugging tool such as SoftICE; in addition, writing an interception program to tamper with the communication data between the software and the encryption device has also become a common way to crack the central key system. The superposition of these technical loopholes and management defects makes the traditional centralized key system have a high risk of key leakage and system cracking when facing professional attacks. SUMMARY

[0003] The purpose of the present application is to provide a semi-distributed secret key management method, which improves the security and reliability of secret key use.

[0004] To solve the above technical problems, the embodiments of the present application provide a semi-distributed secret key management method, comprising the following steps:

[0005] The semi-distributed secret key management method is applied to a semi-distributed secret key management system, which comprises an authentication information edge node, a secret key authentication edge node, a central computing node, a front-end device, a plurality of authentication information edge nodes and a plurality of encryption devices; the method comprises:

[0006] The original secret key of the encryption device is separated into a complete secret key entity and a plurality of secret key sub-authorities, and based on ZigBee communication, only one secret key sub-authority is stored on each authentication information edge node; the secret key authentication edge node centrally stores the complete secret key entity; all authentication information edge nodes periodically send secret key sub-authorities to the central computing node;

[0007] The front-end device sends a call request instruction of the original secret key of the encryption device to the central computing node, the central computing node compares the call request instruction of the original secret key of the encryption device with all secret key sub-authorities, when the comparison reaches the use authority level of the decryption of the encryption device, the secret key authentication edge node finds the corresponding complete secret key entity of the encryption device according to the use authority level of the decryption of the encryption device;

[0008] The encryption device is decrypted using the complete key entity.

[0009] In some optional embodiments, the key authentication edge node is specifically configured to:

[0010] The key authentication edge node supports parallel storage of multiple original key entities and can configure differentiated use permissions for different original key entities.

[0011] In some optional embodiments, the center computing node is specifically configured to:

[0012] The center computing node only involves receiving the key sub-permissions stored in the authentication information edge node, receiving the calling request instruction of the original key of the encryption device initiated by the front-end device, and sending the use permission level reaching the decryption of the encryption device to the key authentication edge node.

[0013] In some optional embodiments, the authentication information edge node periodically sends different levels of key use permissions to the center computing node, specifically including:

[0014] All authentication information edge nodes periodically send key sub-permissions to the center computing node, and each key sub-permission has a certain life cycle. When the life cycle reaches the upper limit, the center computing node will lose the key sub-permission information if it does not receive the updated key sub-permission of the authentication information edge node.

[0015] The semi-distributed key management method provided by the application has at least the following beneficial effects:

[0016] The original key is separated into a complete key entity and a key use permission, and the generation, distribution, storage and update of the key use permission are realized by means of distributed computing and storage technology. This architecture significantly reduces the risk of single-point theft, enhances the system fault tolerance and attack resistance, and is more suitable for massive key management in large-scale scenarios such as cloud computing and Internet of Things, providing efficient and reliable protection for data encryption transmission and storage.

[0017] The authentication information edge node in the system is only responsible for the permission verification of the authentication process and does not store the key entity, which not only reduces the network transmission security requirement but also simplifies the ZigBee network management center device design. At the same time, the separately designed key storage node independently manages the key, improving the flexibility of system deployment, and the centralized storage facilitates the centralized management, backup and storage of the key, further strengthening the security. BRIEF DESCRIPTION OF DRAWINGS

[0018] The accompanying drawings, which are included to provide a further understanding of the application and constitute a part of this application, illustrate certain illustrative embodiments of the application and are used to explain the application, but do not limit the application. In the drawings:

[0019] Figure 1 is a semi-distributed key management method flow chart provided according to an embodiment of the application;

[0020] Figure 2 is an authentication information edge node physical diagram according to an embodiment of the application;

[0021] Figure 3 is an authentication information edge node flow chart according to an embodiment of the application;

[0022] Figure 4 is a key authentication edge node physical diagram according to an embodiment of the application;

[0023] Figure 5 is a key authentication edge node flow chart according to an embodiment of the application;

[0024] Figure 6 is a central computing node physical diagram according to an embodiment of the application;

[0025] Figure 7 is a central computing node flow chart according to an embodiment of the application;

[0026] Figure 8 is a schematic diagram of a user using a WeChat mini program according to an embodiment of the application;

[0027] Figure 9 is a semi-distributed key management method system diagram according to an embodiment of the application; DETAILED DESCRIPTION

[0028] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described below in detail with specific embodiments of the present application and corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0029] One embodiment of the present application relates to a semi-distributed key management method, and the implementation details of the grape bud quantitative evaluation method of the present embodiment will be described in detail below. The following content is only provided for the convenience of understanding the implementation details, and is not necessary for implementing the present solution.

