A key management method, device, terminal and storage medium

Abstract

The present application relates to the technical field of data management, and particularly relates to a key management method and device, a terminal and a storage medium, the method comprising: generating a compressed package key library, adding the compressed package key library into a pre-constructed key library list; determining a target compressed package key library in the key library list, and performing identity authentication; generating a key file with key content in the target compressed package key library; determining a target key file in a key file list, and encrypting an object to be encrypted based on the key content of the target key file.The present application generates a key file in the compressed package key library, forms a list of the generated key files, realizes unified management, obtains a target key file from the compressed package key library when encrypting the object to be encrypted, and the encryption mode is simple; and only by identity authentication can the compressed package key library be opened, so that the key is safely managed while encryption is facilitated.

Description

Technical Field

[0001] This invention relates to the field of data management technology, and in particular to a key management method, apparatus, terminal and storage medium. Background Technology

[0002] When encrypting and archiving an object (such as a document or directory), there are various encryption methods. Common methods include direct compression encryption or encryption and decryption using keys (symmetric and asymmetric methods), such as using GPG (open-source encryption software) or hardware encryption devices. Specifically, compression encryption primarily relies on passwords. However, for a large number of historically encrypted documents, passwords are easily forgotten, and password management is complex. Therefore, key-based encryption and decryption are more frequently used.

[0003] However, some existing key management solutions fail to protect the keys during key management; others, while providing secure key management, suffer from inconvenient encryption processes, severely limiting their application scenarios. Therefore, existing key management methods cannot simultaneously achieve convenient encryption and secure key management.

[0004] Therefore, existing technologies have shortcomings and need to be improved and developed. Summary of the Invention

[0005] This application provides a key management method, apparatus, terminal, and storage medium to solve the technical problem in related technologies that it is impossible to achieve secure key management while facilitating encryption.

[0006] To achieve the above objectives, this application adopts the following technical solution:

[0007] A key management method, wherein the method includes:

[0008] Based on the key library generation instructions, key library information and identity authentication information are obtained. A compressed package key library is generated according to the key library information and identity authentication information, and the compressed package key library is added to a pre-built key library list.

[0009] In response to the key file generation instruction, the target compressed package key library is determined from the key library list, and the identity of the target compressed package key library is authenticated.

[0010] If the identity authentication of the target compressed package key library is successfully passed, a key file with key content is generated in the target compressed package key library, and the key file is added to the pre-built key file list corresponding to the target compressed package key library;

[0011] When an instruction is received to encrypt the object to be encrypted using the target compressed package key library, a target key file is determined from the list of key files corresponding to the target compressed package key library, and the object to be encrypted is encrypted based on the key content of the target key file.

[0012] In one embodiment of this application, key library information and identity authentication information are obtained based on key library generation instructions, and a compressed package key library is generated according to the key library information and identity authentication information, including:

[0013] Responding to the keystore generation instruction, it receives the input keystore information and generates a compressed keystore based on the keystore information;

[0014] Receive input identity authentication information, which includes: several questions and corresponding answers;

[0015] Set the hash value formed by combining all the answers in the identity authentication information as the access password for the compressed key library, and append the bytecode formed by combining all the questions in the identity authentication information to the end of the bytes of the compressed key library;

[0016] Receive operator information and append the operator information to the end of the bytes of the compressed package key library.

[0017] In one embodiment of this application, if identity authentication is successfully passed through the target compressed package key library, a key file containing key content is generated in the target compressed package key library, including:

[0018] If the identity authentication of the target compressed package key library is successfully passed, a key file containing key content is generated;

[0019] Obtain the operator information at the end of the bytes of the target compressed package key library, and name the key file according to the operator information and the hash value of the key content to obtain the key file name corresponding to the key file.

[0020] In one embodiment of this application, when an instruction to encrypt an object to be encrypted using the target compressed package key library is received, a target key file is determined from the key file list corresponding to the target compressed package key library, and the object to be encrypted is encrypted based on the key content of the target key file, including:

[0021] In response to the encryption command for the object to be encrypted, the target compressed package key library is determined from the key library list, and the identity of the target compressed package key library is authenticated.

[0022] If the identity authentication of the target compressed package key library is successfully passed, the target key file is determined from the list of key files corresponding to the target compressed package key library;

[0023] Based on the key content of the target key file, the object to be encrypted is encrypted using a symmetric encryption algorithm to obtain an encrypted object, and the key file name corresponding to the target key file is written as additional information bytecode at the end of the encrypted object.

[0024] In one embodiment of this application, the key management method further includes:

[0025] In response to a decryption command for an encrypted object, the target compressed package key library is determined from the key library list, and the identity of the target compressed package key library is authenticated.

[0026] If the identity authentication of the target compressed package key library is successfully passed, the name of the key file attached to the end of the encrypted object to be decrypted is obtained, and the target key file is obtained according to the name of the key file.

[0027] Based on the key content in the target key file, the encrypted object to be decrypted is decrypted using a symmetric decryption method.

[0028] In one embodiment of this application, the key management method further includes:

[0029] In response to the key export command, the target compressed package key library is determined from the key library list, and the identity of the target compressed package key library is authenticated.

