CN116073999A - Key updating method and device, electronic equipment and storage medium - Google Patents
Key updating method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN116073999A CN116073999A CN202310135178.6A CN202310135178A CN116073999A CN 116073999 A CN116073999 A CN 116073999A CN 202310135178 A CN202310135178 A CN 202310135178A CN 116073999 A CN116073999 A CN 116073999A
- Authority
- CN
- China
- Prior art keywords
- key
- public key
- current
- external input
- input device
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
- H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
- H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L9/3006—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or public-key parameters
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computing Systems (AREA)
- Theoretical Computer Science (AREA)
- Storage Device Security (AREA)
Abstract
The invention discloses a key updating method, a device, electronic equipment and a storage medium, wherein the method comprises the following steps: receiving a key update request sent by a key management terminal, wherein the key update request comprises a first encryption public key; decrypting the first encrypted public key by using the current private key in the current key pair to obtain a first public key; generating a second public key; encrypting the second public key by using the first public key to obtain a second encrypted public key, and sending the second encrypted public key to the key management terminal; the receiving key management end decrypts the second encrypted public key by using the first private key in the first key pair to obtain an update prompt message sent after the second public key; and updating the current public key to the second public key in response to the update-prompting message. The technical scheme of the invention can realize the non-inductive updating of the key of the hardware equipment (external input equipment), improve the updating efficiency and speed of the key updating, simplify the key updating step, save the time cost of the user and improve the key updating experience of the user.
Description
Technical Field
The embodiment of the invention relates to computer technology, in particular to a key updating method, a device, electronic equipment and a storage medium.
Background
The existing key updating modes mainly comprise two modes: 1. solidifying the key to the hardware device, and binding a new hardware device after the key is out of date; 2. and (5) carrying out identity authentication through a login management background, and updating a key after the identity authentication is passed.
For the hardware equipment with the key not replaced, in order to ensure the safety, the hardware equipment can only be replaced periodically to achieve the purpose of updating the key, but the use cost of the hardware equipment is increased, and the frequent replacement of the hardware equipment can bring poorer use experience to users; in addition, the user updates the key through the login management background according to the operation guidance mode, the key updating operation is complex, and the consumed user time cost is high.
Disclosure of Invention
The embodiment of the invention provides a key updating method, a device, electronic equipment and a storage medium, which can realize the non-inductive updating of the key of hardware equipment (external input equipment), improve the updating efficiency and speed of the key updating, increase the flexibility of the key updating of the hardware equipment, simplify the key updating step, save the time cost of a user and improve the key updating experience of the user.
In a first aspect, an embodiment of the present invention provides a key updating method, where the method is applied to an external input device, and the method includes:
Receiving a key updating request sent by a key management end, wherein the key updating request comprises a first encryption public key, and the first encryption public key is obtained by the key management end encrypting a first public key in a first key pair by utilizing a current public key in the current key pair of external input equipment after the first key pair is generated;
decrypting the first encrypted public key by using a current private key in the current key pair to obtain the first public key;
generating a second public key, the second public key being randomly generated;
encrypting the second public key by using the first public key to obtain a second encrypted public key, and sending the second encrypted public key to the key management terminal;
receiving an update prompt message sent by the key management end after decrypting the second encryption public key by using a first private key in the first key pair to obtain the second public key;
and updating the current public key to the second public key in response to the update prompt message.
In a second aspect, an embodiment of the present invention provides a method for updating a key, where the method is applied to a key management end, and the method includes:
generating a first key pair, the first key pair comprising a first public key and a first private key;
Encrypting the first public key by using a current public key in a current key pair of external input equipment to obtain a first encrypted public key;
generating a key update request carrying the first encryption public key, and sending the key update request to the external input device, so that the external input device decrypts the first encryption public key by using the current private key in the current key pair to obtain the first public key;
obtaining a second encryption public key from the external input device, wherein the second encryption public key is obtained by encrypting a second public key generated by the external input device through the first public key;
decrypting the second encrypted public key by using the first private key to obtain the second public key;
and sending an update prompt message to the external input device so that the external input device responds to the update prompt message to update the current public key to the second public key.
In a third aspect, an embodiment of the present invention provides a key updating apparatus, where the apparatus is configured to an external input device, and the apparatus includes:
a key update request receiving module, configured to receive a key update request sent by a key management end, where the key update request includes a first encrypted public key, where the first encrypted public key is obtained by the key management end encrypting a first public key in a first key pair by using a current public key in a current key pair of the external input device after the first key pair is generated;
The first public key acquisition module is used for decrypting the first encrypted public key by utilizing the current private key in the current key pair to obtain the first public key;
a second public key generation module for generating a second public key, the second public key being randomly generated;
the second encryption public key sending module is used for encrypting the second public key by using the first public key to obtain a second encryption public key and sending the second encryption public key to the key management end;
the update prompt message receiving module is used for receiving the update prompt message sent after the key management end decrypts the second encrypted public key by using the first private key in the first key pair to obtain the second public key;
and the second public key updating module is used for updating the current public key into the second public key in response to the updating prompt message.
