WO2019134241A1

WO2019134241A1 - Method for acquiring dynamic key, device, terminal apparatus, and storage medium

Info

Publication number: WO2019134241A1
Application number: PCT/CN2018/077474
Authority: WO
Inventors: 黄飞
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-01-08
Filing date: 2018-02-28
Publication date: 2019-07-11
Also published as: CN108462686B; CN108462686A

Abstract

Disclosed in the present application are a method for acquiring a dynamic key, a device, a terminal apparatus, and a storage medium. The method for acquiring a dynamic key comprises the following steps executable by a server: acquiring a configuration file sent by a client, the configuration file comprising encrypted ciphertext acquired on the basis of an encryptor and a time of update; calling the encryptor to decrypt the encrypted ciphertext, and acquiring a decrypted random seed and a reference time; acquiring a variable factor on the basis of the time of update and the reference time; and processing the random seed and the variable factor by means of a dynamic key generation algorithm, acquiring a dynamic key, and sending the dynamic key to the client. The method for acquiring a dynamic key effectively solves the issues of time wastage and low security of conventional encryption mechanisms.

Description

Dynamic key acquisition method, device, terminal device and storage medium

This patent application is based on the Chinese Patent Application No. 201810014135.1 filed on Jan. 8, 2018, entitled "Dynamic Key Acquisition Method, Apparatus, Terminal Equipment and Storage Medium", and requires priority.

Technical field

The present application relates to the field of data encryption, and in particular, to a method, an apparatus, a terminal device, and a storage medium for acquiring a dynamic key.

Background technique

At present, the traditional encryption mechanism generally uses an encryption machine for encryption or a software program for encryption. When the encryption is performed by the encryption machine, although the key acquired by the encryption machine is not easily leaked, the key acquisition time is too long due to the large amount of calculation. When using software programs for encryption, although the efficiency of software encryption is high, since the acquired key is fixed, it will cause a big security risk when the key is leaked, causing different degrees of loss and greatly reducing. The security of the data.

Summary of the invention

The embodiment of the present invention provides a method, an apparatus, a terminal device, and a storage medium for acquiring a dynamic key, so as to solve the problem that the traditional encryption mechanism is time-consuming or low in security.

In a first aspect, an embodiment of the present application provides a method for acquiring a dynamic key, including the following steps performed by a server:

Obtaining a configuration file sent by the client, where the configuration file includes an encrypted ciphertext and an update time obtained based on the encryption machine;

Calling the encryption machine to decrypt the encrypted ciphertext, and obtaining the decrypted random seed and the reference time;

Obtaining a variable factor based on the update time and the reference time;

The dynamic seed generation algorithm is used to process the random seed and the variable factor, obtain a dynamic key, and send the dynamic key to the client.

In a second aspect, the embodiment of the present application provides a device for acquiring a dynamic key, including a server, where the server includes:

a configuration file obtaining module, configured to acquire a configuration file sent by the client, where the configuration file includes an encrypted ciphertext and an update time obtained by the encryption machine;

The encryption machine decryption module is configured to invoke the encryption machine to decrypt the encrypted ciphertext, and obtain the decrypted random seed and the reference time;

a variable factor acquisition module, configured to acquire a variable factor based on the update time and the reference time;

The dynamic key acquisition module is configured to process the random seed and the variable factor by using a dynamic key generation algorithm, obtain a dynamic key, and send the dynamic key to the client.

In a third aspect, the embodiment of the present application provides a method for acquiring a dynamic key, which includes the following steps performed by a client:

Use a seed generation tool to obtain random seeds and benchmark time;

Invoking an encryption machine to encrypt the random seed and the reference time to obtain an encrypted ciphertext;

Obtaining a configuration file based on the encrypted ciphertext and an update time, and sending the configuration file to a server;

Receiving the dynamic key generated by the server based on the configuration file.

In a fourth aspect, the embodiment of the present application provides a dynamic key obtaining apparatus, including a client, where the client includes:

A random seed and reference time acquisition module for acquiring a random seed and a reference time using a seed generation tool;

An encrypted ciphertext obtaining module, configured to invoke an encryption machine to encrypt the random seed and the reference time to obtain an encrypted ciphertext;

a configuration file obtaining module, configured to acquire a configuration file based on the encrypted ciphertext and an update time, and send the configuration file to a server;

And a dynamic key receiving module, configured to receive the dynamic key generated by the server based on the configuration file.

