Disclosure of Invention
In order to solve the technical problems, the following technical scheme is provided:
in a first aspect, an embodiment of the present application provides a method for secure synchronization of two point keys, where the method includes: after a first user sends a generated first nascent key to a second user, encrypting a first key verification value of the first nascent key through a node key to obtain an encrypted key verification value, wherein the first user and the second user are users with common key equipment, the first nascent key is any symmetric key generated by the first user through local key equipment, and the first key verification value is a unique identifier of the first nascent key; the first user sends the encryption key check value to the second user; processing the first primary key according to the feedback information of the second user
By adopting the implementation mode, after the first user sends the generated key to the second user, the key received by the second user is verified through the unique identification key check value of the key, and if the key check values are inconsistent, the key is discarded. The key between the two is ensured to keep synchronous, and the problem that data interaction is carried out between two data communication parties under the condition that the keys are not synchronous is further avoided.
With reference to the first aspect, in a first possible implementation manner of the first aspect, the processing the first primary key according to the information fed back by the second user includes: the second user obtains a carried first key check value according to the encryption key check value; if the first key check value is different from a key check value carried by a first nascent key received by a second user, discarding the first nascent key; or if the first key check value is the same as the key check value carried by the first nascent key received by the second user, using the first nascent key as a normal key.
With reference to the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, the obtaining, by the second user, the carried first key check value according to the encryption key check value includes: determining a node key negotiated with a first user; and decrypting the encrypted key check value according to the node key to obtain the first key check value.
With reference to the first aspect, in a third possible implementation manner of the first aspect, the sending, by the first user, the generated first primary key to the second user includes: the first user encrypts the first primary key through a local key to obtain a first key; encrypting the first key through a node key to obtain a second key; and sending the second key to the first user.
With reference to the first aspect, in a fourth possible implementation manner of the first aspect, the first user sends an encryption key check value to the second user according to a first time interval, and the second user sends feedback information to the first user according to a second time interval, where the second time interval is greater than the first time interval.
With reference to the fourth possible implementation manner of the first aspect, in a fifth possible implementation manner of the first aspect, if the first user or the second user detects that a communication network is abnormal, a prompt message is sent.
With reference to the fifth possible implementation manner of the first aspect, in a sixth possible implementation manner of the first aspect, after the second user sends the first feedback information to the first user at the first time, when the second user receives the prompt information from the first user at the second time with an interval duration less than the second time interval or when the second user detects that the communication network is abnormal, the second user directly sends the feedback information to the first user.
In a second aspect, an embodiment of the present application provides a two-point key security synchronization system, where the system includes: an obtaining module, configured to encrypt a first key check value of a first nascent key by a node key after the first user sends the generated first nascent key to a second user, to obtain an encrypted key check value, where the first user and the second user are users having a common key device, the first nascent key is any symmetric key generated by the first user through a local key device, and the first key check value is a unique identifier of the first nascent key; a sending module, configured to send, by the first user, the encryption key check value to the second user; and the processing module is used for processing the first primary key according to the feedback information of the second user.
With reference to the second aspect, in a first possible implementation manner of the second aspect, the processing module includes: the decryption unit is used for the second user to obtain a carried first key check value according to the encryption key check value; the verification unit is used for discarding the first primary key if the first key verification value is different from a key verification value carried by the first primary key received by the second user; or, if the first key check value is the same as a key check value carried by a first nascent key received by a second user, using the first nascent key as a normal key.
In a third aspect, an embodiment of the present application provides an apparatus, including: a processor; a memory for storing processor executable instructions; the processor executes the two-point key security synchronization method described in the first aspect or any possible implementation manner of the first aspect to ensure key synchronization between users of encrypted communication.
Detailed Description
The present invention will be described with reference to the accompanying drawings and embodiments.
The key synchronization directly aims to call a key management system by application systems in different places to acquire the same key, so that the key is applied to encrypt, transmit, decrypt and the like some important information. However, based on the problems presented in the background, the present application proposes the following solutions.