[0030] If the identity authentication of the target compressed package key library is successfully passed, then several target key files are determined from the list of key files corresponding to the target compressed package key library;

[0031] After reading each of the target key files, all the target key files are packaged into a key file compressed package, and a password is set to open the key file compressed package.

[0032] In one embodiment of this application, the key management method further includes:

[0033] In response to the key import command, the target compressed package key library is determined from the key library list, and the identity of the target compressed package key library is authenticated.

[0034] If the identity authentication of the target compressed key library is successfully passed, the key file in the compressed key file to be imported is read based on the open password of the compressed key file to be imported.

[0035] Import the key file from the compressed key file package to be imported into the key library of the target compressed package to obtain the imported key file.

[0036] This application also provides a key management device, wherein the device includes:

[0037] The key library generation module is used to obtain key library information and identity authentication information based on key library generation instructions, generate a compressed key library based on the key library information and identity authentication information, and add the compressed key library to a pre-built key library list;

[0038] The identity authentication module is used to respond to the key file generation instruction, determine the target compressed package key library in the key library list, and perform identity authentication of the target compressed package key library;

[0039] The key file generation module is used to generate a key file containing key content in the target compressed package key library if the identity authentication is successfully passed, and to add the key file to the pre-built key file list corresponding to the target compressed package key library;

[0040] The encryption module is used to determine the target key file from the list of key files corresponding to the target compressed package key library when it receives an instruction to encrypt the object to be encrypted using the target compressed package key library, and to encrypt the object to be encrypted based on the key content of the target key file.

[0041] This application also provides a terminal, comprising: a memory, a processor, and a key management program stored in the memory and executable on the processor, wherein the key management program, when executed by the processor, implements the steps of the key management method as described above.

[0042] This application also provides a computer-readable storage medium storing a computer program that can be executed to implement the steps of the key management method described above.

[0043] The beneficial effects of this invention are as follows: The method of this embodiment obtains key library information and identity authentication information based on a key library generation instruction, generates a compressed package key library according to the key library information and identity authentication information, and adds the compressed package key library to a pre-built key library list; in response to a key file generation instruction, a target compressed package key library is determined in the key library list, and identity authentication of the target compressed package key library is performed; if the identity authentication of the target compressed package key library is successfully passed, a key file with key content is generated in the target compressed package key library, and the key file is added to the pre-built key file list corresponding to the target compressed package key library; when an instruction to encrypt an object to be encrypted using the target compressed package key library is received, a target key file is determined in the key file list corresponding to the target compressed package key library, and the object to be encrypted is encrypted based on the key content of the target key file. This application can generate a compressed key library, generate key files in the compressed key library, and form a list of generated key files for unified management. When encrypting an object, the target key file can be obtained from the compressed key library. The encryption method is simple, and the compressed key library can only be opened after identity authentication. Therefore, it achieves convenient encryption while ensuring secure key management. Attached Figure Description

[0044] Figure 1 This is a flowchart of a preferred embodiment of the key management method in this invention.

[0045] Figure 2 This is a schematic diagram illustrating the functions of the encryption / decryption platform tool in this invention.

[0046] Figure 3 This is a schematic diagram of the list of key files in the compressed package key library of this invention.

[0047] Figure 4 This is a schematic diagram of the operation interface of the newly added key library in this invention.

[0048] Figure 5 This is a schematic diagram of the question and answer interface for identity verification in this invention.

[0049] Figure 6 This is a schematic diagram of the operation interface for adding a new key in this invention.

[0050] Figure 7 This is a schematic diagram of the identity authentication operation page in this invention.

[0051] Figure 8 This is a schematic diagram of the key file compressed package in this invention.

[0052] Figure 9 This is a schematic diagram of the first operation interface for exporting the key in this invention.

[0053] Figure 10 This is a schematic diagram of the second operation interface for exporting the key in this invention.

[0054] Figure 11 This is a schematic diagram of the key import operation interface in this invention.

[0055] Figure 12 This is a schematic diagram of the operation interface for changing authentication information in this invention.

[0056] Figure 13 This is a schematic diagram of the operation interface for document encryption in this invention.

[0057] Figure 14 This is a schematic diagram of the document decryption operation interface in this invention.

[0058] Figure 15 This is a functional principle block diagram of a preferred embodiment of the key management device in this invention.

[0059] Figure 16 This is a functional principle block diagram of a preferred embodiment of the terminal in this invention. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this invention clearer and more explicit, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0061] This application provides a key management method that can be used in everyday environments. It offers high flexibility, low cost, a certain level of security, and long-term effective encryption and decryption. Based on these performance characteristics, the method can be used for historical backup and encrypted archiving of relevant objects (such as documents, directories, etc.) for individuals, departments, specific scenarios (such as projects), or companies. A tool platform can be configured based on this method; this application uses documents as an example for illustration. The tool platform includes functions such as document encryption, document decryption, adding a keystore, adding a key, exporting a key, importing a key, and changing authentication information.

