WO2019227557A1

WO2019227557A1 - Key management method, device, storage medium and apparatus

Info

Publication number: WO2019227557A1
Application number: PCT/CN2018/092987
Authority: WO
Inventors: 易周成
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-06-01
Filing date: 2018-06-27
Publication date: 2019-12-05
Also published as: CN109728902A

Abstract

Disclosed by the present application are a key management method, device, storage medium and apparatus, the method comprising: a key management device receiving a plaintext and target key identifier that are sent by a first server; searching for a target encryption key corresponding to the target key identifier; encrypting the plaintext according to the target encryption key to obtain a ciphertext, and feeding back the ciphertext to the first server such that the first server sends the ciphertext and target key identifier to a second server; receiving the ciphertext and target key identifier that are sent by the second server; searching for a target decryption key corresponding to the target key identifier; decrypting the ciphertext according to the target decryption key to obtain a plaintext, and sending the plaintext to the second server.

Description

Key management method, device, storage medium and device Ranch

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on June 01, 2018, with application number 201810561050.5, and the invention name is "Key Management Method, Device, Storage Medium and Device", the entire contents of which are incorporated by reference In the application.

Technical field

The present application relates to the technical field of key management, and in particular, to a key management method, device, storage medium, and device.

Background technique

In the prior art, the encryption machine purchases hardware and software separately, which is troublesome to upgrade and troublesome to update the algorithm. Key management is bloated and inconvenient to use. It is controlled by external vendors and has no security verification means. The first server and the second server need to perform data interaction. First, the identity certification agency needs to verify the identities of the first server and the second server, pass the audit, and issue certificates. Communication, issuance and management of documents need to involve a large amount of data management, which is inefficient, and the keys are easily lost or stolen. Key management is a very large system, including key distribution, key storage, key expiration, and key expiration period. There are situations where the key is invalid and the key expiration period expires, such as when updating the algorithm or key expiration period. When the time limit expires, the first server is notified, and the second server is not notified. When the second server receives the ciphertext sent by the first server, it cannot be decrypted using the original key because the original key has expired. The first server and the second server must be notified to update the encryption algorithm. The process of updating the algorithm is exposed to a non-secure environment. There is a risk of exposing the algorithm during the update process. Therefore, the cost of the update algorithm is high and the risk is high.

The above content is only provided to assist in understanding the technical solution of the present application, and does not mean that the above content is prior art.

Summary of the Invention

The main purpose of this application is to provide a key management method, device, storage medium, and device, which are aimed at solving the technical problems of bloated key management and low security in the prior art.

To achieve the above objective, the present application provides a key management method, which includes the following steps:

The key management device receives the plain text and the target key identifier sent by the first server;

Find a target encryption key corresponding to the target key identifier;

Encrypt the plaintext according to the target encryption key to obtain a ciphertext, and feed back the ciphertext to the first server, so that the first server sends the ciphertext and the target key Sending the identification to the second server;

Receiving the ciphertext and the target key identifier sent by the second server;

Find a target decryption key corresponding to the target key identifier;

Decrypt the ciphertext according to the target decryption key, obtain a plaintext, and send the plaintext to the second server.

In addition, in order to achieve the above object, the present application also proposes a key management device. The key management device includes a memory, a processor, and a key management program stored on the memory and operable on the processor. The key management program is configured to implement the steps of the key management method as described above.

In addition, in order to achieve the above-mentioned object, the present application also proposes a storage medium on which a key management program is stored. When the key management program is executed by a processor, the key management method described above is implemented. step.

In addition, in order to achieve the above object, the present application also proposes a key management device, which includes a receiving module, a searching module, an encryption module, and a decryption module;

The receiving module is configured to receive a plain text and a target key identifier sent by the first server;

The search module is configured to search for a target encryption key corresponding to the target key identifier;

The encryption module is configured to encrypt the plaintext according to the target encryption key, obtain a ciphertext, and feed back the ciphertext to the first server, so that the first server will encrypt the plaintext Sending the text and the target key identifier to a second server;

The receiving module is further configured to receive the ciphertext and the target key identifier sent by a second server;

The search module is further configured to search for a target decryption key corresponding to the target key identifier;

The decryption module is configured to decrypt the ciphertext according to the target decryption key, obtain a plaintext, and send the plaintext to the second server.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic structural diagram of a key management device for a hardware operating environment according to a solution of an embodiment of the present application; FIG.