In a fifth aspect, an embodiment of the present application provides a terminal device, including a memory, a processor, and computer readable instructions stored in the memory and executable on the processor. When the processor executes the computer readable instructions, the following steps are implemented:

Obtaining a variable factor based on the update time and the reference time;

In a sixth aspect, an embodiment of the present application provides a terminal device, including a memory, a processor, and computer readable instructions stored in the memory and executable on the processor, where the processor executes the computer The following steps are implemented when reading the instruction:

Use a seed generation tool to obtain random seeds and benchmark time;

In a seventh aspect, the embodiment of the present application provides a computer readable storage medium, where the computer readable storage medium stores computer readable instructions, and when the computer readable instructions are executed by the processor, the following steps are implemented:

Obtaining a variable factor based on the update time and the reference time;

In an eighth aspect, an embodiment of the present application provides a computer readable medium storing computer readable instructions, where the computer readable instructions are executed by a processor to implement the following steps:

Use a seed generation tool to obtain random seeds and benchmark time;

In the method, device, terminal device and storage medium for acquiring the dynamic key provided by the embodiment of the present application, the seed generation tool is first used on the client to obtain the random seed and the reference time, so that the client invokes the encryption machine to the random seed and the reference time. Encryption is performed to obtain encrypted ciphertext, which increases the security of the dynamic key. Then, the client obtains the configuration file based on the encrypted ciphertext and the update time, and sends the configuration file to the server, so that the server automatically operates according to the configuration of the configuration file, and the operation is simple, and the efficiency of obtaining the dynamic key is improved. After that, the server obtains the configuration file sent by the client, so that the server invokes the encryption machine to decrypt the encrypted ciphertext in the configuration file, and obtains the decrypted random seed and the reference time, so that the server obtains the variable factor based on the update time and the reference time. So that the server uses the dynamic key generation algorithm to process the random seed and the variable factor to obtain the dynamic key, which improves the key acquisition efficiency and the security of the key.

DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings used in the description of the embodiments of the present application will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present application. Other drawings may be obtained from those skilled in the art based on these drawings without paying any inventive labor.

FIG. 1 is a flowchart of a method for acquiring a dynamic key provided in Embodiment 1.

FIG. 2 is a specific schematic diagram of step S16 of FIG. 1.

FIG. 3 is a specific schematic diagram of step S17 of FIG. 1.

4 is a schematic diagram of an apparatus for acquiring a dynamic key provided in Embodiment 2.

FIG. 5 is a schematic diagram of a terminal device provided in Embodiment 4.

Detailed ways

The technical solutions in the embodiments of the present application are clearly and completely described in the following with reference to the drawings in the embodiments of the present application. It is obvious that the described embodiments are a part of the embodiments of the present application, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope are the scope of the present application.

Example 1

The method for obtaining the dynamic key provided by the application includes the steps of generating a configuration file on the client and generating a dynamic key on the server, which effectively solves the problem that the current traditional encryption mechanism has time-consuming or low security.

Specifically, the client performs the following steps to implement the configuration file generation process:

Use a seed generation tool to obtain random seeds and benchmark time;

The server performs the following steps to implement the dynamic key generation process:

Obtaining a variable factor based on the update time and the reference time;

FIG. 1 is a flow chart showing a method of acquiring a dynamic key in this embodiment. As shown in FIG. 1 , the method for acquiring the dynamic key includes the following steps:

S11: The client uses a seed generation tool to obtain a random seed and a reference time.

Among them, the seed generation tool is an executable program document pre-written by the developer. A random seed is a string of strings randomly generated by the client using a seed generation tool. Since the random seed is randomly generated, the random seed is not easily leaked, and the safety is improved. The base time is the system time generated by the seed generation tool. The client is a terminal with a seed generation tool installed, including but not limited to computers, tablets, and smartphones. The reference time generated by the seed generation tool on the client, specifically converting the acquired system time to the value of milliseconds as the reference time, is advantageous for calculation. In this embodiment, the system time can be obtained by using the Long.parseLong (encryptedDate) method, and then the millisecond value of the system time is obtained by using the System.currentTimeMillis (current time) method.

S12: The client invokes the encryption machine to encrypt the random seed and the reference time to obtain the encrypted ciphertext.

Among them, the encryption machine is a domestically-developed host encryption device that has been authenticated and approved by the national commercial password authority. The key of the encryption machine is not easy to be leaked, and it is mostly used in financial institutions to ensure the case of financial business. The encrypted ciphertext is a string of characters obtained by encrypting with an encryption machine. Specifically, the client invokes the encryption machine to encrypt the random seed and the reference time respectively, and forms a character string obtained by encrypting the random seed (hereinafter referred to as the first character string) and a string encrypted by the reference time (hereinafter referred to as the second String) to obtain the encrypted ciphertext based on the first string and the second character. In this embodiment, the client invokes the encryption machine connected thereto to generate a key pair (public key and private key) by using a public key encryption algorithm, and encrypts the random seed and the reference time by using the public key in the key pair, and The key pair is stored in a password management system in the encryption machine. Among them, the public key encryption algorithm refers to the use of different keys (ie, public and private keys) for encryption and decryption, and the "private key" is not known to others, and the "public key" can be made public. The two must be paired. The data encrypted with the public key must be decrypted with the corresponding private key. The technical security is high, so that the key is not easily leaked.

In this embodiment, the public key encryption algorithm used by the encryption machine includes, but is not limited to, an RSA encryption algorithm. Among them, RSA encryption algorithm is currently the most influential and most commonly used public key encryption algorithm. It can resist most of the password attacks known so far, and has high security. Generally, public key encryption and private key decryption are adopted. .

S13: The client obtains the configuration file based on the encrypted ciphertext and the update time, and sends the configuration file to the server.