Fig. 1 is a schematic flowchart of a two-point key security synchronization method provided in an embodiment of the present application, and referring to fig. 1, the two-point key security synchronization method provided in the embodiment of the present application includes:
s101, after the first user sends the generated first nascent secret key to the second user, the first secret key check value of the first nascent secret key is encrypted through the node secret key to obtain an encryption secret key check value.
In this embodiment, the first user and the second user are users having a common key device and have the same local master key. The first primary key is any symmetric key generated by the first user through local key equipment, and the first key check value is a unique identifier of the first primary key.
And the first user encrypts the first primary key through a local key to obtain a first key. The first user and the second user use asymmetric key encryption to negotiate a symmetric key as a node key, and the first key is encrypted through the node key to obtain a second key. Sending the second key to the first user
And S102, the first user sends the encryption key check value to the second user.
In this embodiment, the first user sending the encryption key check value to the second user is determined according to the sending of the key to the second user. After the primary key is sent to the second user every time, in order to ensure the subsequent synchronization of the key during data interaction and encryption and decryption, the second user sends a key check value to check the key synchronization after receiving the primary key.
S103, processing the first primary key according to the feedback information of the second user.
Because there may be not only the first user but also other users interacting with the second user, there may be a plurality of node keys in the corresponding second user key management system, and different node keys are distinguished according to different user identifications.
The second user firstly determines first user identification information corresponding to the currently received encryption key check value, and determines a node key negotiated with the first user. And decrypting the encrypted key check value according to the node key to obtain a first key check value.
The second user then extracts the corresponding key check value from the first nascent key data most recently received from the first user, and compares it with the first key check value. And if the first key check value is different from the key check value carried by the first nascent key received by the second user, discarding the first nascent key, and changing the state of the nascent key into waste, so that the first user is required to send a new key to the second user again. And if the first key check value is the same as the key check value carried by the first nascent key received by the second user, the first nascent key is used as a normal key, the state of the nascent key is changed to be normal, and the first user and the second user can perform normal encryption and decryption data interaction.
In an exemplary embodiment, it is ensured that a plurality of keys are used between the first user and the second user to satisfy the requirement of data interaction security, and therefore, the first user sends the encryption key check value after sending the key to the second user. When the first user sends a plurality of encryption key check values to the second user according to the first time interval, because the key serial numbers corresponding to the key check values carried in different encryption key check values are unique, the second user does not perform feedback according to the receiving times, but performs unified feedback after receiving a predetermined number of encryption key check values. Thus, if the first user sends the encryption key check value to the second user at a first time interval, the second user sends feedback information to the first user at a second time interval greater than the first time interval.
Generally, after a first user sends a key to a second user, most of the conditions of key synchronization are affected by network anomaly. Thus, if the first user or the second user detects a network anomaly, such as a network outage or a network transport protocol modification. At this time, a prompt message is sent, and the first user stops sending the key when detecting that the first user sends the feedback information back. And if the second user detects the key, informing the first user of stopping sending the key, and prompting the first user to send the encryption key check value corresponding to the latest key after the network is recovered.
In an exemplary embodiment, after the second user sends the first feedback information to the first user at the first time, the network abnormality information prompted by the first user is received at a certain subsequent time or the second user detects the network abnormality. At this time, the time for sending the feedback information at the next moment is not yet reached, but the feedback information is directly sent to the first user in order to determine the key synchronization state received at the previous moment.
Corresponding to the two-point key security synchronization method provided by the foregoing embodiment, the present application also provides an embodiment of a two-point key security synchronization system, and referring to fig. 2, the two-point key security synchronization system 20 includes: an acquisition module 201, a sending module 202 and a processing module 203.
The obtaining module 201 is configured to encrypt a first key check value of a first nascent key by a node key after the first user sends the generated first nascent key to a second user to obtain an encrypted key check value, where the first user and the second user are users having a common key device, the first nascent key is any symmetric key generated by the first user through a local key device, and the first key check value is a unique identifier of the first nascent key.