In a fourth aspect, an embodiment of the present invention provides a key updating apparatus, where the apparatus is configured at a key management end, and the apparatus includes:
a first key pair generation module configured to generate a first key pair, where the first key pair includes a first public key and a first private key;
the first encryption public key generation module is used for encrypting the first public key by utilizing the current public key in the current key pair of the external input device to obtain a first encryption public key;
A key update request sending module, configured to generate a key update request carrying the first encrypted public key, and send the key update request to the external input device, so that the external input device decrypts the first encrypted public key with the current private key in the current key pair to obtain the first public key;
the second encryption public key acquisition module is used for acquiring a second encryption public key from the external input device, wherein the second encryption public key is obtained by encrypting a second public key generated by the external input device through the first public key;
the second public key acquisition module is used for decrypting the second encrypted public key by utilizing the first private key to obtain the second public key;
and the update prompt message sending module is used for sending an update prompt message to the external input device so that the external input device responds to the update prompt message to update the current public key to the second public key.
In a fifth aspect, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor, where the processor implements the method for updating a key according to any one of the embodiments of the present invention when the processor executes the program.
In a sixth aspect, embodiments of the present invention further provide a computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements a key updating method according to any of the embodiments of the present invention.
In the embodiment of the invention, a key update request sent by a key management end is received, wherein the key update request comprises a first encryption public key, and the first encryption public key is obtained by encrypting a first public key in a first key pair by a current public key in the current key pair of external input equipment after the key management end generates the first key pair; decrypting the first encrypted public key by using the current private key in the current key pair to obtain a first public key; generating a second public key; encrypting the second public key by using the first public key to obtain a second encrypted public key, and sending the second encrypted public key to the key management terminal; the receiving key management end decrypts the second encrypted public key by using the first private key in the first key pair to obtain an update prompt message sent after the second public key; and updating the current public key to the second public key in response to the update-prompting message. The technical scheme of the invention can receive the first encryption public key obtained by encrypting the first public key in the first key pair by using the current public key in the current key pair of the external input device after the key management end (login management background) generates the first key pair, and then decrypt the first encryption public key by using the current private key in the current key pair to obtain the first public key; obtaining a second encrypted public key by using a second public key generated by encrypting the first public key, sending the second encrypted public key to a key management end, finally receiving an update prompt message sent by the key management end after decrypting the second encrypted public key by using a first private key in a first key pair to obtain the second public key, and automatically updating the current public key into the second public key in response to the update prompt message, thereby realizing the non-inductive updating of the key of hardware equipment (external input equipment), improving the updating efficiency and speed of the key updating, and solving the problem of increasing the use cost of the hardware equipment due to the fact that the hardware equipment is replaced regularly to achieve the purpose of key updating; for the user, the user does not need to update the key according to operation guidance through the key management end, the flexibility of key update of the hardware equipment is improved, the key update step is simplified, the time cost of the user is saved, and the key update experience of the user is improved.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that are needed in the embodiments will be briefly described below, it being understood that the following drawings only illustrate some embodiments of the present invention and therefore should not be considered as limiting the scope, and other related drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
Fig. 1 is a schematic flow chart of a key updating method according to an embodiment of the present invention;
FIG. 2 is a schematic flow chart of another method for updating a key according to an embodiment of the present invention;
FIG. 3 is a schematic diagram of a method for updating a key according to an embodiment of the present invention;
fig. 4 is a schematic structural diagram of a key updating device according to an embodiment of the present invention;
fig. 5 is a schematic diagram of another structure of a key updating apparatus according to an embodiment of the present invention;
fig. 6 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
The invention is described in further detail below with reference to the drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the invention and are not limiting thereof. It should be further noted that, for convenience of description, only some, but not all of the structures related to the present invention are shown in the drawings.
Fig. 1 is a schematic flow chart of a key updating method according to an embodiment of the present invention, where the method may be performed by a key updating device configured in an external input device according to an embodiment of the present invention, and the device may be implemented in a software and/or hardware manner. In a specific embodiment, the apparatus may be integrated in an electronic device, such as an external input device, for example, a fingerprint mouse with a fingerprint module embedded therein. The following embodiments will be described taking the example of the integration of the apparatus in an electronic device, and referring to fig. 1, the method may specifically include the following steps:
The key management end can be understood as a key management server; the key update request can be understood as a request for updating a key sent by the received key management terminal; the first key pair may be randomly generated by an external input device, and the first key pair may include a first public key and a first private key.
In an alternative embodiment, the key management end sends a key update request carrying the first encryption public key to the external input device; and the external input equipment receives a key updating request sent by the key management end.
Illustratively, the external input device may be a fingerprint mouse, and the key management terminal may be a key management server; the key management server can generate a first key pair, and encrypt the first public key in the first key pair by using the current public key in the current key pair of the fingerprint mouse to obtain a first encrypted public key; then the key management server sends a key update request carrying a first encryption public key to the fingerprint mouse; the fingerprint mouse receives a key update request sent by the key management server.
The current key pair may be understood as a public key and a private key which are randomly generated by the external input device during the last key update, and the current key pair may include a current private key and a current public key.
The external input device and the key management end can carry out data encryption transmission in an asymmetric encryption mode, so that the external input device and the key management end can randomly generate public and private keys and update the public keys generated randomly to each other. The asymmetric encryption is understood to be a data encryption manner of encrypting and decrypting by using two keys, and specifically, the asymmetric encryption may be encrypted by using a public key and decrypted by using a private key.