[0062] This application uses a compressed archive as the key storage library. By setting security questions for the compressed archive key library, it addresses the problem of easily forgotten passwords. Furthermore, managing keys through the compressed archive key library (saving all historical key files) also solves the problem of decrypting all historical documents. Simultaneously, even if the key files and the documents to be decrypted are located in the same area, a certain level of security and confidentiality is maintained because the key files are stored in the compressed archive key library and protected by the archive's password (using the hash value of the security question answer as the archive's password).

[0063] The key management method, apparatus, terminal, and storage medium of this application are described below with reference to the accompanying drawings. Addressing the security vulnerabilities inherent in key management methods mentioned in the background section, this application provides a key management method. In this method, key library information and authentication information are obtained based on a key library generation instruction; a compressed package key library is generated based on the key library information and authentication information, and the compressed package key library is added to a pre-built key library list; in response to a key file generation instruction, a target compressed package key library is determined from the key library list, and authentication of the target compressed package key library is performed; if authentication of the target compressed package key library is successful, a key file containing key content is generated in the target compressed package key library, and the key file is added to a pre-built key file list corresponding to the target compressed package key library; when an instruction to encrypt an object to be encrypted using the target compressed package key library is received, a target key file is determined from the key file list corresponding to the target compressed package key library, and the object to be encrypted is encrypted based on the key content of the target key file. This application can generate a compressed key library, generate key files in the compressed key library, and form a list of generated key files for unified management. When encrypting an object, the target key file can be obtained from the compressed key library. The encryption method is simple, and the compressed key library can only be opened after identity authentication. Therefore, it achieves convenient encryption while ensuring secure key management.

[0064] Please see Figure 1 The key management method described in this embodiment of the invention includes the following steps:

[0065] Step S100: Obtain key library information and identity authentication information based on key library generation instructions, generate a compressed package key library according to the key library information and identity authentication information, and add the compressed package key library to a pre-built key library list.

[0066] Specifically, step S100 corresponds to the function of adding a keystore on the tool platform of this application. That is, a keystore can be added as needed to form a keystore list, so as to facilitate the subsequent search for the required target compressed package keystore from the keystore list. The compressed package keystore of this application is used to manage keys and has the functions of adding keys, exporting keys, and importing keys, and can also change the compressed package keystore.

[0067] In this embodiment of the application, step S100, "obtaining key library information and identity authentication information based on the key library generation instruction, and generating a compressed package key library based on the key library information and identity authentication information," specifically includes: responding to the key library generation instruction, receiving input key library information, and generating a compressed package key library based on the key library information; receiving input identity authentication information, which includes several questions and corresponding answers; setting the hash value formed by combining all the answers in the identity authentication information as the access password for the compressed package key library, and appending the bytecode formed by combining all the questions in the identity authentication information to the end of the bytes of the compressed package key library; receiving operator information and appending the operator information to the end of the bytes of the compressed package key library.

[0068] Specifically, the compressed file keystore itself requires authentication management. If only passwords are used for management, they are easily forgotten over time. Therefore, this application uses a question-and-answer method to replace the common password method for password protection of the compressed file keystore. That is, user-set questions and answers are used, and the hash value of the answer content is used as the password for accessing the compressed file keystore. For example, three questions are set (the number of questions is unlimited), and then the answers to the questions are combined (such as forming a simple string), and the resulting hash value is used as the access password for the compressed file keystore.

[0069] To access the compressed keystore—for example, to read keys on demand or add new key files—the previously prepared set of security questions is needed. This ensures that hash values ​​with identical answers are generated as the password for accessing the keystore. Since computer-based compression and encryption tools lack data storage capabilities, the security question set used for encryption must be stored in the generated keystore. This allows the user to be prompted for answers and generate the answer key when accessing the keystore. Specifically, when generating the keystore, the security question set is appended to the keystore's bytecode according to certain rules. When retrieving the security question set, it is extracted from the end of the bytecode in the correct order and according to the rules. Additionally, notes, such as the operator's information, can be added to the end of the keystore's bytecode as needed. The security question set can be changed to protect all key files; alternatively, the operator's information can be changed, simultaneously updating the security question set.

[0070] For example, if the use case is a company, a department, or a project, and there is a need for multiple users to use the compressed package key library, then different users can create their own compressed package key libraries. Each user can set their own questions and answers for each compressed package key library, thus obtaining different access passwords.

[0071] This application utilizes a method where different users establish their own compressed file key libraries, each with its own set access password, thereby ensuring the security of key acquisition. Furthermore, the security questions are appended to the encrypted compressed file key library in bytecode form, so that the questions can be displayed for the user to answer during decryption. This solves the problems of users forgetting passwords for previously encrypted documents or not being able to find encryption keys, and also addresses the issue of insufficient security when users use keys for encryption, i.e., the keys themselves are not protected and pose a certain risk of use. This application uses a compressed file key library with authentication to protect the keys, effectively enhancing the security of key decryption.

[0072] Step S200: In response to the key file generation instruction, determine the target compressed package key library from the key library list and perform identity authentication of the target compressed package key library.

[0073] Specifically, when a user needs to generate a new key, they locate their own compressed package keystore, i.e., the target compressed package keystore, and add a new key file in the target compressed package keystore.