And the first user encrypts the first primary key through a local key to obtain a first key, encrypts the first key through a node key to obtain a second key, and sends the second key to the first user.
A sending module 202, configured to send the encryption key check value to the second user by the first user.
And the processing module is used for processing the first nascent key according to the information fed back by the second user.
Further, the processing module comprises: a decryption unit and a verification unit.
And the decryption unit is used for the second user to obtain the carried first key check value according to the encryption key check value. Specifically, the second user first determines a node key negotiated with the first user, and decrypts the encrypted key check value according to the node key to obtain the first key check value.
The verification unit is used for discarding the first primary key if the first key verification value is different from a key verification value carried by the first primary key received by the second user; or, if the first key check value is the same as a key check value carried by a first nascent key received by a second user, using the first nascent key as a normal key.
The present application further provides an embodiment of a device, specifically, the device in this embodiment is a device for ensuring key synchronization, and referring to fig. 3, the device 30 includes: a processor 301, a memory 302, and a communication interface 303.
In fig. 3, the processor 301, the memory 302, and the communication interface 303 may be connected to each other by a bus; the bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown in FIG. 3, but this does not mean only one bus or one type of bus.
The processor 301 generally controls the overall functions of the device 30, for example, after the device 30 is started and a terminal is started, a first user sends a generated first nascent key to a second user, encrypts a first key check value of the first nascent key by using a node key to obtain an encrypted key check value, and the first user sends the encrypted key check value to the second user; and processing the first primary key according to the feedback information of the second user.
The processor 301 may be a general-purpose processor such as a Central Processing Unit (CPU), a Network Processor (NP), or a combination of a CPU and an NP. The processor may also be a Microprocessor (MCU). The processor may also include a hardware chip. The hardware chip may be an Application Specific Integrated Circuit (ASIC), a Programmable Logic Device (PLD), or a combination thereof. The PLD may be a Complex Programmable Logic Device (CPLD), a Field Programmable Gate Array (FPGA), or the like.
Memory 302 is configured to store computer-executable instructions to support the operation of device 30 data. The memory 301 may be implemented by any type or combination of volatile or non-volatile memory devices, such as Static Random Access Memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disks.
After the device 30 is started, the processor 301 and the memory 302 are powered on, and the processor 301 reads and executes the computer executable instructions stored in the memory 302 to complete all or part of the steps in the above-described two-point key security synchronization method embodiment.
The communication interface 303 is used for the device 30 to transfer data, for example, to enable communication with a key device. The communication interface 303 includes a wired communication interface, and may also include a wireless communication interface. The wired communication interface comprises a USB interface, a Micro USB interface and an Ethernet interface. The wireless communication interface may be a WLAN interface, a cellular network communication interface, a combination thereof, or the like.
In an exemplary embodiment, the device 30 provided by the embodiments of the present application further includes a power supply component that provides power to the various components of the device 30. The power components may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power for device 30.
In an exemplary embodiment, device 30 may be implemented as one or more Application Specific Integrated Circuits (ASICs), digital Signal Processors (DSPs), digital Signal Processing Devices (DSPDs), programmable Logic Devices (PLDs), field Programmable Gate Arrays (FPGAs), or other electronic components.
It is noted that, in this document, relational terms such as "first" and "second," and the like, are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising a … …" does not exclude the presence of another identical element in a process, method, article, or apparatus that comprises the element.
Of course, the above description is not limited to the above examples, and technical features that are not described in this application may be implemented by or using the prior art, and are not described herein again; the above embodiments and drawings are only for illustrating the technical solutions of the present application and not for limiting the present application, and the present application is only described in detail with reference to the preferred embodiments instead, it should be understood by those skilled in the art that changes, modifications, additions or substitutions within the spirit and scope of the present application may be made by those skilled in the art without departing from the spirit of the present application, and the scope of the claims of the present application should also be covered.