Key management method, apparatus, and system, device, and storage medium

Abstract

The present application discloses a key management method, apparatus, and system, a device, and a storage medium. The method is applied to a network-side device. The method comprises: acquiring a key acquisition request sent by a terminal device; performing security verification on the key acquisition request; in response to the key acquisition request passing the security verification, updating a login key of a first device to a first key; and sending the first key to the terminal device. By means of the technical solution of the present application, different users can each use a different key to control the same device, so that key leakage is effectively prevented, thereby achieving high-security key authorization management.

Description

Key management method, device, system, equipment and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the China Patent Office on September 13, 2023, with application number 202311185647.1 and application name “Key management method, device, system, equipment and storage medium”, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of data security technology, and in particular to a key management method, apparatus, system, device and storage medium. Background Art

[0004] Related technologies typically use solutions such as multi-factor authentication, single sign-on, and unified identity management to centrally manage keys. However, these solutions require complex auditing rules and user identity information protection rules to ensure system reliability and security, and they can lead to key leaks in the event of an attack.

[0005] Summary of the Invention

[0006] To at least partially resolve the problems existing in the related art, the present application provides a key management method, apparatus, system, device and storage medium.

[0007] In a first aspect, an embodiment of the present application provides a key management method, which is applied to a network side device, and the method includes: obtaining a key acquisition request sent by a terminal device; performing a security verification on the key acquisition request; in response to the key acquisition request passing the security verification, updating the login key of the first device to a first key; and sending the first key to the terminal device.

[0008] In one implementation, updating the login key of the first device to the first key includes: generating the first key; creating a container instance; modifying the login key of the first device to the first key based on the container instance; and destroying the container instance.

[0009] In an optional implementation, generating the first key includes: obtaining a random number seed and a preset second key; encrypting the second key based on the random number seed to obtain an encryption result; and obtaining a message digest of the encryption result as the first key.

[0010] In one implementation, sending the first key to the terminal device includes: encrypting the first key based on a national encryption algorithm; and sending the encrypted first key to the terminal device based on a must-reach message.

[0011] In an optional implementation, the method further includes: determining whether the first key has been used to log in to the first device; and in response to the first key having been used to log in to the first device, updating the login key of the first device to a third key.

[0012] In an optional implementation, the method further includes: obtaining key application information sent by the terminal device; performing risk control analysis based on the key application information to obtain a risk control analysis result; generating a key acquisition link in response to the risk control analysis result being normal; and sending the key acquisition link to the terminal device; wherein, obtaining the key acquisition request sent by the terminal device includes: obtaining the key acquisition request sent by the terminal device through the key acquisition link.

[0013] Optionally, the key application information includes at least one of the following: first identification information of a first object; wherein, the first object is the object that submits the key application information through the terminal device; identification information of the first device; the first login account of the first device; the start time of control of the first device; and the duration of control of the first device.

[0014] Optionally, determining whether the first key has been used to log in to the first device includes: obtaining a second login account sent by the first device; and determining whether the first key has been used to log in to the first device based on the first login account and the second login account.

[0015] Optionally, the risk control analysis based on the key application information includes: determining the first device information and controllable time period of the first device based on the identification information; determining whether the first object has the right to apply for a key based on the first identification information and the control duration; in response to the first object having the right to apply for a key, determining the applicable operation duration of the first object and the second device information of the device for which the first object can apply to operate based on the first identification information; performing risk control analysis based on the control start time, the controllable time period, the applicable operation duration, the first device information and the second device information.

[0016] Optionally, determining the applicable operation duration of the first object and the second device information of the device for which the first object can apply for operation based on the first identification information includes: determining the association information of the first object based on the first identification information; determining a weight value based on the association information; determining the target object level of the first object from a plurality of preset object levels based on the weight value; wherein each object level corresponds to a different applicable operation duration and applicable operation device; and determining the applicable operation duration and the second device information based on the target object level.

[0017] Optionally, the associated information includes at least one of the following: working years of the first object; associated project information of the first object; project reuse information of the first object; own attribute information of the first object; abnormal operation information of the first object.

[0018] Optionally, generating a key acquisition link includes: generating a first link; wherein the first link corresponds to a key acquisition entry; generating an encryption identifier based on the key application information; attaching the encryption identifier to the first link to obtain the key acquisition link; and sending the key acquisition link to the terminal device.

[0019] Optionally, the key acquisition request includes a digital signature encrypted using a preset public key, the encryption identifier, and at least one of the second identification information of the terminal device. The security verification of the key acquisition request includes: performing identity authentication based on the second identification information of the terminal device; in response to the identity authentication being passed, determining whether the sending time of the key acquisition request is within a preset validity period; in response to the sending time of the key acquisition request being within the validity period, decrypting the encrypted digital signature based on a preset private key to obtain a first hash value; performing hash calculation based on the encryption identifier to obtain a second hash value; matching the first hash value and the second hash value to obtain a matching result; and in response to the matching result satisfying the first condition, determining that the security verification is passed.

[0020] In the second aspect, an embodiment of the present application provides a key management method, which is applied to a terminal device, and the method includes: sending a key acquisition request to a network side device; wherein, the key acquisition request is used by the network side device to update the login key of the first device to a first key after passing the security verification; and receiving the first key sent by the network side device.

[0021] In one implementation, the method further includes: sending key application information to the network side device; wherein the key application information is used by the network side device to send the key acquisition link to the terminal device after the risk control analysis is passed; receiving the key acquisition link sent by the network side device; wherein the key acquisition link is attached with an encryption identifier, and sending the key acquisition request to the network side device includes: sending the key acquisition request to the network side device through the key acquisition link.

[0022] In an optional implementation, the key application information includes at least one of the following: first identification information of a first object; wherein, the first object is the object that submits the key application information through the terminal device; identification information of the first device; the first login account of the first device; the start time of control of the first device; and the duration of control of the first device.

[0023] In an optional implementation, the key acquisition link is attached with an encryption identifier, and the sending of a key acquisition request to the network-side device includes: performing a hash calculation based on the encryption identifier to obtain a first hash value; signing the first hash value based on a preset public key to obtain a digital signature; and sending the encryption identifier and / or the digital signature as the key acquisition request to the network-side device. In one implementation, the receiving of the first key sent by the network-side device includes: obtaining the first key sent by the network-side device via a must-reach message; wherein the first key is a key encrypted based on a national encryption algorithm.

[0024] In one implementation, the method further includes: decrypting the first key based on the national encryption algorithm; providing a display interface; wherein the display interface is used to display the decrypted first key; and in response to the decrypted first key being known, deleting the decrypted first key.

[0025] In the third aspect, an embodiment of the present application provides a key management method, which is applied to a first device, and the method includes: in response to a login operation on the first device, sending a second login account corresponding to the login operation to the network side device; wherein, the second login account is used by the network side device to determine whether the first key has been used to log in to the first device after the login key of the first device is updated to the first key.

[0026] In a fourth aspect, an embodiment of the present application provides a key management device, which is applied to a network-side device, and the device includes: a first acquisition module, used to obtain a key acquisition request sent by a terminal device; a verification module, used to perform security verification on the key acquisition request; a processing module, used to update the login key of the first device to a first key in response to the key acquisition request passing the security verification; and a first sending module, used to send the first key to the terminal device.