Therefore, in an alternative embodiment, the key management end may randomly generate a first key pair, encrypt a first public key in the first key pair by using a current public key in the current key pair of the external input device to obtain a first encrypted public key, and then send a key update request carrying the first encrypted public key to the external input device; when receiving the key updating request, the external input device can decrypt the first encrypted public key by using the current private key in the current key pair randomly generated in the last key updating to obtain the first public key.
Continuing with the above example, the fingerprint mouse may decrypt the first encrypted public key with the current private key of the current key pair randomly generated at the last key update to obtain the first public key upon receiving the key update request sent by the key management server.
In an alternative embodiment, the external input device may randomly generate the second public key and the second private key after decrypting the first encrypted public key with the current private key in the current key pair to obtain the first public key.
The second encryption public key may be understood as an encryption public key obtained by encrypting the second public key by the external input device using the first public key.
Because the data encryption mode of asymmetric encryption is to encrypt by using a public key, and the private key corresponding to the public key is decrypted, in an alternative implementation mode, the external input device can encrypt the second public key by using the first public key to obtain a second encrypted public key, and send the second encrypted public key to the key management end; after receiving the second encrypted public key sent by the external input device, the key management end decrypts the second encrypted public key by using the first private key to obtain the second public key.
The update prompt message may be understood as a message sent by the key management end to the external input device to prompt the update of the current public key.
In an alternative embodiment, after the key management end decrypts the second encrypted public key by using the first private key to obtain the second public key, the key management end may generate an update prompt message and send the update prompt message to the external input device; and the external input equipment receives the update prompt message sent by the key management terminal.
And step 106, updating the current public key to the second public key in response to the update prompt message.
In an alternative embodiment, the current public key may be updated to the second public key after receiving the update-hint message.
For example, if the current public key is a, the first public key is B, the second public key is C, after the key management server decrypts the second encrypted public key by using the first private key to obtain the second public key C, the key management server may store the second public key C in the database, and the key management server may generate an update prompt message and send the update prompt message to the fingerprint mouse; after receiving the update prompt message sent by the key management server, the fingerprint mouse can update the current public key A to the second public key C so as to complete the key update of the fingerprint mouse.
Alternatively, the current private key may be updated to the second private key after the current public key is updated to the second public key in response to the update-prompting message.
In the embodiment, the key non-sensing update of the hardware equipment (external input equipment) can be realized, the update efficiency and speed of the key update are improved, and the problem that the use cost of the hardware equipment is increased due to the fact that the hardware equipment is replaced regularly to achieve the purpose of the key update is solved; for the user, the user does not need to update the key according to operation guidance through the key management end, the flexibility of key update of the hardware equipment is improved, the key update step is simplified, the time cost of the user is saved, and the key update experience of the user is improved.
In some embodiments, before receiving the key update request sent by the key management end, the method may further include: when a physiological characteristic authentication request sent by a key management end is received, collecting the current physiological characteristic of the current user; the method comprises the steps that current physiological characteristics are sent to a key management end, so that the key management end verifies the current physiological characteristics to obtain verification results, when the verification results are verification passing, the key management end verifies device attribute information of external input devices and time information of the current key pair respectively, and the key management end generates the key pair when the verification results of the device attribute information and/or the time information are verification failure, so that the current physiological characteristics of a current user can be verified before key updating, when the verification results are passed, the key management end further verifies the device attribute information of the external input devices and the time information of the current key pair respectively, and when the verification results of the device attribute information and/or the time information are verification failure, the first key pair is accurately and timely generated, and further instantaneity and accuracy of key updating are improved.
The device attribute information may include a device class of the external input device, and the time information may include a valid time interval of the current key pair.
Optionally, before receiving the physiological characteristic authentication request sent by the key management end, the key management end may send a device identifier query request to the external input device when receiving the login request; when receiving a device identification inquiry request, the external input device sends a device identification to a key management end; after the key management device receives the device identifier, a physiological characteristic authentication request can be generated and sent to the external input device, so that the external input device can acquire the current physiological characteristic of the current user.
In an alternative embodiment, the key management end may query the preset information according to the device identifier to obtain a corresponding user identifier when the device identifier is received, and then obtain a preset physiological feature corresponding to the device identifier according to the user identifier, where when the preset physiological feature is matched with the current physiological feature, the verification result of the current physiological feature is that verification is passed. The device identifier may be understood as a device identifier of an external input device, and the user identifier may be understood as a user identifier of a user; the preset information may be understood as storage information of preset physiological features corresponding to the device identifiers, that is, the preset information may include preset physiological features corresponding to the device identifiers.
When the verification result of the current physiological characteristic is that verification is passed, the key management end can determine whether the equipment category is a mark category or not and determine whether the current time belongs to an effective time interval or not; when the equipment category is the mark category, determining that the verification result of the equipment attribute information is verification failure; when the current time does not belong to the effective time interval, determining that the verification result of the time information is verification failure; when the verification result is that verification fails, the key management end generates a first key pair, encrypts the first public key by using the current public key in the current key pair of the external input device to obtain a first encrypted public key, finally generates a key update request carrying the first encrypted public key, and sends the key update request to the external input device.
The marking category may include marking devices, which may be understood as external input devices in which the current time does not belong to a valid time interval of the current key pair and/or the verification result is that the number of times of verification failure exceeds a preset threshold. The preset threshold may be understood as a critical value of the number of times of the preset authentication failure.
