Key management method, device, equipment, medium, product and chip

Abstract

The present disclosure relates to a key management method, device, equipment, medium, product and chip. The method comprises: an information management module determines first information; the first information is used to determine the related information of a target application program, and the related information of the same application program on different devices is the same; the information management module sends the first information to a key management module; the key management module is a hardware module; the key management module receives the first information, and obtains the related information of the target application program based on the first information; the key management module generates a second key corresponding to the target application program based on the related information of the target application program and a first key; the first key is pre-stored in the key management module, and the second key is used for encryption and decryption. The present disclosure can complete key generation and management based on the key management module of the hardware structure, and the key is not exposed in the software accessible memory, thereby avoiding the key leakage problem caused by software attacks, and greatly improving the security of key use.

Description

Technical Field

[0001] This disclosure relates to the field of key management technology, and in particular to a key management method, apparatus, device, medium, product and chip. Background Technology

[0002] With the rapid iteration and development of trusted computing technology, the Trusted Execution Environment (TEE) has been widely applied in various scenarios such as cloud computing, Internet of Things, and embedded terminals due to its security features of software and hardware isolation and trusted isolation operation, effectively solving security problems such as data being easily tampered with and privacy being easily leaked. Summary of the Invention

[0003] To overcome the problems existing in related technologies, this disclosure provides a key management method, apparatus, device, medium, product, and chip.

[0004] According to a first aspect of the present disclosure, a key management method is provided, comprising: The information management module determines the first information; the first information is used to determine the relevant information of the target application, and the relevant information of the same application on different devices is the same; The information management module sends the first information to the key management module; the key management module is a hardware module. The key management module receives the first information and, based on the first information, obtains relevant information about the target application. The key management module generates a second key corresponding to the target application based on the relevant information of the target application and the first key; the first key is pre-stored in the key management module, and the second key is used for encryption and decryption.

[0005] In this embodiment, a hardware-based key management module completes key generation and management. Keys are not exposed in software-accessible memory, thus avoiding key leakage due to software attacks and significantly improving key security. Furthermore, key management is implemented independently by a local hardware module, ensuring normal key generation and management even in network failures or service outages, effectively enhancing the availability and robustness of the solution. Moreover, the same application on different devices corresponds to the same relevant information, thus ensuring key consistency for the same application across devices without any key distribution protocol, supporting secure sharing of trusted data across devices.

[0006] In some embodiments, the key management module generates a second key corresponding to the target application based on relevant information of the target application and the first key, including: The key management module generates target data for the target application based on relevant information of the target application and a preset algorithm; the preset algorithm is used to determine digest data of relevant information of the application, and the digest data is data with a fixed space occupation. The key management module generates a second key corresponding to the target application based on the target data of the target application, the first key, and the key generation algorithm.

[0007] In this embodiment, a fixed-length digest data is generated using a preset algorithm and relevant information from the application. This standardizes the information format of the application's information, reduces the data volume, decreases the computational and storage overhead of the key generation process, and improves key generation efficiency. Furthermore, based on the target data of the target application, a second key corresponding to the target application is generated, which can achieve key isolation between keys corresponding to different applications, preventing other applications from obtaining the second key corresponding to the target application.

[0008] In some embodiments, the method further includes: The target application sends a second message to the information management module, the second message including the target application's pending data and processing type; the processing type is used to indicate encryption or decryption; The information management module receives the second information; The information management module sends the first information to the key management module, including: The information management module sends the first information and the second information to the key management module.

[0009] In this embodiment of the disclosure, the information management module can also receive the second information and send the first and second information to the key management module, thereby providing data basis for subsequent data processing.

[0010] In some embodiments, the target application sends second information to the information management module, including: The target application receives the second information and sends the second information to the information management module. The data to be processed by the target application is encrypted data, and the processing type is decryption; or, The target application determines the second information and sends the second information to the information management module. The data to be processed by the target application is data to be encrypted, and the processing type is encryption.

[0011] In this embodiment of the disclosure, the data source of the second information can be used to distinguish between encrypted and decrypted data and encryption / decryption types, thereby accurately matching the differentiated business needs of plaintext encryption and ciphertext decryption and improving the adaptability of the method.

[0012] In some embodiments, the data to be processed is data to be encrypted, and the target application sends second information to the information management module, including: In response to the sharing operation of the data to be processed, the target application sends the second information to the information management module.

[0013] In this embodiment of the disclosure, when the data to be processed is data to be encrypted, the target application sends the second information to the information management module in response to a sharing operation of the data to be processed. Thus, the target application only sends the second information to the information management module when an encryption requirement is triggered, thereby reducing and optimizing device resource consumption.

[0014] In some embodiments, the key management module receives the first information, including: The key management module receives the first information and the second information; The method further includes: The key management module processes the data to be processed based on the second key corresponding to the target application and the processing type to obtain the processed data. The key management module sends the processed data to the target application.