[0030] The specific process of the semi-distributed key management method of the present embodiment is shown in Figure 1 , which includes:

[0031] Step 101, the original key of the encryption device is separated into a complete key entity and a plurality of key sub-authorities, based on ZigBee communication, only one key sub-authority is stored on each authentication information edge node; the key authentication edge node centrally stores the complete key entity; all authentication information edge nodes periodically send key sub-authorities to the central computing node.

[0032] The authentication information edge node is implemented by CC2530. To meet the demand of small and portable, CC2530 and power module need to be integrated. The physical diagram of the authentication information edge node is shown in Figure 2 .

[0033] The authentication information edge node stores different levels of key use authorities and sends them to the central computing node when needed. The flow chart of the authentication information edge node is shown in Figure 3 . The flow starts with the authentication information edge node initializing, judging the network access state, and continuously retrying if not accessed. After successful access, it waits for the send key operation. If it is not pressed, it will always wait. After pressing, it sends different levels of key use authorities to the central computing node, and exits the system after sending.

[0034] The authentication information edge node periodically sends different levels of key use authorities to the central computing node. Each authority has a certain life cycle. When the upper limit of the life cycle is reached, the central computing node will lose the different levels of key use authority information if it does not receive the updated different levels of key use authorities from the authentication information edge node.

[0035] The key authentication edge node is implemented by combining CC2530 and CH9329. The physical diagram of the key authentication edge node is shown in Figure 4 .

[0036] The key authentication edge node centrally stores the complete key entity, identifies the target key entity corresponding to the original key call request, and outputs the key entity after retrieving the key entity. The flow chart of the key authentication edge node is shown in Figure 5 . The flow starts with the key authentication edge node initializing, and then continuously trying to access the network until successful access. After successful access, the node enters standby state and waits to receive the control command issued by the central computing node. When receiving the control command, the key authentication edge node identifies the type of the original key call request, outputs the corresponding key entity according to different original key call requests, and completes the key output. After that, the flow ends and the node exits the system. The key authentication edge node supports parallel storage of multiple original keys and can configure differentiated use authorities for different original keys.

[0037] The center computing node adopts a CC2530 WIFI transparent gateway module, which integrates a CC2530 master chip, an ESP8266 module, a power supply, a USB, a debugging interface, and a standard IO port, facilitating development. The design uses a CC2530 master chip, an ESP8266 module, an IO interface, and a USB-to-serial port to achieve functions. The physical diagram of the center computing node is shown in Figure 6 .

[0038] The center computing node only involves receiving different levels of secret key usage permissions saved in the authentication information edge node, receiving the original secret key call request initiated by the front-end device, and sending the original secret key call request to the secret key authentication edge node. After the center computing node receives the different levels of secret key usage permissions saved in the authentication information edge node, it calculates the different levels of secret key usage permissions. If the original secret key call request initiated by the front-end device reaches the usage permission level, it sends the original secret key call request to the secret key authentication edge node. The flow chart of the center computing node is shown in Figure 7 . The process starts with the initialization of the center computing node, and then enters the control command waiting state. When the authentication information is received, it is calculated and processed, and then it is determined whether the authentication information matches the received control command. If not, continue to wait for the matching control command; if matched, send the control command to the secret key authentication node, and exit the system after successful sending.

[0039] Step 102: The front-end device sends a call request instruction for the encrypted device original secret key to the center computing node. The center computing node compares the call request instruction for the encrypted device original secret key with all secret key sub-permissions. When the comparison reaches the usage permission level for the encrypted device decryption, the secret key authentication edge node finds the corresponding encrypted device complete secret key entity according to the usage permission level for the encrypted device decryption.