[0027] In one implementation, the apparatus further includes: a second acquisition module for acquiring key application information sent by the terminal device; a risk control module for performing risk control analysis based on the key application information and acquiring a risk control analysis result; a generation module for generating a key acquisition link in response to the risk control analysis result being normal; a second sending module for sending the key acquisition link to the terminal device; wherein the first acquisition module is specifically used to: acquire a key acquisition request sent by the terminal device through the key acquisition link.

[0028] In an optional implementation, the key application information includes at least one of the following: first identification information of a first object; wherein, the first object is the object that submits the key application information through the terminal device; identification information of the first device; the first login account of the first device; the start time of control of the first device; and the duration of control of the first device.

[0029] Optionally, the risk control module is specifically used to: determine the first device information and controllable time period of the first device based on the identification information; determine whether the first object has the right to apply for a key based on the first identification information and the control duration; in response to the first object having the right to apply for a key, determine the applicable operation duration of the first object and the second device information of the device for which the first object can apply to operate based on the first identification information; perform risk control analysis based on the control start time, the controllable time period, the applicable operation duration, the first device information and the second device information.

[0030] Optionally, the risk control module is specifically used to: determine the associated information of the first object based on the first identification information; determine the weight value based on the associated information; determine the target object level of the first object from multiple preset object levels based on the weight value; wherein each object level corresponds to a different applicable operation time and applicable operation device; determine the applicable operation time and the second device information based on the target object level.

[0031] Optionally, the associated information includes at least one of the following: working years of the first object; associated project information of the first object; project reuse information of the first object; own attribute information of the first object; abnormal operation information of the first object.

[0032] In an optional implementation, the generation module is specifically used to: generate a first link; wherein the first link corresponds to a key acquisition entry; generate an encryption identifier based on the key application information; attach the encryption identifier to the first link to obtain the key acquisition link; and send the key acquisition link to the terminal device.

[0033] Optionally, the key acquisition request includes a digital signature encrypted using a preset public key, the encryption identifier, and at least one of the second identification information of the terminal device, and the verification module is specifically used to: perform identity authentication based on the second identification information of the terminal device; in response to the identity authentication being passed, determine whether the sending time of the key acquisition request is within a preset validity period; in response to the sending time of the key acquisition request being within the validity period, decrypt the encrypted digital signature based on a preset private key to obtain a first hash value; perform hash calculation based on the encryption identifier to obtain a second hash value; match the first hash value and the second hash value to obtain a matching result; in response to the matching result satisfying the first condition, determine that the security verification is passed.

[0034] In one implementation, the processing module is specifically configured to: generate the first key; create a container instance; modify a login key of the first device to the first key based on the container instance; and destroy the container instance.

[0035] In an optional implementation, the processing module is specifically used to: obtain a random number seed and a preset second key; encrypt the second key based on the random number seed to obtain an encryption result; and obtain a message digest of the encryption result as the first key.

[0036] In one implementation, the first sending module is specifically used to: encrypt the first key based on a national encryption algorithm; and send the encrypted first key to the terminal device based on a must-reach message.

[0037] Optionally, the apparatus further includes: a third acquisition module, configured to acquire a second login account sent by the first device; and a second processing module, configured to determine whether the first key has been used to log in to the first device based on the first login account and the second login account.

[0038] In the fifth aspect, an embodiment of the present application provides a key management device, which is applied to a terminal device, and the device includes: a first sending module, used to send a key acquisition request to a network side device; wherein, the key acquisition request is used by the network side device to update the login key of the first device to a first key after passing the security verification; a first receiving module, used to receive the first key sent by the network side device.

[0039] In one implementation, the device also includes: a second sending module, used to send key application information to the network side device; wherein, the key application information is used by the network side device to send the key acquisition link to the terminal device after the risk control analysis is passed; a second receiving module, used to receive the key acquisition link sent by the network side device; wherein, the first sending module is specifically used to: send the key acquisition request to the network side device through the key acquisition link.

[0040] In an optional implementation, the key application information includes at least one of the following: first identification information of a first object; wherein, the first object is the object that submits the key application information through the terminal device; identification information of the first device; the first login account of the first device; the start time of control of the first device; and the duration of control of the first device.

[0041] In an optional implementation, the first sending module is specifically used to: perform a hash calculation based on the encryption identifier to obtain a first hash value; sign the first hash value based on a preset public key to obtain a digital signature; and send the encryption identifier and / or the digital signature as the key acquisition request to the network side device. In one implementation, the receiving of the first key sent by the network side device includes: obtaining the first key sent by the network side device via a must-reach message; wherein the first key is a key encrypted based on a national secret algorithm.

[0042] In one implementation, the device also includes: a decryption module for decrypting the first key based on the national secret algorithm; a display module for providing a display interface; wherein the display interface is used to display the decrypted first key; and a processing module for deleting the decrypted first key in response to the decrypted first key being known.

[0043] In the sixth aspect, an embodiment of the present application provides a key management device, which is applied to a first device, and the device includes: a processing module, which is used to send a second login account corresponding to the login operation to the network side device in response to the login operation on the first device; wherein, the second login account is used by the network side device to determine whether the first key has been used to log in to the first device after the login key of the first device is updated to the first key.

[0044] In the seventh aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the key management method as described in the first aspect.

[0045] In an eighth aspect, an embodiment of the present application provides an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the key management method as described in the second aspect.

[0046] In the ninth aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the key management method as described in the third aspect.

[0047] In the tenth aspect, the present application provides a key management system, which includes the key management device described in the fourth aspect, the key management device described in the fifth aspect, and the key management device described in the sixth aspect, or the system includes the electronic device described in the seventh aspect, the electronic device described in the eighth aspect, and the electronic device described in the ninth aspect.

[0048] In an eleventh aspect, an embodiment of the present application provides a computer-readable storage medium for storing instructions, which, when executed, enables the method described in the first aspect to be implemented.

[0049] In a twelfth aspect, an embodiment of the present application provides a computer-readable storage medium for storing instructions, which, when executed, enables the method described in the second aspect to be implemented.

[0050] In a thirteenth aspect, an embodiment of the present application provides a computer-readable storage medium for storing instructions, which, when executed, enables the method described in the third aspect to be implemented.

[0051] In a fourteenth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the key management method as described in the first aspect.

[0052] In a fifteenth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the key management method as described in the second aspect.

[0053] In a sixteenth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the key management method as described in the third aspect.

[0054] The technical solution provided by the embodiments of the present application can achieve the following beneficial effects: a network-side device can, in response to receiving a key acquisition request from a terminal device, update the login key of a first device and send the updated login key to the terminal device. The terminal device can also, after determining, based on the information sent by the first device, that the updated login key has been used to log in to the first device, update the login key of the first device again. This ensures that a single key is valid only once, effectively preventing key leakage and improving the security of key management.