Among them, the update time represents the number of time steps, that is, how long it takes to generate a new key. The update time is pre-configured and stored in the configuration file, ultimately guaranteeing when the key update changes. The configuration file is the file that the client obtains based on the update time and the encrypted ciphertext. This configuration file can be written by the developer based on the Java language using the Notepad tool. It can be understood that the configuration file includes a character string obtained after encrypting the random seed (ie, the first character string), a character string obtained by encrypting the reference time (ie, the second character string), and an update time. Specifically, the client obtains a configuration file based on the encrypted ciphertext and the update time, and sends the configuration file to the server, so that the server can generate a key according to the configuration file. The update time in this embodiment is X days, and the specific value of the parameter X is determined by the developer depending on the project situation. In this embodiment, the encrypted ciphertext sent back by the encryption machine and the update time preset by the client are written into the configuration file, and the configuration file is sent to the server, so that the server automatically operates according to the configuration of the configuration file, and the operation is simple. Improve the efficiency of getting dynamic keys.

S14: The server acquires a configuration file sent by the client, where the configuration file includes the encrypted ciphertext and the update time obtained by the encryption machine.

Specifically, the server acquires a configuration file sent by the client, where the configuration file includes an encrypted ciphertext obtained by the encryption machine (including a character string obtained by encrypting the seed (ie, the first character string) and a character obtained by encrypting the reference time. String (ie the second string)) and update time. In this embodiment, the server provides support for generating a dynamic key by acquiring a configuration file.

S15: The server invokes the encryption machine to decrypt the encrypted ciphertext, and obtains the decrypted random seed and the reference time.

Specifically, the server invokes an encryption machine connected to the server to decrypt the encrypted ciphertext in the configuration file, and obtains the decrypted random neutron and the reference time. The encryption machine is an encryption machine connected to the client for generating an encrypted ciphertext. It can be understood that the encryption algorithm used by the encryption machine is decrypted with the private key generated by the RSA algorithm stored in the client calling the encryption machine to obtain the decrypted random seed and the reference time, and the decrypted random seed and the reference are obtained. Time is stored in the server's memory to provide support for subsequent generation of dynamic keys. In this embodiment, since the key pair generated by the client calling the encryption machine is stored in the password management system in the encryption machine, the server directly invokes the private key in the key pair stored in the encryption machine when the server invokes the encryption machine. To avoid the problem of not being able to decrypt the encrypted ciphertext to get random seed and reference time.

S16: The server acquires a variable factor based on the update time and the reference time.

Among them, the variable factor is a calculation parameter in the dynamic encryption algorithm. Specifically, the server acquires the current time and the preset update time, calls the reference time stored in the server memory, and calculates the current time, the update time, and the reference time by using a variable factor calculation formula to obtain the variable factor. Subsequent dynamic key generation algorithms are used to generate dynamic key provisioning support.

S17: The server processes the random seed and the variable factor by using a dynamic key generation algorithm, obtains a dynamic key, and sends the dynamic key to the client.

The dynamic key generation algorithm refers to an algorithm for regenerating a key with the occurrence of an event (a key is used or a certain time lapse, etc.), and has the advantages of high efficiency, simplicity, and high security. A dynamic key is a key obtained by processing a random seed and a variable factor using a dynamic key generation algorithm. Specifically, the dynamic key generation algorithm is used to process the random seed and the variable factor, obtain a dynamic key, and send the dynamic key to the client, so that the client uses the generated dynamic key to perform certain specific information. encrypt and decode). In this embodiment, the dynamic key generation algorithm is used to process the random seed and the variable factor to obtain a dynamic key, which improves the key acquisition efficiency and the security of the key.

S18: The client receives a dynamic key generated by the configuration file sent by the server.

Specifically, the client receives the dynamic key generated by the configuration file sent by the server, and uses the dynamic key to encrypt (decrypt) certain specific information, for example, when the user dynamically logs in to the system, using the dynamic key to log in. . The dynamic key is a key obtained by performing steps S14-S17.

In this embodiment, the seed generation tool is first used on the client to obtain the random seed and the reference time, so that the client invokes the encryption machine to encrypt the random seed and the reference time, obtain the encrypted ciphertext, and increase the security of the dynamic key. Then, the client obtains the configuration file based on the encrypted ciphertext and the update time, and sends the configuration file to the server, so that the server automatically operates according to the configuration of the configuration file, and the operation is simple, and the efficiency of obtaining the dynamic key is improved. After that, the server obtains the configuration file sent by the client, so that the server invokes the encryption machine to decrypt the encrypted ciphertext in the configuration file, and obtains the decrypted random seed and the reference time, so that the server obtains the variable factor based on the update time and the reference time. So that the server uses the dynamic key generation algorithm to process the random seed and the variable factor to obtain the dynamic key, which improves the key acquisition efficiency and the security of the key. The dynamic key is sent to the client, and the message digest is processed by the TOTP algorithm to obtain a dynamic key, which improves the efficiency of dynamic key acquisition.

In a specific embodiment, as shown in FIG. 2, in step S16, the server acquires a variable factor based on the update time and the reference time, and specifically includes the following steps:

S161: The server determines the interval time based on the current time and the reference time.