For example, assuming that the marking class is marking equipment, the current time is T, the effective time interval of the current key pair is [ T1, T2 ], the current public key is a, and the first public key is B, wherein T does not belong to [ T1, T2 ], when the verification result of the current physiological characteristic is verification passing, the key management end can determine that the equipment class is the marking class, that is, the key management end determines that the verification result of the equipment attribute information is verification failure, and the current time T does not belong to the effective time interval, and the verification result of the time information is verification failure; the key management end can generate a first key pair, the first key pair comprises a first public key B, the key management end encrypts the first public key B by utilizing a current public key A in a current key pair of the external input device to obtain a first encrypted public key, finally generates a key update request carrying the first encrypted public key, and sends the key update request to the external input device.
Fig. 2 is another flow chart of a key updating method according to an embodiment of the present invention, where the method may be performed by a key updating device configured at a key management end according to an embodiment of the present invention, and the device may be implemented in a software and/or hardware manner. In a specific embodiment, the apparatus may be integrated in an electronic device, such as a computer or a server. The following embodiment will be described taking the example of the integration of the apparatus in an electronic device, and referring to fig. 2, the method may specifically include the following steps:
in step 201, a first key pair is generated, the first key pair comprising a first public key and a first private key.
In an alternative embodiment, the key management end checks the device attribute information of the external input device and the time information of the current key pair respectively, and generates the first key pair when the checking result of the device attribute information and/or the checking result of the time information is that the checking fails.
In step 203, a key update request carrying the first encrypted public key is generated, and the key update request is sent to the external input device, so that the external input device decrypts the first encrypted public key by using the current private key in the current key pair to obtain the first public key.
In an alternative embodiment, the external input device may encrypt the second public key with the first public key to obtain a second encrypted public key, and send the second encrypted public key to the key management end; the key management end receives a second encryption public key sent by the external input device.
Optionally, the key management end may store the second public key in the database after decrypting the second encrypted public key with the first private key to obtain the second public key.
In an alternative embodiment, the key management end may decrypt the second encrypted public key with the first private key to obtain the second public key, generate an update-prompting message, and send the update-prompting message to the external input device, so that the external input device responds to the update-prompting message to update the current public key to the second public key.
In the embodiment, the key non-sensing update of the hardware equipment (external input equipment) can be realized, the update efficiency and speed of the key update are improved, and the problem that the use cost of the hardware equipment is increased due to the fact that the hardware equipment is replaced regularly to achieve the purpose of the key update is solved; for the user, the user does not need to update the key according to operation guidance through the key management end, the flexibility of key update of the hardware equipment is improved, the key update step is simplified, the time cost of the user is saved, and the key update experience of the user is improved.
In some embodiments, prior to generating the first key pair, the method further comprises:
sending a physiological characteristic authentication request to the external input device, so that the external input device responds to the physiological characteristic authentication request to acquire the current physiological characteristic of the current user; acquiring current physiological characteristics from external input equipment; and verifying the current physiological characteristics to obtain a verification result. When the verification result is that the verification passes, acquiring equipment attribute information of external input equipment and time information of a current key pair; it is determined whether to trigger execution of the generation of the first key pair based on the device attribute information and the time information.
In an alternative embodiment, determining whether to trigger execution of the generation of the first key pair based on the device attribute information and the time information may include: respectively checking the equipment attribute information and the time information to obtain a checking result of the equipment attribute information and a checking result of the time information; when the verification result of the equipment attribute information and/or the verification result of the time information is verification failure, determining to trigger execution to generate the first key pair, so that whether to trigger generation of the first key pair can be accurately determined, and further the accuracy and the speed of key updating are improved.
Specifically, it may be determined whether the device class is a tag class, and whether the current time belongs to a valid time interval; when the equipment category is the mark category, determining that the verification result of the equipment attribute information is verification failure; and when the current time does not belong to the effective time interval, determining that the verification result of the time information is verification failure. And when the verification result is that the verification fails, the key management end determines to trigger execution to generate a first key pair.
The key updating method provided by the embodiment of the invention is further described by a specific example, wherein a user end and an authentication end can be added between the external input device and the key management end, the user end can interact with the current user and also can communicate with the external input device or the authentication end, the user end can communicate with the key management end through the authentication end, for example, the user end can obtain a physiological characteristic authentication request sent by the key management end through the authentication end and send the physiological characteristic authentication request to the external input device; then the user side can acquire the current physiological characteristics acquired by the external input device when the physiological characteristic authentication request is received. The authentication end can be understood as a communication proxy between the user end and the key management end, and the request message of the user end can be transmitted to the key management end through the authentication end. Optionally, the key management end may include a database, where information such as device identifier, user identifier, etc. may be stored. Fig. 3 is a schematic diagram of a key updating method provided in an embodiment of the present invention, where as shown in fig. 3, an external input device is a fingerprint mouse in fig. 3, a key management end is a key management server in fig. 3, and when a user receives a login request, the user end may send a device identifier query request to the fingerprint mouse; after receiving the equipment identification inquiry request, the fingerprint mouse can feed back the equipment identification of the fingerprint mouse to the user side; the user side may upload the device identification to the authentication side through an authentication interface (e.g., the authentication interface may be an authMathAccount interface); the authentication end can request the temporary session from the key management server according to the received equipment identifier, so that abnormal information inquiry can be avoided, and then the authentication end can communicate the temporary session and send the equipment identifier to the key management server through an equipment identifier sending statement; and the key management server inquires preset information according to the equipment identifier to obtain a corresponding user identifier, and feeds the user identifier back to the user terminal through the authentication terminal.