[0040] The front-end device is implemented using a WeChat mini-program. Four modules are set in the WeChat mini-program, which are the key control module, the time traceability module (viewing the time of using the key), user registration and login, and user password retrieval, as shown in Figure 7 . The schematic diagram of the user using the WeChat mini-program is shown, which includes registration and login, key control, time traceability, and password retrieval.

[0041] The ONENET cloud server management platform is used to store and trace the key usage records. The ONENET cloud server management platform supports multiple communication protocols such as MQTT, EDP, HTTP / HTTPS. Among these protocols, the MQTT protocol has the advantage of lightweight publish / subscribe mechanism, which is highly adaptable to IoT terminal devices with limited computing resources and network bandwidth, effectively reducing the communication burden of the device end.

[0042] authentication edge node, key authentication edge node, central computing node, ONENET cloud server management platform and WeChat applet, Figure 8 For semi-distributed key management method system diagram, clear display different levels of key use permission is stored in the authentication information edge node, in the key authentication edge node storage complete key entity, the central computing node to the original key call request and different levels of key use permission comparison, ONENET cloud server management platform cross network interaction, WeChat applet sends original key call request to control it.

[0043] Step 103: decrypt the encrypted device using the complete key entity.

[0044] The step division of the above methods is only for clear description, and when implemented, one step can be combined or some steps can be split into multiple steps, as long as the same logical relationship is included, which is within the protection scope of the present application; adding irrelevant modifications or introducing irrelevant designs in the algorithm or process, but not changing the core design of the algorithm and process, are within the protection scope of the present application.

[0045] The ordinary skilled in the art can understand that the above embodiments are specific embodiments for implementing the present application, and in actual application, various changes can be made in form and details without departing from the spirit and scope of the present application.

[0046] The ordinary skilled in the art can understand that the above embodiments are specific embodiments for implementing the present application, and in actual application, various changes can be made in form and details without departing from the spirit and scope of the present application.

[0047] The ordinary skilled in the art can understand that the above embodiments are specific embodiments for implementing the present application, and in actual application, various changes can be made in form and details without departing from the spirit and scope of the present application.

Claims

1. A semi-distributed key management method, characterized by, Application to semi-distributed key management The system comprises: an authentication information edge node, a key authentication edge node, a central computing node, a front-end device, a plurality of authentication information edge nodes and a plurality of encryption devices. The method comprises: Separating the original key of the encryption device into a complete key entity and a plurality of key sub-authorities, and storing only one key sub-authority on each authentication information edge node based on ZigBee communication; the key authentication edge node centrally stores the complete key entity; all authentication information edge nodes periodically send key sub-authorities to the central computing node; The front-end device sends a call request instruction of the original key of the encryption device to the central computing node, the central computing node compares the call request instruction of the original key of the encryption device with all key sub-authorities, and when the comparison reaches the use permission level of the encryption device decryption, the key authentication edge node finds the corresponding complete key entity of the encryption device according to the use permission level of the encryption device decryption. Decrypt the encryption device using the complete key entity.

2. The semi-distributed key management method of claim 1, wherein, The key authentication edge node is specifically used for: The key authentication edge node supports parallel storage of multiple original key entities and can configure differentiated use permissions for different original key entities.

3. The semi-distributed key management method of claim 1, wherein, The central computing node is specifically used for: The central computing node only involves receiving key sub-authorities saved in the authentication information edge node, receiving a call request instruction of the original key of the encryption device initiated by the front-end device, and sending a use permission level reaching the encryption device decryption to the key authentication edge node.

4. The semi-distributed key management method of claim 1, wherein, The authentication information edge node periodically sends different levels of key use permissions to the central computing node, specifically including: All authentication information edge nodes periodically send key sub-authorities to the central computing node, and each key sub-authority has a certain life cycle. When the life cycle reaches the upper limit, if the central computing node does not receive the updated key sub-authority of the authentication information edge node, the central computing node will lose the key sub-authority information.

Images