The interval time is a parameter obtained by calculating the variable factor obtained by subtracting the reference time from the current time. The current time is the millisecond value obtained by the server using the current time acquisition method. The current time acquisition method includes but is not limited to System.currentTimeMillis(), which is convenient for quickly obtaining the millisecond value of the current time. System.currentTimeMillis() produces a millisecond value of the current time, which is actually the number of milliseconds since 0:00 on January 1, 1970. As can be appreciated, the server determines the interval based on the current time and the reference time (milliseconds). The interval time is calculated as t=m-n, where t represents the interval time, m represents the current time (milliseconds), and n represents the reference time (milliseconds).

S162: The server calculates the interval time and the update time by using a variable factor calculation formula to obtain a variable factor, and the variable factor is calculated as a variable factor=[t/T]*T, where t is the interval time, and T is Update time, [] is a rounding operation.

Specifically, the interval time and the update time are calculated using a variable factor calculation formula to obtain a variable factor. When calculating the variable factor based on the variable factor calculation formula, first calculate the quotient of the interval time and the update time, then perform the rounding operation on the quotient value, obtain the rounding value, and then take the product of the rounded value and the update time as Variable factor.

In this embodiment, by calculating the current time into a millisecond value and a millisecond value of the reference time to determine the interval time, the calculation process is simple and convenient, and the dynamic key acquisition efficiency is improved, and then the variable factor calculation formula is used. Interval time and update time are calculated to obtain variable factors, which provide support for generating dynamic keys by using dynamic key generation algorithm.

In another specific implementation manner, after the client obtains the dynamic key sent by the server, the server determines whether the interval time is greater than the update time, so as to achieve the purpose of automatically updating the dynamic key. Specifically, after the step S16, the method for generating the dynamic key further includes the following steps:

S163: If the interval time is greater than the update time, generate key invalidation information, and send the key invalidation information to the client.

The dynamic key invalidation information is used to remind the client that the dynamic key corresponding to the current time is invalid, and needs to generate a new dynamic key reminding information. Specifically, the server also obtains the interval time and compares it with the preset update time. If the interval time is greater than the update time, the key failure information is generated, and the key invalidation information is sent to the client, so that the client performs the step. S11-S13, to obtain the updated configuration file, and send the updated configuration file to the server, so that the server generates a new dynamic key based on the updated configuration file, and sends the dynamic key to the client to achieve automatic replacement dynamics. The purpose of the key is to improve security. The updated configuration file includes the updated encrypted ciphertext and the preset update time.

S164: If the interval time is not greater than the update time, the execution server calculates the interval time and the update time by using a variable factor calculation formula to obtain a variable factor.

Specifically, if the interval time is not greater than the update time, it means that the new key does not need to be replaced, and the server continues to perform the step of calculating the interval time and the update time by using the variable factor calculation formula to obtain the variable factor, that is, performing step S162 .

In this embodiment, the server determines whether the interval time is greater than the update time by using the timing interval. If the interval time is greater than the update time, the key failure information is generated, and the key failure information is sent to the client, so that the client performs the step. S11-S13, to obtain the updated configuration file, and send the updated configuration file to the server, so that the server generates a new dynamic key based on the updated configuration file, and sends the dynamic key to the client to achieve automatic replacement dynamics. The purpose of the key is to improve security. If the interval time is not greater than the update time, the execution server calculates the interval time and the update time by using a variable factor calculation formula to obtain a variable factor.

In a specific embodiment, as shown in FIG. 3, in step S17, the server processes the random seed and the variable factor by using a dynamic key generation algorithm to obtain a dynamic key, which specifically includes the following steps:

S171: The server processes the random seed and the variable factor by using a one-way hash function to obtain a message digest.

Among them, Message Digest, also known as Digital Digest. It is a fixed-length value that uniquely corresponds to a message or text, and is generated by a one-way hash function acting on the message. The calculation formula of the one-way hash function is X=(H(K XOR opad, H(K XOR ipad, T)), where T is a variable factor, K is a random seed, XOR is an exclusive OR operation, and ipad is internal. The loop parameter, opad is the outer loop parameter.

In this embodiment, the seed and variable factors are processed by the HMAC-SHA-1 algorithm in the one-way hash function. Among them, HMAC-SHA-1 is a keyed hash algorithm constructed from the SHA1 hash function and is used as HMAC (Hash-based message authentication code). This HMAC process mixes the key with the message data, hashes the mixed result using a hash function, mixes the resulting hash value with the key, and then applies the hash function again. The output hash value is 160 bits long. SHA-1 (Secure Hash Algorithm, also known as SHS, Secure Hash Standard) is a cryptographic hash algorithm issued by the US government. It will generate a 160-bit hash value from a string of any length. Specifically, the steps to obtain a message digest are as follows:

S1711: Add 0 to the random seed K to create a first string with a sub-length B. Since K (random seed) is randomly generated, the length is not fixed. Therefore, it is necessary to add 0 after the random seed K to create a first character string of length B to ensure the smooth progress of the subsequent calculation process. Where B is the processing block size. In this embodiment, the size of B is 64 bytes. For example, if the word length of K is 20 bytes and B (processing block size) = 64 bytes, then 44 zero bytes 0x00 will be added after K.