After receiving the user identification, the user terminal assembles the user identification into a parameter to generate a physiological characteristic authentication request, and sends the physiological characteristic authentication request to an authentication terminal through an authentication interface; the authentication end sends a physiological characteristic authentication request to a key management server; the key management server can send the physiological characteristic authentication request to the fingerprint mouse through the authentication end and the user end when the physiological characteristic authentication request is legal.
When the fingerprint mouse receives a physiological characteristic authentication request sent by the key management end, collecting the current physiological characteristic (such as fingerprint) of the current user; and sending the current physiological characteristics to the key management terminal through the user terminal and the authentication terminal.
When the verification result of the key management server for verifying the current physiological characteristic is verification passing, the key management server respectively verifies the device attribute information of the fingerprint mouse and the time information of the current key pair, generates a first key pair when the verification result of the device attribute information and/or the verification result of the time information is verification failure, encrypts a first public key by using the current public key to obtain a first encrypted public key, finally generates a key update request carrying the first encrypted public key, and sends the key update request to the fingerprint mouse through the user side and the authentication side.
After receiving the key updating request, the fingerprint mouse decrypts the first encrypted public key by using the current private key in the current key pair to obtain a first public key, randomly generates a second public key, encrypts the second public key by using the first public key to obtain a second encrypted public key, and sends the second encrypted public key to the key management server through the user side and the authentication side.
The key management server decrypts the second encrypted public key by using the first private key to obtain a second public key, and sends an update prompt message to the fingerprint mouse.
And the fingerprint mouse receives the update prompt message, and updates the current public key to the second public key in response to the update prompt message to complete key update.
In the embodiment, the key non-sensing update of the hardware equipment (external input equipment) can be realized, the update efficiency and speed of the key update are improved, and the problem that the use cost of the hardware equipment is increased due to the fact that the hardware equipment is replaced regularly to achieve the purpose of the key update is solved; for the user, the user does not need to update the key according to operation guidance through the key management terminal, the flexibility of key update of the hardware equipment is improved, the key update step is simplified, the time cost of the user is saved, and the key update experience of the user is improved
Fig. 4 is a schematic structural diagram of a key updating apparatus according to an embodiment of the present invention, where the apparatus is configured on an external input device, and the apparatus is adapted to execute the key updating method applied to the external input device according to the embodiment of the present invention. As shown in fig. 4, the apparatus may specifically include:
a key update request receiving module 401, configured to receive a key update request sent by a key management end, where the key update request includes a first encrypted public key, where the first encrypted public key is obtained by the key management end encrypting, after generating a first key pair, a first public key in the first key pair with a current public key in a current key pair of the external input device;
a first public key obtaining module 402, configured to decrypt the first encrypted public key with a current private key in the current key pair to obtain the first public key;
a second public key generating module 403, configured to generate a second public key, where the second public key is generated randomly;
a second encrypted public key sending module 404, configured to encrypt the second public key with the first public key to obtain a second encrypted public key, and send the second encrypted public key to the key management end;
An update-prompting message receiving module 405, configured to receive an update-prompting message sent by the key management end after decrypting the second encrypted public key with a first private key in the first key pair to obtain the second public key;
a second public key updating module 406, configured to update the current public key to the second public key in response to the update-prompting message.
Optionally, the apparatus further comprises:
the physiological characteristic acquisition module is used for acquiring the current physiological characteristics of the current user when receiving the physiological characteristic authentication request sent by the key management end;
the physiological characteristic sending module is used for sending the current physiological characteristic to the key management end so that the key management end verifies the current physiological characteristic to obtain a verification result, and the first key pair is generated when the verification result is verification passing, the key management end verifies the equipment attribute information of the external input equipment and the time information of the current key pair respectively, and the verification result of the equipment attribute information and/or the verification result of the time information is verification failure.
It will be apparent to those skilled in the art that, for convenience and brevity of description, only the above-described division of the functional modules is illustrated, and in practical application, the above-described functional allocation may be performed by different functional modules according to needs, i.e. the internal structure of the apparatus is divided into different functional modules to perform all or part of the functions described above. The specific working process of the functional module described above may refer to the corresponding process in the foregoing method embodiment, and will not be described herein.
The device of the embodiment realizes the non-inductive updating of the key of the hardware equipment (the external input equipment), improves the updating efficiency and speed of the key updating, and solves the problem of the increase of the use cost of the hardware equipment caused by the regular replacement of the hardware equipment to achieve the purpose of the key updating; for the user, the user does not need to update the key according to operation guidance through the key management end, the flexibility of key update of the hardware equipment is improved, the key update step is simplified, the time cost of the user is saved, and the key update experience of the user is improved.