[0015] In this embodiment, the key management module can perform data processing, thus enabling the entire process of key generation and data encryption / decryption to be completed within the hardware module. All sensitive data operations and key calls are performed within the hardware security domain, completely eliminating the risk of software-layer key and plaintext data leakage. Furthermore, it can adaptively complete encryption or decryption operations according to the processing type, outputting processed data, simplifying the device data processing chain, and ensuring the security and reliability of the entire data encryption / decryption process.

[0016] In some embodiments, the processed data is encrypted data, and the method further includes: The target application shares the processed data with target applications on other devices outside the device where the key management module is located.

[0017] In this embodiment of the disclosure, encrypted data can be shared across devices, and since the encryption key is used in the hardware module, the data shared across devices is not easily tampered with or stolen, thereby enabling secure and reliable sharing of data across devices.

[0018] In some embodiments, the information management module determines the first information, including: The information management module determines the first information based on the application identifier of the target application and a preset mapping relationship. The first information includes the information address of the relevant information of the target application and the information size of the relevant information of the target application. The preset mapping relationship is used to characterize the association between the application identifier of the application, the information address of the relevant information of the application, and the information size of the relevant information of the application.

[0019] In this embodiment, the address and size of application information are quickly obtained by pre-setting a mapping relationship and matching based on the application identifier, thereby quickly and accurately determining the first information and simplifying the process of obtaining application identity information. Standardized mapping matching enables the standardized retrieval of application information, avoiding information acquisition errors and improving the accuracy and efficiency of key identity matching and key generation, thus adapting to the batch key management needs in multiple application scenarios.

[0020] In some embodiments, the relevant information for different applications is different, but the first key stored in the key management module of different devices is the same.

[0021] In this embodiment of the disclosure, the differences between different applications are restricted. The first key stored in the key management module of different devices is the same, which can ensure that the second key corresponding to the same application is the same, while the second keys corresponding to different applications are different. This enables key interoperability and key isolation between applications, and allows the same application on different devices to generate a consistent second key corresponding to the application. This achieves key interoperability and adaptation across devices and within the same application, while further protecting the security of the key.

[0022] According to a second aspect of the present disclosure, a key management apparatus is provided, comprising: The information management module is configured to determine first information; the first information is used to determine relevant information of the target application, and the relevant information of the same application on different devices is the same. The information management module is further configured to send the first information to the key management module; the key management module is a hardware module. The key management module is configured to receive the first information and, based on the first information, obtain relevant information about the target application. The key management module is further configured to generate a second key corresponding to the target application based on the relevant information of the target application and the first key; the first key is pre-stored in the key management module, and the second key is used for encryption and decryption.

[0023] In some embodiments, the key management module is configured to: Based on the relevant information of the target application and a preset algorithm, target data of the target application is generated; the preset algorithm is used to determine the summary data of the relevant information of the application, and the summary data is data with a fixed space occupation. Based on the target data of the target application, the first key, and the key generation algorithm, a second key corresponding to the target application is generated.

[0024] In some embodiments, the target application is configured to send second information to the information management module, the second information including the target application's pending data and processing type; the processing type is used to indicate encryption or decryption; The information management module is also configured as follows: Receive the second information; Send the first information and the second information to the key management module.

[0025] According to a third aspect of the present disclosure, an electronic device is provided, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to execute the key management method as described in the first aspect of this disclosure.

[0026] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium is provided, wherein when instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the key management method as described in the first aspect of the present disclosure.

[0027] According to a fifth aspect of the present disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the key management method as described in the first aspect of the present disclosure.

[0028] According to a sixth aspect of the present disclosure, a chip is provided, the chip being configured to perform the key management method as described in the first aspect of the present disclosure.

[0029] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0030] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0031] Figure 1This is a flowchart illustrating a key management method according to an exemplary embodiment.

[0032] Figure 2 This is a flowchart illustrating a key management method according to an exemplary embodiment.

[0033] Figure 3 This is a flowchart illustrating a key management method according to an exemplary embodiment.

[0034] Figure 4 This is a block diagram illustrating a key management device according to an exemplary embodiment.

[0035] Figure 5 This is a block diagram of an electronic device according to an exemplary embodiment. Detailed Implementation

[0036] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0037] The key management method provided in this disclosure is applied to data sharing scenarios between a TEE (Technical Equipment Environment) and cross-device TEE applications. It is executed by an electronic device, which can specifically be a mobile phone, tablet, laptop, smart robot, smart wearable device, or other smart device. The TEE provides a secure, hardware-isolated runtime space for applications. The code logic and order of applications running within the TEE are protected at the hardware level. The same application can be deployed on multiple devices, enabling data sharing between different devices. For example, if a mobile phone and a laptop have the same payment application installed, when a payment transaction is initiated on the laptop, the payment transaction data can be shared with the mobile phone, allowing the payment to be completed on the mobile phone. Similarly, if a mobile phone and a tablet have the same image viewing application installed, images from the tablet can be shared to the mobile phone. Likewise, if a mobile phone and a smartwatch have the same fitness application installed, fitness data from the smartwatch can be shared to the mobile phone to synchronize data and facilitate user viewing.