S1712: Perform an exclusive OR operation on the character string of B length generated in step S1711 and the ipad to obtain the second character string. Among them, ipad is 0x36363636..., and its length is the same as B (64 bytes). Among them, the XOR operation is also called semi-addition operation, and the XOR algorithm is: 0 XOR 0=0, 1 XOR 0=1, 0 XOR 1=1, 1 XOR 1=0 (that is, the same is 0, the difference is 1 ).

S1713: Fill the variable factor T into the second string to obtain the third string. Specifically, the variable factor T may be directly filled after the second character string to obtain the third character string.

S1714: Use H to act on the third string to obtain the fourth string. Where H is a hash function, and a hash function refers to mapping a binary string of arbitrary length into a short fixed-length binary string.

S1715: Perform an exclusive OR operation on the first character string of the B byte length generated in step S1711 and the opad to obtain the fifth character string. Among them, the opad is 0x5c5c5c..., and its length is the same as B.

S1716: The fourth string is further filled into the fifth string.

S1717: H is applied to the fourth character string to hash the fourth character string to obtain a message digest (a 20-byte (160 bite) array).

In this embodiment, since the random seed is randomly generated, the length is not fixed, and the HMAC-SHA-1 algorithm can accept a string of any size and generate a hash sequence of 160 bits (ie, a message digest), so The HMAC-SHA-1 algorithm processes the seed and variable factors to obtain a message digest, which is convenient for calculation and facilitates subsequent generation of dynamic keys.

S172: The message digest is processed by using the TOTP algorithm to obtain a dynamic key.

The formula of the TOTP algorithm is TOTP(K,T)=Truncate(X)mod 10^d, where T is a variable factor, K is a random seed, mod is a modulus operation, and d is the length of the dynamic key. , X is the message digest. Specifically, since the length of the fifth character string obtained after the hashing of the variable factor T is too long, it needs to be processed by Truncate (dynamic truncation function) to obtain a 32-bit (4 bytes) unsigned integer. To improve the efficiency of obtaining the dynamic key; then, the unsigned integer is modulo-operated with the d-th power of 10 to obtain a digital password of the d-bit, that is, the dynamic key. In this embodiment, the value of d may be 6 or 8, and should not be too long, so as to facilitate user input when using a dynamic key for encryption (decryption).

For example, the resulting message digest (20 bytes) is as follows:

1f|86|98|69|0e|02|ca|16|61|85|50|ef|7f|19|da|8e|94|5b|55|5a

(ie hmac_result[0]...hmac_result[19], hmac_result is the message digest). The process of dynamic truncation is to perform a bitwise AND operation on the last byte of the message digest and 0xf to obtain an offset value (the initial value of the dynamic truncation function). Among them, the operation rule of bitwise AND operation: 00&0=0;0&1=0;1&0=0;1&1=1; that is: two bits are "1" at the same time, the result is "1", otherwise it is 0. Among them, the hexadecimal value of the last byte (the 19th byte is hmac_result[19]) bit is 0x5a (one byte is 8-bit binary), then the lower 4-bit value is 0xa (offset value), offset value Is byte 10 (0xa), then the 4-byte value starts from 10 bytes and is 0x50ef7f19, TOTP(K,T)=0x50ef7f19mod10^6 (or 10^8).

In this embodiment, due to the boundary problem of the algorithm itself, a retraction attempt mechanism is also added, and when the current time point decryption fails, an attempt is made to decrypt using the key of the previous time point. Specifically, the bounce attempt mechanism refers to the decryption of the current time when the decryption is performed by using the generated key (for example, the current time point is 5:13:10s, and the update time is 30s, then at 5:13:40s) The dynamic key has been updated, but the third-party authentication server may receive the updated key due to network delay, resulting in decryption failure. The key is decrypted at the previous point in time to improve the fault tolerance of the algorithm. .

In this embodiment, the server processes the seed and the variable factor by using a one-way hash function, obtains a fixed-length message digest for convenient calculation, and then processes the message digest by using the TOTP algorithm to obtain a dynamic key and improve the dynamic key. The efficiency of the acquisition.

In this embodiment, the seed generation tool is first used on the client to obtain the random seed and the reference time, so that the client invokes the encryption machine to encrypt the random seed and the reference time, obtain the encrypted ciphertext, and increase the security of the dynamic key. Then, the client obtains the configuration file based on the encrypted ciphertext and the update time, and sends the configuration file to the server, so that the server automatically operates according to the configuration of the configuration file, and the operation is simple, and the efficiency of obtaining the dynamic key is improved. After that, the server obtains the configuration file sent by the client, so that the server invokes the encryption machine to decrypt the encrypted ciphertext in the configuration file, and obtains the decrypted random seed and the reference time. The server then determines the interval based on the current time and the reference time to calculate the interval and update time using a variable factor calculation formula to obtain a variable factor to enable the server to perform random seed and variable factors using a one-way hash function. Processing, obtaining a message digest to reduce the amount of calculation; using the TOTP algorithm to process the message digest, obtaining a dynamic key, and improving the efficiency of dynamic key acquisition. The message digest is processed by the TOTP algorithm to obtain a dynamic key, which improves the efficiency of dynamic key acquisition. Moreover, due to the boundary problem of the algorithm itself, a retraction attempt mechanism is also added, and when the current time point decryption fails, the key is decrypted by using the key at the previous time point to improve fault tolerance. Finally, the server further determines whether the interval time is greater than the update time, so that the server obtains the updated dynamic key based on the updated configuration file sent by the client and performs the steps of S14-S18, so as to automatically replace the dynamic key. purpose.

