Security key processing method and device, storage medium and electronic device

Abstract

The invention discloses a security key processing method and device, a storage medium and an electronic device, and relates to the technical field of information security. The security key processing method comprises the following steps: receiving a signature request sent by a signature requester; in response to the signature request, generating a first random number, and selecting a group of target micro-services from the micro-service set; transmitting the first key derivation information and the first random number to a group of target micro-services through a micro-service bus, so that the group of target micro-services perform ring signature on the first key derivation information by using the first random number and a ring signature private key of the group of target micro-services; and under the condition that first signature information returned by the group of target micro-services is received, sending a signature response message to the signature requester. Through application of the method and the device, the problem that the identity exposure risk is relatively high in a security key processing method in the related technology is solved, and the effect of improving the security of the signature information is further achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to a secure key processing method and device, a storage medium and an electronic device. BACKGROUND

[0002] In the microservice architecture, communication and data sharing between services are increasingly frequent, which not only improves the flexibility and scalability of the system, but also brings significant security challenges. Traditional signature mechanisms, such as single private key-based digital signatures, while being able to verify service identity and data integrity, have the problem of exposing the identity of the signer, who may become an attack target after exposing the identity, affecting system security.

[0003] Therefore, the secure key processing method in the related art has the problem of high identity exposure risk. SUMMARY

[0004] The embodiments of the present application provide a secure key processing method and device, a storage medium and an electronic device to at least solve the problem of high identity exposure risk of the secure key processing method in the related art.

[0005] According to an embodiment of the present application, a secure key processing method is provided, comprising: receiving a signature request sent by a signature requester, wherein the signature request carries first key derivation information, and the first key derivation information is the derivation information of a first secure key; in response to the signature request, generating a first random number and selecting a group of target microservices from a microservice set, wherein the microservice set is a set of microservices registered through a microservice bus; passing the first key derivation information and the first random number to the group of target microservices via the microservice bus, so that the group of target microservices use the first random number and the ring signature private key of the group of target microservices to perform ring signature on the first key derivation information; in the case of receiving the first signature information returned by the group of target microservices, sending a signature response message to the signature requester, wherein the signature response message carries the first signature information and the first random number.

[0006] According to another aspect of the present application, there is also provided a processing apparatus for a security key, comprising: a first receiving unit configured to receive a signature request sent by a signature requester, wherein the signature request carries first key derivation information, and the first key derivation information is derivation information of a first security key; an executing unit configured to generate a first random number and select a group of target microservices from a microservice set in response to the signature request, wherein the microservice set is a set of microservices registered via a microservice bus; a passing unit configured to pass the first key derivation information and the first random number to the group of target microservices via the microservice bus, so that the group of target microservices performs ring signature on the first key derivation information using the first random number and ring signature private keys of the group of target microservices; and a first sending unit configured to send a signature response message to the signature requester in a case where the first signature information returned by the group of target microservices is received, wherein the signature response message carries the first signature information and the first random number.

[0007] In an example embodiment, the executing unit comprises: an operation module configured to perform a hash operation on the first random number to obtain a first hash value; and a determination module configured to determine, as the group of target microservices, a microservice in the microservice set whose microservice identifier is closest to the first hash value, wherein the microservice identifier of each microservice in the microservice set is a hash value obtained by performing a hash operation on a ring signature public key of the microservice.

[0008] In an example embodiment, the determination module comprises one of: a first determination submodule configured to determine, as the group of target microservices, a microservice in the microservice set whose microservice identifier is closest to the first hash value; and a second determination submodule configured to determine, as the group of target microservices, a microservice in the microservice set whose microservice identifier is closest to the first hash value.

[0009] In an example embodiment, the passing unit comprises: a first passing module configured to, in a case where the group of target microservices comprises a plurality of target microservices, pass the first key derivation information and the first random number to a first target microservice in the group of target microservices via the microservice bus, so that each target microservice in the group of target microservices performs ring signature on the first key derivation information using the first random number and a ring signature private key of the target microservice in sequence, wherein the first signature information comprises signature information obtained by each target microservice in the group of target microservices performing ring signature on the first key derivation information.

[0010] In an exemplary embodiment, the transmission unit includes: a splitting unit, configured to split the first key derivation information into multiple sub-derivation information when the group of target microservices includes multiple target microservices, wherein the target microservices in the multiple target microservices correspond one-to-one with the sub-derivation information in the multiple sub-derivation information; and a second transmission module, configured to transmit the sub-derivation information corresponding to each target microservice in the multiple target microservices and the first random number to each target microservice via the microservice bus, so that each target microservice can use the first random number and the ring signature private key of each target microservice to perform ring signature on the sub-derivation information corresponding to each target microservice, wherein the first signature information includes the signature information obtained by each target microservice performing ring signature on the sub-derivation information corresponding to each target microservice.

[0011] In one exemplary embodiment, the apparatus further includes: a second receiving unit, configured to receive the first random number and derivation information to be signed through each of the target microservices in the group of target microservices after the first key derivation information and the first random number are transmitted to the group of target microservices via the microservice bus, wherein the derivation information to be signed is at least a portion of the information in the first key derivation information; and a signing unit, configured to perform a ring signature on the derivation information to be signed using the first random number, the ring signature private key of each target microservice, and a ring signature public key list to obtain target signature information, wherein the ring signature public key list includes the ring signature public keys of each microservice in the microservice set, and the first signature information includes the target signature information.