Fig. 5 is a schematic diagram of another structure of a key updating device according to an embodiment of the present invention, where the device is configured at a key management end, and the device is adapted to execute a key updating method applied to the key management end according to an embodiment of the present invention. As shown in fig. 5, the apparatus may specifically include:
a first key pair generating module 501, configured to generate a first key pair, where the first key pair includes a first public key and a first private key;
a first encrypted public key generating module 502, configured to encrypt the first public key with a current public key in a current key pair of an external input device to obtain a first encrypted public key;
a key update request sending module 503, configured to generate a key update request carrying the first encrypted public key, and send the key update request to the external input device, so that the external input device decrypts the first encrypted public key with the current private key in the current key pair to obtain the first public key;
A second encrypted public key obtaining module 504, configured to obtain a second encrypted public key from the external input device, where the second encrypted public key is obtained by encrypting, by the external input device, a second public key generated by the external input device using the first public key;
a second public key obtaining module 505, configured to decrypt the second encrypted public key with the first private key to obtain the second public key;
and an update-prompting message sending module 506, configured to send an update-prompting message to the external input device, so that the external input device updates the current public key to the second public key in response to the update-prompting message.
Optionally, the apparatus further comprises:
the authentication request sending module is used for sending a physiological characteristic authentication request to the external input device so that the external input device responds to the physiological characteristic authentication request to acquire the current physiological characteristic of the current user;
the physiological characteristic acquisition module is used for acquiring the current physiological characteristic from the external input equipment;
the physiological characteristic verification module is used for verifying the current physiological characteristic to obtain a verification result;
the information acquisition module is used for acquiring the equipment attribute information of the external input equipment and the time information of the current key pair when the verification result is that the verification is passed;
And the execution module is used for determining whether to trigger execution to generate a first key pair or not based on the equipment attribute information and the time information.
Optionally, the execution module determines whether to trigger execution to generate the first key pair based on the device attribute information and the time information, including:
respectively checking the equipment attribute information and the time information to obtain a checking result of the equipment attribute information and a checking result of the time information;
and when the verification result of the equipment attribute information and/or the verification result of the time information is verification failure, determining to trigger execution to generate a first key pair.
Optionally, the device attribute information includes a device class of the external input device, the time information includes an effective time interval of the current key pair, and the execution module performs verification on the device attribute information and the time information respectively to obtain a verification result of the device attribute information and a verification result of the time information, where the verification result includes:
determining whether the equipment category is a mark category or not, and determining whether the current time belongs to the effective time interval or not;
when the equipment category is the marking category, determining that the verification result of the equipment attribute information is verification failure; and when the current time does not belong to the effective time interval, determining that the verification result of the time information is verification failure.
It will be apparent to those skilled in the art that, for convenience and brevity of description, only the above-described division of the functional modules is illustrated, and in practical application, the above-described functional allocation may be performed by different functional modules according to needs, i.e. the internal structure of the apparatus is divided into different functional modules to perform all or part of the functions described above. The specific working process of the functional module described above may refer to the corresponding process in the foregoing method embodiment, and will not be described herein.
The device of the embodiment realizes the non-inductive updating of the key of the hardware equipment (the external input equipment), improves the updating efficiency and speed of the key updating, and solves the problem of the increase of the use cost of the hardware equipment caused by the regular replacement of the hardware equipment to achieve the purpose of the key updating; for the user, the user does not need to update the key according to operation guidance through the key management end, the flexibility of key update of the hardware equipment is improved, the key update step is simplified, the time cost of the user is saved, and the key update experience of the user is improved.
The embodiment of the invention also provides electronic equipment, which comprises a memory, a processor and a computer program stored in the memory and capable of running on the processor, wherein the processor realizes the key updating method provided by any embodiment when executing the program.
The embodiment of the invention also provides a computer readable medium, on which a computer program is stored, the program, when executed by a processor, implementing the key updating method provided in any of the above embodiments.
Referring now to FIG. 6, there is illustrated a schematic diagram of a computer system 600 suitable for use in implementing an electronic device of an embodiment of the present invention. The electronic device shown in fig. 6 is only an example and should not be construed as limiting the functionality and scope of use of the embodiments of the invention.
As shown in fig. 6, the computer system 600 includes a Central Processing Unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) 602 or a program loaded from a storage section 608 into a Random Access Memory (RAM) 603. In the RAM603, various programs and data required for the operation of the computer system 600 are also stored. The CPU 601, ROM 602, and RAM603 are connected to each other through a bus 604. An input/output (I/O) interface 605 is also connected to bus 604.
The following components are connected to the I/O interface 605: an input portion 606 including a keyboard, mouse, etc.; an output portion 607 including a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, a speaker, and the like; a storage section 608 including a hard disk and the like; and a communication section 609 including a network interface card such as a LAN card, a modem, or the like. The communication section 609 performs communication processing via a network such as the internet. The drive 610 is also connected to the I/O interface 605 as needed. Removable media 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is installed as needed on drive 610 so that a computer program read therefrom is installed as needed into storage section 608.
In particular, according to embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method shown in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication portion 609, and/or installed from the removable medium 611. The above-described functions defined in the system of the present invention are performed when the computer program is executed by a Central Processing Unit (CPU) 601.
The computer readable medium shown in the present invention may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present invention, however, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.
The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The modules and/or units involved in the embodiments of the present invention may be implemented in software, or may be implemented in hardware. The described modules and/or units may also be provided in a processor, e.g., may be described as: the processor comprises a key update request receiving module, a first public key acquisition module, a second public key generation module, a second encryption public key sending module, an update prompt message receiving module and a second public key update module; alternatively, for example, it can be described as: a processor includes a first key pair generation module, a first encrypted public key generation module, a key update request transmission module, a second encrypted public key acquisition module, a second public key acquisition module, and an update hint message transmission module. The names of these modules do not constitute a limitation on the module itself in some cases.