[0038] In one embodiment, the data sharing scenario for cross-device TEE applications can include the data sharing scenario for TEE applications of distributed computing clusters (a set of servers working collaboratively formed by networking multiple independent physical servers), the data sharing scenario for TEE applications of IoT devices, and the data sharing scenario for TEE applications of edge computing nodes.

[0039] In one example, within a distributed computing cluster, multiple physical servers each run a Trusted Execution Environment (TEE), and the same applications (such as distributed database engines, privacy computing frameworks, etc.) are deployed within these environments. These TEE applications can achieve cross-device data sharing. For instance, after the encrypted data of the TEE application on physical server a is stored in a shared storage system, the same TEE application on physical server b can read and decrypt the encrypted data.

[0040] In one example, in an IoT scenario, multiple embedded devices (such as smart sensors and security gateways) are equipped with TEE functionality. Devices of the same type can run the same TEE application and achieve data sharing between devices. For instance, multiple sensor nodes in an industrial control network can share monitoring data.

[0041] In one example, in an edge computing scenario, edge nodes distributed in different geographical locations can run the same TEE application and achieve data sharing between nodes.

[0042] The key management method provided in this disclosure involves an electronic device with an application program installed, a chip mounted on the chip, and hardware resources such as a key management module and software resources such as an information management module. The key management module generates and manages keys, the application program can be a trusted application running within a TEE (Trusted Application Environment), and the information management module can be the TEE kernel, acting as a relay module between the key management module and the application program.

[0043] Figure 1 This is a flowchart illustrating a key management method according to an exemplary embodiment, executed by an electronic device, see [link to flowchart]. Figure 1 The method includes the following steps: Step S101: The information management module determines the first information.

[0044] The first piece of information is used to determine the relevant information of the target application. The target application can be any application on an electronic device. The relevant information of the same application on different devices is the same, and the relevant information of different applications is different.

[0045] In some embodiments, the relevant information of the target application may include the code information of the target application, which may refer to the source code of the target application. The first information may include the size and address of the code information of the target application. Since the source code of different applications is different, the code information of different applications is also different; however, the source code of the same application is the same on different devices, therefore, the code information of the same application is the same on different devices.

[0046] In some embodiments, the relevant information of the target application may include the application identifier of the target application, and the first information may include the attribute information of the target application, which may include the application identifier of the target application. It should be noted that the application identifier is used to distinguish applications; different applications have different application identifiers, and the application identifier is unique.

[0047] In some embodiments, the information management module can serve as an information relay module between the target application and the key management module. During key management, the target application can initiate a data encryption / decryption request and send it to the information management module. The data encryption / decryption request includes a data encryption request or a data decryption request. The data encryption request is used to encrypt relevant data of the application, and the data decryption request is used to decrypt the received encrypted relevant data of the application.

[0048] In some embodiments, a data encryption / decryption request may include data to be processed and a processing type. The data to be processed refers to data to be encrypted or decrypted, which is business data and / or operational data of the target application. The processing type includes decryption or encryption. Based on the processing type, the data encryption / decryption request can be determined to be either a data decryption request or a data encryption request.

[0049] Optionally, when the target application's related information is the target application's code information, the first information may include the information address and the information size of the target application's related information. Before receiving a data encryption / decryption request, the information management module can obtain the application identifier of the target application initiating the data encryption / decryption request, and determine the first information based on the target application's application identifier and a preset mapping relationship. Here, the information address may refer to the memory address of the target application's related information, the information size may refer to the memory space occupied by the target application's related information, and the preset mapping relationship is used to characterize the association between the application identifier, the information address of the application's related information, and the information size of the application's related information.

[0050] In other words, the target application can determine the address and size of the target application's code information based on the target application's application identifier.

[0051] Optionally, when the relevant information of the target application is the application identifier of the target application, the first information can be the attribute information of the target application, and the information management module can obtain the attribute information of the target application.

[0052] In step S102, the information management module sends the first information to the key management module.

[0053] The key management module is a hardware module, which can be integrated into a dedicated hardware security module within the chip of an electronic device. That is, the key management module is not controlled by software, and the keys within the key management module do not appear in the software-accessible memory space, thus ensuring key security.

[0054] In some embodiments, the target application sends second information to the information management module, the information management module receives the second information, and the information management module may send first information and second information to the key management module. The second information refers to the information included in the encryption / decryption request, that is, the second information includes the target application's pending data and processing type.

[0055] In some embodiments, the information management module may send the first information and the second information to the key management module simultaneously, or the information management module may send the first information and the second information to the key management module sequentially, and the order of sending is not limited here.