It should be understood that the size of the sequence of the steps in the above embodiments does not mean that the order of execution is performed. The order of execution of each process should be determined by its function and internal logic, and should not be construed as limiting the implementation process of the embodiments of the present application.

Example 2

FIG. 4 is a schematic block diagram showing a device for acquiring a dynamic key corresponding to the method for acquiring a dynamic key in the first embodiment. As shown in FIG. 4, the dynamic key acquisition apparatus includes a server 10 and a client 20. The server includes a configuration file obtaining module 11, an encryption machine decryption module 12, a variable factor acquisition module 13, and a dynamic key acquisition module 14. The client 20 includes the steps of the random seed and reference time acquisition module 21, the encrypted ciphertext acquisition module 22, the configuration file acquisition module 23, and the dynamic key receiving module 24, and the dynamic key acquisition method in the embodiment. Correspondingly, in order to avoid redundancy, the present embodiment will not be described in detail.

The server 10 includes a profile acquisition module 11, a encryptor decryption module 12, a variable factor acquisition module 13, and a dynamic key acquisition module 14.

The configuration file obtaining module 11 is configured to obtain a configuration file sent by the client, where the configuration file includes the encrypted ciphertext and the update time obtained by the encryption machine.

The encryption machine decryption module 12 is configured to invoke the encryption machine to decrypt the encrypted ciphertext, and obtain the decrypted random seed and the reference time.

The variable factor acquisition module 13 is configured to acquire a variable factor based on the update time and the reference time.

The dynamic key obtaining module 14 is configured to process the random seed and the variable factor by using a dynamic key generation algorithm, obtain a dynamic key, and send the dynamic key to the client.

Preferably, the variable factor acquisition module 13 includes an interval time determination unit 131 and a variable factor acquisition unit 132.

The interval determining unit 131 is configured to determine the interval time based on the current time and the reference time.

The first variable factor obtaining unit 132 is configured to calculate the interval time and the update time by using a variable factor calculation formula to obtain a variable factor, and the variable factor calculation formula is a variable factor=[t/T]*T, wherein , t is the interval time, T is the update time, and [] is the rounding operation.

Preferably, the dynamic key acquiring apparatus further includes a key invalidation information acquiring unit 133 and a second variable factor acquiring unit 134.

The key invalidation information obtaining unit 133 is configured to generate key invalidation information if the interval time is greater than the update time, and send the key invalidation information to the client.

The second variable factor obtaining unit 134 is configured to: if the interval time is not greater than the update time, the execution server calculates the interval time and the update time by using a variable factor calculation formula to obtain a variable factor.

Preferably, the dynamic key acquisition module 14 includes a message digest acquisition unit 141 and a dynamic key acquisition unit 142.

The message digest obtaining unit 141 processes the random seed and the variable factor by using a one-way hash function to obtain a message digest.

The dynamic key obtaining unit 142 processes the message digest by using the TOTP algorithm to obtain a dynamic key.

The client 20 includes a random seed and reference time acquisition module 21, an encrypted ciphertext acquisition module 22, a configuration file acquisition module 23, and a dynamic key receiving module 24.

The random seed and reference time acquisition module 21 is configured to acquire a random seed and a reference time using a seed generation tool.

The encrypted ciphertext obtaining module 22 is configured to invoke the encryption machine to encrypt the random seed and the reference time to obtain the encrypted ciphertext.

The configuration file obtaining module 23 is configured to obtain a configuration file based on the encrypted ciphertext and the update time, and send the configuration file to the server.

The dynamic key receiving module 24 is configured to receive a dynamic key generated by the server based on the configuration file.

Example 3

The embodiment provides a computer readable storage medium on which computer readable instructions are stored, and when the computer readable instructions are executed by the processor, the method for acquiring the dynamic key in Embodiment 1 is implemented, in order to avoid duplication. , I won't go into details here. Alternatively, the functions of the modules/units in the apparatus for acquiring the dynamic key in the second embodiment are implemented when the computer readable instructions are executed by the processor. To avoid repetition, details are not described herein again.

The computer readable storage medium can include any entity or device capable of carrying the computer readable instruction code, a recording medium, a USB flash drive, a removable hard drive, a magnetic disk, an optical disk, a computer memory, a read only memory (ROM, Read-Only) Memory), random access memory (RAM), electrical carrier signals, telecommunications signals, and software distribution media.