FIG. 2 is a schematic flowchart of a first embodiment of a key management method of this application;

3 is a schematic flowchart of a second embodiment of a key management method of this application;

4 is a schematic flowchart of a third embodiment of a key management method of this application;

5 is a schematic flowchart of a fourth embodiment of a key management method of this application;

FIG. 6 is a structural block diagram of a first embodiment of a key management apparatus of the present application.

The implementation, functional characteristics and advantages of the purpose of this application will be further described with reference to the embodiments and the drawings.

Detailed ways

It should be understood that the specific embodiments described herein are only used to explain the application, and are not intended to limit the application.

Referring to FIG. 1, FIG. 1 is a schematic structural diagram of a key management device in a hardware operating environment according to a solution of an embodiment of the present application.

As shown in FIG. 1, the key management device may include: a processor 1001, such as a central processing unit (Central Processing Unit (CPU), communication bus 1002, user interface 1003, network interface 1004, and memory 1005. The communication bus 1002 is configured to implement connection and communication between these components. The user interface 1003 may include a display screen. The optional user interface 1003 may further include a standard wired interface and a wireless interface. The wired interface of the user interface 1003 may be a USB interface in this application. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WIreless-FIdelity (WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory (RAM) memory or non-volatile memory Memory (NVM), such as disk storage. The memory 1005 may optionally be a storage device independent of the foregoing processor 1001.

Those skilled in the art can understand that the structure shown in FIG. 1 does not constitute a limitation on the key management device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange different components.

As shown in FIG. 1, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a key management program.

In the key management device shown in FIG. 1, the network interface 1004 is mainly configured to connect to a background server and perform data communication with the background server; the user interface 1003 is mainly configured to connect to a user device; 1001 calls a key management program stored in the memory 1005, and executes the key management method provided in the embodiment of the present application.

Based on the above hardware structure, an embodiment of the key management method of the present application is proposed.

Referring to FIG. 2, FIG. 2 is a schematic flowchart of a first embodiment of a key management method of the present application, and a first embodiment of a key management method of the present application is proposed.

In a first embodiment, the key management method includes the following steps:

Step S10: The key management device receives the plain text and the target key identifier sent by the first server.

It should be understood that the execution subject of this embodiment is a key management device, where the key management device may be an electronic device such as a personal computer or a server. The key management device is in a secure environment, and there are security measures such as a firewall to prevent key leakage and improve the security of key management. The key management device stores a key identifier, an encryption key, and The corresponding relationship between the decryption keys can be obtained by using the target key identifier to find the corresponding target encryption key to encrypt the plaintext. The target encryption key corresponds to a unique target key identifier, and the key identifier sent by the first server may be randomly selected from a key identifier table.

It should be noted that the key management device stores a plurality of encryption keys, and sets a corresponding key identifier for each encryption key. The key identifier may be a number or a letter, and is set to the The encryption keys are numbered to facilitate the management and differentiation of each encryption key. The key management device may store key identifiers corresponding to all encryption keys stored in the key management device as a key identifier table, and when the first server needs to encrypt the plain text, send the first server to the first server. Sending the key identification table, so that the first server randomly selects a key identification from the key identification table as the target key identification.

Step S20: Find a target encryption key corresponding to the target key identifier.

It is understandable that the encryption key is stored in the key management device, and each encryption key corresponds to a key identifier, and the corresponding encryption key can be found in the key management device according to the key identifier. Each encryption key in the key management device is randomly generated. Specifically, the encryption key may be an encryption key generated by a combination of one or more encryption algorithms. That is, the target encryption key may be a combination of one or more encryption algorithms, and the encryption algorithm includes a data encryption algorithm (Data Encryption Algorithm (DEA) encryption algorithm, Advanced Encryption Standard Standard (AES) encryption algorithm, RSA encryption algorithm, base64 encryption algorithm, Message Digest Algorithm fifth edition MD5), Secure Hash Algorithm Algorithm, SHA1), combinations of mathematical operations, combinations of alphabetical operations, etc. The key management device may obtain multiple encryption keys by randomly combining one or any of the encryption algorithms.