[0012] In one exemplary embodiment, the apparatus further includes: a third receiving unit, configured to receive a signature verification request sent by a signature verification requester through a signature verification microservice, wherein the signature verification request carries a second random number and second signature information, the signature verification request being used to request verification of whether the second signature information is obtained by at least one microservice in the microservice set using the second random number to perform a ring signature on second key derivation information, the second key derivation information being derivation information of a second security key, and the signature verification microservice being a microservice providing ring signature verification services; a verification unit, configured to, in response to the signature verification request, perform signature verification on the second signature information using the second random number and a ring signature public key list through the signature verification microservice, and obtain a signature verification result, wherein the ring signature public key list includes the ring signature public keys of each microservice in the microservice set; and a second sending unit, configured to send a signature verification response message to the signature verification requester through the signature verification microservice, wherein the signature verification response message carries indication information of the signature verification result.

[0013] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer program, and the computer program is configured to execute the above-described security key processing method when running.

[0014] According to another aspect of the embodiments of this application, an electronic device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the security key processing method through the computer program.

[0015] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the above-described method for processing security keys.

[0016] In this embodiment, a signature request is received from a signature requester, wherein the signature request carries first key derivation information, which is derived from a first security key. In response to the signature request, a first random number is generated, and a set of target microservices is selected from a microservice set, wherein the microservice set is a set of microservices registered through a microservice bus. The first key derivation information and the first random number are transmitted to the set of target microservices via the microservice bus, so that the set of target microservices can perform a ring signature on the first key derivation information using the first random number and their ring signature private key. Upon receiving the first signature information returned by the set of target microservices, a signature response message is sent to the signature requester, wherein the signature response message carries the first signature information and the first random number. By selecting the corresponding microservice for ring signing the security key based on the random number, and due to the randomness of the randomly selected signer microservice and the anonymity of the signer in ring signing, anonymous signing can be achieved, effectively protecting the identity security of the signer. This solves the problem of high identity exposure risk in related technologies' security key processing methods, effectively improving the security of signature information. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1This is a schematic diagram of the hardware environment for a security key processing method according to an embodiment of this application;

[0020] Figure 2 This is a flowchart of a security key processing method according to an embodiment of this application;

[0021] Figure 3 This is a structural block diagram of a security key processing device according to an embodiment of this application. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] The collection, storage, use, processing, transmission, provision, and disclosure of financial data or user data involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0025] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0026] The methods and embodiments provided in this application can be executed on a computer terminal or similar computing device. Taking running on a computer terminal as an example, Figure 1 This is a hardware structure block diagram of a computer terminal for a security key processing method according to an embodiment of this application. For example... Figure 1As shown, a computer terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a central processing unit (CPU) or a field-programmable gate array (FPGA)) and a memory 104 for storing data are also shown. The computer terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the computer terminal described above. For example, the computer terminal may also include components that are more complex than those described above. Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0027] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the security key processing method in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thus implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to a computer terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0028] The computer terminal uses a wireless network provided by a communications provider. In one example, transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0029] This embodiment provides a method for processing security keys, which is applied to the aforementioned computer terminal. Figure 2 This is a flowchart of a security key processing method according to an embodiment of this application, such as... Figure 2 As shown, the process includes the following steps:

[0030] Step S202: Receive a signature request sent by the signature requester, wherein the signature request carries first key derivation information, which is the derivation information of the first security key;

[0031] Step S204: In response to the signature request, generate a first random number and select a set of target microservices from the microservice set, wherein the microservice set is a set of microservices registered through the microservice bus;

[0032] Step S206: The first key derivation information and the first random number are transmitted to a group of target microservices via the microservice bus, so that the group of target microservices can use the first random number and the ring signature private key of the group of target microservices to perform ring signature on the first key derivation information.

[0033] Step S208: Upon receiving the first signature information returned by a set of target microservices, a signature response message is sent to the signature requester, wherein the signature response message carries the first signature information and the first random number.

[0034] The security key processing method in this embodiment can be applied to the field of information security technology, specifically to scenarios where ring signatures are performed on derived information of the security key through microservices.

[0035] Microservice architecture is an emerging approach to designing software applications. It breaks down a large, complex monolithic application into a series of small, independent, and independently deployable services—microservices. Each microservice is built around a specific business function, has independent data management, and interacts with each other through lightweight communication mechanisms. This provides a high degree of decoupling and modularity, making the system easier to understand and maintain. Furthermore, each service can be independently extended and upgraded without affecting other services.

[0036] In microservice architectures, communication and data sharing between microservices are becoming increasingly frequent. This not only improves system flexibility and scalability but also brings significant security challenges. Traditional signature mechanisms, such as digital signatures based on a single private key, while capable of verifying service identity and data integrity, expose the signer's identity. The signer, once exposed, could become a target for attacks, impacting system security. Therefore, the methods for handling secure keys in related technologies have a high risk of identity exposure.