[0055] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0057] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0058] FIG1 is a flowchart of a key management method provided in an embodiment of the present application;

[0059] FIG2 is a flowchart of another key management method provided in an embodiment of the present application;

[0060] FIG3 is a flowchart of another key management method provided in an embodiment of the present application;

[0061] FIG4 is a flowchart of another key management method provided in an embodiment of the present application;

[0062] FIG5 is a schematic diagram of a key update process provided in an embodiment of the present application;

[0063] FIG6 is a flowchart of another key management method provided in an embodiment of the present application;

[0064] FIG7 is a schematic diagram of a risk control analysis solution provided in an embodiment of the present application;

[0065] FIG8 is a flowchart of another key management method provided in an embodiment of the present application;

[0066] FIG9 is a flowchart of another key management method provided in an embodiment of the present application;

[0067] FIG10 is a flowchart of another key management method provided in an embodiment of the present application;

[0068] FIG11 is a flowchart of another key management method provided in an embodiment of the present application;

[0069] FIG12 is an interactive flow chart of a key management solution provided in an embodiment of the present application;

[0070] FIG13 is a schematic diagram of a key management device provided in an embodiment of the present application;

[0071] FIG14 is a schematic diagram of another key management device provided in an embodiment of the present application;

[0072] FIG15 is a schematic diagram of another key management device provided in an embodiment of the present application;

[0073] FIG16 is a schematic diagram of another key management device provided in an embodiment of the present application;

[0074] FIG17 is a schematic diagram of another key management device provided in an embodiment of the present application;

[0075] FIG18 is a schematic diagram of another key management device provided in an embodiment of the present application;

[0076] FIG19 is a schematic diagram of another key management device provided in an embodiment of the present application;

[0077] FIG20 is a schematic block diagram of an example electronic device that may be used to implement embodiments of the present application. DETAILED DESCRIPTION

[0078] The following description of exemplary embodiments of the present application is made in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding. These details should be considered as merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present application. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0079] In the description of this application, unless otherwise specified, " / " represents or. For example, A / B can represent A or B. "And / or" in this application is merely a description of the association relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. The various numbers such as first and second mentioned in this application are only for convenience of description and are not intended to limit the scope of the embodiments of this application, nor do they indicate a sequential order.

[0080] Please refer to Figure 1, which is a flow chart of a key management method provided by an embodiment of the present application. The method can be applied to network-side devices. As shown in Figure 1, the method may include but is not limited to the following steps:

[0081] Step S101: Obtain a key acquisition request sent by a terminal device.

[0082] For example, a key acquisition request sent by a terminal device through a preset request sending channel (e.g., a 5G (5th Generation Mobile Communication Technology) message or an App (application)) is obtained. The key acquisition request is used to request to obtain a key from a network-side device.

[0083] Step S102: Perform security verification on the key acquisition request.

[0084] For example, the key acquisition request is identified through a preset security gateway to screen and eliminate abnormal access data, verify the identity of the terminal device sending the key acquisition request, and confirm the security of the channel sending the key acquisition request.

[0085] In some embodiments of the present application, for a terminal device equipped with a SIM (Subscriber Identity Module) card, the identity of the terminal device can be authenticated through SIM authentication.

[0086] Step S103: In response to the key acquisition request passing the security verification, the login key of the first device is updated to the first key.

[0087] In an embodiment of the present application, the first device is a device that the user expects to obtain a login key and log in to through a key acquisition request.

[0088] It should be noted that, in the embodiments of the present application, the first device may be a software device or a hardware device.

[0089] For example, in response to a key acquisition request sent by the terminal device passing security verification, the login key of the first device that the user needs to use to log in is changed to a randomly generated first key.

[0090] In some embodiments of the present application, the first key may have a corresponding validity period, that is, the login key of the first device is updated to the first key only during the validity period.

[0091] Step S104: Send the first key to the terminal device.

[0092] For example, the first key is encrypted and sent to the terminal device via a 5G message.

[0093] By implementing the embodiments of the present application, a security verification can be performed on a terminal device's key acquisition request. After the security verification passes, the login key of the first device is updated to the first key, and the first key is sent to the terminal device. Thus, the user can obtain the first key through the terminal device and use the first key to log in to the first device. This enables different users to control the same device using different keys, thereby achieving highly secure key authorization management.

[0094] In an optional implementation, container technology can be used to update the login key of the first device to the first key to prevent leakage of the first key. As an example, see Figure 2, which is a flow chart of another key management method provided by an embodiment of the present application. This method can be applied to network-side devices. As shown in Figure 2, the method may include but is not limited to the following steps:

[0095] Step S201: Obtain a key acquisition request sent by a terminal device.

[0096] In the embodiment of the present application, step S201 can be implemented by any of the methods in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0097] Step S202: Perform security verification on the key acquisition request.

[0098] In the embodiment of the present application, step S202 can be implemented by any of the methods in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0099] Step S203: In response to the key acquisition request passing the security verification, a first key is generated.

[0100] For example, in response to the key acquisition request passing the security verification, a key is randomly generated as the first key.

[0101] In an optional implementation, the above-mentioned generation of the first key may include the following steps: obtaining a random number seed and a preset second key; encrypting the second key based on the random number seed to obtain an encryption result; and obtaining a message digest of the encryption result as the first key.

[0102] For example, the current time value is obtained as a random number seed, the preset second key is encrypted to obtain an encryption result, and the SHA-1 (Secure Hash Algorithm 1) algorithm is used to extract the message digest of the encryption result, and the message digest is used as the first key.

[0103] It can be understood that in some embodiments of the present application, the first key can be verified after it is generated. In response to the first key passing the verification, subsequent steps are executed; or, in response to the first key failing the verification, a new first key is regenerated.

[0104] For example, the generated first key is verified to check whether its complexity meets preset requirements and whether it complies with key rules. For example, the first key should contain at least two characters from the group consisting of uppercase letters, lowercase letters, numbers, and special characters. Passwords that cannot be used by the operating system, such as R$xxxxx, which truncates the password after the "$" character, or R!1234, which converts the content after the "!" character into a random value, should be avoided.

[0105] Step S204: Create a container instance.

[0106] Step S205: Modify the login key of the first device to the first key based on the container instance.

[0107] For example, the first key is sent to the container instance, so that the container instance modifies the login key of the first device to the first key.

[0108] Step S206: Destroy the container instance.

[0109] For example, calling the instance's destruction method destroys the instance in the container and releases the system resources and content corresponding to the instance.

[0110] Step S207: Send the first key to the terminal device.

[0111] In the embodiment of the present application, step S207 can be implemented by any of the methods in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0112] By implementing the embodiments of the present application, a security verification can be performed on a terminal device's key acquisition request. Once the security verification passes, the first device's login key is updated to the first key based on the container instance. After the update is complete, the container instance is destroyed, preventing the first key from being leaked from the network-side device. This achieves highly secure key authorization management.

[0113] In an optional implementation, the first key can be sent to the terminal device via the Bida Message Platform. As an example, see Figure 3, which is a flow chart of another key management method provided by an embodiment of the present application. This method can be applied to network-side devices. As shown in Figure 3, the method may include but is not limited to the following steps:

[0114] Step S301: Obtain a key acquisition request sent by a terminal device.

[0115] In the embodiment of the present application, step S301 can be implemented in any of the ways in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0116] Step S302: Perform security verification on the key acquisition request.

[0117] In the embodiment of the present application, step S302 can be implemented by any of the methods in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0118] Step S303: In response to the key acquisition request passing the security verification, the login key of the first device is updated to the first key.

[0119] In the embodiment of the present application, step S303 can be implemented by any of the methods in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0120] Step S304: Encrypt the first key based on the national encryption algorithm.

[0121] Step S305: Send the encrypted first key to the terminal device based on the must-reach message.

[0122] For example, the BiDa notification service based on the 5G super SIM card will send the first key encrypted using the national secret algorithm to the terminal device.

[0123] By implementing the embodiments of the present application, a security check can be performed on the key acquisition request of the terminal device. After the security check passes, the login key of the first device is updated to the first key, and the first key is sent to the terminal device via the BiDa messaging platform. Thus, the user can obtain the first key through the terminal device and use the first key to log in to the first device. This enables multiple users to control the same device using different keys, thereby achieving highly secure key authorization management.