[0074] Step S300: If the identity authentication of the target compressed package key library is successfully passed, a key file with key content is generated in the target compressed package key library, and the key file is added to the pre-built key file list corresponding to the target compressed package key library.

[0075] Specifically, only those who successfully pass the identity authentication process of the target compressed file key store have permission to access it. This application can continuously add keys, thus enabling the storage of keys for documents requiring long-term encryption protection, and allowing for the decryption of historical documents over extended periods.

[0076] In this embodiment of the application, step S300, "if the identity authentication of the target compressed package key library is successfully passed, a key file with key content is generated in the target compressed package key library", specifically includes: if the identity authentication of the target compressed package key library is successfully passed, a key file with key content is generated; the operator information at the end of the bytes of the target compressed package key library is obtained, and the key file is named according to the operator information and the hash value of the key content to obtain the key file name corresponding to the key file.

[0077] Specifically, when a key is added to the keystore, the name can be in the form of "date + key purpose description + operator information at the time + hash value of key content", for example: 20250828181114-project1-pqq-be72959b30f71b71f60c353dff351490.

[0078] This application names the key file based on the operator information and the hash value of the key content, thus obtaining the key file name corresponding to the key file. In this way, when it is necessary to use the key to encrypt historical documents, the key file name is written at the end of the encrypted document in the form of additional information bytecode; when it is necessary to use the key to decrypt the document, the corresponding key in the key library can be found through the content of the key file name in the document to decrypt the document.

[0079] Step S400: When an instruction to encrypt the object to be encrypted using the target compressed package key library is received, a target key file is determined from the key file list corresponding to the target compressed package key library, and the object to be encrypted is encrypted based on the key content of the target key file.

[0080] This application uses a key to encrypt the object to be encrypted, solving the problem of users managing document encryption passwords using password software, which is also easily forgotten if the software is not used for a long time. Furthermore, for large-scale document management scenarios (such as backing up important company documents), due to staff turnover, managing historical documents using simple personal password software can easily lead to problems. This application, however, can manage a compressed package keystore. For example, if the keystore operator is changed (and a new set of questions is set simultaneously), the company only needs to maintain the latest compressed package keystore. This keystore can be stored in the same area as historical documents because of the keystore access authentication control. Even if an employee leaves, the company can simply change the operator management of the previously managed compressed package keystore according to the change requirements, without affecting the decryption of historical documents (documents encrypted with key files from the previously managed compressed package keystore).

[0081] In this embodiment of the application, step S400 specifically includes: responding to the encryption instruction for the object to be encrypted, determining the target compressed package key library in the key library list, and performing identity authentication of the target compressed package key library; if the identity authentication of the target compressed package key library is successfully passed, determining the target key file in the key file list corresponding to the target compressed package key library; based on the key content of the target key file, encrypting the object to be encrypted using a symmetric encryption algorithm to obtain an encrypted object, and writing the key file name corresponding to the target key file at the end of the encrypted object in the form of additional information bytecode.

[0082] Specifically, this application can, after authentication (by entering the password for the corresponding compressed file key library), use the latest key in the target compressed file key library by default to encrypt the document using a symmetric encryption algorithm, or manually select other keys.

[0083] In order to achieve the function of automatically decrypting historical documents, this application adds some additional character content after the byte content of the document encrypted with the key, such as appending the name of the key file that was encrypted at that time as a note to the end of the character code of the key library.

[0084] When using a key to encrypt an object (such as a document), this application adds key-related information (such as the key file name) to the end of the bytecode of the generated encrypted document so that the key used for decryption can be automatically found during decryption.

[0085] In one embodiment of this application, the key management method further includes: responding to a decryption instruction for an encrypted object, determining a target compressed package key library in the key library list, and performing identity authentication of the target compressed package key library; if the identity authentication of the target compressed package key library is successfully passed, obtaining the key file name attached to the end of the encrypted object to be decrypted, obtaining the target key file according to the key file name; and decrypting the encrypted object to be decrypted using a symmetric decryption method based on the key content in the target key file.

[0086] Specifically, this application can automatically find a matching symmetric key in the key library to decrypt historical encrypted documents based on the characteristics of the encrypted documents.

[0087] For example, since different users (operators) construct their own compressed key libraries using their operator information, multiple users can decrypt an encrypted object using the question-and-answer content of their own compressed key libraries. Each user's compressed key library only needs to contain the key file used for decryption. Each user accesses their own compressed key library using their own question-and-answer content, thereby protecting these key files and solving the problem of multiple people knowing and using the same password for an encrypted object. In other words, the encrypted object corresponds to the same key, but the key can be set in different users' compressed key libraries and protected based on their respective question-and-answer content, thus enabling each user to decrypt the same encrypted object using their own method. This approach is very useful in scenarios where teams share keys. Furthermore, when sending an encrypted object to a third party for decryption, the third party only needs to create their own compressed key library—that is, set their own protection questions and import the key file (with password protection) sent by the other party—to encrypt and decrypt the encrypted object using their own compressed key library.

[0088] This application not only provides secure protection for the key, but also automatically identifies the correspondence between the key and the encrypted document. That is, it can automatically use the historical keys in the compressed package key library to decrypt historically encrypted objects without requiring the user to manually search for historical keys.