As another aspect, the present invention also provides a computer-readable medium that may be contained in the apparatus described in the above embodiments; or may be present alone without being fitted into the device. The computer readable medium carries one or more programs which, when executed by a device, cause the device to include: receiving a key updating request sent by a key management end, wherein the key updating request comprises a first encryption public key, and the first encryption public key is obtained by the key management end by encrypting a first public key in a first key pair by using a current public key in the current key pair of external input equipment after the first key pair is generated; decrypting the first encrypted public key by using the current private key in the current key pair to obtain a first public key; generating a second public key; encrypting the second public key by using the first public key to obtain a second encrypted public key, and sending the second encrypted public key to the key management terminal; the receiving key management end decrypts the second encrypted public key by using the first private key in the first key pair to obtain an update prompt message sent after the second public key; and updating the current public key to the second public key in response to the update-prompting message. Alternatively, the computer-readable medium carries one or more programs, which when executed by a device, cause the device to include: generating a first key pair comprising a first public key and a first private key; encrypting the first public key by using a current public key in a current key pair of external input equipment to obtain a first encrypted public key; generating a key update request carrying a first encryption public key, and sending the key update request to the external input device, so that the external input device decrypts the first encryption public key by using the current private key in the current key pair to obtain the first public key; obtaining a second encryption public key from the external input device, wherein the second encryption public key is obtained by encrypting a second public key generated by the external input device by using the first public key by the external input device; decrypting the second encrypted public key by using the first private key to obtain a second public key; and sending an update prompt message to the external input device so that the external input device responds to the update prompt message to update the current public key to the second public key.
According to the technical scheme provided by the embodiment of the invention, the key noninductive update of the hardware equipment (external input equipment) can be realized, the update efficiency and speed of the key update are improved, and the problem that the use cost of the hardware equipment is increased due to the fact that the hardware equipment is replaced regularly to achieve the purpose of the key update is solved; for the user, the user does not need to update the key according to operation guidance through the key management end, the flexibility of key update of the hardware equipment is improved, the key update step is simplified, the time cost of the user is saved, and the key update experience of the user is improved.
The above embodiments do not limit the scope of the present invention. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives can occur depending upon design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of the present invention.
Claims (10)
1. A method of key updating, the method being applied to an external input device, the method comprising:
receiving a key updating request sent by a key management end, wherein the key updating request comprises a first encryption public key, and the first encryption public key is obtained by the key management end encrypting a first public key in a first key pair by utilizing a current public key in the current key pair of external input equipment after the first key pair is generated;
Decrypting the first encrypted public key by using a current private key in the current key pair to obtain the first public key;
generating a second public key, the second public key being randomly generated;
encrypting the second public key by using the first public key to obtain a second encrypted public key, and sending the second encrypted public key to the key management terminal;
receiving an update prompt message sent by the key management end after decrypting the second encryption public key by using a first private key in the first key pair to obtain the second public key;
and updating the current public key to the second public key in response to the update prompt message.
2. The method of claim 1, wherein prior to receiving the key update request sent by the key management side, the method further comprises:
when a physiological characteristic authentication request sent by the key management end is received, collecting the current physiological characteristic of the current user;
and sending the current physiological characteristic to the key management end, so that the key management end verifies the current physiological characteristic to obtain a verification result, wherein the first key pair is generated when the verification result is verification passing, the key management end respectively verifies the equipment attribute information of the external input equipment and the time information of the current key pair, and the verification result of the equipment attribute information and/or the verification result of the time information is verification failure.
3. A method for updating a key, the method being applied to a key management terminal, the method comprising:
generating a first key pair, the first key pair comprising a first public key and a first private key;
encrypting the first public key by using a current public key in a current key pair of external input equipment to obtain a first encrypted public key;
generating a key update request carrying the first encryption public key, and sending the key update request to the external input device, so that the external input device decrypts the first encryption public key by using the current private key in the current key pair to obtain the first public key;
obtaining a second encryption public key from the external input device, wherein the second encryption public key is obtained by encrypting a second public key generated by the external input device through the first public key;
decrypting the second encrypted public key by using the first private key to obtain the second public key;
and sending an update prompt message to the external input device so that the external input device responds to the update prompt message to update the current public key to the second public key.
4. A method according to claim 3, wherein prior to said generating the first key pair, the method further comprises:
Sending a physiological characteristic authentication request to the external input device, so that the external input device responds to the physiological characteristic authentication request to acquire the current physiological characteristic of the current user;
acquiring the current physiological characteristic from the external input device;
verifying the current physiological characteristics to obtain a verification result;
when the verification result is that verification passes, acquiring equipment attribute information of the external input equipment and time information of the current key pair;
determining whether to trigger execution of the generation of the first key pair based on the device attribute information and the time information.
5. The method of claim 4, wherein the determining whether to trigger execution of the generation of the first key pair based on the device attribute information and the time information comprises:
respectively checking the equipment attribute information and the time information to obtain a checking result of the equipment attribute information and a checking result of the time information;
and when the verification result of the equipment attribute information and/or the verification result of the time information is verification failure, determining to trigger execution to generate a first key pair.