[0124] In one implementation, after determining that the first device has been logged in using the first key, the login key of the first device may be updated again. As an example, see Figure 4, which is a flowchart of another key management method provided in an embodiment of the present application. This method can be applied to network-side devices. As shown in Figure 4, the method may include but is not limited to the following steps:

[0125] Step S401: Obtain a key acquisition request sent by a terminal device.

[0126] In the embodiment of the present application, step S401 can be implemented in any of the ways in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0127] Step S402: Perform security verification on the key acquisition request.

[0128] In the embodiment of the present application, step S402 can be implemented by any of the methods in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0129] Step S403: In response to the key acquisition request passing the security verification, the login key of the first device is updated to the first key.

[0130] In the embodiment of the present application, step S403 can be implemented by any of the methods in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0131] Step S404: Send the first key to the terminal device.

[0132] In the embodiment of the present application, step S404 can be implemented by any of the methods in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0133] Step S405: Determine whether the first key has been used to log in to the first device.

[0134] For example, it is determined whether the user has logged into the first device using the first key.

[0135] Step S406: In response to the first key being used to log in to the first device, the login key of the first device is updated to a third key.

[0136] For example, in response to the user having logged into the first device using the first key, the login key of the first device is updated to the third key.

[0137] It should be noted that in the embodiments of the present application, the specific steps of updating the login key of the first device to the third key can be the same as the steps of updating the login key of the first device to the first key in any of the aforementioned embodiments. The embodiments of the present application do not limit this and will not be repeated.

[0138] It should be noted that in an embodiment of the present application, when the login key of the first device is updated to the third key, if the user who logs in to the first device using the first key has not logged out, the user will not be logged out due to the update of the login password.

[0139] By implementing the embodiments of the present application, the network-side device can update the login key of the first device again after determining that the first device has been logged in using the first key. This ensures that the authorized key is valid only once, thereby improving the security of key authorization.

[0140] As an example, see Figure 5, which is a schematic diagram of a key update process provided in an embodiment of the present application. As shown in Figure 5, after receiving the key application information, the key application information can be subjected to a security check. After passing the security check, the login key of the first device can be modified to the first key. The first key is then sent to the terminal device. Simultaneously, the login status of the first device is monitored, and upon detecting that a user has logged in to the first device using the first key, the login key of the first device is changed.

[0141] In one implementation, the network-side device may perform a correlation analysis based on the relevant information sent by the terminal device to determine whether to process the terminal device's key acquisition request. As an example, see Figure 6, which is a flowchart of another key management method provided in an embodiment of the present application. This method can be applied to the network-side device. As shown in Figure 6, the method may include but is not limited to the following steps:

[0142] Step S601: Obtain key application information sent by the terminal device.

[0143] In an optional implementation, the key application information includes at least one of the following: first identification information of the first object; wherein the first object is the object that submits the key application information through the terminal device; identification information of the first device; the first login account of the first device; the start time of control of the first device; and the control duration of the first device.

[0144] In the embodiment of the present application, the first identification information of the first object may include but is not limited to: the ID (Identity document, identity identification number), name, etc. of the first object.

[0145] In some embodiments of the present application, the identification information of the terminal device may be used as the identification information of the first object. The identification information of the terminal device may include, but is not limited to, an IMEI (International Mobile Equipment Identity) and an ICCID (Integrated Circuit Card Identity) of a SIM card in the terminal device.

[0146] In the embodiment of the present application, the identification information of the first device may include but is not limited to: an IP (Internet Protocol) address corresponding to the first device, a device identification code of the first device (eg, IMEI), etc.

[0147] Step S602: Perform risk control analysis based on the key application information and obtain risk control analysis results.

[0148] Specifically, a risk control analysis is performed based on the key application information to identify whether the key application information poses risks and obtain a risk control analysis result.

[0149] In an optional implementation, the risk control analysis based on the key application information may include the following steps:

[0150] A1: Determine first device information and a controllable time period of the first device according to the identification information.

[0151] Specifically, according to the identification information of the first device, the first device information of the first device (for example, the performance index of the first device, the load level of the first device) is determined, and the controllable time period during which the first device can be currently used is determined.

[0152] A2: Determine whether the first object has the right to apply for a key based on the first identification information and the control duration.

[0153] For example, the controllable duration of the first object is determined according to the first identification information, thereby determining whether the controllable duration of the first object is greater than the control duration, and determining whether the first object has the right to apply for a key.

[0154] A3: In response to the first object being authorized to apply for a key, determining, based on the first identification information, the duration of the operation that the first object can apply for, and second device information of the device that the first object can apply to operate;

[0155] For example, different object levels can be pre-set, each capable of controlling different devices, and each capable of controlling a device for different durations. The target object level corresponding to the first object is determined based on the first identification information, and the applicable operating duration for the first object and the second device information for the device that the first object can apply to operate are determined based on the devices that the target object level can control and the duration for which the target object level can control the device.

[0156] Optionally, determining the applicable operation duration of the first object and the second device information of the device for which the first object can apply for operation based on the first identification information may include the following steps: determining the associated information of the first object based on the first identification information; determining a weight value based on the associated information; determining a target object level of the first object from a plurality of preset object levels based on the weight value; and determining the applicable operation duration and the second device information based on the target object level.

[0157] Among them, in an embodiment of the present application, the associated information includes at least one of the following: working years of the first object; associated project information of the first object; project reuse information of the first object; own attribute information of the first object; abnormal operation information of the first object.

[0158] In the embodiment of the present application, the associated project information of the first object may include but is not limited to project attributes associated with the first object, such as an operation support project, a research and development project, and the like.

[0159] In the embodiment of the present application, the first object's own attribute information may include but is not limited to the first object's position information and the first object's rank information.

[0160] In an embodiment of the present application, the abnormal operation information of the first object may be the number of illegal operations of the first object within a preset period of time (for example, one year).

[0161] In the embodiment of the present application, each object level corresponds to a different applicable operation duration and applicable operation device.

[0162] For example, based on the first identification information, the associated information of the first object is determined from the associated information of multiple objects obtained in advance, and a weight value is assigned to each associated information based on a preset rule, and the weight value corresponding to each associated information is weighted and summed to obtain the weight value corresponding to the first object. Multiple object levels are pre-set, and each object level has a different weight value range, so that the weight value range to which the weight value corresponding to the first object belongs can be determined, and then the target object level corresponding to the first object is determined, and the applicable operation time and applicable operation device corresponding to the target object level are determined as the applicable operation time and second device information of the first object.

[0163] A4: Conduct risk control analysis based on the control start time, controllable time period, applicable operation duration, first device information, and second device information.

[0164] As an example, please refer to Figure 7, which is a schematic diagram of a risk control analysis solution provided by an embodiment of the present application. As shown in Figure 7, key application information can be obtained, and based on the user's identification information in the key information, multiple pieces of associated information of the user (i.e., the first object) can be obtained, thereby assigning a weight to each piece of associated information according to its importance, and obtaining a final weight value through a weighted sum algorithm, so as to obtain the user level of the applicant based on the final weight value. For example, it can be divided into Level 1 (the applicable operation time is ≤24 hours, and all devices can be operated), Level 2 (the applicable operation time is ≤8 hours, and core and low-load devices can be operated), and Level 3 (the applicable operation time is ≤1 hour, and non-core and low-load devices can be operated). At the same time, the identification information of the device applied for operation is identified and analyzed, including whether the applied device has been applied for within the application period, whether the applied device is a core device, and the load level of the device applied for operation. Finally, combined with the user level, the equipment applied for operation is analyzed and screened, and the relevant information is finally returned to the user (for example, the user is Level X, the applicable operation time is ≤x hours, and the identification information of the device that can be applied for this time is XXX).