[0037] To at least partially address the aforementioned technical problems, this embodiment employs a ring signature method where a microservice is randomly selected to perform a ring signature on the security key. Due to the randomness of the selected microservice and the anonymity of the ring signature, anonymous signing is achieved, effectively protecting the signer's identity. Here, a ring signature is a signature scheme that protects the signer's privacy. Unlike traditional digital signatures, a ring signature allows any member of a group to generate a signature for a group-signed message. External verifiers can verify the signature's validity but cannot determine which member of the group generated the signature, thus protecting the signer's privacy.

[0038] In this embodiment, a signature request is received from the signature requester. The signature request carries first key derivation information, which is derived from the first security key. Here, derivation information refers to new data derived from the original data using a specific algorithm. While this derivation information carries some characteristics of the original data, it does not directly expose the specific content of the original data. By carrying only the derivation information, rather than the first key itself, in the signature request, information leakage caused by directly transmitting the security key can be avoided. Simultaneously, the derivation information can be used to verify the data integrity and consistency of the security key itself. Signing the derivation information can achieve the same effect as signing the security key itself in verifying data integrity and authenticity. Optionally, the derivation information may include a digest of the first key, a hash value, or other data derived through a specific algorithm; this embodiment does not limit this.

[0039] Upon receiving a signature request, in response to the request, a first random number is generated, and a set of target microservices is selected from the microservice set, which is a collection of microservices registered through the microservice bus. Here, the first random number can be a number-once (nonce), an arbitrary or non-repeating random value used only once, which can be used to verify that information is not reused to combat replay attacks. Furthermore, in this embodiment, the nonce is also used to select a set of target microservices from the microservice set, which can increase the randomness of the selected target microservices, thereby improving the security of the signature.

[0040] In this embodiment, the microservice set is a collection of microservices registered through a microservice bus. A microservice bus is an architectural pattern that facilitates communication and integration between microservices. It simplifies interactions between microservices, provides unified interface management and data transmission mechanisms, thereby reducing the complexity of communication between services within the system. The microservice bus can be considered the nervous system of the microservice architecture, responsible for coordinating and controlling message passing and data exchange between microservices. Here, all microservices in the microservice set are registered through the microservice bus. The microservice bus can accurately schedule each microservice based on its registration information. For example, the microservice bus can schedule the corresponding microservice based on the address, identifier (ID), and other information provided during microservice registration.

[0041] The first key derivation information and the first random number are transmitted to a group of target microservices via a microservice bus. These target microservices then use the first random number and their own ring signature private key to perform a ring signature on the first key derivation information. Here, the group of target microservices consists of microservices that implement the ring signature function. Optionally, the group of target microservices may include one or more microservices. When the group of target microservices includes multiple microservices, the signature generation can be sequential, i.e., the microservices pass information and sign sequentially, or it can be parallel, i.e., all microservices sign simultaneously.

[0042] Upon receiving the first signature information returned by a set of target microservices, a signature response message is sent to the signature requester. This signature response message carries the first signature information and a first random number. Upon receiving the first signature information returned by a set of target microservices, indicating successful signing of the first key-derived information, a signature response message can be sent to the signature requester. This signature response message indicates the completion of the signing process and carries the first signature information and a first random number, which can be used to verify the first signature information subsequently. Optionally, the signature response message may also carry information such as the signature time and signature algorithm type to enhance the integrity and verifiability of the signature information.

[0043] The embodiments provided in this application receive a signature request sent by a signature requester, wherein the signature request carries first key derivation information, which is a derivation of a first security key; in response to the signature request, a first random number is generated, and a set of target microservices is selected from a microservice set, wherein the microservice set is a set of microservices registered through a microservice bus; the first key derivation information and the first random number are transmitted to the set of target microservices via the microservice bus, so that the set of target microservices can perform ring signature on the first key derivation information using the first random number and the ring signature private key of the set of target microservices; upon receiving the first signature information returned by the set of target microservices, a signature response message is sent to the signature requester, wherein the signature response message carries the first signature information and the first random number. By selecting the corresponding microservice to perform ring signature on the security key based on the random number in the signature, and due to the randomness of the randomly selected signer microservice and the anonymity of the signer in ring signatures, the effect of anonymous signing can be achieved, effectively protecting the identity security of the signer, solving the problem of high identity exposure risk in related technologies' security key processing methods, and effectively improving the security of signature information.

[0044] In an exemplary embodiment, selecting a group of target microservices from a set of microservices includes: performing a hash operation on a first random number to obtain a first hash value; and determining the microservices in the set of microservices whose microservice identifiers match the first hash value as a group of target microservices, wherein the microservice identifier of each microservice in the set of microservices is a hash value obtained by performing a hash operation on the ring signature public key of each microservice.

[0045] To improve the randomness of selecting the target microservice and thus enhance the security of the signer's identity, in this embodiment, the target microservice can be selected from the microservice set based on a first random number, thereby achieving the effect of randomly selecting the target microservice.

[0046] In this embodiment, a hash operation is performed on the first random number to obtain a first hash value. Here, a specific hash algorithm (such as Secure Hash Algorithm 256-bit (SHA-256)) can be used to convert the first random number into a fixed-length first hash value. The use of a hash algorithm ensures that even if the nonce is leaked, it is difficult for an attacker to deduce the original nonce or predict future nonce values ​​from the hash value.