[0056] Additionally, it should be noted that the target application can receive the second information and send it to the information management module; or, the target application can determine the second information and send it to the information management module. In some embodiments, if the target application receives the second information, then the target application is the application that initiates decryption, indicating that the data to be processed is encrypted at this time. Accordingly, the electronic device needs to decrypt the data to be processed, and the processing type is decryption. Similarly, if the target application determines the second information, then the target application is the application that initiates encryption, indicating that the data to be processed is data to be encrypted at this time. Accordingly, the electronic device needs to encrypt the data to be processed, and the processing type can be encryption.

[0057] In some embodiments, when the target application is the application initiating encryption and the data to be processed is data to be encrypted, the target application may send second information to the information management module in response to the sharing operation of the data to be processed. In some embodiments, the sharing operation of the data to be processed may include a click operation on a preset control, and the preset control is different in different use cases. For example, in the scenario of payment data sharing, the preset control may be a "Pay on mobile device" button; in the scenario of sports data sharing, the preset control may be a "Data sharing" button; and in the scenario of image sharing, the preset control may be an "Image sharing" button.

[0058] In step S103, the key management module receives the first information and, based on the first information, obtains relevant information about the target application.

[0059] In some embodiments, when the first information includes the address and size of the target application's related information, the key management module can read the target application's related information, i.e., the target application's code information, based on the address and size of the target application's related information. In one example, the key management module can use the address of the target application's related information as the starting position to read the size of the target application's related information, thereby obtaining the target application's related information.

[0060] In some embodiments, the target application's code information is stored in memory. The key management module can read the target application's relevant information from memory using Direct Memory Access (DMA) based on the address and size of the target application's relevant information. This allows the key management module to directly read the target application's relevant information from memory, thereby improving the accuracy of the read information and consequently enhancing the accuracy of the generated second key.

[0061] In some embodiments, when the first information includes the attribute information of the target application, the key management module can obtain relevant information about the target application from the attribute information, namely the application identifier of the target application.

[0062] In some embodiments, the key management module may also receive second information sent by the information management module.

[0063] In step S104, the key management module generates a second key corresponding to the target application based on the relevant information of the target application and the first key.

[0064] The first key is pre-stored in the key management module. This first key can be a root key or a random number with a fixed space requirement. Furthermore, the first key stored in the key management modules of different devices is the same. The second key is used for encryption and decryption.

[0065] It should be noted that the second key corresponds to an application. Since the relevant information for the same application is the same on different devices, and the first key stored in the key management modules of different devices is the same, the second key corresponding to the same application on different devices is the same, thus enabling cross-device key interoperability. Conversely, since the relevant information for different applications is different, the second key corresponding to different applications is different, thus enabling key isolation; other applications cannot obtain the second key corresponding to the target application.

[0066] In some embodiments, a first key can be pre-programmed into the key management module during the manufacturing stage of the electronic device. In one example, the first key can be pre-programmed into a One-Time Programmable (OTP) memory within the key management module. This first key in the OTP is unmodifiable and cannot be read by software. Thus, only the first key needs to be programmed during the manufacturing stage; no additional components, lists, or processes need to be deployed during runtime, reducing the complexity of key management.

[0067] Optionally, the key management module can restrict multiple devices that have the same first key to be stored. For example, devices in the same series can store the same first key; devices in a later series can store the same first key.

[0068] In some embodiments, the key management module can generate target data for the target application based on relevant information of the target application and a preset algorithm. The key management module can also generate a second key corresponding to the target application based on the target data, a first key, and a key generation algorithm. The preset algorithm is used to determine the digest data of relevant information of the application. The digest data is data with a fixed space occupancy. The target data of the target application can refer to the digest data of relevant information of the target application. The target data of the target application can be data with a fixed space occupancy of the target application.

[0069] In some embodiments, the space occupied by the target application's target data is less than the space occupied by the target application's related information. It should be noted that the target application's related information may have a large space footprint. For example, if the target application's related information is its code information, using such a large amount of space-consuming information in the key generation process could lead to a high computational load, severely consuming the electronic device's computing resources, and potentially causing the device to freeze or crash. Therefore, the key management module can obtain the target application's target data with a fixed and smaller space footprint based on the target application's related information and a preset algorithm.

[0070] In some embodiments, the preset algorithm may include a Secure Hash Algorithm (SHA) 256-bit. SHA256 can be a hash digest algorithm that calculates and outputs the hash value of the current input data. The hash value occupies 256 bits of space. Correspondingly, relevant information of the target application can be input into SHA256, and the target data of the target application in size of 256 bits will be output.

[0071] It should be noted that the summary data of relevant information differs across applications, and the summary data also changes when the relevant information of an application changes. Therefore, a unique summary data corresponding to the relevant information of an application can be determined based on that information. Consequently, since the relevant information differs across applications, the target data for each application also differs.