[0165] Step S603: In response to the risk control analysis result being normal, a key acquisition link is generated.

[0166] For example, in response to the risk control analysis result indicating that the first object can control the first device within the corresponding time period, a key acquisition link is generated.

[0167] In some embodiments of the present application, the risk control analysis results may also be sent to a terminal device so that the user can promptly learn about the processing status of the key application through the terminal device.

[0168] In some embodiments of the present application, before generating the key acquisition link, manual approval may be performed based on the risk control analysis results, and in response to the manual approval being passed, a key acquisition link is generated.

[0169] Optionally, the above-mentioned generation of the key acquisition link may include the following steps: generating a first link; generating an encryption identifier based on the key application information; attaching the encryption identifier to the first link to obtain the key acquisition link; and sending the key acquisition link to the terminal device.

[0170] In the embodiment of the present application, the first link corresponds to the key acquisition entry.

[0171] Specifically, a first connection for obtaining a key is generated, a private field is created to store key application information, the values ​​of the various fields in the key application information are combined to form an encryption identifier, which is attached to the first link to obtain a key acquisition link, and the key acquisition link is sent to the terminal device.

[0172] Step S604: Send a key acquisition link to the terminal device.

[0173] For example, the key acquisition link is sent to the terminal device via 5G message.

[0174] Step S605: Obtain the key acquisition request sent by the terminal device through the key acquisition link.

[0175] For example, a key acquisition request sent by a user by clicking a key acquisition link through a terminal device is obtained.

[0176] Step S606: Perform security verification on the key acquisition request.

[0177] In the embodiment of the present application, step S606 can be implemented in any of the ways in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0178] Optionally, the key acquisition request includes at least one of a digital signature encrypted using a preset public key, an encryption identifier, and second identification information of the terminal device. Performing security verification on the key acquisition request includes:

[0179] B1: Perform identity authentication based on the second identification information of the terminal device.

[0180] In an embodiment of the present application, the second identification information may include but is not limited to the IMEI of the terminal device and the ICCID of the SIM card in the terminal device.

[0181] B2: In response to the identity authentication being passed, determining whether the sending time of the key acquisition request is within a preset validity period.

[0182] Specifically, in response to the identity authentication being passed, it is determined whether the moment when the first object sends the key acquisition request by clicking the key acquisition link is within a preset link validity period.

[0183] B3: In response to the sending time of the key acquisition request being within the validity period, the encrypted digital signature is decrypted based on the preset private key to obtain a first hash value.

[0184] Specifically, in response to the moment when the first object sends a key acquisition request by clicking the key acquisition link, within the preset link validity period, the encrypted digital signature is decrypted based on the preset private key to obtain the first hash value.

[0185] In some other embodiments of the present application, in response to the moment when the first object sends the key acquisition request by clicking the key acquisition link, if the moment is not within the preset link validity period, corresponding prompt information is sent to the terminal device.

[0186] B4: Perform hash calculation based on the encrypted identifier to obtain a second hash value.

[0187] B5: Match the first hash value and the second hash value to obtain a matching result.

[0188] B6: In response to the matching result satisfying the first condition, determining that the security check has passed.

[0189] For example, in response to the matching result that the first hash value and the second hash value are the same, it is determined that the security check is passed.

[0190] Step S607: In response to the key acquisition request passing the security verification, the login key of the first device is updated to the first key.

[0191] In the embodiment of the present application, step S607 can be implemented by any of the methods in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0192] Step S608: Send the first key to the terminal device.

[0193] In the embodiment of the present application, step S608 can be implemented by any of the methods in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0194] By implementing the embodiments of the present application, the network-side device can receive key application information sent by the terminal device, perform risk analysis based on the key application information, and send a key acquisition link to the terminal device after the risk analysis passes. The terminal device can then send a key acquisition request through the key acquisition link. This can perform security verification on the terminal device's identity and key request, thereby achieving highly secure key authorization management.

[0195] In the above-mentioned embodiments provided in this application, the key management method provided in the embodiments of this application is introduced from the perspective of the network side device. Next, the key management method provided in the embodiments of this application will be further introduced from the perspective of the terminal device.

[0196] Please refer to Figure 8, which is a flow chart of another key management method provided by an embodiment of the present application. The method is applied to a terminal device. As shown in Figure 8, the method may include but is not limited to the following steps:

[0197] Step S801: Send a key acquisition request to a network-side device.

[0198] In an embodiment of the present application, the key acquisition request is used by the network side device to update the login key of the first device to the first key after passing the security verification.

[0199] For example, a key acquisition request is sent to the network side device, where the key acquisition request is used to request to obtain a key for logging into the first device from the network side device.

[0200] Step S802: Acquire a first key sent by the network-side device.

[0201] For example, a first key sent by a network-side device for logging into a first device is obtained.

[0202] By implementing the embodiment of the present application, the terminal device can send a key acquisition request to the network device to receive the first key sent by the network device based on the key acquisition request, thereby achieving high-security key authorization management.

[0203] In one implementation, the terminal device may also send relevant information for applying for a key to the network device. This relevant information is used by the network device to analyze the relevant situation of the terminal device and, based on this relevant information, determine whether to send information for obtaining a key to the terminal device. As an example, please refer to Figure 9, which is a flowchart of another key management method provided by an embodiment of the present application. This method is applied to a terminal device. As shown in Figure 9, this method may include but is not limited to the following steps:

[0204] Step S901: Send key application information to the network side device.

[0205] Among them, the key application information is used by the network side device to send the key acquisition link to the terminal device after passing the risk control analysis;

[0206] The key application information includes at least one of the following: first identification information of the first object; identification information of the first device; first login account of the first device; start time of control of the first device; and duration of control of the first device.

[0207] Among them, the first object is the object that submits key application information through the terminal device.

[0208] Step S902: Receive a key acquisition link sent by a network-side device.

[0209] For example, a key acquisition link sent by a network-side device is received, where the key acquisition link points to a key acquisition entry.

[0210] Step S903: Send a key acquisition request to the network side device through the key acquisition link.

[0211] For example, when the user needs to log in to the first device, the user clicks a key application link to send a key acquisition request to the network-side device.

[0212] In an embodiment of the present application, an encryption identifier is attached to the key acquisition link, and a key acquisition request is sent to the network side device, including: performing a hash calculation based on the encryption identifier to obtain a first hash value; signing the first hash value based on a preset public key to obtain a digital signature; and sending the encryption identifier and / or digital signature as a key acquisition request to the network side device.

[0213] For example, the key acquisition link is attached with an encryption identifier. In response to the user clicking the key acquisition link, the encryption identifier is hashed to obtain a hash value, and the hash value is signed using a preset public key to generate a digital signature, thereby sending the digital signature and encryption identifier to the network side device.

[0214] Step S904: Acquire the first key sent by the network-side device.

[0215] For example, a 5G message sent by a network side device is received, and the 5G message carries a first key.

[0216] By implementing the embodiments of the present application, a terminal device can send key application information to a network device, receive a key acquisition link sent by the network device after risk control analysis based on the key application information, and send a key acquisition request to the network device using the key acquisition link. This can improve the security of key management.