Example 4

FIG. 5 is a schematic diagram of a terminal device according to an embodiment of the present application. As shown in FIG. 5, the terminal device 50 of this embodiment includes a processor 51, a memory 52, and computer readable instructions 53 stored in the memory 52 and operable on the processor 51. The processor 51 executes the steps of the method for acquiring the dynamic key in the first embodiment, such as steps S11 to S18 shown in FIG. 1, when the computer readable instructions 53 are executed. Alternatively, when the processor 51 executes the computer readable instructions 53, the functions of each module/unit of the dynamic key acquisition apparatus in Embodiment 2 are implemented, such as the configuration file acquisition module 11 and the encryption machine decryption module 12 shown in FIG. The functions of the factor acquisition module 13 and the dynamic key acquisition module 14 or the random seed and reference time acquisition module 21, the encrypted ciphertext acquisition module 22, the configuration file acquisition module 23, and the dynamic key receiving module 24.

Illustratively, computer readable instructions 53 may be partitioned into one or more modules/units, one or more modules/units being stored in memory 52 and executed by processor 51 to complete the application. The one or more modules/units may be an instruction segment of a series of computer readable instructions 53 capable of performing a particular function, which is used to describe the execution of computer readable instructions 53 in the terminal device 50.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The embodiments described above are only used to explain the technical solutions of the present application, and are not limited thereto. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions described in the foregoing embodiments may be modified or equivalently substituted for some of the technical features. Modifications or substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the scope of the present application.

Claims

A method for obtaining a dynamic key, comprising the following steps performed by a server:

Obtaining a configuration file sent by the client, where the configuration file includes an encrypted ciphertext and an update time obtained based on the encryption machine;

Calling the encryption machine to decrypt the encrypted ciphertext, and obtaining the decrypted random seed and the reference time;

Obtaining a variable factor based on the update time and the reference time;

The dynamic seed generation algorithm is used to process the random seed and the variable factor, obtain a dynamic key, and send the dynamic key to the client.
The method for obtaining a dynamic key according to claim 1, wherein the obtaining a variable factor based on the update time and the reference time comprises:

Determining an interval time based on the current time and the reference time;

Calculating the interval time and the update time by using a variable factor calculation formula to obtain a variable factor, and the variable factor is calculated as a variable factor=[t/T]*T, where t is the The interval time, T is the update time, and [] is the rounding operation.
The method for acquiring a dynamic key according to claim 2, wherein after the step of determining the interval time based on the current time and the reference time, the method for acquiring the dynamic key further comprises:

If the interval time is greater than the update time, generating key failure information, and sending the key failure information to the client;

And if the interval time is not greater than the update time, performing the step of calculating the interval time and the update time by using a variable factor calculation formula to obtain a variable factor.
The method for obtaining a dynamic key according to claim 1, wherein the processing of the random seed and the variable factor by using a dynamic key generation algorithm to obtain a dynamic key comprises:

Processing the random seed and the variable factor by using a one-way hash function to obtain a message digest;

The message digest is processed by using the TOTP algorithm to obtain the dynamic key.
The method for acquiring a dynamic key according to claim 4, wherein the one-way hash function has the formula X=(H(K XOR opad, H(K XOR ipad, T)), wherein, T For the variable factor, K is the random seed, XOR is an exclusive OR symbol, ipad is an internal loop parameter, and opad is an external loop parameter;

The formula of the TOTP algorithm is TOTP(K,T)=Truncate(X)mod 10^d, where T is the variable factor, K is the random seed, mod is a modulo operation, and d is a custom The length of the dynamic key, X is the message digest.
A method for obtaining a dynamic key, comprising the following steps performed by a client:

Use a seed generation tool to obtain random seeds and benchmark time;

Invoking an encryption machine to encrypt the random seed and the reference time to obtain an encrypted ciphertext;

Obtaining a configuration file based on the encrypted ciphertext and an update time, and sending the configuration file to a server;

Receiving the dynamic key generated by the server based on the configuration file.
A device for acquiring a dynamic key, comprising:

a configuration file obtaining module, configured to acquire a configuration file sent by the client, where the configuration file includes an encrypted ciphertext and an update time obtained by the encryption machine;

The encryption machine decryption module is configured to invoke the encryption machine to decrypt the encrypted ciphertext, and obtain the decrypted random seed and the reference time;

a variable factor acquisition module, configured to acquire a variable factor based on the update time and the reference time;

The dynamic key acquisition module is configured to process the random seed and the variable factor by using a dynamic key generation algorithm, obtain a dynamic key, and send the dynamic key to the client.
A device for acquiring a dynamic key, comprising:

A random seed and reference time acquisition module for acquiring a random seed and a reference time using a seed generation tool;

An encrypted ciphertext obtaining module, configured to invoke an encryption machine to encrypt the random seed and the reference time to obtain an encrypted ciphertext;

a configuration file obtaining module, configured to acquire a configuration file based on the encrypted ciphertext and an update time, and send the configuration file to a server;