[0089] In existing technologies, some encryption machines are used to encrypt and decrypt objects, especially for encrypting and decrypting data in production environments. However, these methods are costly and lack flexibility. For example, many departments and scenarios use historical documents within a company, but in practice, not many encryption machines are needed for management. Using only a small number of encryption machines to manage multiple scenarios can easily lead to management chaos. Therefore, this application solves the problems of inflexibility and high cost associated with traditional encryption machines. This application can be used for individual users to manage document encryption themselves, as well as for large-scale scenarios, such as protecting company-level, department-level, and project-level objects to be encrypted (such as documents). Using it in multiple scenarios will not incur additional costs; only a corresponding compressed key library needs to be established as needed, and it is convenient, simple, and effective to use.

[0090] In this embodiment of the application, the key management method further includes: responding to a key export instruction, determining a target compressed package key library in the key library list, and performing identity authentication of the target compressed package key library; if the identity authentication of the target compressed package key library is successfully passed, determining a number of target key files in the key file list corresponding to the target compressed package key library; after reading each of the target key files, packaging all the target key files into a key file compressed package, and setting an opening password for the key file compressed package.

[0091] The compressed key library of this application can export key files. To avoid security issues, the exported key file is a password-protected compressed package, which facilitates key sharing between different users.

[0092] In one embodiment of this application, the key management method further includes: responding to a key import instruction, determining a target compressed package key library in the key library list, and performing identity authentication of the target compressed package key library; if the identity authentication of the target compressed package key library is successfully passed, then reading the key file in the compressed package to be imported based on the input open password of the compressed package to be imported; and importing the key file in the compressed package to be imported into the target compressed package key library to obtain the imported key file.

[0093] The compressed key library of this application can import key files, which facilitates key sharing between different users.

[0094] This application uses symmetric keys to encrypt and decrypt documents. The keys used for document encryption and decryption are managed in a compressed archive, forming a compressed key library. The management functions of the compressed key library include: adding symmetric keys, deleting keys (historical keys are generally not allowed to be deleted), exporting related key files (password-protected compressed archives), importing compressed key files (password-protected), and changing the password for using the compressed key library.

[0095] Furthermore, this application can re-encrypt all encrypted objects that have been encrypted using the key file in the compressed key library to further ensure security. For example, it can re-encrypt all encrypted objects that have been encrypted using the key file in the compressed key library using the latest key file.

[0096] This application provides encryption and decryption platform tools, such as... Figure 2 As shown, the encryption / decryption platform tool can generate compressed key libraries, add key files, export key files, change operators of compressed key libraries, import key files, encrypt documents, decrypt documents, and re-encrypt historical encrypted documents. It is a simple, easy-to-use, low-cost, independent computer-based, secure, and comprehensive tool with related key file management and document encryption / decryption functions. It is especially suitable for encrypting and decrypting historical documents.

[0097] In a specific embodiment of this application, a window program that can be directly executed on a computer is developed. Specifically, the tool APP (an executable file) installed on the user's computer adopts a multi-tab design, with each independent function presented in a separate tab. Users can quickly switch between function modules by clicking different tabs. The tool APP of this application includes, but is not limited to, the following functions.

[0098] First, a new keystore feature has been added. The window application generates a compressed keystore B with an access password, used to manage all key files. Initially, there are no key files; key files are added continuously as needed. Figure 3 As shown, key file 1, key file 2, ..., key file N form a key file list. The compressed key library B can be named using information such as the user's name or scenario. Simultaneously, the window program, after reading the key files in the key library, sets an access password for the compressed key library B. This access password is the hash value of the answer set of several questions set by the user on the interface when performing the new key library operation. The question set must also be combined into bytecode and appended to the end of the compressed key library B. When generating the compressed key library B, the user can set its remarks, such as the operator information (i.e., the operator information for setting the questions, such as name). This remarks are also appended to the end of the compressed key library B's bytes.

[0099] In specific operations, such as Figure 4 and Figure 5 As shown, Figure 4 This is the interface for adding a new keystore. Figure 5This involves setting up questions and answers for identity verification. Users open the PC app, enter the "Add Keystore" module, select the path to the compressed keystore to be saved, and fill in relevant information such as: keystore name, operator name, purpose, authentication protection questions and their corresponding answers. Multiple questions can be set; more questions mean higher security. Then, click "Save" to generate the compressed keystore.

[0100] Second, the function of adding a new key file. Specifically, this involves adding a key file to the compressed key repository B. First, the compressed key repository B is read, user authentication is performed (by answering a security question), and relevant information is obtained, such as the hash value of the user's answer and the operator information obtained from the last bytes of the compressed key repository B file. Then, a new key file E is generated (named according to a rule, such as yyyymmddhhmmss-use case description-operator-hash value of key content). Finally, the answer hash value is used as the access password for the compressed key repository B, and the key file addition operation is performed on the compressed key repository B, that is, the key file E is added to the compressed key repository B.