[0217] In one implementation, the first key sent by the network-side device based on the Bida message platform can be obtained and displayed. As an example, please refer to Figure 10, which is a flowchart of another key management method provided by an embodiment of the present application. The method is applied to the terminal device. As shown in Figure 10, the method may include but is not limited to the following steps:

[0218] Step S1001: Send a key acquisition request to a network-side device.

[0219] In the embodiment of the present application, step S1001 can be implemented in any of the ways in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0220] Step S1002: Obtain the first key sent by the network side device through the must-reach message.

[0221] In the embodiment of the present application, step S1002 can be implemented by any of the methods in the embodiments of the present application. The embodiments of the present application do not limit this and will not be described in detail.

[0222] Among them, the first key is the key encrypted based on the national secret algorithm.

[0223] Step S1003: Decrypt the first key based on the national encryption algorithm.

[0224] Specifically, the encrypted first key is decrypted based on the national encryption algorithm to obtain the decrypted first key.

[0225] In some embodiments of the present application, the first key can be decrypted based on the national secret algorithm through the encryption and decryption function module of the super SIM card in the terminal device.

[0226] Step S1004: providing a display interface, where the display interface is used to display the decrypted first key.

[0227] For example, the decrypted first key is displayed through a display interface of the terminal device.

[0228] Step S1005: In response to the decrypted first key being known, the decrypted first key is deleted.

[0229] For example, through the relevant functions of the Must-Get message, after determining that the user has read the first key, the pop-up window for displaying the first key is canceled, and the first key is deleted on the terminal device.

[0230] By implementing the embodiments of the present application, the terminal device can receive the first key sent by the network side device based on the must-reach message, and after the user learns the first key through the terminal device, the terminal device can delete the first key from the terminal device to avoid leakage of the first key. Improve the security of key management. In this way, the network side device can be, for example, a server, which replaces the centralized password management method by changing the password to obtain the latest password of the terminal, thereby reducing the complexity of the password management system; the password is automatically updated after the user successfully logs in to ensure that each password can only be used once; the container / instance is released immediately after the password is generated and issued to achieve the purpose of immediate destruction, reducing the consumption of memory resources of the network side device and saving the resources of the network side device.

[0231] In the above embodiments provided in this application, the key management method provided in the embodiments of this application is introduced from the perspectives of the network side device and the terminal device respectively. Next, the key management method provided in the embodiments of this application will be further introduced from the perspective of the first device.

[0232] Please refer to Figure 11, which is a flow chart of another key management method provided by an embodiment of the present application. The method can be applied to the first device. As shown in Figure 11, the method may include but is not limited to the following steps:

[0233] Step S1101: In response to a login operation on a first device, a second login account corresponding to the login operation is sent to a network-side device.

[0234] The second login account is used by the network side device to determine whether the first key has been used to log in to the first device after the network side device updates the login key of the first device to the first key.

[0235] Specifically, in response to a user logging into the first device, the account number used by the user to log into the first device is sent to the network side device.

[0236] As an example, the first device can monitor the WTMP log in real time through a pre-installed agent, and collect the original logs generated by the service runtime according to the configured parsing rules to monitor changes in the log content, thereby reading the locally logged-in account and sending the locally logged-in account to the network side device.

[0237] By implementing the embodiments of the present application, the first device can respond to a user's login operation by sending the second login account corresponding to the login operation to the network device, so that the network device can determine whether to update the login account of the first device based on whether the first object has logged into the first device, thereby improving the security of the first device.

[0238] Please refer to Figure 12, which is an interactive flow chart of a key management solution provided by an embodiment of the present application. As shown in Figure 12, in this solution, the network side device can perform risk control analysis based on the key application information sent by the user through the terminal device, and provide a key acquisition link to the terminal device after the risk control analysis passes. Within the preset authorization period, the user can send a key acquisition request to the network side device through the key acquisition link. After receiving the key acquisition request, the network side device verifies the key acquisition request. After the verification is passed, a temporary container is generated to modify the key of the specified device to a randomly generated first key. After the modification is completed, the container is released to ensure that the key information is destroyed. The first key is sent to the terminal device to ensure that the key information is destroyed. After detecting that the user uses the first key to log in to the system, the network side device will re-initiate a password change action and modify the login key of the above-mentioned specified device to the third key again, thereby ensuring that each key can only be used once.

[0239] Please refer to Figure 13, which is a schematic diagram of a key management device provided in an embodiment of the present application. The device is applied to a network-side device. As shown in Figure 13, the device 1300 includes: a first acquisition module 1301, which is used to obtain a key acquisition request sent by a terminal device; a verification module 1302, which is used to perform security verification on the key acquisition request; a first processing module 1303, which is used to update the login key of the first device to the first key in response to the key acquisition request passing the security verification; and a first sending module 1304, which is used to send the first key to the terminal device.

[0240] In one implementation, the above-mentioned device also includes: a second acquisition module, a risk control module, a generation module, and a second sending module. As an example, please refer to Figure 14, which is a schematic diagram of another key management device provided by an embodiment of the present application. As shown in Figure 14, the device 1400 also includes: a second acquisition module 1405, which is used to obtain key application information sent by the terminal device; a risk control module 1406, which is used to perform risk control analysis based on the key application information and obtain risk control analysis results; a second sending module 1407, which is used to send risk control analysis results to the terminal device; a generation module 1408, which is used to generate a key acquisition link in response to the risk control analysis result being normal; the second sending module 1407 is also used to send a key acquisition link to the terminal device; wherein the first acquisition module 1401 is specifically used to: obtain the key acquisition request sent by the terminal device through the key acquisition link. Among them, modules 1401 to 1404 in Figure 14 have the same structure and function as modules 1301 to 1304 in Figure 13.

[0241] In an optional implementation, the key application information includes at least one of the following: first identification information of the first object; wherein the first object is the object that submits the key application information through the terminal device; identification information of the first device; the first login account of the first device; the start time of control of the first device; and the control duration of the first device.

[0242] Optionally, the risk control module 1406 is specifically used to: determine the first device information and controllable time period of the first device based on the identification information; determine whether the first object has the right to apply for a key based on the first identification information and the control duration; in response to the first object having the right to apply for a key, determine the applicable operation duration of the first object and the second device information of the device for which the first object can apply to operate based on the first identification information; perform risk control analysis based on the control start time, the controllable time period, the applicable operation duration, the first device information and the second device information.

[0243] Optionally, the risk control module 1406 is specifically used to: determine the associated information of the first object based on the first identification information; determine the weight value based on the associated information; determine the target object level of the first object from multiple preset object levels based on the weight value; wherein each object level corresponds to a different applicable operation time and applicable operation device; determine the applicable operation time and second device information based on the target object level.

[0244] Optionally, the associated information includes at least one of the following: working years of the first object; associated project information of the first object; project reuse information of the first object; own attribute information of the first object; abnormal operation information of the first object.

[0245] In an optional implementation, the generation module 1408 is specifically used to: generate a first link; wherein the first link corresponds to a key acquisition entry; generate an encryption identifier based on the key application information; attach the encryption identifier to the first link to obtain a key acquisition link; and send the key acquisition link to the terminal device.