And a dynamic key receiving module, configured to receive the dynamic key generated by the server based on the configuration file.
A terminal device comprising a memory, a processor, and computer readable instructions stored in the memory and operable on the processor, wherein the processor executes the computer readable instructions as follows step:

Obtaining a configuration file sent by the client, where the configuration file includes an encrypted ciphertext and an update time obtained based on the encryption machine;

Calling the encryption machine to decrypt the encrypted ciphertext, and obtaining the decrypted random seed and the reference time;

Obtaining a variable factor based on the update time and the reference time;

The dynamic seed generation algorithm is used to process the random seed and the variable factor, obtain a dynamic key, and send the dynamic key to the client.
The terminal device according to claim 9, wherein the obtaining a variable factor based on the update time and the reference time comprises:

Determining an interval time based on the current time and the reference time;

Calculating the interval time and the update time by using a variable factor calculation formula to obtain a variable factor, and the variable factor is calculated as a variable factor=[t/T]*T, where t is the The interval time, T is the update time, and [] is the rounding operation.
The terminal device according to claim 10, wherein the step of implementing the computer readable instructions by the processor after the step of determining the interval time based on the current time and the reference time further comprises the steps of:

If the interval time is greater than the update time, generating key failure information, and sending the key failure information to the client;

And if the interval time is not greater than the update time, performing the step of calculating the interval time and the update time by using a variable factor calculation formula to obtain a variable factor.
The terminal device according to claim 9, wherein the processing of the random seed and the variable factor by using a dynamic key generation algorithm to obtain a dynamic key comprises:

Processing the random seed and the variable factor by using a one-way hash function to obtain a message digest;

The message digest is processed by using the TOTP algorithm to obtain the dynamic key.
The terminal device according to claim 12, wherein the one-way hash function has the formula X=(H(K XOR opad, H(K XOR ipad, T)), wherein T is the Variable factor, K is the random seed, XOR is an XOR symbol, ipad is an internal loop parameter, and opad is an external loop parameter;

The formula of the TOTP algorithm is TOTP(K,T)=Truncate(X)mod 10^d, where T is the variable factor, K is the random seed, mod is a modulo operation, and d is a custom The length of the dynamic key, X is the message digest.
A terminal device comprising a memory, a processor, and computer readable instructions stored in the memory and operable on the processor, wherein the processor executes the computer readable instructions as follows step:

Use a seed generation tool to obtain random seeds and benchmark time;

Invoking an encryption machine to encrypt the random seed and the reference time to obtain an encrypted ciphertext;

Obtaining a configuration file based on the encrypted ciphertext and an update time, and sending the configuration file to a server;

Receiving the dynamic key generated by the server based on the configuration file.
A computer readable storage medium storing computer readable instructions, wherein the computer readable instructions, when executed by a processor, implement the following steps:

Obtaining a configuration file sent by the client, where the configuration file includes an encrypted ciphertext and an update time obtained based on the encryption machine;

Calling the encryption machine to decrypt the encrypted ciphertext, and obtaining the decrypted random seed and the reference time;

Obtaining a variable factor based on the update time and the reference time;

The dynamic seed generation algorithm is used to process the random seed and the variable factor, obtain a dynamic key, and send the dynamic key to the client.
The computer readable storage medium of claim 15, wherein the obtaining a variable factor based on the update time and the reference time comprises:

Determining an interval time based on the current time and the reference time;

Calculating the interval time and the update time by using a variable factor calculation formula to obtain a variable factor, and the variable factor is calculated as a variable factor=[t/T]*T, where t is the The interval time, T is the update time, and [] is the rounding operation.
A computer readable storage medium according to claim 16 wherein said computer readable instructions are further executed by said processor after said step of determining an interval based on said current time and said reference time :

If the interval time is greater than the update time, generating key failure information, and sending the key failure information to the client;

And if the interval time is not greater than the update time, performing the step of calculating the interval time and the update time by using a variable factor calculation formula to obtain a variable factor.
The computer readable storage medium according to claim 15, wherein the processing the random seed and the variable factor by using a dynamic key generation algorithm to obtain a dynamic key comprises:

Processing the random seed and the variable factor by using a one-way hash function to obtain a message digest;

The message digest is processed by using the TOTP algorithm to obtain the dynamic key.
The computer readable storage medium according to claim 18, wherein the one-way hash function has the formula X = (H (K XOR opad, H (K XOR ipad, T)), wherein T is The variable factor, K is the random seed, XOR is an exclusive OR symbol, ipad is an internal loop parameter, and opad is an external loop parameter;

The formula of the TOTP algorithm is TOTP(K,T)=Truncate(X)mod 10^d, where T is the variable factor, K is the random seed, mod is a modulo operation, and d is a custom The length of the dynamic key, X is the message digest.
A computer readable storage medium storing computer readable instructions, wherein the computer readable instructions, when executed by a processor, implement the following steps:

Use a seed generation tool to obtain random seeds and benchmark time;

Invoking an encryption machine to encrypt the random seed and the reference time to obtain an encrypted ciphertext;

Obtaining a configuration file based on the encrypted ciphertext and an update time, and sending the configuration file to a server;

Receiving the dynamic key generated by the server based on the configuration file.