[0101] In specific operations, such as Figure 6 and Figure 7 As shown, Figure 6 This is the interface for adding a new key. Figure 7 This is the identity authentication page. Users open the computer app, select the "Add Key" function, and if multiple compressed key libraries exist, they choose the target library for the new key file. After successful user authentication, users fill in the relevant description information for the new key file, such as its purpose or usage scenario, and then click the "Save" button. The new key file is then added to the compressed key library. The key file is named according to certain rules, such as date and time-usage scenario-username-hash value of the key content. The key file content can be randomly generated 16 bytes of HEX encoded content.

[0102] Third, the function to export key files. This means that key files in the compressed keystore B can be selectively exported. Specifically, the compressed keystore B is first read for user authentication (answering questions), a list of all key files is obtained, the names of the key files to be imported are selected (multiple files can be selected at once), the selected key files are read, and then a compressed package of exported key files is generated, such as... Figure 8 As shown, a password is set to open the compressed file (entered by the user in the tool window), which protects the exported temporary key file.

[0103] In specific operations, such as Figure 9 and Figure 10 As shown, Figure 9 and Figure 10This is the interface for exporting keys. Users can use the "Export Key Files" function when they need to share certain key files from a compressed key repository with other users. Specifically, the user opens the PC app, selects the "Export Keys" module, and after selecting a specific compressed key repository, must first authenticate themselves. In the pop-up authentication window, after correctly answering the questions, the "Export Keys" interface will display a list of all key names in the compressed key repository. The user can then select one or more key files to export. The window then prompts the user to enter a password, and clicking the "Export" button generates a compressed archive of password-protected key files.

[0104] Fourth, the key file import function. This means that if a user needs to use a key file generated by another user, they can import that key file into their own compressed key repository. Specifically, the process first reads the user's own compressed key repository to perform user authentication (answering security questions), obtaining relevant information such as the hash value of the user's answer and the operator information obtained from the last bytes of the compressed key repository file. Then, the user selects the new compressed key file to import and enters the password to open it in the tool window. After reading the key file from the compressed key file, it is written into the user's own compressed key repository.

[0105] In specific operations, such as Figure 11 As shown, Figure 11 This is the interface for importing keys. Users can use the "Import Key Files" function when they need to import key files shared by other users into their own compressed key repository. Specifically, the user opens the PC app, selects the target compressed key repository to import to, and undergoes identity verification. After correctly answering the questions, the interface will redirect to the import file interface. The user selects the compressed key file to import and is prompted to enter the password for that compressed key file (i.e., the password set during export). The user clicks the "Import" button. After successful system verification, a window will indicate that the import was successful, meaning the imported key files have been generated in the user's own compressed key repository.

[0106] Fifth, the authentication information modification function. This means that if the administrator of the compressed keystore B changes, and the user using the compressed keystore B changes, two things must be done: first, update the relevant descriptive information of the compressed keystore B (found at the end of the compressed keystore B bytecode, such as operator information); second, replace the new operator's question set with the new operator's, and use the hash value of the new operator's answer set as the access password for the compressed keystore B. If only the original operator changes the question set (regular changes are beneficial to ensure key security), then only the hash value of the new question answer needs to replace the original access password. Specifically, the original compressed keystore B is accessed using the hash value of the original question answer, and then the access password and operator information (in the case of a change in operator) are reset using the hash value of the new question answer. The new operator information replaces the original operator information and is appended to the end of the compressed keystore B bytecode.

[0107] In specific operations, such as Figure 12 As shown, Figure 12 This is the interface for changing authentication information. Users open the PC app, select the target compressed file keystore to be operated on in the window, first undergo original identity verification (question and answer), after which the user sets new user information, such as entering new operator information, and also needs to set new question and answer to protect the target compressed file keystore. After setting, click save.

[0108] Sixth, document encryption function. When encrypting a document, the operator selects their own compressed key library B, completes user authentication (answering questions), reads the latest key file from the compressed key library B, or can choose other key files, uses a symmetric encryption algorithm to encrypt the document, generates an encrypted document D, and then writes the previously obtained key information (such as the key name) and operator information as additional information bytecode at the end of the encrypted document D.

[0109] In specific operations, such as Figure 13 As shown, Figure 13 This is the interface for document encryption. Users open the computer app, select the target compressed file key library for encryption in the window, and after authentication (answering security questions), the window displays a list of encryption key files. The first one displayed is the most recent key name (used by default). Users then select the specific key file to use for encryption. Finally, users select the document to be encrypted and click the "Encrypt" button to complete the encryption process.

[0110] Seventh, document decryption function. When decrypting an encrypted document, the key name to be used for decryption is obtained from the encrypted document. After authentication by the tool (answering the set of questions attached to the compressed key library B, using the hash value of the answer set to access the compressed key library), the user obtains all the key files. The corresponding key file is located based on the key name information appended to the end of the encrypted document. The corresponding key content is read as the key to decrypt the document, and the document is decrypted using a symmetric decryption method.

[0111] In specific operations, such as Figure 14 As shown, Figure 14 This is the interface for document decryption. Users open the PC app, select the target compressed file key library for decryption in the window, authenticate (by answering questions), select the document to be decrypted, and then click the decrypt button to complete the decryption operation.

[0112] Eighth, this application also has the function of re-encrypting corresponding historical encrypted documents with a new key. Specifically, after the user authenticates by answering questions, they select the key file to be used as the new key from the compressed key library, and then re-encrypt the historical documents. That is, they iterate through all historical documents, decrypt them using the document decryption function, and then symmetrically encrypt the decrypted documents using the selected new key. At the same time, it is necessary to delete the relevant transitional documents.

[0113] In practice, the user opens the PC app, selects the target compressed file key library in the window, authenticates (by answering security questions), selects a new key file (the latest key file is used by default), and then selects the specific file or directory to be re-encrypted (all related encrypted documents can be recursively re-encrypted). Clicking the "Re-encrypt" button completes the re-encryption process. The actual process involves automatically decrypting with the original key and then re-encrypting with the latest key (or the selected key).

[0114] Ninth, if there are multiple users in a certain scenario, or a user has multiple scenarios, and you want to store multiple key libraries together, you can compress these key libraries to form a master key library file A. That is, master key library file A contains different compressed key libraries, each protected by its own set of security questions. The operations related to a specific compressed key library B in master key library file A are the same as if compressed key library B were not further compressed, except for an additional processing step: first, read compressed key library B from master key library file A. When compressed key library B is updated, then master key library file A is updated synchronously.

[0115] It is understandable that encryption can be applied not only to a single document, but also to a directory, by first compressing and packaging the directory before encrypting it.

[0116] In one embodiment, such as Figure 15 As shown, based on the above key management method, the present invention also provides a key management device, comprising:

[0117] The key library generation module 100 is used to obtain key library information and identity authentication information based on key library generation instructions, generate a compressed key library according to the key library information and identity authentication information, and add the compressed key library to a pre-built key library list;

[0118] The identity authentication module 200 is used to respond to the key file generation instruction, determine the target compressed package key library in the key library list, and perform identity authentication of the target compressed package key library;

[0119] The key file generation module 300 is used to generate a key file with key content in the target compressed package key library if the identity authentication is successfully passed, and add the key file to the pre-built key file list corresponding to the target compressed package key library;

[0120] The encryption module 400 is used to determine a target key file from the list of key files corresponding to the target compressed package key library when it receives an instruction to encrypt an object to be encrypted using the target compressed package key library, and to encrypt the object to be encrypted based on the key content of the target key file.

[0121] It should be noted that the foregoing explanation of the key management method embodiment also applies to the key management device of this embodiment, and will not be repeated here.

[0122] This invention discloses a key management device. Based on a key library generation instruction, it obtains key library information and authentication information. A compressed package key library is generated according to the key library information and authentication information, and the compressed package key library is added to a pre-built key library list. In response to a key file generation instruction, a target compressed package key library is determined from the key library list, and authentication of the target compressed package key library is performed. If authentication of the target compressed package key library is successful, a key file containing key content is generated in the target compressed package key library, and the key file is added to a pre-built key file list corresponding to the target compressed package key library. When an instruction is received to encrypt an object to be encrypted using the target compressed package key library, a target key file is determined from the key file list corresponding to the target compressed package key library, and the object to be encrypted is encrypted based on the key content of the target key file. This application can generate a compressed key library, generate key files in the compressed key library, and form a list of generated key files for unified management. When encrypting an object, the target key file can be obtained from the compressed key library. The encryption method is simple, and the compressed key library can only be opened after identity authentication. Therefore, it achieves convenient encryption while ensuring secure key management.

[0123] Figure 16 A schematic diagram of the structure of a terminal provided in an embodiment of this application. The terminal may include:

[0124] The memory 501, the processor 502, and the computer program stored on the memory 501 and capable of running on the processor 502.

[0125] When the processor 502 executes the program, it implements the key management method provided in the above embodiments.

[0126] Furthermore, the terminal also includes:

[0127] Communication interface 503 is used for communication between memory 501 and processor 502.

[0128] The memory 501 is used to store computer programs that can run on the processor 502.

[0129] The memory 501 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0130] If the memory 501, processor 502, and communication interface 503 are implemented independently, they can be interconnected via a bus to communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, only one line is used in the diagram, but this does not imply that there is only one bus or one type of bus.

[0131] Optionally, in a specific implementation, if the memory 501, processor 502, and communication interface 503 are integrated on a single chip, then the memory 501, processor 502, and communication interface 503 can communicate with each other through an internal interface.

[0132] Processor 502 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0133] This embodiment also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the key management method described above.

[0134] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0135] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0136] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0137] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can read and execute instructions from or in conjunction with such an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). In addition, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically by optically scanning paper or other media, then editing, interpreting or otherwise processing them as necessary, and then storing them in computer memory.

[0138] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0139] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it includes one or a combination of the steps of the method embodiments.