[0246] Optionally, the key acquisition request includes at least one of a digital signature encrypted using a preset public key, an encrypted identifier, and the second identification information of the terminal device, and the verification module 1302 is specifically used to: perform identity authentication based on the second identification information of the terminal device; in response to the identity authentication being successful, determine whether the sending time of the key acquisition request is within the preset validity period; in response to the sending time of the key acquisition request being within the validity period, decrypt the encrypted digital signature based on the preset private key to obtain a first hash value; perform hash calculation based on the encrypted identifier to obtain a second hash value; match the first hash value and the second hash value to obtain a matching result; in response to the matching result satisfying the first condition, determine that the security verification has passed.

[0247] In one implementation, the first processing module 1303 is specifically configured to: generate a first key; create a container instance; modify a login key of the first device to the first key based on the container instance; and destroy the container instance.

[0248] In an optional implementation, the first processing module 1303 is specifically configured to: obtain a random number seed and a preset second key; encrypt the second key based on the random number seed to obtain an encryption result; and obtain a message digest of the encryption result as the first key.

[0249] In one implementation, the first sending module 1304 is specifically used to: encrypt the first key based on the national encryption algorithm; and send the encrypted first key to the terminal device based on the must-reach message.

[0250] Optionally, the above-mentioned device also includes a third acquisition module and a second processing module. As an example, please refer to Figure 15, which is a schematic diagram of another key management device provided in an embodiment of the present application. As shown in Figure 15, the device 1500 also includes: a third acquisition module 1509, which is used to obtain the second login account sent by the first device; a second processing module 1510, which is used to determine whether the first key has been used to log in to the first device based on the first login account and the second login account. Among them, modules 1501 to 1508 in Figure 15 have the same structure and function as modules 1401 to 1408 in Figure 14.

[0251] Please refer to Figure 16, which is a schematic diagram of another key management device provided in an embodiment of the present application. Device 1600 is applied to a terminal device. As shown in Figure 16, device 1600 includes: a first sending module 1601, configured to send a key acquisition request to a network-side device; wherein the key acquisition request is used by the network-side device to update the login key of the first device to a first key after passing security verification; and a first receiving module 1602, configured to receive the first key sent by the network-side device.

[0252] In one implementation, the above-mentioned device further includes: a second sending module and a second receiving module. As an example. Please refer to Figure 17, which is a schematic diagram of another key management device provided in an embodiment of the present application. The device 1700 is applied to a terminal device. As shown in Figure 17, the device 1700 also includes: a second sending module 1703, which is used to send key application information to the network side device; wherein the key application information is used by the network side device to send a key acquisition link to the terminal device after the risk control analysis is passed; a second receiving module 1704, which is used to receive the key acquisition link sent by the network side device; wherein the first sending module 1701 is specifically used to: send a key acquisition request to the network side device through the key acquisition link. Among them, modules 1701 and 1702 in Figure 17 have the same structure and function as modules 1601 and 1602 in Figure 16.

[0253] In an optional implementation, the key application information includes at least one of the following: first identification information of the first object; wherein the first object is the object that submits the key application information through the terminal device; identification information of the first device; the first login account of the first device; the start time of control of the first device; and the control duration of the first device.

[0254] In an optional implementation, the first sending module 1601 is specifically used to: perform hash calculation based on the encryption identifier to obtain a first hash value; sign the first hash value based on a preset public key to obtain a digital signature; and send the encryption identifier and / or digital signature as a key acquisition request to the network side device.

[0255] In one implementation, the first receiving module 1602 is specifically used to: obtain a first key sent by a network-side device through a must-reach message; wherein the first key is a key encrypted based on a national encryption algorithm.

[0256] In one implementation, the above-mentioned device further includes: a decryption module, a display module, and a processing module. As an example. Please refer to Figure 18, which is a schematic diagram of another key management device provided in an embodiment of the present application. The device 1800 is applied to a terminal device. As shown in Figure 18, the device 1800 also includes: a decryption module 1803, which is used to decrypt the first key based on the national secret algorithm; a display module 1804, which is used to provide a display interface; wherein the display interface is used to display the decrypted first key; a processing module 1805, which is used to delete the decrypted first key in response to the decrypted first key being known. Among them, modules 1801 and 1802 in Figure 18 have the same structure and function as modules 1601 and 1602 in Figure 16.

[0257] Please refer to Figure 19, which is a schematic diagram of another key management device provided in an embodiment of the present application. Device 1900 is applied to a first device. As shown in Figure 19, device 1900 includes: a processing module 1901, configured to, in response to a login operation on the first device, send a second login account corresponding to the login operation to a network-side device; wherein the second login account is used by the network-side device to determine whether the first key has been used to log in to the first device after the login key of the first device is updated to the first key.

[0258] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0259] Based on the embodiments of the present application, the present application also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the key management method of any of the aforementioned embodiments.

[0260] Based on the embodiments of the present application, the present application also provides a computer-readable storage medium, wherein computer instructions are used to enable a computer to execute the key management method of any of the aforementioned embodiments provided in accordance with the embodiments of the present application.

[0261] Please refer to FIG. 20 , which is a schematic block diagram of an example electronic device that can be used to implement embodiments of the present application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The components shown herein, their connections and relationships, and their functions are provided for example only and are not intended to limit the implementation of the present application as described and / or claimed herein.

[0262] As shown in FIG20 , the device 2000 includes a computing unit 2001, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 2002 or a computer program loaded from a storage unit 20020 into a random access memory (RAM) 2003. Various programs and data required for the operation of the device 2000 can also be stored in the RAM 2003. The computing unit 2001, the ROM 2002, and the RAM 2003 are connected to each other via a bus 2004. An input / output (I / O) interface 2005 is also connected to the bus 2004.

[0263] Multiple components in device 2000 are connected to I / O interface 2005, including: an input unit 2006, such as a keyboard, mouse, etc.; an output unit 2007, such as various types of displays, speakers, etc.; a storage unit 20020, such as a magnetic disk, optical disk, etc.; and a communication unit 2009, such as a network card, modem, wireless communication transceiver, etc. The communication unit 2009 allows device 2000 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0264] The computing unit 2001 can be a variety of general-purpose and / or specialized processing components with processing and computing capabilities. Some examples of the computing unit 2001 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 2001 performs the various methods and processes described above, such as the key management method. For example, in some embodiments, the key management method can be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as the storage unit 20020. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 2000 via the ROM 2002 and / or the communication unit 2009. When the computer program is loaded into the RAM 2003 and executed by the computing unit 2001, one or more steps of the key management method described above can be performed. Alternatively, in other embodiments, the computing unit 2001 may be configured to execute the key management method in any other appropriate manner (for example, by means of firmware).

[0265] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard parts (ASSPs), system on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0266] The program code for implementing the methods of the present application can be written in any combination of one or more programming languages. Such program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the program code is executed by the processor or controller, the functions / operations specified in the flow charts and / or block diagrams are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0267] In the context of the present application, a machine-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM) or a flash memory, an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0268] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a cathode ray tube (CRT) or an LCD (Liquid Crystal Display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0269] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0270] A computer system may include a client and a server. The client and server are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, establishing a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host, a host product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS (Virtual Private Server) services. The server may also be a server in a distributed system or a server integrated with blockchain.

[0271] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this application can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of this application can be achieved. This is not limited herein.

[0272] The above specific embodiments do not constitute a limitation on the scope of protection of this application. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application shall be included within the scope of protection of this application. Industrial Applicability

[0273] The present application discloses a key management method, apparatus, system, device, and storage medium. The method is applied to a network-side device and includes: obtaining a key acquisition request sent by a terminal device; performing a security check on the key acquisition request; updating a login key of a first device to a first key in response to the key acquisition request passing the security check; and sending the first key to the terminal device. The technical solution of the present application enables different users to control the same device using different keys, effectively preventing key leakage and thus achieving highly secure key authorization management.