[0047] Within the microservice set, microservices whose microservice identifiers match the first hash value are identified as a group of target microservices. Here, the microservice identifier for each microservice in the microservice set is a hash value obtained by hashing the ring signature public key of each microservice. Alternatively, the microservice identifier can be matched based on the first hash value and the microservice identifier of each microservice, and the matching microservices can be identified as a group of target microservices. The microservice identifier is the hash value obtained by hashing the ring signature public key of the microservice. Optionally, the microservice can provide its ring signature public key when registering with the microservice bus. The microservice bus performs a hash operation to obtain and saves the microservice identifier for each microservice in the service directory. Upon receiving a signature request, the microservice bus can quickly find the matching microservice in the service directory, thus identifying a group of target microservices, facilitating the rapid location and scheduling of this group of target microservices.

[0048] In this embodiment, by selecting a target microservice that matches the microservice identifier based on the hash operation of the first random number, the target microservice can be randomly selected, ensuring that the signer's identity is anonymized and improving the security of the signing process.

[0049] In one exemplary embodiment, a group of target microservices is determined when the microservice identifier matches the first hash value, including one of the following: determining the microservice in the microservice set whose microservice identifier is closest to the first hash value as a group of target microservices; or determining the microservice in the microservice set whose microservice identifier is less than a preset distance threshold as a group of target microservices.

[0050] To improve the flexibility of target microservice selection, this embodiment provides two optional methods for selecting target microservices: selecting the microservice whose microservice identifier is closest to the first hash value; or selecting the microservice whose microservice identifier is less than a preset distance threshold from the first hash value.

[0051] Optionally, the two microservice selection methods can be preset, or the selection method can be set according to the situation after receiving the signature request. For example, when the system is busy, the default method can be to select the microservice whose microservice identifier is closest to the first hash value to reduce the system load caused by scheduling multiple microservices; or, if the signature request indicates that multiple microservices need to be used for signing to further improve signature security, the method can be to select the microservice whose microservice identifier is less than the preset distance threshold according to the instruction.

[0052] Optionally, the preset distance threshold can be a fixed threshold set in advance, or it can be dynamically adjusted based on the indication of the signature request or the system load. For example, when the system load is high, the preset distance threshold can be reduced to reduce the number of target microservices and reduce the system load caused by scheduling a large number of microservices; or, when the signature request indicates that higher signature security is required, the preset distance threshold can be increased to try to call more target microservices for signing; or, when using the preset distance threshold to determine the target microservice, if there is no microservice with a distance less than the preset distance threshold, the preset distance threshold can be temporarily increased, or it can be automatically switched to the method of selecting the microservice whose microservice identifier is closest to the first hash value.

[0053] Optionally, the microservice whose microservice identifier is closest to the first hash value in the microservice set is identified as a group of target microservices. A preset quantity threshold can be set, and multiple microservices whose microservice identifier is closest to the first hash value are identified as a group of target microservices in turn, until the number of microservices in a group of target microservices meets the preset quantity threshold. The size of the preset quantity threshold can be set based on the current system load or the security requirements of the signature request. This embodiment does not limit this.

[0054] This embodiment demonstrates how two methods for determining a set of target microservices can be used to flexibly select the method for determining target microservices according to requirements, thereby improving the flexibility of the security key processing method.

[0055] In one exemplary embodiment, transmitting the first key derivation information and the first random number to a group of target microservices via a microservice bus includes: when the group of target microservices contains multiple target microservices, transmitting the first key derivation information and the first random number to the first target microservice in the group of target microservices via the microservice bus, so that each target microservice in the group of target microservices sequentially uses the first random number and the ring signature private key of each target microservice to ring sign the first key derivation information, wherein the first signature information includes the signature information obtained by each target microservice ring signing the first key derivation information.

[0056] When a group of target microservices includes only one target microservice, the first key derivation information and the first random number can be directly passed to that target microservice for signing via the microservice bus. However, when a group of target microservices includes multiple target microservices, multiple target microservices need to collaborate on signing. In this embodiment, collaborative signing of multiple target microservices can be achieved by having each target microservice perform ring signing sequentially.

[0057] In this embodiment, when a group of target microservices contains multiple target microservices, the first key derivation information and the first random number are transmitted to the first target microservice in the group via the microservice bus. Each target microservice in the group then sequentially performs a ring signature on the first key derivation information using the first random number and its own ring signature private key. The first signature information includes the signature information obtained by each target microservice performing a ring signature on the first key derivation information. Optionally, the first target microservice in the group can be the microservice whose microservice identifier is closest to the first hash value. The group of microservices can be ordered sequentially by the distance between their microservice identifiers and the first hash value, and the ring signatures are performed sequentially.

[0058] In this embodiment, after the first target microservice receives the first random number and first key derivation information from the microservice bus, it can use its own ring signature private key to ring sign the first key derivation information, generating first signature information. Subsequently, the first target microservice can pass the first signature information, first key derivation information, and first random number to the next target microservice. Each target microservice performs ring signature operations and updates the first signature information in the above manner until all target microservices in the group have completed signing. During this process, each target microservice uses the first random number and its own ring signature private key to sign the first key derivation information, and then passes the updated first signature information and first key derivation information to the next microservice until all signing operations are completed. After completing the signing process, the last target microservice can return the first signature information containing the signature information of all member microservices to the microservice bus to return a signature response message carrying the first signature information to the request initiator.