[0140] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0141] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A key management method characterized by comprising: The method comprises: Based on the key library generation instruction, the key library information and the identity authentication information are obtained, and a compressed package key library is generated according to the key library information and the identity authentication information, and the compressed package key library is added to a pre-constructed key library list; In response to a key file generation instruction, a target compressed package key library is determined in the key library list, and identity authentication of the target compressed package key library is performed; If the identity authentication of the target compressed package key library is passed successfully, a key file with key content is generated in the target compressed package key library, and the key file is added to a key file list corresponding to the target compressed package key library in the pre-constructed key file list; When an instruction for encrypting a to-be-encrypted object by using the target compressed package key library is received, a target key file is determined in the key file list corresponding to the target compressed package key library, and the to-be-encrypted object is encrypted based on the key content of the target key file; Based on the key library generation instruction, the key library information and the identity authentication information are obtained, and a compressed package key library is generated according to the key library information and the identity authentication information, comprising: In response to the key library generation instruction, the input key library information is received, and a compressed package key library is generated according to the key library information; Identity authentication information is received, and the identity authentication information comprises a plurality of questions and corresponding answers; A hash value composed of all the answers in the identity authentication information is set as an access password of the compressed package key library, and a byte code composed of all the questions in the identity authentication information is attached to a byte tail of the compressed package key library; Operator information is received, and the operator information is attached to the byte tail of the compressed package key library.

2. The key management method according to claim 1, characterized by, If the identity authentication of the target compressed package key library is passed successfully, a key file with key content is generated in the target compressed package key library, comprising: If the identity authentication of the target compressed package key library is passed successfully, a key file with key content is generated; The operator information of the byte tail of the target compressed package key library is obtained, the key file is named according to the operator information and a hash value of the key content, and a key file name corresponding to the key file is obtained.

3. The key management method according to claim 1, characterized by, When an instruction for encrypting a to-be-encrypted object by using the target compressed package key library is received, a target key file is determined in the key file list corresponding to the target compressed package key library, and the to-be-encrypted object is encrypted based on the key content of the target key file, comprising: In response to the key library generation instruction, the input key library information is received, and a compressed package key library is generated according to the key library information; Identity authentication information is received, and the identity authentication information comprises a plurality of questions and corresponding answers; A hash value composed of all the answers in the identity authentication information is set as an access password of the compressed package key library, and a byte code composed of all the questions in the identity authentication information is attached to a byte tail of the compressed package key library; 4. The key management method according to claim 1, characterized by, Operator information is received, and the operator information is attached to the byte tail of the compressed package key library. The key management method further comprises: In response to a decryption instruction for the encrypted object, a target compressed package key library is determined in the key library list, and identity authentication of the target compressed package key library is performed; If the identity authentication of the target compressed package key library is passed successfully, a key file name attached to a tail of the encrypted object to be decrypted is obtained, and a target key file is obtained according to the key file name; The encrypted object to be decrypted is decrypted in a symmetric decryption mode based on key content in the target key file.

5. The key management method according to claim 1, wherein, The key management method further comprises: In response to a key derivation instruction, a target compressed package key library is determined in the key library list, and identity authentication of the target compressed package key library is performed; If the identity authentication of the target compressed package key library is passed successfully, a plurality of target key files are determined in a key file list corresponding to the target compressed package key library; After each target key file is read, all the target key files are packaged to generate a key file compressed package, and an opening password of the key file compressed package is set.

6. The key management method according to claim 1, wherein, The key management method further comprises: In response to a key derivation instruction, a target compressed package key library is determined in the key library list, and identity authentication of the target compressed package key library is performed; If the identity authentication of the target compressed package key library is passed successfully, a key file name attached to a tail of the encrypted object to be decrypted is obtained, and a target key file is obtained according to the key file name; The encrypted object to be decrypted is decrypted in a symmetric decryption mode based on key content in the target key file.

7. A key management apparatus characterized by comprising: The device comprises: A key library generation module is configured to obtain key library information and identity authentication information based on a key library generation instruction, generate a compressed package key library according to the key library information and the identity authentication information, and add the compressed package key library to a pre-constructed key library list; An identity authentication module is configured to determine a target compressed package key library in the key library list in response to a key file generation instruction, and perform identity authentication of the target compressed package key library; A key file generation module is configured to generate a key file with key content in the target compressed package key library if the identity authentication of the target compressed package key library is passed successfully, and add the key file to a pre-constructed key file list corresponding to the target compressed package key library; An encryption module is configured to determine a target key file in a key file list corresponding to the target compressed package key library when an instruction of encrypting an object to be encrypted by using the target compressed package key library is received, and encrypt the object to be encrypted based on key content of the target key file; The key library information and the identity authentication information are obtained based on the key library generation instruction, and the compressed package key library is generated according to the key library information and the identity authentication information, including: In response to the key library generation instruction, input key library information is received, and a compressed package key library is generated according to the key library information; Input identity authentication information is received, and the identity authentication information includes a plurality of questions and corresponding answers; Combining all the answers in the identity authentication information into a hash value as an access password of the compressed package key library, and appending a byte code of all the questions in the identity authentication information to a byte tail of the compressed package key library; Receiving operator information, and appending the operator information to the byte tail of the compressed package key library.

8. A terminal, characterized by comprising: Comprise: A memory, a processor, and a key management program stored on the memory and executable on the processor, the key management program, when executed by the processor, implements the steps of the key management method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program can be executed to implement the steps of the key management method according to any one of claims 1-6.

Images