Step S30: encrypt the plaintext according to the target encryption key to obtain a ciphertext, and feed the ciphertext back to the first server, so that the first server sends the ciphertext and the ciphertext The target key identifier is sent to the second server.

It should be noted that the key management device stores a correspondence between a key identifier, an encryption key, and a decryption key, and the target encryption key is any combination of one or more algorithms. The target encryption key encrypts the plain text, and the key management device is in a secure environment, making the encryption process more secure. For example, if the plaintext is 5678, the target key identifier is 001, and the corresponding target encryption key is: (plaintext + 1234) * 2, and the target decryption key is: ciphertext / 2-1234, then the ciphertext is obtained. Is 13824, the ciphertext 13824 and the target key identifier 001 are sent to the first server, and the first server sends the ciphertext 13824 and the target key identifier 001 to the second server . Generally, the amount of data sent by the first server to the second server is large, but only part of the data is plain text that needs to be encrypted.

Step S40: Receive the ciphertext and the target key identifier sent by the second server.

In specific implementation, when the second server receives the ciphertext and the target key identifier sent by the first server, the ciphertext and the target key identifier are sent to the ciphertext. A key management device, so that the key management device searches for a target decryption key corresponding to the target key identifier to decrypt the ciphertext.

Step S50: Find a target decryption key corresponding to the target key identifier.

It should be understood that the key management device stores a correspondence between an encryption key corresponding to a key identifier and a decryption key, and extracts a target corresponding to the target key identifier from the correspondence. Decryption key.

Step S60: Decrypt the ciphertext according to the target decryption key, obtain a plaintext, and send the plaintext to the second server.

It can be understood that the ciphertext is decrypted by using the found target decryption key, and the key management device is in a secure environment, making the decryption process more secure. For example, the second server sends the ciphertext 13824 and the target key identifier 001 to the key management device, and the key management device searches for and associates the key identifier with the stored correspondence. The target decryption key corresponding to 001: ciphertext / 2-1234. The target decryption key: ciphertext / 2-1234 is used to decrypt the ciphertext 13824, so that the plaintext is 5678, and the decrypted The plain text 5678 is sent to the second server, thereby implementing communication between the first server and the second server, and improving the security of data encryption and decryption.

In a first embodiment, the key management device receives the plaintext and the target key identifier sent by the first server, finds a target encryption key corresponding to the target key identifier, and pairs the plaintext according to the target encryption key. Performing encryption to obtain a ciphertext, and encrypting the plaintext through the key management device, which is usually in a secure environment, which improves the security of encryption; and feeds back the ciphertext to the A first server, so that the first server sends the ciphertext and the target key identifier to a second server without transmitting a key, reducing the risk of key leakage; receiving the secret sent by the second server Text and the target key identifier, find a target decryption key corresponding to the target key identifier, decrypt the ciphertext according to the target decryption key, obtain a plaintext, and send the plaintext to all Mentioned second server. The key management device decrypts the ciphertext to improve the security of decryption. The first server and the second server do not need to store keys, which reduces the risk of theft in the key storage process.

Referring to FIG. 3, FIG. 3 is a schematic flowchart of a second embodiment of the key management method of the present application. Based on the first embodiment shown in FIG. 2 above, a second embodiment of the key management method of the present application is proposed.

In a second embodiment, before step S10, the method includes:

Step S01: Receive the encryption request sent by the second server.

Understandably, in order to meet special requirements, the encryption requirement may be that the second server requires that the ciphertext must be in a certain format (such as visible characters or numbers), or in order to confuse audiovisual, make the ciphertext appear The plaintext is similar. For example, the plaintext is a string of numbers. You can set the encryption key to a series of mathematical operations so that the ciphertext obtained by the encryption key is a string of digits with the same number of digits as When maliciously intercepted, the interceptor mistakes the ciphertext as plaintext.

Step S02: Find a target encryption key and a corresponding target key identifier according to the encryption requirement.

It should be understood that, in order to improve the encryption efficiency, the encryption requirements of each server may be collected in advance, and a corresponding encryption key is set according to the collected encryption requirements of each server, so that the plaintext encryption obtained through the encryption key is used for encryption. Text can meet the encryption requirements. Generally, there may be multiple encryption keys that meet the requirements for an encryption requirement, and each encryption key is set with a corresponding key identifier. Multiple encryption keys that meet the requirements can be stored as an encryption key set, and all The correspondence between the encryption key set and the corresponding encryption requirements is described. Therefore, a target encryption key and a corresponding target key identifier that meet the encryption requirements can be found from the foregoing correspondence.

Step S03: Send the target key identifier to the first server.

It should be noted that, in order to make the ciphertext encrypted by the plaintext of the first server through the key management device comply with the encryption requirements of the second server, a key corresponding to the encryption key that meets the encryption requirements The identification is sent to the first server. Then, the first server may encrypt the plain text by sending the plain text to be encrypted and the target key identifier to the key management device.

In a second embodiment, the key management device receives an encryption request sent by a second server, finds a target encryption key and a corresponding target key identifier according to the encryption request, and sends the target key identifier to all The first server is described, so that the first server can encrypt the plain text by sending the plain text that needs to be encrypted and the target key identifier to the key management device to obtain encryption requirements that meet the requirements of the second server. Cipher text.

Referring to FIG. 4, FIG. 4 is a schematic flowchart of a third embodiment of the key management method of the present application. Based on the second embodiment shown in FIG. 3 described above, a third embodiment of the key management method of the present application is proposed.

In a third embodiment, the step S02 includes:

Step S021: Extract the target ciphertext type from the encryption requirement.

It should be understood that the encryption requirement may be to encrypt plain text into a series of numbers, characters, or a combination of numbers and characters, that is, the target cipher text type includes a series of numbers, characters, or a combination of numbers and characters.

Step S022: Finding a target encryption key set corresponding to the target ciphertext type from a first preset mapping relationship table, where the first preset mapping relationship table includes information between the ciphertext type and the encryption key set. Correspondence.

It should be noted that, in order to improve the encryption efficiency of the key management device, the encryption requirements of the second server may be collected in advance, and corresponding encryption keys are set according to the collected encryption requirements of the second server, so that all The ciphertext obtained by encrypting the plaintext by using the encryption key can meet the encryption requirements. By using the cipher text type extracted from the encryption requirements, different encryption keys are set for different cipher text types. Generally, there may be multiple encryption keys that meet the requirements for a cipher text type. The keys are respectively set with corresponding key identifiers, and multiple encryption keys that meet the requirements can be stored as an encryption key set, and a first preset relationship is established between the encryption key set and the corresponding cipher text type. Mapping relationship table. Therefore, a target encryption key set that meets the encryption requirements can be found from the first preset mapping relationship table.

Step S023: randomly select an encryption key from the target encryption key set as the target encryption key.

In a specific implementation, since the encryption keys in the target encryption key set all meet the encryption requirements, randomly selecting an encryption key from the target encryption key set can meet the encryption requirements.

Step S024: Find a target key identifier corresponding to the target encryption key.

Understandably, each encryption key is provided with a corresponding key identifier, and then a target key identifier corresponding to the target encryption key can be found, and the target key identifier is sent to the first server. So that the first server can encrypt the plaintext by sending the plaintext that needs to be encrypted and the target key identifier to the key management device to obtain a ciphertext that meets the encryption requirements.

It should be noted that after the plaintext is encrypted into the ciphertext by the target encryption key, the ciphertext needs to be decrypted by the corresponding target decryption key. For example, the target encryption key is a For a series of mathematical operations, the target decryption key is a series of reverse mathematical operations corresponding to the target encryption key. The key management device stores multiple encryption keys, and generally generates corresponding decryption keys based on the encryption keys. In order to quickly find the corresponding encryption key and decryption key through the key identifier, the encryption key and the decryption key are decrypted. The correspondence between the key and the key identifier is established as a second preset mapping relationship table, and then the target decryption key corresponding to the target key identifier can be quickly found through the second preset mapping relationship table. In this embodiment, the step S50 includes: finding a target decryption key corresponding to the target key identifier from the second preset mapping relationship table, and the second preset mapping relationship table includes Correspondence between key identification, encryption key, and decryption key.