[0072] In some embodiments, when the relevant information of the target application is the code information of the target application, the target data can represent the code fingerprint of the code information of the target application. In one example, the code fingerprint can be determined using the following formula: code_fingerprint=SHA256(code_data) Here, code_fingerprint represents the code fingerprint of the target application's code information, SHA256 represents the 256-bit secure hash algorithm, and code_data represents the code information of the target application.

[0073] In some embodiments, the key management module is equipped with a first engine containing a preset algorithm, which can generate target data for the target application based on relevant information of the target application.

[0074] In some embodiments, the key generation algorithm may include a Key Derivation Function (KDF). Accordingly, the target data of the target application and a first key can be input into the key generation algorithm, which can then generate a second key corresponding to the application. Thus, by using the key generation algorithm, the root key is not directly used, protecting it from leakage and ensuring its security.

[0075] In some embodiments, the second key can be determined using the following formula: K_app=KDF(RK, code_fingerprint) Where K_app represents the second key, KDF represents the key derivation algorithm, RK represents the root key, and code_fingerprint represents the code fingerprint of the target application's code information.

[0076] In some embodiments, the key management module is provided with a second engine for a key generation algorithm. The second engine can generate a second key corresponding to the target application based on the target data of the target application and the first key.

[0077] In some embodiments, after the key management module generates a second key corresponding to the target application, it can process the data to be processed based on the second key and the processing type corresponding to the target application, obtain processed data, and send the processed data to the target application. Optionally, the type of data to be processed and the processing type can be determined based on the method by which the target application receives / determines the second information, which will not be elaborated further here.

[0078] In one example, if the data to be processed is encrypted and the processing type is decryption, the key management module can decrypt the data to be processed based on the second key corresponding to the target application to obtain the processed data (original data) and send the processed data to the target application. In another example, if the data to be processed is encrypted and the processing type is encryption, the key management module can encrypt the data to be processed based on the second key corresponding to the target application to obtain the processed data (encrypted data).

[0079] It should be noted that the data to be processed uses a symmetric encryption algorithm. Symmetric encryption algorithms use the same key for both encryption and decryption, meaning the encryption and decryption keys are identical. The key management module also includes a third engine for encryption and decryption, which can encrypt or decrypt the data to be processed.

[0080] In some embodiments, the key management module may send processed data to the target application.

[0081] In some embodiments, when processing encrypted data, the target application shares the processed data with target applications on other devices besides the device where the key management module resides, thereby achieving cross-device data sharing and ensuring data security by sharing encrypted data. Optionally, the target application can send the processed data to an external storage area, from which target applications on other devices can retrieve the processed data. The external storage area may include a database, a distributed file system, the cloud, etc., to achieve data sharing. Optionally, the target application can directly send the processed data to target applications on other devices.

[0082] With the rapid iteration and development of trusted computing technology, TEE (Trusted Execution Environment) has been widely applied in various scenarios such as cloud computing, IoT, and embedded terminals due to its security features of hardware and software isolation and trusted isolation operation. It effectively solves security problems such as data tampering and privacy leakage. When the same TEE application is deployed on multiple devices, key management can be a key part to ensure the successful encryption and decryption and secure sharing of TEE application data. The security, availability, and reliability of this part directly affect the overall protection capability of the data interaction system of cross-device TEE applications.

[0083] Key management schemes in related technologies include the following two types: two devices negotiate a shared key through a key exchange protocol, or a centralized Key Management Service (KMS) manages the key. A trusted Key Management Service (tKMS) agent can request keys from the centralized KMS, the centralized KMS can distribute keys to the tKMS agent, and the tKMS agent can send the keys to the corresponding devices. However, the key management schemes provided by related technologies have the following problems: First, centralized KMS key management solutions heavily rely on network connectivity and cloud service nodes. Application operations such as key acquisition, updating, and revocation all require interaction between the tKMS proxy and the centralized KMS. In the event of network failures, link anomalies, KMS node downtime, or service disruptions, applications not only cannot obtain the necessary business keys, but online applications that have successfully acquired keys also cannot complete key iteration updates and expiration revocation operations. This can easily lead to terminal service interruptions, resulting in serious network dependency risks and single points of failure for the overall solution, and poor availability and robustness of terminal key management.

[0084] Second, the key management schemes in related technologies all implement key invocation and use at the software level. The keys are temporarily stored and executed in plaintext in the software-accessible memory space of the terminal device. Attackers can steal the plaintext keys in memory through software-level attack methods such as memory scanning, process injection, and system vulnerability exploitation, leading to the leakage of core encryption keys. This directly undermines the terminal's data encryption system and the trusted operation mechanism of applications, posing an extremely high risk of key leakage and weakening the overall security protection capabilities of the terminal.

[0085] Third, in the key management scheme of related technologies, all applications share a common tKMS agent. This agent can obtain the keys corresponding to all applications. If the agent is attacked or has logical vulnerabilities, the keys corresponding to all applications are at risk of being leaked.

[0086] Fourth, it requires the deployment of a three-tier service component consisting of centralized KMS, tKMS, and application layers, resulting in high operation and maintenance costs.

[0087] The method provided in this disclosure uses a hardware-based key management module to generate and manage keys. Keys are not exposed in software-accessible memory, thus avoiding key leakage caused by software attacks and significantly improving key security. Furthermore, key management is implemented independently by a local hardware module, eliminating reliance on centralized KMS and network transmission. Key generation and management can continue even in network failures or service outages, effectively enhancing the availability and robustness of the solution. Moreover, the same application on different devices corresponds to the same information, ensuring key consistency for the same application across devices without any key distribution protocol, supporting secure sharing of trusted data across devices.

[0088] Furthermore, in the method provided in this disclosure, different applications have different related information, while the first key stored in the key management modules of different devices is the same. Therefore, the second key corresponding to different applications is different, and there is a key isolation mechanism between applications, preventing other applications from obtaining the second key corresponding to the target application. Moreover, the method provided in this disclosure does not require the deployment of the three-tier service components described above, resulting in lower operation and maintenance costs and simpler operation.

[0089] In some embodiments, the following is by Figure 2 and Figure 3 The illustrated embodiment explains the process of cross-device data interaction.

[0090] Figure 2 and Figure 3 These are flowcharts illustrating a key management method according to an exemplary embodiment, executed by electronic device A and electronic device B.

[0091] like Figure 2As shown, for electronic device A, the method includes the following steps: The target application X on electronic device A sends an encryption request to the information management module. The encryption request includes the data to be processed and the processing type, which is encryption.

[0092] The information management module on electronic device A determines the information address and the information size of the code information of the target application X based on the application identifier of the target application X.

[0093] The information management module on electronic device A sends the data to be processed, the processing type, the address of the code information of the target application X, and the size of the code information of the target application X to the key management module.

[0094] The key management module on electronic device A reads the code information of target application X based on the information address and the information size of the code information of target application X.

[0095] The key management module on electronic device A determines the target data based on the code information of the target application X.

[0096] The key management module on electronic device A generates a second key corresponding to the target application X based on the target data and the first key.

[0097] The key management module on electronic device A encrypts the data to be processed based on the second key corresponding to the target application X, and obtains the encrypted data.

[0098] The key management module on electronic device A sends encrypted data to target application X.

[0099] The target application X on electronic device A sends encrypted data to an external storage area.

[0100] like Figure 3 As shown, for electronic device B, the method includes the following steps: A target application X is launched on electronic device B. The target application X on electronic device B retrieves encrypted data sent by the target application X on electronic device A from the external storage area.

[0101] The target application X on electronic device B sends a decryption request to the information management module. The decryption request includes the encrypted data and the processing type, which is decryption.

[0102] The information management module on electronic device B determines the information address and the information size of the code information of the target application X based on the application identifier of the target application X.

[0103] The information management module on electronic device B sends the data to be processed, the processing type, the address of the code information of the target application X, and the size of the code information of the target application X to the key management module.

[0104] The key management module on electronic device B reads the code information of target application X based on the information address and the information size of the code information of target application X.

[0105] The key management module on electronic device B determines the target data based on the code information of the target application X.

[0106] The key management module on electronic device B generates a second key corresponding to the target application X based on the target data and the first key.

[0107] The key management module on electronic device B decrypts the encrypted data based on the second key corresponding to the target application X to obtain the data to be processed.

[0108] Through the above Figure 2 and Figure 3 The given example shows that electronic device A is the initiator of data sharing, and electronic device B is the receiver. Electronic device A can determine a second key for encryption and encrypt the data to be processed based on this second key, obtaining the encrypted data. Similarly, electronic device B can determine a second key for decryption, and this decryption key is the same as the encryption key. It then decrypts the encrypted data based on this second key, obtaining the data to be processed. Thus, without a centralized KMS, electronic devices A and B can determine the encryption and decryption keys and achieve data sharing between them.

[0109] Figure 4 This is a block diagram illustrating a key management device according to an exemplary embodiment, configured in an electronic device, see [link to relevant documentation]. Figure 4 The device includes: The information management module 401 is configured to determine first information; the first information is used to determine the relevant information of the target application, and the relevant information of the same application on different devices is the same. The information management module 401 is also configured to send first information to the key management module 402; the key management module 402 is a hardware module. The key management module 402 is configured to receive first information and, based on the first information, obtain relevant information about the target application. The key management module 402 is also configured to generate a second key corresponding to the target application based on the relevant information of the target application and the first key; the first key is pre-stored in the key management module 402, and the second key is used for encryption and decryption.

[0110] In some embodiments, the key management module 402 is configured as follows: Based on the relevant information of the target application and the preset algorithm, target data of the target application is generated; the preset algorithm is used to determine the summary data of the relevant information of the application, and the summary data is data with a fixed space occupation. Based on the target application's target data, the first key, and the key generation algorithm, a second key corresponding to the target application is generated.

[0111] In some embodiments, the target application is configured to send second information to the information management module 401, the second information including the target application's pending data and processing type; the processing type is used to indicate encryption or decryption. Information management module 401 is also configured as follows: Receive the second message; Send the first and second information to the key management module 402.

[0112] In some embodiments, the target application is configured as follows: The second message is received and sent to the information management module 401. The data to be processed by the target application is encrypted data, and the processing type is decryption; or, The second information is determined and sent to the information management module 401. The data to be processed by the target application is the data to be encrypted, and the processing type is encryption.

[0113] In some embodiments, the data to be processed is data to be encrypted, and the target application is configured as follows: In response to the sharing operation of the data to be processed, a second message is sent to the information management module 401.

[0114] In some embodiments, the key management module 402 is configured as follows: Receive the first and second information; The key management module 402 is also configured as follows: Based on the second key and processing type corresponding to the target application, the data to be processed is processed to obtain the processed data; Send processed data to the target application.

[0115] In some embodiments, the processed data is encrypted, and the target application is further configured to: Share processed data with target applications in devices other than the device where the key management module 402 is located.

[0116] In some embodiments, the information management module 401 is configured as follows: Based on the application identifier of the target application and the preset mapping relationship, the first information is determined; the first information includes the information address of the relevant information of the target application and the information size of the relevant information of the target application, and the preset mapping relationship is used to characterize the association between the application identifier of the application, the information address of the relevant information of the application and the information size of the relevant information of the application.

[0117] In some embodiments, the relevant information of different applications is different, but the first key stored in the key management module 402 of different devices is the same.

[0118] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0119] This disclosure also provides an electronic device, including: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the key management method in the above embodiments.

[0120] Figure 5 This is a block diagram of an electronic device 500 according to an exemplary embodiment.

[0121] Reference Figure 5 The electronic device 500 may include one or more of the following components: processing component 502, memory 504, power supply component 506, multimedia component 508, audio component 510, input / output (I / O) interface 512, sensor component 514, and communication component 516.

[0122] Processing component 502 typically controls the overall operation of electronic device 500, such as operations associated with display, telephone calls, data communication, camera operation, and recording. Processing component 502 may include one or more processors 520 to execute instructions to perform all or part of the steps of the methods described above. Furthermore, processing component 502 may include one or more modules to facilitate interaction between processing component 502 and other components. For example, processing component 502 may include a multimedia module to facilitate interaction between multimedia component 508 and processing component 502.

[0123] Memory 504 is configured to store various types of data to support the operation of electronic device 500. Examples of this data include instructions for any application or method operating on electronic device 500, contact data, phonebook data, messages, pictures, videos, etc. Memory 504 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0124] Power supply component 506 provides power to various components of electronic device 500. Power supply component 506 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to electronic device 500.

[0125] Multimedia component 508 includes a screen that provides an output interface between the electronic device 500 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 508 includes a front-facing camera and / or a rear-facing camera. When the electronic device 500 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0126] Audio component 510 is configured to output and / or input audio signals. For example, audio component 510 includes a microphone (MIC) configured to receive external audio signals when electronic device 500 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 504 or transmitted via communication component 516. In some embodiments, audio component 510 also includes a speaker for outputting audio signals.

[0127] I / O interface 512 provides an interface between processing component 502 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, start buttons, and lock buttons.

[0128] Sensor assembly 514 includes one or more sensors for providing state assessments of various aspects of electronic device 500. For example, sensor assembly 514 may detect the on / off state of electronic device 500, the relative positioning of components such as the display and keypad of electronic device 500, changes in position of electronic device 500 or a component of electronic device 500, the presence or absence of user contact with electronic device 500, orientation or acceleration / deceleration of electronic device 500, and temperature changes of electronic device 500. Sensor assembly 514 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 514 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 514 may also include an accelerometer, gyroscope, magnetometer, pressure sensor, or temperature sensor.

[0129] Communication component 516 is configured to facilitate wired or wireless communication between electronic device 500 and other devices. Electronic device 500 can access wireless networks based on communication standards, such as WiFi, 2G, or 3G, or combinations thereof. In one exemplary embodiment, communication component 516 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 516 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0130] In an exemplary embodiment, the electronic device 500 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0131] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 504 including instructions, which can be executed by a processor 520 of an electronic device 500 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0132] A non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to perform the key management method provided in exemplary embodiments of this disclosure.

[0133] This disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the key management method described in the above embodiments.

[0134] This disclosure also provides a chip configured to perform the key management method described in the above embodiments.

[0135] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0136] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this disclosure. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0137] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this disclosure, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0138] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0139] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

[0140] The examples in this document may involve user data, data acquisition, and / or use. All of these aspects comply with relevant laws, regulations, and rules. In the examples, all data collection, acquisition, processing, manipulation, forwarding, and use are conducted with the user's knowledge and confirmation. Accordingly, when implementing each example, the type, scope of use, and usage scenarios of any data or information that may be involved should be communicated to the user and their authorization obtained through appropriate means, in accordance with relevant laws and regulations. The specific methods of notification and / or authorization can vary depending on the actual situation and application scenario; the scope of the solution is not limited in this regard.

[0141] In this manual and the sample solutions, any processing of personal information will be conducted only under legal grounds (such as obtaining the consent of the data subject or being necessary for the performance of a contract) and will only be carried out within the scope stipulated or agreed upon. A user's refusal to process personal information beyond what is necessary for basic functions will not affect the user's use of basic functions.

Claims

1. A key management method, characterized in that, include: The information management module determines the first piece of information; The first information is used to determine the relevant information of the target application, and the relevant information of the same application is the same on different devices; The information management module sends the first information to the key management module; the key management module is a hardware module. The key management module receives the first information and, based on the first information, obtains relevant information about the target application. The key management module generates a second key corresponding to the target application based on the relevant information of the target application and the first key; The first key is pre-stored in the key management module, and the second key is used for encryption and decryption.

2. The key management method according to claim 1, characterized in that, The key management module generates a second key corresponding to the target application based on the relevant information of the target application and the first key, including: The key management module generates target data for the target application based on relevant information of the target application and a preset algorithm; the preset algorithm is used to determine digest data of relevant information of the application, and the digest data is data with a fixed space occupation. The key management module generates a second key corresponding to the target application based on the target data of the target application, the first key, and the key generation algorithm.

3. The key management method according to claim 1, characterized in that, The method further includes: The target application sends a second message to the information management module, the second message including the target application's pending data and processing type; the processing type is used to indicate encryption or decryption; The information management module receives the second information; The information management module sends the first information to the key management module, including: The information management module sends the first information and the second information to the key management module.

4. The key management method according to claim 3, characterized in that, The target application sends a second message to the information management module, including: The target application receives the second information and sends the second information to the information management module. The data to be processed by the target application is encrypted data, and the processing type is decryption; or, The target application determines the second information and sends the second information to the information management module. The data to be processed by the target application is data to be encrypted, and the processing type is encryption.

5. The key management method according to claim 3, characterized in that, The data to be processed is data to be encrypted. The target application sends second information to the information management module, including: In response to the sharing operation of the data to be processed, the target application sends the second information to the information management module.

6. The key management method according to claim 3, characterized in that, The key management module receives the first information, including: The key management module receives the first information and the second information; The method further includes: The key management module processes the data to be processed based on the second key corresponding to the target application and the processing type to obtain the processed data. The key management module sends the processed data to the target application.

7. The key management method according to claim 6, characterized in that, The processed data is encrypted data, and the method further includes: The target application shares the processed data with target applications on other devices outside the device where the key management module is located.

8. The key management method according to claim 1, characterized in that, The information management module determines the first information, including: The information management module determines the first information based on the application identifier of the target application and a preset mapping relationship. The first information includes the information address of the relevant information of the target application and the information size of the relevant information of the target application. The preset mapping relationship is used to characterize the association between the application identifier of the application, the information address of the relevant information of the application, and the information size of the relevant information of the application.

9. The key management method according to claim 1, characterized in that, The relevant information differs across applications, but the first key stored in the key management module of different devices is the same.

10. A key management device, characterized in that, include: The information management module is configured to determine the first piece of information; The first information is used to determine the relevant information of the target application, and the relevant information of the same application is the same on different devices; The information management module is further configured to send the first information to the key management module; the key management module is a hardware module. The key management module is configured to receive the first information and, based on the first information, obtain relevant information about the target application. The key management module is further configured to generate a second key corresponding to the target application based on the relevant information of the target application and the first key; the first key is pre-stored in the key management module, and the second key is used for encryption and decryption.

11. The key management device according to claim 10, characterized in that, The key management module is configured as follows: Based on the relevant information of the target application and a preset algorithm, target data of the target application is generated; the preset algorithm is used to determine the summary data of the relevant information of the application, and the summary data is data with a fixed space occupation. Based on the target data of the target application, the first key, and the key generation algorithm, a second key corresponding to the target application is generated.

12. The key management device according to claim 10, characterized in that, The target application is configured to send a second message to the information management module, the second message including the target application's pending data and processing type; the processing type is used to indicate encryption or decryption. The information management module is also configured as follows: Receive the second information; Send the first information and the second information to the key management module.

13. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to perform the key management method as described in any one of claims 1-9.

14. A non-transitory computer-readable storage medium, characterized in that, When the instructions in the storage medium are executed by the processor of the electronic device, the electronic device is able to perform the key management method as described in any one of claims 1-9.

15. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the key management method as described in any one of claims 1-9.

16. A chip, characterized in that, The chip is configured to perform the key management method as described in any one of claims 1-9.

Images