6. The method of claim 5, wherein the device attribute information includes a device class of the external input device, the time information includes a valid time interval of the current key pair, and the verifying the device attribute information and the time information respectively to obtain a verification result of the device attribute information and a verification result of the time information includes:
Determining whether the equipment category is a mark category or not, and determining whether the current time belongs to the effective time interval or not;
when the equipment category is the marking category, determining that the verification result of the equipment attribute information is verification failure; and when the current time does not belong to the effective time interval, determining that the verification result of the time information is verification failure.
7. A key updating apparatus, the apparatus being configured to an external input device, the apparatus comprising:
a key update request receiving module, configured to receive a key update request sent by a key management end, where the key update request includes a first encrypted public key, where the first encrypted public key is obtained by the key management end encrypting a first public key in a first key pair by using a current public key in a current key pair of the external input device after the first key pair is generated;
the first public key acquisition module is used for decrypting the first encrypted public key by utilizing the current private key in the current key pair to obtain the first public key;
a second public key generation module for generating a second public key, the second public key being randomly generated;
The second encryption public key sending module is used for encrypting the second public key by using the first public key to obtain a second encryption public key and sending the second encryption public key to the key management end;
the update prompt message receiving module is used for receiving the update prompt message sent after the key management end decrypts the second encrypted public key by using the first private key in the first key pair to obtain the second public key;
and the second public key updating module is used for updating the current public key into the second public key in response to the updating prompt message.
8. A key updating apparatus, the apparatus being configured at a key management end, the apparatus comprising:
a first key pair generation module configured to generate a first key pair, where the first key pair includes a first public key and a first private key;
the first encryption public key generation module is used for encrypting the first public key by utilizing the current public key in the current key pair of the external input device to obtain a first encryption public key;
a key update request sending module, configured to generate a key update request carrying the first encrypted public key, and send the key update request to the external input device, so that the external input device decrypts the first encrypted public key with the current private key in the current key pair to obtain the first public key;
The second encryption public key acquisition module is used for acquiring a second encryption public key from the external input device, wherein the second encryption public key is obtained by encrypting a second public key generated by the external input device through the first public key;
the second public key acquisition module is used for decrypting the second encrypted public key by utilizing the first private key to obtain the second public key;
and the update prompt message sending module is used for sending an update prompt message to the external input device so that the external input device responds to the update prompt message to update the current public key to the second public key.
9. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the key updating method according to claim 1 or 2 when executing the program or the processor implements the key updating method according to any of claims 3 to 6 when executing the program.
10. A computer-readable storage medium, on which a computer program is stored, characterized in that the program, when executed by a processor, implements the key updating method according to claim 1 or 2, or the program, when executed by a processor, implements the key updating method according to any one of claims 3 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310135178.6A CN116073999A (en) | 2023-02-17 | 2023-02-17 | Key updating method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310135178.6A CN116073999A (en) | 2023-02-17 | 2023-02-17 | Key updating method and device, electronic equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116073999A true CN116073999A (en) | 2023-05-05 |
Family
ID=86179961
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310135178.6A Pending CN116073999A (en) | 2023-02-17 | 2023-02-17 | Key updating method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116073999A (en) |
-
2023
- 2023-02-17 CN CN202310135178.6A patent/CN116073999A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11665006B2 (en) | User authentication with self-signed certificate and identity verification | |
| CN110061846B (en) | Method, device and computer readable storage medium for identity authentication and confirmation of user node in block chain | |
| CN111224788B (en) | Electronic contract management method, device and system based on block chain | |
| CN106936577B (en) | Method, terminal and system for certificate application | |
| CN111435913B (en) | Identity authentication method and device for terminal of Internet of things and storage medium | |
| CN110611657A (en) | File stream processing method, device and system based on block chain | |
| CN112632521B (en) | Request response method and device, electronic equipment and storage medium | |
| CN113271296B (en) | Login authority management method and device | |
| CN113472790A (en) | Information transmission method based on HTTPS (hypertext transfer protocol secure protocol), client and server | |
| US20220124096A1 (en) | Authorization method and non-transitory computer-readable storage medium | |
| CN111049789B (en) | Domain name access method and device | |
| CN114584381A (en) | Security authentication method and device based on gateway, electronic equipment and storage medium | |
| CN110266653A (en) | A kind of method for authenticating, system and terminal device | |
| CN112235276B (en) | Master-slave equipment interaction method, device, system, electronic equipment and computer medium | |
| CN111399867A (en) | Software upgrading method, device, equipment and computer readable storage medium | |
| CN111010283B (en) | Method and apparatus for generating information | |
| CN115766294B (en) | Cloud server resource authentication processing method, device, equipment and storage medium | |
| CN110602075A (en) | File stream processing method, device and system for encryption access control | |
| CN110995454A (en) | Service verification method and system | |
| CN116073999A (en) | Key updating method and device, electronic equipment and storage medium | |
| CN111726320B (en) | Data processing method, device and equipment | |
| CN114697137B (en) | Application program login method, device, equipment and storage medium | |
| CN111885510B (en) | Attendance checking method, attendance checking client and attendance checking system | |
| US20230224293A1 (en) | Medical device communication certificate management | |
| CN117370959A (en) | Fingerprint authentication method and device, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |