Key distribution method, key distribution device and electronic equipment

Abstract

The invention provides a key distribution method, a key distribution device and electronic equipment, and relates to the technical field of information security. The method comprises the following steps: when receiving a device identifier and a key application request, a security service platform can obtain a key corresponding to the device identifier, performs key dispersion through the device identifier and the key corresponding to the device identifier to obtain a dispersed key corresponding to the device identifier, and sends the obtained dispersed key to a device corresponding to the device identifier, and the device carries out data encryption by using the received distributed key. Based on the above scheme, the security of the secret key can be improved, and when the device data is encrypted by using the safer secret key, the device data can be safer.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a key distribution method, a key distribution device, and an electronic device in the field of information security technology. Background Art

[0002] In order to protect device data, you can encrypt device data with a key to improve the security of device data. However, if the key is not secure, it cannot protect the device data and will reduce the security of the device data.

[0003] Therefore, how to improve the security of keys is an urgent problem that needs to be solved. Summary of the Invention

[0004] The present application provides a key distribution method, a key distribution device and an electronic device. The method can improve the security of the key and make the device data more secure when using a more secure key to encrypt the device data.

[0005] In a first aspect, the present application provides a key distribution method, which is applied to a security service platform. The key distribution method includes:

[0006] Receive target device identification and key application request;

[0007] Based on the target device identifier, obtain a target key corresponding to the target device identifier;

[0008] Based on the target device identifier and the target key, a target distributed key corresponding to the target key is obtained;

[0009] The target distributed key is sent to the target device corresponding to the target device identifier, so that the target device uses the target distributed key to encrypt data.

[0010] In an embodiment of the present application, when the security service platform receives a device identifier and a key application request, it can obtain the key corresponding to the device identifier (i.e., the target key), and perform key dispersion using the device identifier and the key corresponding to the device identifier to obtain a dispersed key corresponding to the device identifier (i.e., the target dispersed key), and then send the obtained dispersed key to the device corresponding to the device identifier so that the device uses the received dispersed key to encrypt data. When obtaining the key corresponding to the device identifier, in order to improve the security of the key corresponding to the device identifier, the dispersed key corresponding to the key can be obtained, so that the device uses the obtained dispersed key to encrypt data instead of directly using the key corresponding to the device identifier. This can avoid the problem of the key corresponding to the device identifier being leaked, thereby improving the security of the key corresponding to the device identifier. Furthermore, by obtaining the key corresponding to the device identifier, the dispersed key used by the device when encrypting data is related to the device identifier, not a universal key, i.e., different device identifiers correspond to different keys, which can avoid the security risks caused by repeated use of keys, can make the key corresponding to the device identifier unique, and is also more secure, so that when a more secure key is used to encrypt device data, the device data can also be made more secure. Furthermore, since the key corresponding to the device identification is unique, the existence of obfuscated keys can be avoided, thereby avoiding the problem of data encryption failure caused by obfuscated keys and improving the security of device data.

[0011] In conjunction with the first aspect, in certain implementations of the first aspect, obtaining the target key corresponding to the target device identifier based on the target device identifier includes:

[0012] Determine the service type of the target device based on the target device identifier;

[0013] Based on the business type, determine the key generation module corresponding to the business type;

[0014] The target key is obtained through the key generation module.

[0015] In an embodiment of the present application, when the target key corresponding to the target device identifier is obtained, it is generated by the key generation module corresponding to the business type of the target device, that is, there is a correspondence between the business type of the target device and the key generation module. The key generation module corresponding to the business type of the target device will not generate a key corresponding to the business type of a non-target device. This can avoid the generation of keys for different types of businesses through the same key generation module, resulting in excessive generation burden on the key generation module, slow generation efficiency and key generation errors, thereby improving the efficiency and accuracy of key generation.

[0016] In combination with the first aspect and the above implementations, in some implementations of the first aspect, the method further includes:

[0017] Based on the business type, determine the key management module corresponding to the business type;

[0018] The target device identification is encrypted by the key management module to obtain an encrypted target device identification;

[0019] The target key is obtained through the key generation module, including:

[0020] In the key generation module, a target key is obtained based on the encrypted target device identifier.

[0021] In an embodiment of the present application, when obtaining the target key corresponding to the target device identifier, it is necessary to first encrypt the target device identifier through the key management module corresponding to the target device's business type to obtain the encrypted target device identifier. By encrypting the target device identifier, the security of the identifier data can be improved. Furthermore, the target device identifier is encrypted through the key management module corresponding to the target device's business type. That is, there is a corresponding relationship between the target device's business type and the key management module. The key management module corresponding to the target device's business type will not encrypt the device identifier corresponding to the business type of non-target devices. This can avoid the problem of identifiers corresponding to different types of business being encrypted through the same key management module, which would result in excessive encryption burden on the key management module, slow encryption efficiency, and encryption errors. This improves the efficiency and accuracy of identifier encryption.

[0022] Optionally, based on the encrypted target device identification, a target key corresponding to the encrypted target device identification is searched in a preset mapping relationship, wherein the preset mapping relationship is used to represent a mapping relationship between a device identification and a key.

[0023] In combination with the first aspect and the above implementations, in certain implementations of the first aspect, obtaining the target distributed key corresponding to the target key based on the target device identifier and the target key includes:

[0024] Performing splicing processing on the target device identifier and the target key to obtain target splicing data;

[0025] Perform hash operation on the target splicing data to obtain the target distributed key.

[0026] In an embodiment of the present application, the target device identifier and the target key are first concatenated, and then a hash operation is performed on the concatenated data to obtain the target distributed key. The probability of hash collision can be reduced by concatenating first and then hashing, thereby improving the security and uniqueness of the distributed key.

[0027] In combination with the first aspect and the above implementations, in certain implementations of the first aspect, the above-mentioned concatenation of the target device identifier and the target key to obtain the target concatenated data includes:

[0028] Encrypting the target device identification to obtain an encrypted target device identification;

[0029] Encrypting the target key to obtain the encrypted target key;

[0030] The encrypted target device identifier and the encrypted target key are concatenated to obtain target concatenated data.

[0031] In an embodiment of the present application, the target device identifier and the target key are encrypted separately to obtain their respective encrypted values. The encrypted values ​​corresponding to the target device identifier and the target key are then concatenated and hashed to obtain a distributed key corresponding to the target device identifier. That is, the distributed key corresponding to the target device identifier is obtained by first encrypting the data and then performing a hash operation. This encryption-then-hashing method can hide the data characteristics of the target device identifier and the target key, avoiding the possibility of tampering with the target device identifier and the target key by directly analyzing the data characteristics of the target device identifier and the target key through the distribution of the hash value corresponding to the hash operation, making the target device identifier and the target key more secure, thereby improving the security of the distributed key corresponding to the target device identifier.

[0032] In combination with the first aspect and the above implementations, in certain implementations of the first aspect, the above-mentioned concatenation of the target device identifier and the target key to obtain the target concatenated data includes:

[0033] Performing a hash operation on the target device identifier to obtain a first hash value;

[0034] Performing a hash operation on the target key to obtain a second hash value;

[0035] The first Hash value and the second Hash value are concatenated to obtain target concatenated data.

[0036] In an embodiment of the present application, a hash operation is performed on the target device identifier and the target key to obtain their respective hash values. The hash values ​​corresponding to the target device identifier and the target key are then concatenated and hashed again to obtain a distributed key corresponding to the target device identifier. That is, the distributed key corresponding to the target device identifier is obtained through two hash operations. This cascade hashing method can increase the difficulty of tampering with the target device identifier and the target key, making the target device identifier and the target key more secure, thereby improving the security of the distributed key corresponding to the target device identifier.

[0037] In combination with the first aspect and the above implementations, in some implementations of the first aspect, receiving the target device identifier and the key application request includes:

[0038] When the target device is initialized, receiving the target device identification and key application request; or

[0039] If the target device does not have a target key and the authority verification is passed, the target device identification and key application request are received.

[0040] In combination with the first aspect and the above implementations, in some implementations of the first aspect, the method further includes:

[0041] Generate a generation log of the target decentralized key;

[0042] Stores the generated log.

[0043] In the embodiment of the present application, by storing the generation log of the distributed key corresponding to the target device identifier, it is possible to facilitate subsequent query and tracing of the generation information of the target distributed key corresponding to the target device identifier.

[0044] In a second aspect, the present application provides a key distribution device, which is configured on a security service platform, and the key distribution device includes:

[0045] A receiving module, configured to receive a target device identification and a key application request;

[0046] A generation module, configured to obtain a target key corresponding to the target device identifier based on the target device identifier;

[0047] A processing module, configured to obtain a target distributed key corresponding to the target key based on the target device identifier and the target key;

[0048] The sending module is used to send the target distributed key to the target device corresponding to the target device identifier, so that the target device uses the target distributed key to encrypt data.

[0049] In a third aspect, the present application provides an electronic device comprising a memory and a processor. The memory is configured to store executable program code, and the processor is configured to retrieve and execute the executable program code from the memory, so that the electronic device executes the method of the first aspect or any possible implementation of the first aspect.

[0050] In a fourth aspect, the present application provides a computer program product, which includes: computer program code, which, when running on a computer, enables the computer to execute the method in the above-mentioned first aspect or any possible implementation of the first aspect.

[0051] In a fifth aspect, the present application provides a computer-readable storage medium, which stores a computer program code. When the computer program code runs on a computer, the computer executes the method in the above-mentioned first aspect or any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is a scenario diagram of the key distribution method provided in an embodiment of the present application.

[0053] Figure 2 This is a schematic diagram of the architecture of a key distribution method provided in an embodiment of the present application.

[0054] Figure 3 This is a flowchart of a key distribution method provided in an embodiment of the present application.

[0055] Figure 4 This is an interactive diagram of a key distribution method provided in an embodiment of the present application.

[0056] Figure 5 This is another interactive schematic diagram of a key distribution method provided in an embodiment of the present application.

[0057] Figure 6 It is a structural diagram of the key distribution device provided in an embodiment of the present application.

[0058] Figure 7 It is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] The following will clearly and thoroughly describe the technical solutions in this application in conjunction with the accompanying drawings. In the description of the embodiments of this application, unless otherwise specified, " / " means or, for example, A / B can mean A or B: "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more than two.

[0060] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood to imply or suggest relative importance or implicitly indicate the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0061] Figure 1 This is a scenario diagram of the key distribution method provided in an embodiment of the present application.

[0062] For example, Figure 1 As shown, Figure 1 The encrypted device data 102 is obtained by encrypting the device data 101.

[0063] If the device data 101 is not protected, it will be easy to be maliciously accessed or tampered with. Therefore, in order to protect the device data 101, the device data 101 can be encrypted with a key to obtain encrypted device data 102 to improve the security of the device data 101.

[0064] However, if the device data 101 is directly encrypted using a universal key, if the universal key is leaked, it is unsafe and may cause the device data 101 encrypted using the universal key to be at risk of malicious access or malicious tampering, thereby reducing the security of the device data 101.

[0065] In view of this, the present application proposes a key distribution method, a key distribution device and an electronic device. Through the embodiments of the present application, when the security service platform receives a device identification and a key application request, it can obtain the key corresponding to the device identification, and obtain the dispersed key corresponding to the device identification by dispersing the key through the device identification and the key corresponding to the device identification, and then send the obtained dispersed key to the device corresponding to the device identification, so that the device uses the received dispersed key to encrypt data, which can improve the security of the key, and thus make the device data more secure when using a more secure key to encrypt the device data.

[0066] The following combination Figures 2 to 5 The key distribution method provided in the embodiment of the present application is described in detail.

[0067] Figure 2 This is a schematic diagram of the architecture of a key distribution method provided in an embodiment of the present application.

[0068] For example, Figure 2 As shown, Figure 2The architecture 200 shown in FIG includes an initialization management module 110, a key distribution management module 120, and a security service platform 130. Specifically, the security service platform (SSP) 130 may include a service interface layer 140, a service processing layer 150, and a key management interface layer 160. The service interface layer 140 includes an initialization service interface 141 and a key distribution service interface 142. The service processing layer 150 includes an initialization service processing module 151 and a key distribution service processing module 152. The key management interface layer 160 includes a key management system (KMS) module 161 and an encryption engine 162.

[0069] The initialization management module 110 can be used to perform initialization operations on the device. The key distribution management module 120 can be used to perform operations such as key distribution, authority verification, and authority allocation on the device.

[0070] The service interface layer 140 is used to build a data transmission channel between the SSP 130 and each module. The initialization service interface 141 is used to build a data transmission channel between the initialization management module 110 and the SSP 130 to realize data transmission between the initialization management module 110 and the SSP 130. Data related to the initialization service is transmitted through the initialization service interface 141, and data unrelated to the initialization service is transmitted through the interface corresponding to the respective service type (i.e., the non-initialization service interface 141). In addition, the key distribution service interface 142 is used to build a data transmission channel between the key distribution management module 120 and the SSP 130 to realize data transmission between the key distribution management module 120 and the SSP 130. Data related to the key distribution service is transmitted through the key distribution service interface 142, and data unrelated to the key distribution service is transmitted through the interface corresponding to the respective service type (i.e., the non-initialization service interface 142). That is to say, the business type corresponding to each business (for example, the business type of the initialization business, the business type of the key issuance business) is provided with its own corresponding data transmission interface in the business interface layer 140. The data transmission interface corresponding to the business is related to the business type corresponding to the business. Different business types have different corresponding data transmission interfaces, thereby realizing the independence of data transmission between different business types and avoiding the problem that multiple business types transmit data through the same interface, resulting in data transmission congestion and low data transmission efficiency, or transmission errors, thereby improving the efficiency and accuracy of data transmission.

[0071] It should be understood that the business interface layer 140 includes not only the initialization business interface 141 and the key issuance business interface 142, but also a digital key business interface, a certificate business interface, an isolation business interface, and the like.

[0072] SSP 130 can be used to receive device information and key application requests sent by the initialization management module 110 through the initialization service interface 141. Furthermore, SSP 130 can provide a modular software development toolkit (which can be referred to as a "service processing module") required for the service type of the initialization service in the service processing layer 150, namely, the initialization service processing module 151, and initiate the key generation process through the initialization service processing module 151 to call the key management docking layer 160 to provide information security services for the initialization service. Furthermore, SSP 130 can also be used to receive device information and key application requests sent by the key distribution management module 120 through the key distribution service interface 142. Furthermore, SSP 130 can provide a key distribution service processing module 152 required for the service type of the key distribution service in the service processing layer 150, and initiate the key generation process through the key distribution service processing module 152 to call the key management docking layer 160 to provide information security services for the key distribution service. That is to say, the business type corresponding to each business (for example, the business type of the initialization business, the business type of the key issuance business) is provided with its own corresponding processing module in the business processing layer 150. The processing module corresponding to the business is related to the business type corresponding to the business. Different business types correspond to different processing modules, thereby realizing the independence of processing different business types and avoiding the problem that multiple business types are processed by the same processing module, resulting in excessive processing volume and low processing efficiency, or processing errors, thereby improving the efficiency and accuracy of business processing.

[0073] It should be understood that the business processing module includes not only the initialization business processing module 151 and the key distribution business processing module 152, but also a digital key business processing module, a certificate business processing module, an isolation business processing module, etc. Information security services may include key generation services and key management services, etc.

[0074] The key management module 161 can be used to manage and store keys (e.g., distributed keys) generated by the encryption engine 162, i.e., a key management service. The encryption engine 162 can match keys corresponding to various business types and distribute the keys to obtain the corresponding distributed keys, i.e., a key generation service.

[0075] The key management docking layer 160 may include multiple key management modules and multiple encryption machines, and different business types have their own corresponding key management modules and encryption machines.

[0076] Figure 3 1 is a flow chart of a key distribution method provided in an embodiment of the present application. The method can be executed by an SSP.

[0077] For example, Figure 3As shown, the method 300 includes the following implementation process:

[0078] S210: Receive a target device identification and a key application request.

[0079] For example, when a device (which may be referred to as a "target device") requires data encryption, it may send its own device identifier (which may be referred to as a "target device identifier") and a request for a key required for data encryption by the target device (which may be referred to as a "key request request") to the SPP. In this embodiment of the present application, the key generated by the SSP in response to the key request request may be referred to as the "target key."

[0080] Optionally, when the target device is initialized, in order to perform key filling after initialization (i.e., there is a data encryption requirement), the target device can send a target device identifier (Identifier, ID) and a key application request corresponding to the target device to the SSP, so that the SSP generates a key (i.e., a target key) for key filling of the initialized target device when it receives the target device ID and the key application request corresponding to the target device.

[0081] Alternatively, when the target device needs to encrypt data (i.e., there is a data encryption requirement) but there is no key that can encrypt the data, if the target device's authority verification is passed, the target device can send a key application request corresponding to the target device ID and the target device to the SSP, so that the SSP generates a key that can encrypt the data (i.e., the target key) when it receives the key application request corresponding to the target device ID and the target device.

[0082] S220: Based on the target device identifier, obtain a target key corresponding to the target device identifier.

[0083] Exemplarily, upon receiving a key application request corresponding to the target device identifier and the target device, the SSP may respond to the key application request corresponding to the target device and generate a key corresponding to the target device identifier (ie, a target key).

[0084] Optionally, the SSP may receive the target device identifier and the key application request corresponding to the target device sent by the target device through a data transmission interface corresponding to the service type of the target device.

[0085] Exemplarily, when obtaining the target key corresponding to the target device identifier, the SSP may first obtain the service being executed by the target device using the target device identifier to obtain the service type corresponding to the service being executed by the target device. For example, when the target device is performing initialization, the service type corresponding to the target device is the service type of the initialization service. Alternatively, when the target device is performing data encryption, the service type corresponding to the target device is the service type of the key distribution service. It is understood that the service types corresponding to different target devices may be different. In the embodiments of the present application, the service type corresponding to the target device is assumed to be the service type of the initialization service and / or the service type of the key distribution service.

[0086] Furthermore, when the SSP obtains the service type of the target device, it can determine the key generation module (i.e., the encryption engine) corresponding to the service type based on the service type of the target device. The SSP then uses the key generation module (e.g., the encryption engine 162) corresponding to the service type of the target device to obtain the target key corresponding to the target device identifier. Different service types of the target device correspond to different key generation modules.

[0087] In an embodiment of the present application, when the target key corresponding to the target device identifier is obtained, it is generated by the key generation module corresponding to the business type of the target device, that is, there is a correspondence between the business type of the target device and the key generation module. The key generation module corresponding to the business type of the target device will not generate a key corresponding to the business type of a non-target device. This can avoid the generation of keys for different types of businesses through the same key generation module, resulting in excessive generation burden on the key generation module, slow generation efficiency and key generation errors, thereby improving the efficiency and accuracy of key generation.

[0088] Exemplarily, when the SSP determines the business type corresponding to the target device, it can also determine the key management module corresponding to the business type through the business type of the target device. When determining the key management module corresponding to the business type of the target device, the target device identifier can be first encrypted by the key management module corresponding to the business type of the target device (for example, the above-mentioned key management module 161) to obtain the encrypted data corresponding to the target device identifier (i.e., the encrypted target device identifier). Then, in the key generation module corresponding to the key management module, the key corresponding to the encrypted target device identifier (i.e., the target key) is obtained. Specifically, in the key generation module corresponding to the key management module, the target key corresponding to the encrypted target device identifier is queried in the preset mapping relationship through the encrypted target device identifier. Among them, the business type of the target device corresponding to the key management module and the key generation module corresponding to the key management module is the same. Different business types of target devices correspond to different key management modules.

[0089] The preset mapping relationship is used to represent the mapping relationship between the device identifier and the key. The preset mapping relationship contains at least one set of mapping relationships between the device identifier and the key.

[0090] In an embodiment of the present application, when obtaining the target key corresponding to the target device identifier, it is necessary to first encrypt the target device identifier through the key management module corresponding to the target device's business type to obtain the encrypted target device identifier. By encrypting the target device identifier, the security of the identifier data can be improved. Furthermore, the target device identifier is encrypted through the key management module corresponding to the target device's business type. That is, there is a corresponding relationship between the target device's business type and the key management module. The key management module corresponding to the target device's business type will not encrypt the device identifier corresponding to the business type of non-target devices. This can avoid the problem of identifiers corresponding to different types of business being encrypted through the same key management module, which would result in excessive encryption burden on the key management module, slow encryption efficiency, and encryption errors. This improves the efficiency and accuracy of identifier encryption.

[0091] S230: Obtain a target distributed key corresponding to the target key based on the target device identifier and the target key.

[0092] Exemplarily, when the SSP obtains the target device identifier and the target key corresponding to the target device identifier, it can perform key dispersion (also called "key derivation") on the target key to obtain a dispersed key corresponding to the target key (also called "target dispersed key").

[0093] When obtaining the target distributed key using the target device identifier and the target key, the target device identifier and the target key may be concatenated to obtain concatenated data of the target device identifier and the target key (referred to as "target concatenated data"). A hash calculation may then be performed on the target concatenated data to obtain a hash value corresponding to the target concatenated data (i.e., the target distributed key).

[0094] Optionally, when the target device identifier and the target key are concatenated, the target device identifier and the target key can be concatenated in a preset concatenation order. The preset concatenation order can represent a concatenation order in which the target device identifier is in front and the target key is in the back, or a concatenation order in which the target device identifier is in the back and the target key is in the front. By presetting the concatenation order, it can be ensured that unique concatenated data can be obtained, and then a hash calculation can be performed on the unique concatenated data to obtain a unique distributed key, thereby improving the security of the distributed key. Alternatively, when the target device identifier and the target key are concatenated, the encrypted target device identifier and the target key can be concatenated to improve the security of the concatenated data, thereby improving the security of the distributed key.

[0095] In an embodiment of the present application, the target device identifier and the target key are first concatenated, and then a hash operation is performed on the concatenated data to obtain the target distributed key. The probability of hash collision can be reduced by concatenating first and then hashing, thereby improving the security and uniqueness of the distributed key.

[0096] Optionally, when concatenating the target device identifier and the target key, the target device identifier may be first encrypted to obtain encrypted data corresponding to the target device identifier (i.e., the encrypted target device identifier). Furthermore, the target key may be encrypted to obtain encrypted data corresponding to the target key (i.e., the encrypted target key). The encrypted target device identifier and the encrypted target key are concatenated to obtain the target concatenated data, and then a hash calculation is performed on the target concatenated data to obtain a hash value corresponding to the target concatenated data (i.e., the target distributed key).

[0097] For example, the encrypted target device identifier and the encrypted target key are spliced ​​together according to a preset splicing order to obtain the target splicing data.

[0098] In an embodiment of the present application, the target device identifier and the target key are encrypted separately to obtain their respective encrypted values. The encrypted values ​​corresponding to the target device identifier and the target key are then concatenated and hashed to obtain a distributed key corresponding to the target device identifier. That is, the distributed key corresponding to the target device identifier is obtained by first encrypting the data and then performing a hash operation. This encryption-then-hashing method can hide the data characteristics of the target device identifier and the target key, avoiding the possibility of tampering with the target device identifier and the target key by directly analyzing the data characteristics of the target device identifier and the target key through the distribution of the hash value corresponding to the hash operation, making the target device identifier and the target key more secure, thereby improving the security of the distributed key corresponding to the target device identifier.

[0099] Optionally, when concatenating the target device identifier and the target key, a hash operation may be first performed on the target device identifier to obtain a hash value corresponding to the target device identifier (which may be referred to as a "first hash value"). Furthermore, a hash operation may be performed on the target key to obtain a hash value corresponding to the target key (which may be referred to as a "second hash value"). The first hash value and the second hash value are concatenated to obtain the target concatenated data, and then a hash calculation is performed on the target concatenated data to obtain a hash value corresponding to the target concatenated data (i.e., the target distributed key).

[0100] In an embodiment of the present application, a hash operation is performed on the target device identifier and the target key to obtain their respective hash values. The hash values ​​corresponding to the target device identifier and the target key are then concatenated and hashed again to obtain a distributed key corresponding to the target device identifier. That is, the distributed key corresponding to the target device identifier is obtained through two hash operations. This cascade hashing method can increase the difficulty of tampering with the target device identifier and the target key, making the target device identifier and the target key more secure, thereby improving the security of the distributed key corresponding to the target device identifier.

[0101] S240: Send the target distributed key to the target device corresponding to the target device identifier, so that the target device uses the target distributed key to encrypt data.

[0102] For example, when the SSP obtains the target decentralized key corresponding to the target device identifier, it can send the target decentralized key to the target device. When the target device receives the target decentralized key sent by the SSP, it can encrypt its own data using the target decentralized key to improve the security of its own data.

[0103] In such Figure 3 In the illustrated method 300, upon receiving a device identifier and a key request, the security service platform can obtain the key corresponding to the device identifier (i.e., the target key), perform key dispersion using the device identifier and the key corresponding to the device identifier to obtain a dispersed key corresponding to the device identifier (i.e., the target dispersed key), and then send the dispersed key obtained to the device corresponding to the device identifier, so that the device uses the received dispersed key to encrypt data. Upon obtaining the key corresponding to the device identifier, in order to improve the security of the key corresponding to the device identifier, the dispersed key corresponding to the key can be obtained, and the device can use the obtained dispersed key for data encryption instead of directly using the key corresponding to the device identifier. This can avoid the problem of the key corresponding to the device identifier being leaked, thereby improving the security of the key corresponding to the device identifier. Furthermore, by obtaining the key corresponding to the device identifier, the dispersed key used by the device for data encryption is associated with the device identifier, rather than a universal key. That is, different device identifiers correspond to different keys, thus avoiding the security risks associated with key reuse. The key corresponding to the device identifier is made random and unique, making it more secure. Thus, when a more secure key is used to encrypt device data, the device data can also be made more secure. Furthermore, since the key corresponding to the device identification is unique, the existence of obfuscated keys can be avoided, thereby avoiding the problem of data encryption failure caused by obfuscated keys and improving the security of device data.

[0104] Exemplarily, when the SSP obtains the target decentralized key corresponding to the target device identifier, it can also generate a target decentralized key generation log and store the target decentralized key generation log in its own storage area to facilitate subsequent query and tracing of the target decentralized key generation information corresponding to the target device identifier.

[0105] The generation information of the target distributed key may include but is not limited to the generation time, the algorithm and method used, parameters, etc.

[0106] In the embodiment of the present application, by storing the generation log of the distributed key corresponding to the target device identifier, it is possible to facilitate subsequent query and tracing of the generation information of the target distributed key corresponding to the target device identifier.

[0107] Figure 4 1 is an interactive diagram of a key distribution method provided by an embodiment of the present application, wherein the management platform, the security key (i.e., the target device), the security key initialization tool (i.e., the initialization management module 110), and the SSP can communicate with each other for data transmission.

[0108] The management platform can be used to issue initialization instructions.

[0109] The security key (key) can be used to perform key filling and identity authentication through the filled key. Among them, the security key is an identity authentication device.

[0110] The security key initialization tool can be used to initialize the security key. There is a corresponding relationship between the security key and the security key initialization tool. For example, if the security key is a USB key, the corresponding security key initialization tool is the USB key initialization tool.

[0111] SSP can generate a key that is loaded into a USB key. SSP also includes KMS and an encryption device.

[0112] The encryption machine (ie the key generation module) can process the generation and verification operations of the key loaded in the USB key.

[0113] KMS (i.e. the above-mentioned key management module) can be responsible for the management, storage and other related operations of the keys generated by the encryption machine.

[0114] For the sake of convenience, in the embodiments of the present application, the security key is assumed to be a USB key, and the corresponding security key initialization tool is assumed to be a USB key initialization tool for exemplary description.

[0115] For example, Figure 4 As shown, the method 400 includes the following implementation process:

[0116] S301 sends an initialization instruction.

[0117] When the USB key needs to be initialized, the management platform can start the USB key initialization process and send an initialization instruction for initializing the USB key to the USB key initialization tool.

[0118] The USB key needs to be initialized when it is used for the first time, when there is a security risk in the USB key, when data is lost in the USB key, etc. In addition, there is at least one USB key, and each USB key has its own corresponding USB key initialization tool.

[0119] S302 requests device status information.

[0120] When receiving the initialization instruction, the USB key initialization tool may request the USB key to read the device status information corresponding to the USB key.

[0121] S303 sends device status information.

[0122] When the USBkey receives a read request for its own device status information from the USBkey initialization tool, the USBkey can respond to the read request, obtain its own device status information, and feed the obtained device status information back to the USBkey initialization tool.

[0123] The device status information may include at least one of the following: initialization history information of the USB key, the device ID of the USB key, and the device storage capacity. The initialization history information may include at least one of the number of USB key initializations, the initialization time, and the initialization reason. The device ID of the USB key may include at least one of the vendor ID of the USB key and the product ID of the USB key.

[0124] S304 determines whether the USBKey meets the initialization conditions through the device status information. If it meets the conditions, it indicates that the USBKey initialization preparation is complete, and generates an application request for the key corresponding to the USBKey.

[0125] When the USB key initialization tool receives the device status information of the USB key, it can determine whether the USB key meets the initialization conditions based on the initialization history information in the device status information. If the USB key meets the initialization conditions, it can be indicated that the USB key initialization preparation is complete. In addition, when the USB key initialization preparation is complete, an application request for applying for the key corresponding to the USB key can be generated to apply for the distributed key corresponding to the USB key.

[0126] When the number of initialization times of the USBkey is 0, that is, the USBkey has not been initialized before the current moment, it can be said that the USBkey meets the initialization conditions. Alternatively, when the number of initialization times of the USBkey is at least 1, that is, the USBkey has been initialized at least once before the current moment, it can be fed back to the management platform that the USBkey has been initialized, and the management platform can be determined to determine whether to still perform the initialization on the USBkey. When the confirmation information of the management platform confirming the execution of the initialization of the USBkey is received, it can also be said that the USBkey meets the initialization conditions. When the cancellation information of the management platform confirming the cancellation of the initialization of the USBkey is received, it can be said that the USBkey does not meet the initialization conditions.

[0127] S305 displays the message “USBKey initialization preparation is complete, and the key corresponding to the device is being requested.”

[0128] When the USBKey meets the initialization conditions and generates an application request for the key corresponding to the USBKey, the USBkey initialization tool can display a message to the management platform saying "USBKey initialization preparation is completed, and the key corresponding to the device is being applied for" so that the management platform can promptly grasp the initialization progress of the USBKey and the application progress of the key corresponding to the USBKey.

[0129] S306 performs initialization on the USBKey and generates an initialization result when the initialization is completed.

[0130] When the USBKey meets the initialization conditions, the USBKey initialization tool can start initializing the USBKey to initialize the USBKey, and when the USBKey initialization is completed, a USBKey initialization result can be generated. By initializing the USBKey, the USBKey can be ensured to be secure, and potential security risks that may exist before the USBKey is initialized can be eliminated, thereby ensuring the security of the data in the initialized USBKey. In addition, by initializing the USBKey, a secure processing environment can be constructed for the subsequent generation and filling of decentralized keys, thereby ensuring the security of the generation and filling of decentralized keys.

[0131] The USBKey initialization result may indicate that the USBKey initialization tool completes the initialization of the USBKey.

[0132] It should be understood that S305 and S306 can be executed simultaneously or sequentially, and this embodiment of the present application does not limit this.

[0133] S307 sends the initialization result.

[0134] When generating the USBKey initialization result, the USBKey initialization tool may send the USBKey initialization result to the SSP through the initialization service interface 141 , and send the USBKey initialization result to the USBKey.

[0135] S308 saves the initialization result.

[0136] When receiving the USBKey initialization result, the USBKey and SSP can save the USBKey initialization result, so as to timely grasp the USBKey initialization information. In addition, the USBKey initialization tool will also save the USBKey initialization result when generating the USBKey initialization result.

[0137] S309 saves the result in response.

[0138] When the USBkey completes saving the USBkey initialization result, the USBkey may feed back a result saving response to the USBkey initialization tool, so that the USBkey initialization tool knows that the USBkey completes saving the USBkey initialization result.

[0139] S310 saves the result in response.

[0140] When the SSP completes saving of the USBKey initialization result, it can feed back a result saving response to the USBKey initialization tool through the initialization service interface 141, so that the USBKey initialization tool knows that the SSP completes saving of the USBKey initialization result.

[0141] S311 displays the initialization result.

[0142] When generating the USBKey initialization result, the USBKey initialization tool can display the USBKey initialization result to the management platform so that the management platform can grasp the USBKey initialization progress in a timely manner.

[0143] It should be understood that S307 and S311 can be executed simultaneously or sequentially, and this embodiment of the present application does not limit this.

[0144] S312 obtains the device ID of the USBKey through the device status information.

[0145] When the USBkey initialization tool receives the device status information of the USBkey, it can use the device ID of the USBkey in the device status information.

[0146] It should be understood that S312 and S304 can be executed simultaneously or sequentially, and this embodiment of the present application does not limit this.

[0147] S313 sends the device ID and application request.

[0148] When the USBkey initialization tool generates an application request for the key corresponding to the USBKey and obtains the device ID of the USBKey, the application request and the device ID of the USBKey can be sent to the SSP through the initialization service interface 141 to generate a distributed key corresponding to the device ID of the USBKey through the SSP.

[0149] S314 generates a distribution request for the key corresponding to the application request.

[0150] When the SSP receives an application request for a key corresponding to the USBKey and the device ID of the USBKey through the initialization service interface 141 , it can generate a distributed request for the key corresponding to the application request through the initialization service processing module 151 .

[0151] S315 sends the device ID, application request and distribution request.

[0152] The SSP may send the device ID of the USBKey, the key application request, and the key distribution request to the KMS (ie, the key management module 161 ).

[0153] S316 encrypts the device ID to obtain an encrypted device ID.

[0154] When receiving the device ID of the USBKey, the KMS may encrypt the device ID of the USBKey to obtain encrypted data corresponding to the device ID of the USBKey (which may be referred to as "encrypted device ID").

[0155] S317 sends the encrypted device ID, application request and distribution request.

[0156] The KMS may send the encrypted device ID and the received key application request and key distribution request to the encryption machine (ie, the encryption machine 162 ).

[0157] S318 distributes the root key corresponding to the encrypted device ID, and obtains a distributed key based on the root key and the encrypted device ID.

[0158] When receiving the encrypted device ID, the encryption machine can respond to the key application request and allocate the corresponding root key (ie the above-mentioned target key) to the encrypted device ID corresponding to the USB key.

[0159] When the encryption machine obtains the root key corresponding to the encrypted device ID, it can respond to the key dispersion request and use the encrypted device ID as a dispersion factor to disperse the root key corresponding to the encrypted device ID to obtain the dispersed key corresponding to the root key. It should be understood that the specific dispersion method of the dispersed key is Figure 3 Detailed description is given in , which will not be repeated here.

[0160] S319 sends the distributed key.

[0161] The encryption machine returns the distributed key corresponding to the device ID to the KMS, so that the KMS manages and stores the distributed key corresponding to the device ID.

[0162] S320 sends the distributed key.

[0163] The KMS returns the distributed key corresponding to the device ID to the initialization service processing module 151 in the SSP.

[0164] S321 records the generation log of the distributed key.

[0165] When receiving the distributed key corresponding to the device ID, the initialization service processing module 151 in the SSP can record the generation log of the distributed key corresponding to the device ID, so as to facilitate the subsequent tracing and auditing of the generation information of the distributed key corresponding to the device ID.

[0166] S322 sends the distributed key.

[0167] The initialization service processing module 151 in the SSP can return the distributed key corresponding to the device ID of the USB key to the USB key initialization tool through the initialization service interface 141 .

[0168] S323 sends the distributed key.

[0169] The USBkey initialization tool can return the distributed key corresponding to the device ID to the USBkey.

[0170] S324 displays the message "Key obtained, key being written".

[0171] When the USBkey initialization tool returns the distributed key corresponding to the device ID to the USBkey, it can display the display information of "key obtained, USBkey is writing key" to the management platform, so that the management platform can timely grasp the writing progress of the USBKey key.

[0172] S325 saves the distributed key.

[0173] Upon receiving the USBkey returned by the USBkey initialization tool, the USBkey enters the initialization complete state. When the USBkey is in the initialization complete state, the distributed key corresponding to the device ID may be stored in the USBkey's secure storage area. By storing the distributed key corresponding to the device ID in the USBkey's secure storage area, the distributed key corresponding to the device ID can be prevented from being leaked during storage or subsequent transmission, thereby reducing the risk of leakage of the distributed key corresponding to the device ID and improving the security of the distributed key corresponding to the device ID.

[0174] When the USB key is in an uncompleted initialization state, you can wait until the USB key initialization is completed without saving the distributed key corresponding to the device ID. When the USB key is in an initialization completed state, save the distributed key corresponding to the device ID to complete the filling of the USB key.

[0175] exist Figure 4 In the system, the independent design between USB key and SSP can realize independent maintenance of USB key and SSP, making the use of USB key and SSP more flexible and safe.

[0176] It should be noted that Figure 4 yes Figure 3 The specific application of the method 300 shown in FIG. 3 in the device initialization scenario is as follows: Figure 4 Zhongyu Figure 2 The cross-content is in Figure 2 The corresponding embodiments are described in detail in the accompanying drawings and will not be repeated here.

[0177] Figure 5 This is another interactive diagram of a key distribution method provided by an embodiment of the present application, wherein the component (i.e., the target device), the debugging tool, the key distribution management module (i.e., the key distribution management module 120) and the SSP can communicate with each other to perform data transmission.

[0178] The component can be used to receive the decentralized key issued by the key issuance management module and encrypt data using the decentralized key.

[0179] Debugging tools can be used to detect component status, locate component faults, calibrate component parameters, initiate component data encryption processes, and perform other debugging operations. There is a correspondence between components and their debugging tools, with different components typically corresponding to different debugging tools. Component debugging tools are also located within the component's control system.

[0180] The key distribution management module is used to distribute keys, verify permissions, and assign permissions to components. For example, the key distribution service in the Advanced Driver Assistance Systems Controller (ADAS) is used.

[0181] SSP can generate the distributed keys required by components to encrypt data. SSP also includes KMS and encryption machine.

[0182] The encryption machine (i.e. the key generation module mentioned above) can handle the key generation and verification operations required by the components for data encryption.

[0183] KMS (i.e. the above-mentioned key management module) can be responsible for the management, storage and other related operations of the keys generated by the encryption machine.

[0184] For example, Figure 5 As shown, the method 500 includes the following implementation process:

[0185] S401 queries the key of the component.

[0186] When it is detected that a component has a data encryption requirement, the debugging tool can query the key of the component to determine whether the component has a key (ie, a distributed key) that can be used to encrypt the data.

[0187] When the key of the component is not found in S402 , the device ID of the component is obtained, and an application request for the key corresponding to the component is generated.

[0188] If the debugging tool fails to find the distributed key for a component, it indicates that the SSP needs to generate a distributed key that can be used to encrypt the component's data. To enable the SSP to generate the distributed key for the component, the debugging tool can collect the component's device ID and generate a request for the key corresponding to the component to obtain the distributed key.

[0189] S403 sends the device ID and application request.

[0190] When the debugging tool obtains the device ID of the component and generates an application request for applying for the key corresponding to the component, the debugging tool can send the application request and the device ID of the component to the key distribution management module.

[0191] S404 determines the authority of the component.

[0192] When the key issuance management module receives the device ID of a component and the application request for the key corresponding to the component, it can verify the authority of the component through the device ID of the component to determine whether the device ID of the component is in the whitelist. When the device ID of the component is in the whitelist, it means that the component verification has passed, and business permissions can be assigned to the component to restrict the business permissions of the component. When the device ID of the component is not in the whitelist, it means that the component verification has failed. In order to prevent the SSP from being maliciously attacked, the application request for the device ID and key of the component can be refused to be forwarded to the SSP. By verifying and allocating permissions to the components, the legitimacy of the component identity can be ensured. On the basis of the legitimacy of the component identity, the subsequent decentralized key distribution can be made secure and controllable.

[0193] S405 records the key query log.

[0194] The key distribution management module can record the query log of the key corresponding to the component to facilitate subsequent tracing and auditing of the key query information.

[0195] It should be understood that S404 and S405 can be executed simultaneously or sequentially, and this embodiment of the present application does not limit this.

[0196] S406 Send device ID and application request.

[0197] When the key issuance management module determines that the device ID of the component is in the whitelist, it can forward the device ID of the component and the key application request to the SSP through the key issuance service interface 142 to generate a decentralized key corresponding to the device ID of the component through the SSP.

[0198] S407 generates a distribution request for the key corresponding to the application request.

[0199] When the SSP receives an application request for a key corresponding to a component and the device ID of the component through the key distribution service interface 142 , it can generate a decentralized request for the key corresponding to the application request through the key distribution service processing module 152 .

[0200] S408 sends the device ID, application request and distribution request.

[0201] The SSP may send the device ID of the component, the key application request, and the key distribution request to the KMS (ie, the key management module 161 ).

[0202] S409 encrypts the device ID to obtain an encrypted device ID.

[0203] When KMS receives the device ID of a component, it can encrypt the device ID of the component to obtain encrypted data corresponding to the device ID of the component (which may be called "encrypted device ID").

[0204] S410 sends the encrypted device ID, application request and distribution request.

[0205] The KMS may send the encrypted device ID and the received key application request and key distribution request to the encryption machine (ie, the encryption machine 162 ).

[0206] S411 distributes a root key corresponding to the encrypted device ID, and obtains a distributed key based on the root key and the encrypted device ID.

[0207] When the encryption machine receives the encrypted device ID, it can respond to the key application request and allocate the corresponding root key (ie the above-mentioned target key) to the encrypted device ID corresponding to the component.

[0208] When the encryption machine obtains the root key corresponding to the encrypted device ID, it can respond to the key dispersion request and use the encrypted device ID as a dispersion factor to disperse the root key corresponding to the encrypted device ID to obtain the dispersed key corresponding to the root key. It should be understood that the specific dispersion method of the dispersed key is Figure 3 It is described in detail in , and will not be repeated here.

[0209] S412 sends the distributed key.

[0210] The encryption machine returns the distributed key corresponding to the device ID to the KMS, so that the KMS manages and stores the distributed key corresponding to the device ID.

[0211] S413 sends the distributed key.

[0212] The KMS returns the distributed key corresponding to the device ID to the key distribution service processing module 152 in the SSP.

[0213] S414 records the generation log of the distributed key.

[0214] When receiving the distributed key corresponding to the device ID, the key issuance service processing module 152 in the SSP can record the generation log of the distributed key corresponding to the device ID, so as to facilitate the subsequent tracing and auditing of the generation information of the distributed key corresponding to the device ID.

[0215] S415 sends the distributed key.

[0216] The key distribution service processing module 152 in the SSP can return the distributed key corresponding to the device ID of the component to the key distribution management module corresponding to the component through the initialization service interface 141.

[0217] S416 records the acquisition log of the distributed key.

[0218] When the key distribution management module receives the distributed key corresponding to the device ID of the component, it can record the acquisition log of the key corresponding to the component to facilitate subsequent tracing of the key acquisition information.

[0219] S417 sends the distributed key.

[0220] The key distribution management module can return the distributed key corresponding to the device ID to the debugging tool.

[0221] S418 sends the distributed key.

[0222] When the debugging tool receives the distributed key corresponding to the device ID, it can forward the distributed key to the component corresponding to the device ID.

[0223] Alternatively, when the debugging tool finds that a distributed key exists in a component through S401, it indicates that the component has a distributed key capable of encrypting data and does not need to generate a distributed key through the SSP. The found distributed key can be sent to the component.

[0224] S419 encrypts the data of the components using a distributed key to obtain encrypted data.

[0225] When a component obtains a distributed key used to encrypt its own data (e.g., business data, usage data, generated data), it can use the distributed key to encrypt the data to obtain encrypted data, thereby improving data security and preventing data tampering.

[0226] S420 sends the encrypted data.

[0227] After the component completes data encryption, it can send the encrypted data to the debugging tool to ensure the security of data transmission.

[0228] When there is a need for debugging, S421 decrypts the encrypted data using a distributed key and uses the decrypted data to debug the components.

[0229] When there is a need to debug a component, for example, when the debugging tool receives a debugging instruction for the component, it can decrypt the encrypted data using the distributed key corresponding to the device ID of the component, and use the decrypted data to perform the debugging operation corresponding to the debugging instruction on the component, for example, detecting the status of the component.

[0230] It should be noted that Figure 5 yes Figure 3The specific application of the method 300 shown in FIG. 3 in the device initialization scenario is as follows: Figure 5 Zhongyu Figure 2 The cross-content is in Figure 2 The corresponding embodiments are described in detail in the accompanying drawings and will not be repeated here.

[0231] In summary, in order to securely protect device data, the device data can be encrypted using a decentralized key corresponding to the device identifier, so that on the basis of improved key security, the device data encrypted using a more secure key is also more secure. By determining the key generation module that matches the business type based on the device's business type, the efficiency and accuracy of key generation corresponding to the device identifier can be improved, and by determining the key management module that matches the business type, the efficiency and accuracy of key management can be improved. In addition, the embodiments of the present application can not only improve the efficiency of key distribution and the security of use, but also ensure that the key can be traced and audited by recording key generation logs and query logs, making the key traceable.

[0232] It should be understood that the above examples are intended to help those skilled in the art understand the embodiments of the present application, and are not intended to limit the embodiments of the present application to the specific numerical values ​​or specific scenarios illustrated. Those skilled in the art can obviously make various equivalent modifications or variations based on the above examples, and such modifications or variations also fall within the scope of the embodiments of the present application.

[0233] Combined with the above Figures 1 to 5 The key distribution method provided by the embodiment of the present application is described in detail; Figure 6 and Figure 7 The device embodiments of the present application are described in detail. It should be understood that the devices in the embodiments of the present application can execute the various methods of the aforementioned embodiments of the present application, that is, the specific working processes of the following various products can refer to the corresponding processes in the aforementioned method embodiments.

[0234] Figure 6 It is a structural diagram of the key distribution device provided in an embodiment of the present application.

[0235] For example, Figure 6 As shown, the device 600 is configured on a security service platform and includes:

[0236] Receiving module 610, configured to receive a target device identification and a key application request;

[0237] A generating module 620 is configured to obtain a target key corresponding to the target device identifier based on the target device identifier;

[0238] The processing module 630 is configured to obtain a target distributed key corresponding to the target key based on the target device identifier and the target key;

[0239] The sending module 640 is configured to send the target distributed key to the target device corresponding to the target device identifier, so that the target device uses the target distributed key to perform data encryption.

[0240] In one possible implementation, the generating module 620 is specifically configured to:

[0241] Determine the service type of the target device based on the target device identifier;

[0242] Based on the business type, determine the key generation module corresponding to the business type;

[0243] The target key is obtained through the key generation module.

[0244] In one possible implementation, the generating module 620 is further configured to:

[0245] Based on the business type, determine the key management module corresponding to the business type;

[0246] The target device identification is encrypted by the key management module to obtain an encrypted target device identification;

[0247] The generation module 620 is specifically used for:

[0248] In the key generation module, a target key is obtained based on the encrypted target device identifier.

[0249] In one possible implementation, the processing module 630 is specifically configured to:

[0250] Performing splicing processing on the target device identifier and the target key to obtain target splicing data;

[0251] Perform hash operation on the target splicing data to obtain the target distributed key.

[0252] In one possible implementation, the processing module 630 is specifically configured to:

[0253] Encrypting the target device identification to obtain an encrypted target device identification;

[0254] Encrypting the target key to obtain the encrypted target key;

[0255] The encrypted target device identifier and the encrypted target key are concatenated to obtain target concatenated data.

[0256] In one possible implementation, the processing module 630 is specifically configured to:

[0257] Performing a hash operation on the target device identifier to obtain a first hash value;

[0258] Performing a hash operation on the target key to obtain a second hash value;

[0259] The first Hash value and the second Hash value are concatenated to obtain target concatenated data.

[0260] In one possible implementation, the receiving module 610 is specifically configured to:

[0261] When the target device is initialized, receiving the target device identification and key application request; or

[0262] If the target device does not have a target key and the authority verification is passed, the target device identification and key application request are received.

[0263] In one possible implementation, the processing module 630 is further configured to:

[0264] Generate a generation log of the target decentralized key;

[0265] Stores the generated log.

[0266] It should be noted that the above-mentioned device 600 is embodied in the form of a functional module. The term "module" here can be implemented in the form of software and / or hardware, and is not specifically limited to this.

[0267] For example, a "module" may be a software program, a hardware circuit, or a combination of the two that implements the aforementioned functionality. The hardware circuit may include an application-specific integrated circuit (ASIC), an electronic circuit, a processor (e.g., a shared processor, a dedicated processor, or a combination of processors) and memory for executing one or more software or firmware programs, combined logic circuits, and / or other suitable components that support the described functionality.

[0268] Therefore, the modules of each example described in the embodiments of this application can be implemented with electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0269] Figure 7 It is a structural diagram of an electronic device provided in an embodiment of the present application.

[0270] For example, Figure 7As shown, the electronic device 700 includes: a memory 710 and a processor 720, wherein the memory 710 stores an executable program code 7101, and the processor 720 is used to call and execute the executable program code 7101 to perform a key distribution method.

[0271] It should be noted that the electronic device 700 may be an intelligent device configured with a security service platform, including but not limited to: a personal computer, a tablet computer, a handheld device, an in-vehicle device, a wearable device, a computing device, or other processing device connected to a wireless modem. In different networks, electronic devices may be called different names, such as: user equipment, access electronic device, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote electronic device, mobile device, user electronic device, electronic device, wireless communication device, user agent or user device, cellular phone, cordless phone, electronic device in 5G network or future evolution network, etc., and the embodiments of the present application are not limited to this.

[0272] This application can divide the electronic device into functional modules based on the above-mentioned method examples. For example, each functional module can be mapped to a specific functional module, or two or more functions can be integrated into a processing module. The above-mentioned integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is illustrative and is only a logical functional division. In actual implementation, other division methods may be used.

[0273] In the case of dividing each functional module into corresponding functional modules, the electronic device may include: a receiving module, a generating module, a processing module, a sending module, etc. It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0274] The electronic device provided in this application is used to execute the above-mentioned key distribution method, and thus can achieve the same effect as the above-mentioned implementation method.

[0275] In the case of an integrated unit, the electronic device may include a processing module and a storage module. The processing module may be used to control and manage the operation of the electronic device, and the storage module may be used to support the electronic device in executing relevant program codes and data.

[0276] The processing module may be a processor or controller that implements or executes the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor (DSP) and a microprocessor, and the storage module may be a memory.

[0277] The present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the aforementioned methods. The computer-readable storage medium may include, but is not limited to, any type of disk, including a floppy disk, an optical disk, a DVD (Digital Video Disc), a CD-ROM (Compact Disc Read-Only Memory), a microdrive, a magneto-optical disk, a ROM (Read-Only Memory), a RAM (Random Access Memory), an EPROM (Erasable Programmable Read-Only Memory), an EEPROM (Electrically Erasable Programmable Read-Only Memory), a DRAM (Dynamic Random Access Memory), a VRAM (Video Random Access Memory), a flash memory device, a magnetic or optical card, a nanosystem (including a molecular memory IC), or any other type of medium or device suitable for storing instructions and / or data.

[0278] The present application also provides a computer program product. When the computer program product is run on a computer, it enables the computer to execute the above-mentioned related steps to implement a key distribution method in the above-mentioned embodiment.

[0279] In addition, the electronic device provided in the embodiments of the present application can specifically be a chip, component or module, and the electronic device may include a connected processor and memory; wherein the memory is used to store instructions, and when the electronic device is running, the processor can call and execute instructions so that the chip executes a key distribution method in the above embodiment.

[0280] Among them, the electronic device, computer-readable storage medium, computer program product or chip provided in this application are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0281] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0282] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0283] The above content is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A key distribution method, characterized in that: Applied to a security service platform, the method includes: Receive target device identification and key application request; Based on the target device identifier, obtaining a target key corresponding to the target device identifier; Based on the target device identifier and the target key, obtaining a target distributed key corresponding to the target key; The target distributed key is sent to a target device corresponding to the target device identifier, so that the target device uses the target distributed key to encrypt data.

2. The method according to claim 1, characterized in that The obtaining, based on the target device identifier, a target key corresponding to the target device identifier, includes: Determining a service type of the target device based on the target device identifier; Based on the service type, determining a key generation module corresponding to the service type; The target key is obtained through the key generation module.

3. The method according to claim 2, characterized in that The method further comprises: Based on the service type, determining a key management module corresponding to the service type; Encrypting the target device identification by the key management module to obtain an encrypted target device identification; The step of obtaining the target key through the key generation module includes: In the key generation module, the target key is obtained based on the encrypted target device identifier.

4. The method according to any one of claims 1 to 3, characterized in that The obtaining, based on the target device identifier and the target key, a target distributed key corresponding to the target key, includes: performing splicing processing on the target device identifier and the target key to obtain target splicing data; A hash operation is performed on the target splicing data to obtain the target distributed key.

5. The method according to claim 4, characterized in that The step of concatenating the target device identifier and the target key to obtain target concatenated data includes: Encrypting the target device identification to obtain an encrypted target device identification; Encrypting the target key to obtain an encrypted target key; The encrypted target device identifier and the encrypted target key are concatenated to obtain the target concatenated data.

6. The method according to claim 4, characterized in that The step of concatenating the target device identifier and the target key to obtain target concatenated data includes: Performing the hash operation on the target device identifier to obtain a first hash value; Performing the hash operation on the target key to obtain a second hash value; The first Hash value and the second Hash value are concatenated to obtain the target concatenated data.

7. The method according to any one of claims 1 to 3, characterized in that The receiving of the target device identification and the key application request includes: When the target device is initialized, receiving the target device identification and the key application request; or If the target key does not exist on the target device and the authority verification is passed, the target device identifier and the key application request are received.

8. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Generating a generation log of the target decentralized key; The generation log is stored.

9. A key distribution device, characterized in that: Configured on a security service platform, the device includes: A receiving module, configured to receive a target device identification and a key application request; A generating module, configured to obtain a target key corresponding to the target device identifier based on the target device identifier; A processing module, configured to obtain a target distributed key corresponding to the target key based on the target device identifier and the target key; The sending module is configured to send the target distributed key to the target device corresponding to the target device identifier, so that the target device uses the target distributed key to perform data encryption.

10. An electronic device, characterized in that: The electronic device comprises: a memory for storing executable program code; A processor, configured to call and run the executable program code from the memory, so that the electronic device executes the method according to any one of claims 1 to 8.

Images