Claims

1. A key management method, the method being applied to a terminal device, the method comprising: Sending a key acquisition request to the network side device; wherein the key acquisition request is used by the network side device to update the login key of the first device to the first key after passing the security verification; Obtain the first key sent by the network side device.

2. The method of claim 1, wherein: The method further comprises: Send key application information to the network side device; Receiving the key acquisition link sent by the network side device; wherein the key acquisition link is generated by the network side device in response to the key application information after the key application information passes the risk control analysis of the network side device; Correspondingly, sending a key acquisition request to the network side device includes: If an operation on the key acquisition link is detected, the key acquisition request is sent to the network side device.

3. The method of claim 2, wherein: The key application information includes at least one of the following: First identification information of a first object; wherein the first object is an object that submits the key application information through the terminal device; identification information of the first device; a first login account of the first device; a start time of controlling the first device; The duration of controlling the first device.

4. The method of claim 2, wherein: The key acquisition link is attached with an encryption identifier, and the sending of the key acquisition request to the network side device includes: Performing a hash calculation based on the encryption identifier to obtain a first hash value; Sign the first hash value based on a preset public key to obtain a digital signature; The encryption identifier and / or the digital signature is sent to the network side device as the key acquisition request.

5. The method of claim 1, wherein: The obtaining the first key sent by the network side device includes: Obtain the first key sent by the network side device through a must-reach message.

6. The method of claim 1, wherein: The method further comprises: Decrypting the encrypted first key based on the national secret algorithm to obtain the first key; Providing a display interface; wherein the display interface is used to display the first key; In response to the first key being learned, the first key is deleted.

7. A key management method, the method being applied to a network side device, the method comprising: Obtain a key acquisition request sent by a terminal device; Performing a security check on the key acquisition request; In response to the key acquisition request passing the security verification, updating the login key of the first device to the first key; The first key is sent to the terminal device.

8. The method of claim 7, wherein: The updating the login key of the first device to the first key includes: generating the first key; Create a container instance; Modify the login key of the first device to the first key based on the container instance; Destroys the container instance.

9. The method of claim 8, wherein: The generating the first key comprises: Obtain a random number seed and a preset second key; Encrypt the second key based on the random number seed to obtain an encryption result; A message digest of the encryption result is obtained as the first key.

10. The method of claim 7, wherein: The sending the first key to the terminal device includes: Encrypting the first key based on the national secret algorithm; The encrypted first key is sent to the terminal device based on the must-reach message.

11. The method of claim 7, wherein: The method further comprises: determining whether the first key has been used to log into the first device; In response to the first key being used to log into the first device, updating the login key of the first device to a third key.

12. The method of claim 11, wherein: The method further comprises: Obtaining key application information sent by the terminal device; Perform risk control analysis based on the key application information to obtain risk control analysis results; In response to the risk control analysis result indicating that the risk control is normal, generating a key acquisition link; Sending the key acquisition link to the terminal device; The key acquisition request and the key acquisition link are associated with each other.

13. The method of claim 12, wherein: The key application information includes at least one of the following: First identification information of a first object; wherein the first object is an object that submits the key application information through the terminal device; identification information of the first device; a first login account of the first device; a start time of controlling the first device; The duration of controlling the first device.

14. The method of claim 13, wherein: The determining whether the first key has been used to log in to the first device includes: Obtaining a second login account sent by the first device; According to the first login account and the second login account, it is determined whether the first key has been used to log in to the first device.

15. The method of claim 13, wherein: The risk control analysis based on the key application information includes: Determining first device information and a controllable time period of the first device according to the identification information; Determining, according to the first identification information and the control duration, whether the first object has the right to apply for a key; In response to the first object being entitled to apply for a key, determining, according to the first identification information, a duration for which the first object can apply for an operation, and second device information of a device for which the first object can apply for an operation; A risk control analysis is performed based on the control start time, the controllable time period, the applicable operation duration, the first device information, and the second device information.

16. The method of claim 15, wherein: The determining, according to the first identification information, the applicable operation duration of the first object and the second device information of the device that the first object can apply to operate includes: Determine the association information of the first object according to the first identification information; Determining a weight value based on the association information; Determining a target object level of the first object from a plurality of preset object levels according to the weight value; wherein each object level corresponds to a different applicable operation duration and applicable operation device; The applicable operation duration and the second device information are determined according to the target object level.

17. The method of claim 16, wherein: The associated information includes at least one of the following: The first subject’s years of work experience; Related project information of the first object; Project reuse information of the first object; The first object's own attribute information; Abnormal operation information of the first object.

18. The method of claim 13, wherein: The step of generating a key to obtain a link includes: Generate a first link; wherein the first link corresponds to a key acquisition entry; Generate an encryption identifier based on the key application information; Attaching the encryption identifier to the first link to obtain the key acquisition link; The key acquisition link is sent to the terminal device.

19. The method of claim 18, wherein: The key acquisition request includes a digital signature encrypted using a preset public key, the encryption identifier, and at least one of the second identification information of the terminal device, and the security verification of the key acquisition request includes: Performing identity authentication based on the second identification information of the terminal device; In response to the identity authentication being passed, determining whether the sending time of the key acquisition request is within a preset validity period; In response to the sending time of the key acquisition request being within the validity period, decrypting the encrypted digital signature based on a preset private key to obtain a first hash value; Performing a hash calculation based on the encryption identifier to obtain a second hash value; Matching the first Hash value and the second Hash value to obtain a matching result; In response to the matching result satisfying the first condition, it is determined that the security check is passed.

20. A key management method, the method being applied to a first device, the method comprising: In response to a login operation on the first device, a second login account corresponding to the login operation is sent to the network side device; wherein the second login account is used by the network side device to determine whether the first key has been used to log in to the first device after the login key of the first device is updated to the first key.

21. A key management device, the device being applied to a network side device, the device comprising: A first acquisition module, used to acquire a key acquisition request sent by a terminal device; A verification module, used to perform security verification on the key acquisition request; A first processing module, configured to update the login key of the first device to the first key in response to the key acquisition request passing the security verification; The first sending module is used to send the first key to the terminal device.

22. A key management device, the device being applied to a terminal device, the device comprising: A first sending module, configured to send a key acquisition request to a network side device; wherein the key acquisition request is used by the network side device to update the login key of the first device to the first key after passing the security verification; The first receiving module is used to receive the first key sent by the network side device.

23. A key management device, the device being applied to a first device, the device comprising: A processing module is used to send a second login account corresponding to the login operation to the network side device in response to the login operation on the first device; wherein the second login account is used by the network side device to determine whether the first key has been used to log in to the first device after the login key of the first device is updated to the first key.

24. A key management system, comprising: A network-side device, configured to execute the method according to any one of claims 7 to 19; A terminal device, configured to execute the method according to any one of claims 1 to 6; The first-side device is used to execute the method as claimed in claim 20.

25. An electronic device comprising: at least one processor; and a memory communicatively coupled to the at least one processor; In which, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the key management method described in any one of claims 1 to 6; or, enable the at least one processor to execute the key management method described in any one of claims 7 to 19; or, enable the at least one processor to execute the key management method described in claim 20.

26. A computer-readable storage medium storing instructions, which, when executed, implement the method according to any one of claims 1 to 6; or, implement the method according to any one of claims 7 to 19; or, implement the method according to claim 20.

Images