[0059] In this embodiment, a group of target microservices sequentially perform ring signatures on the information derived from the first key. By adopting a chain-like information transmission method, the collaboration between multiple microservices can be effectively organized, thereby improving the efficiency and reliability of the signature operation.

[0060] In one exemplary embodiment, transmitting the first key derivation information and the first random number to a group of target microservices via a microservice bus includes: when the group of target microservices contains multiple target microservices, splitting the first key derivation information into multiple sub-derivation information, wherein each target microservice in the multiple target microservices corresponds one-to-one with the sub-derivation information in the multiple sub-derivation information; transmitting the sub-derivation information corresponding to each target microservice and the first random number to each target microservice via the microservice bus, so that each target microservice uses the first random number and the ring signature private key of each target microservice to perform a ring signature on the sub-derivation information corresponding to each target microservice, wherein the first signature information includes the signature information obtained by each target microservice performing a ring signature on the sub-derivation information corresponding to each target microservice.

[0061] To further improve the efficiency of ring signing by multiple target microservices, in this embodiment, the first key derivation information that needs to be signed can be split and distributed to each target microservice, and the target microservices can perform ring signing in parallel.

[0062] In this embodiment, when a group of target microservices contains multiple target microservices, the first key derivation information is split into multiple sub-derivation information, wherein each target microservice corresponds one-to-one with a sub-derivation information. Here, the first key derivation information can be split into multiple sub-derivation information evenly or unevenly according to the number of target microservices, ensuring that each target microservice receives its corresponding sub-information.

[0063] After obtaining multiple sub-derived information, the sub-derived information corresponding to each of the multiple target microservices and the first random number can be transmitted to each target microservice via the microservice bus. Each target microservice then uses the first random number and its own ring signature private key to ring sign its corresponding sub-derived information. The first signature information includes the signature information obtained by each target microservice from ring signing its corresponding sub-derived information. Here, after receiving its own sub-derived information and first random number, each target microservice can use its own ring signature private key to ring sign its sub-derived information, generating an independent signature information fragment. This signing process can be performed in parallel across multiple microservices without waiting for other microservices to complete their signatures or provide feedback, significantly improving the efficiency of the ring signature process.

[0064] Optionally, after each target microservice performs a ring signature on the sub-derived information corresponding to each target microservice using a first random number and the ring signature private key of each target microservice, the respective ring signature results can be sent back to the microservice bus. The microservice bus collects the signature information fragments from each target microservice and integrates them into a complete ring signature in a specific order to obtain the first signature information.

[0065] In this embodiment, by splitting and distributing the first key-derived information to each target microservice, each target microservice processes only a portion of the sub-derived information, reducing the risk of information concentration and enhancing the security of the ring signature process. Furthermore, the parallel ring signature operations performed by the target microservices can further improve the efficiency of ring signature.

[0066] In an exemplary embodiment, after transmitting the first key derivation information and the first random number to a group of target microservices via a microservice bus, the method further includes: receiving the first random number and derivation information to be signed by each target microservice in the group of target microservices, wherein the derivation information to be signed is at least a portion of the information in the first key derivation information; and performing a ring signature on the derivation information to be signed by each target microservice using the first random number, the ring signature private key of each target microservice, and a ring signature public key list to obtain target signature information, wherein the ring signature public key list includes the ring signature public keys of each microservice in the microservice set, and the first signature information includes the target signature information.

[0067] In ring signatures, a decentralized design is employed to protect and conceal the signer's identity. Signature verification does not rely on the signer's specific identity information; only a list of public keys, including the signer's, is required. In the event of signature information leakage, the specific signer cannot be identified from the public key list, thus achieving signer anonymity and protecting signer privacy. In this embodiment, the target microservice uses a first random number, each target microservice's ring signature private key, and a ring signature public key list to ring-sign the derived information to be signed, for subsequent ring signature verification.

[0068] In this embodiment, each target microservice in a group of target microservices receives a first random number and derivation information to be signed, wherein the derivation information to be signed is at least a portion of the information in the first key derivation information. The foregoing embodiments provide two ring signature methods: a chained ring signature method where each target microservice sequentially performs a chained ring signature, and a method where each target microservice concurrently performs a partial ring signature. Here, in the chained ring signature method where each target microservice sequentially performs a chained ring signature, the derivation information to be signed is all the information in the first key derivation information; in the method where each target microservice concurrently performs a partial ring signature, the derivation information to be signed is the sub-derivation information corresponding to each target microservice. For example, a first microservice can receive a first random number and derivation information to be signed transmitted via a microservice bus, and perform a ring signature operation based on its own ring signature private key. Here, the first microservice is the microservice providing the ring signature service, i.e., one of the target microservices.

[0069] After each target microservice receives the first random number and the derivation information to be signed, it can perform a ring signature on the derivation information using the first random number, the ring signature private key of each target microservice, and a list of ring signature public keys to obtain the target signature information. The ring signature public key list includes the ring signature public keys of each microservice in the microservice set, and the first signature information includes the target signature information. Here, all target microservices are registered through the microservice bus. The microservice bus can record the ring signature public key of each microservice during registration, forming a ring signature public key list. When a target microservice needs to perform a ring signature, the microservice synchronously sends the ring signature public key list to the target microservice so that the target microservice can perform a ring signature based on the list of ring signature public keys.

[0070] In this embodiment, the target microservice uses a first random number, a list of ring signature private keys and ring signature public keys of each target microservice to perform ring signature on the information to be signed. This not only protects the privacy of the target microservice, but also ensures the efficient generation and verification of the ring signature, thus improving the security and efficiency of the ring signature.

[0071] In one exemplary embodiment, the method further includes: receiving a signature verification request sent by a signature verification requester through a signature verification microservice, wherein the signature verification request carries a second random number and second signature information, the signature verification request being used to request verification of whether the second signature information is obtained by at least one microservice in the microservice set using the second random number to perform a ring signature on second key derivation information, the second key derivation information being derivation information of a second security key, and the signature verification microservice being a microservice providing ring signature verification services; responding to the signature verification request, performing signature verification on the second signature information using the second random number and a ring signature public key list through the signature verification microservice to obtain a signature verification result, wherein the ring signature public key list includes the ring signature public keys of each microservice in the microservice set; and sending a signature verification response message to the signature verification requester through the signature verification microservice, wherein the signature verification response message carries indication information of the signature verification result.

[0072] After signing, to verify the integrity and trustworthiness of the security key, a signature verification operation can be performed. In this embodiment, the signature information can be verified based on the random number used during signing and the list of ring signature public keys, without needing to know the specific signer's public key, thus protecting the signer's privacy and security during the verification process.

[0073] In this embodiment, a signature verification microservice receives a signature verification request sent by a signature requester. The signature verification request carries a second random number and second signature information. The request verifies whether the second signature information was obtained by at least one microservice in the microservice set using the second random number to perform a ring signature on second key-derived information. The second key-derived information is derived from the second security key. The signature verification microservice provides ring signature verification services. Here, the microservice set refers to the microservices that perform the ring signature signing process, and the signature verification microservice refers to the microservice that performs the ring signature verification process. The signature verification microservice is not part of the microservice set, but both the signature verification microservice and the microservices in the microservice set are registered through the microservice bus and can be invoked accordingly through the microservice bus. The second random number is the random number used in the process of signing the second key-derived information. The signing process for the second key-derived information is similar to that in the previous embodiments and will not be described in detail here.

[0074] In response to a signature verification request, the signature verification microservice uses a second random number and a ring signature public key list to verify the second signature information, obtaining a signature verification result. The ring signature public key list includes the ring signature public keys of each microservice in the microservice set. Optionally, similar to the previous embodiments, the microservice bus can record the ring signature public key of each microservice during microservice registration, forming a ring signature public key list. This list is updated accordingly when a new microservice registers. Upon receiving a signature verification request, the microservice bus can send the ring signature public key list to the signature verification microservice, enabling the verification microservice to use the second random number and the ring signature public key list to verify the second signature information and obtain a signature verification result.

[0075] After the signature verification microservice completes the signature verification, it can send a signature verification response message to the signature verification requester. This response message carries indication information of the signature verification result. Optionally, the signature verification microservice can send this indication information to the microservice bus, which then generates a signature verification response message based on the indication information and sends it to the signature verification requester.

[0076] In this embodiment, the signature verification microservice verifies the signature using the random number and ring signature public key list used during signing. This not only verifies the validity of the signature but also maintains the anonymity of the signer, thus improving the security of the signing and verification process.

[0077] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, operating terminal, or network device, etc.) to execute the methods of the various embodiments of this application.

[0078] According to another aspect of the embodiments of this application, a security key processing apparatus is also provided. This security key processing apparatus can be used to implement the security key processing method provided in the above embodiments, and details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0079] Figure 3This is a structural block diagram of an optional security key processing device according to an embodiment of this application, such as... Figure 3 As shown, the security key processing device includes:

[0080] The first receiving unit 302 is used to receive a signature request sent by the signature requester, wherein the signature request carries first key derivation information, which is the derivation information of the first security key.

[0081] Execution unit 304 is configured to generate a first random number in response to a signature request, and select a set of target microservices from the microservice set, wherein the microservice set is a set of microservices registered through the microservice bus;

[0082] The transmission unit 306 is used to transmit the first key derivation information and the first random number to a group of target microservices via the microservice bus, so that the group of target microservices can use the first random number and the ring signature private key of the group of target microservices to perform ring signature on the first key derivation information.

[0083] The first sending unit 308 is configured to send a signature response message to the signature requester upon receiving first signature information returned by a set of target microservices, wherein the signature response message carries the first signature information and a first random number.

[0084] It should be noted that the first receiving unit 302 in this embodiment can be used to execute the above step S202, the execution unit 304 in this embodiment can be used to execute the above step S204, the transmission unit 306 in this embodiment can be used to execute the above step S206, and the first sending unit 308 in this embodiment can be used to execute the above step S208.

[0085] The embodiments provided in this application receive a signature request sent by a signature requester, wherein the signature request carries first key derivation information, which is a derivation of a first security key; in response to the signature request, a first random number is generated, and a set of target microservices is selected from a microservice set, wherein the microservice set is a set of microservices registered through a microservice bus; the first key derivation information and the first random number are transmitted to the set of target microservices via the microservice bus, so that the set of target microservices can perform ring signature on the first key derivation information using the first random number and the ring signature private key of the set of target microservices; upon receiving the first signature information returned by the set of target microservices, a signature response message is sent to the signature requester, wherein the signature response message carries the first signature information and the first random number. By selecting the corresponding microservice to perform ring signature on the security key based on the random number in the signature, and due to the randomness of the randomly selected signer microservice and the anonymity of the signer in ring signatures, the effect of anonymous signing can be achieved, effectively protecting the identity security of the signer, solving the problem of high identity exposure risk in related technologies' security key processing methods, and effectively improving the security of signature information.

[0086] In an exemplary embodiment, the execution unit includes: a calculation module, configured to perform a hash operation on a first random number to obtain a first hash value; and a determination module, configured to determine a group of target microservices in a microservice set whose microservice identifiers match the first hash value, wherein the microservice identifier of each microservice in the microservice set is a hash value obtained by performing a hash operation on the ring signature public key of each microservice.

[0087] In an exemplary embodiment, the determining module includes one of the following: a first determining submodule, configured to determine the microservice in the microservice set whose microservice identifier is closest to the first hash value as a group of target microservices; and a second determining submodule, configured to determine the microservices in the microservice set whose microservice identifier is less than the first hash value as a group of target microservices.

[0088] In an exemplary embodiment, the transmission unit includes: a first transmission module, configured to transmit first key derivation information and a first random number via a microservice bus to the first target microservice in a set of target microservices when a set of target microservices contains multiple target microservices, so that each target microservice in the set of target microservices sequentially uses the first random number and the ring signature private key of each target microservice to ring sign the first key derivation information, wherein the first signature information includes the signature information obtained by each target microservice ring signing the first key derivation information.

[0089] In an exemplary embodiment, the transmission unit includes: a splitting unit, configured to split the first key derivation information into multiple sub-derivation information when a group of target microservices contains multiple target microservices, wherein each target microservice in the multiple target microservices corresponds one-to-one with the sub-derivation information in the multiple sub-derivation information; and a second transmission module, configured to transmit the sub-derivation information corresponding to each target microservice and the first random number to each target microservice via a microservice bus, so that each target microservice can perform a ring signature on the sub-derivation information corresponding to each target microservice using the first random number and the ring signature private key of each target microservice, wherein the first signature information includes the signature information obtained by each target microservice performing a ring signature on the sub-derivation information corresponding to each target microservice.

[0090] In one exemplary embodiment, the apparatus further includes: a second receiving unit, configured to receive the first random number and derivation information to be signed through each of the target microservices in the set of target microservices after transmitting the first key derivation information and the first random number to a set of target microservices via a microservice bus, wherein the derivation information to be signed is at least a portion of the information in the first key derivation information; and a signing unit, configured to perform ring signing on the derivation information to be signed using the first random number, the ring signing private key of each target microservice, and a ring signing public key list, to obtain target signature information, wherein the ring signing public key list includes the ring signing public keys of each microservice in the set of microservices, and the first signature information includes the target signature information.

[0091] In one exemplary embodiment, the apparatus further includes: a third receiving unit, configured to receive a signature verification request sent by a signature verification requester through a signature verification microservice, wherein the signature verification request carries a second random number and second signature information, the signature verification request being used to request verification of whether the second signature information is obtained by at least one microservice in the microservice set using the second random number to perform a ring signature on second key derivation information, the second key derivation information being derivation information of a second security key, and the signature verification microservice being a microservice providing ring signature verification services; a verification unit, configured to, in response to the signature verification request, perform signature verification on the second signature information using the second random number and a ring signature public key list through the signature verification microservice, and obtain a signature verification result, wherein the ring signature public key list includes the ring signature public keys of each microservice in the microservice set; and a second sending unit, configured to send a signature verification response message to the signature verification requester through the signature verification microservice, wherein the signature verification response message carries indication information of the signature verification result.

[0092] Embodiments of this application also provide a storage medium including a stored program, wherein the program executes any of the methods described above when it is run.

[0093] Optionally, in this embodiment, the storage medium may be configured to store program code for performing the following steps:

[0094] S1, receive a signature request sent by the signature requester, wherein the signature request carries first key derivation information, which is the derivation information of the first security key;

[0095] S2, in response to the signature request, generates a first random number and selects a set of target microservices from the microservice set, wherein the microservice set is a set of microservices registered through the microservice bus;

[0096] S3, the first key derivation information and the first random number are transmitted to a group of target microservices via the microservice bus, so that the group of target microservices can use the first random number and the ring signature private key of the group of target microservices to perform ring signature on the first key derivation information;

[0097] S4, upon receiving the first signature information returned by a set of target microservices, sends a signature response message to the signature requester, wherein the signature response message carries the first signature information and the first random number.

[0098] Embodiments of this application also provide an electronic device including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0099] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0100] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0101] S1, receive a signature request sent by the signature requester, wherein the signature request carries first key derivation information, which is the derivation information of the first security key;

[0102] S2, in response to the signature request, generates a first random number and selects a set of target microservices from the microservice set, wherein the microservice set is a set of microservices registered through the microservice bus;

[0103] S3, the first key derivation information and the first random number are transmitted to a group of target microservices via the microservice bus, so that the group of target microservices can use the first random number and the ring signature private key of the group of target microservices to perform ring signature on the first key derivation information;

[0104] S4, upon receiving the first signature information returned by a set of target microservices, sends a signature response message to the signature requester, wherein the signature response message carries the first signature information and the first random number.

[0105] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0106] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0107] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0108] Embodiments of this application also provide a computer program that includes computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps in any of the above method embodiments.

[0109] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.

[0110] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0111] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for processing a security key, characterized in that, include: Receive a signature request sent by a signature requester, wherein the signature request carries first key derivation information, which is derivation information of a first security key; In response to the signature request, a first random number is generated, and a set of target microservices is selected from the microservice set, wherein the microservice set is a set of microservices registered through the microservice bus; The first key derivation information and the first random number are transmitted to the group of target microservices via the microservice bus, so that the group of target microservices can use the first random number and the ring signature private key of the group of target microservices to perform ring signature on the first key derivation information; Upon receiving the first signature information returned by the group of target microservices, a signature response message is sent to the signature requester, wherein the signature response message carries the first signature information and the first random number.

2. The method according to claim 1, characterized in that, The step of selecting a set of target microservices from the microservice set includes: Perform a hash operation on the first random number to obtain the first hash value; The microservices whose microservice identifiers match the first hash value in the microservice set are identified as the target microservices. The microservice identifier of each microservice in the microservice set is the hash value obtained by hashing the ring signature public key of each microservice.

3. The method according to claim 2, characterized in that, The step of identifying the microservice whose microservice identifier matches the first hash value in the microservice set as the target group of microservices includes one of the following: The microservice whose microservice identifier is closest to the first hash value in the set of microservices is identified as the target set of microservices. The microservices in the set of microservices whose microservice identifiers are less than a preset distance threshold from the first hash value are identified as the target microservices.

4. The method according to claim 1, characterized in that, The step of transmitting the first key derivation information and the first random number to the group of target microservices via the microservice bus includes: When the set of target microservices contains multiple target microservices, the first key derivation information and the first random number are transmitted to the first target microservice in the set of target microservices via the microservice bus, so that each target microservice in the set of target microservices sequentially uses the first random number and the ring signature private key of each target microservice to ring sign the first key derivation information, wherein the first signature information includes the signature information obtained by each target microservice ring signing the first key derivation information.

5. The method according to claim 1, characterized in that, The step of transmitting the first key derivation information and the first random number to the group of target microservices via the microservice bus includes: When the set of target microservices contains multiple target microservices, the first key derivation information is split into multiple sub-derivation information, wherein the target microservices in the multiple target microservices correspond one-to-one with the sub-derivation information in the multiple sub-derivation information; The sub-derived information corresponding to each of the plurality of target microservices and the first random number are transmitted to each target microservice via the microservice bus, so that each target microservice can use the first random number and the ring signature private key of each target microservice to perform ring signature on the sub-derived information corresponding to each target microservice. The first signature information includes the signature information obtained by each target microservice performing ring signature on the sub-derived information corresponding to each target microservice.

6. The method according to any one of claims 1 to 5, characterized in that, After transmitting the first key derivation information and the first random number to the group of target microservices via the microservice bus, the method further includes: Each of the target microservices in the set of target microservices receives the first random number and the derivation information to be signed, wherein the derivation information to be signed is at least a portion of the information in the first key derivation information; The target signature information is obtained by ring signing the derived information to be signed using the first random number, the ring signature private key and the ring signature public key list of each target microservice. The ring signature public key list includes the ring signature public keys of each microservice in the microservice set, and the first signature information includes the target signature information.

7. The method according to any one of claims 1 to 5, characterized in that, The method further includes: The signature verification microservice receives a signature verification request sent by the signature verification requester. The signature verification request carries a second random number and second signature information. The signature verification request is used to request verification of whether the second signature information is obtained by at least one microservice in the microservice set using the second random number to perform a ring signature on the second key derivation information. The second key derivation information is the derivation information of the second security key. The signature verification microservice is a microservice that provides ring signature verification services. In response to the signature verification request, the signature verification microservice uses the second random number and the ring signature public key list to verify the second signature information and obtain a signature verification result. The ring signature public key list includes the ring signature public keys of each microservice in the microservice set. The signature verification microservice sends a signature verification response message to the signature verification requester, wherein the signature verification response message carries indication information of the signature verification result.

8. A security key processing device, characterized in that, include: The first receiving unit is used to receive a signature request sent by the signature requester, wherein the signature request carries first key derivation information, which is the derivation information of the first security key. An execution unit is configured to, in response to the signature request, generate a first random number and select a set of target microservices from the microservice set, wherein the microservice set is a set of microservices registered through the microservice bus; The transmission unit is used to transmit the first key derivation information and the first random number to the group of target microservices via the microservice bus, so that the group of target microservices can use the first random number and the ring signature private key of the group of target microservices to perform ring signature on the first key derivation information. The first sending unit is configured to send a signature response message to the signature requester upon receiving the first signature information returned by the group of target microservices, wherein the signature response message carries the first signature information and the first random number.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program, when executed, performs the method described in any one of claims 1 to 7.

10. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to execute the method described in any one of claims 1 to 7 through the computer program.

Images