In a third embodiment, after step S60, the method further includes:

Step S70: Receive a key update instruction sent by the first server, and extract a target key identifier from the key update instruction.

It should be understood that the key management device does not need to perform key distribution at the time of use, and directly distributes and uses keys in a secure environment, and can even encrypt one key at a time, which is suitable for confidential transmission between most systems. The first server may send a key update instruction to the key management device for key update. The key update instruction usually includes a target key identifier, and the key management device may update the key according to the instruction from the key. The original target encryption key can be found by extracting the target key identifier from it, so as to find an encryption key different from the original target encryption key as the new target encryption key.

Step S80: randomly select an encryption key from the encryption keys in the encryption key set other than the target encryption key corresponding to the target key identifier as a new target encryption key.

It can be understood that the encryption key set includes multiple encryption keys, and the target encryption key corresponding to the target key identifier is an encryption key originally used by the first server and the second server. , Exclude it, and randomly obtain an encryption key from the remaining encryption keys as the new target encryption key, that is, update the encryption key.

Step S90: Find a new target key identifier corresponding to the new target encryption key, and send the new target key identifier to the first server, so that the first server sends the The plain text and the new target key are identified to the key management device to encrypt the plain text.

It should be noted that when a new target encryption key is obtained, a new target key identifier corresponding to the new target encryption key can be found from the second preset mapping relationship, and the new target encryption key is Sending the target key identifier to the first server, so that the first server and the second server can be encrypted by using the new target encryption key corresponding to the new key identifier, and using the new The new target decryption key corresponding to the key ID is decrypted. Sending the new target key identifier to the first server, so that the first server sends the plain text and the new target key identifier to the key management device to encrypt the plain text, specifically The key management device receives the plain text and the new target key identifier sent by the first server; finds a new target encryption key corresponding to the new target key identifier; and according to the new target encryption key pair Encrypt the plaintext to obtain a ciphertext, and feed the ciphertext to the first server, so that the first server sends the ciphertext and the new target key identifier to a second server Receiving the ciphertext and the new target key identifier sent by the second server; finding a new target decryption key corresponding to the new target key identifier; and according to the new target decryption key pair The ciphertext is decrypted to obtain a plaintext, and the plaintext is sent to the second server. The key management device can update the stored encryption key at any time. Since the key management device is in a secure environment, there are security measures such as a firewall to prevent the leakage of encryption keys and decryption keys, and to improve the update of encryption keys. Key and decryption key security.

In this embodiment, since the target encryption key is randomly selected from the target encryption key set, the security of encryption is improved. The first server and the second server may perform encryption by using a new target encryption key corresponding to the new key identifier, and perform decryption by using a new target decryption key corresponding to the new key identifier, With the key update instruction sent by the first server, it is even possible to update the encryption key every time data is transmitted, thereby improving the security of updating the encryption key and the decryption key.

Referring to FIG. 5, FIG. 5 is a schematic flowchart of a fourth embodiment of the key management method of the present application. Based on the first embodiment, the second embodiment, and the third embodiment, a fourth embodiment of the key management method of the present application is proposed. In this embodiment, the description will be based on the first embodiment.

In the fourth embodiment, before step S20, the method further includes:

Step S101: Obtain a first device identifier of the first server, and determine whether the first server belongs to a registered user of the key management device according to the first device identifier.

It can be understood that the first device identifier is an identifier set to identify the first server, and the first server corresponds to a unique first device identifier. The key management device is in a secure environment. Before encrypting the plain text sent by the first server, the identity of the first server needs to be checked to determine whether the first server is the key management. A registered user of the device, if the first server is a registered user of the key management device, finds a target encryption key corresponding to the target key identifier.

If so, step S20 is performed.

It should be understood that if the first server belongs to a registered user of the key management device, it searches for a target encryption key corresponding to the target key identifier, and then according to the found target encryption key pair The plain text is encrypted; if the first server does not belong to a registered user of the key management device, the step of finding a target encryption key corresponding to the target key identifier is not performed. The key management device is in a secure environment and only encrypts its registered users, which further improves the security of key management.

In a fourth embodiment, before step S50, the method further includes:

Step S401: Obtain a second device identifier of the second server, and determine whether the second server belongs to a registered user of the key management device according to the second device identifier.

It should be noted that the second device identifier is an identifier set to identify the second server, and the second server corresponds to a unique second device identifier. The key management device is in a secure environment. Before decrypting the ciphertext sent by the second server, the identity of the second server needs to be checked to determine whether the second server is the key. A registered user of the management device, if the second server is a registered user of the key management device, finds a target decryption key corresponding to the target key identifier.

If so, step S50 is performed.

In specific implementation, if the second server belongs to a registered user of the key management device, find a target decryption key corresponding to the target key identifier, and then according to the found target decryption key pair, The ciphertext is decrypted; if the second server does not belong to a registered user of the key management device, the step of finding a target decryption key corresponding to the target key identifier is not performed. The key management device is in a secure environment and only decrypts its registered users, which further improves the security of key management.

In this embodiment, whether the first server belongs to a registered user of the key management device is determined according to the first device identifier, and only the registered user is encrypted, which further improves the security of key management; The second device identifier of the second server is used to determine whether the second server belongs to a registered user of the key management device according to the second device identifier, and only the registered user is decrypted, which further improves the key management. safety.

In addition, an embodiment of the present application further provides a storage medium, where a key management program is stored, and when the key management program is executed by a processor, implements the steps of the key management method described above. The storage medium may be a non-volatile readable storage medium.

In addition, referring to FIG. 6, an embodiment of the present application further provides a key management apparatus. The key management apparatus includes: a receiving module 10, a searching module 20, an encryption module 30, and a decryption module 40;

The receiving module 10 is configured to receive a plain text and a target key identifier sent by the first server;

The search module 20 is configured to search for a target encryption key corresponding to the target key identifier;

The encryption module 30 is configured to encrypt the plaintext according to the target encryption key, obtain a ciphertext, and feed back the ciphertext to the first server, so that the first server sends the Sending the ciphertext and the target key identifier to a second server;

The receiving module 10 is further configured to receive the ciphertext and the target key identifier sent by a second server;

The search module 20 is further configured to search for a target decryption key corresponding to the target key identifier;

The decryption module 40 is configured to decrypt the ciphertext according to the target decryption key, obtain a plaintext, and send the plaintext to the second server.

For other embodiments or specific implementations of the key management apparatus described in this application, reference may be made to the foregoing method embodiments, and details are not described herein again.

It should be noted that in this article, the terms "including", "including" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, It also includes other elements that are not explicitly listed, or elements that are inherent to such a process, method, article, or system. Without more restrictions, an element limited by the sentence "including a ..." does not exclude the existence of other identical elements in the process, method, article, or system that includes the element.

The above-mentioned serial numbers of the embodiments of the present application are merely for description, and do not represent the superiority or inferiority of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand the above. The method of the embodiment can be implemented by means of software plus a necessary universal hardware platform. Hardware, but in many cases the former is a better implementation. Based on such an understanding, the technical solution of the present application in essence or a part that contributes to the existing technology may be in the form of a software product. Now, the computer software product is stored in a storage medium (such as a Read Only Memory image (ROM) / Random Access Memory (Random Access Memory (RAM), magnetic disks, and optical disks) include a number of instructions for causing a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the embodiments of this application.

The above are only preferred embodiments of the present application, and thus do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the description and drawings of the application, or directly or indirectly used in other related technical fields Are included in the scope of patent protection of this application. Ranch

Claims

A key management method, wherein the key management method includes the following steps:

The key management device receives the plain text and the target key identifier sent by the first server;

Find a target encryption key corresponding to the target key identifier;

Encrypt the plaintext according to the target encryption key to obtain a ciphertext, and feed back the ciphertext to the first server, so that the first server sends the ciphertext and the target key Sending the identification to the second server;

Receiving the ciphertext and the target key identifier sent by the second server;

Find a target decryption key corresponding to the target key identifier;

Decrypt the ciphertext according to the target decryption key, obtain a plaintext, and send the plaintext to the second server.
The key management method according to claim 1, wherein before the key management device receives the plain text and the key identifier sent by the first server, the key management method further comprises:

Receiving the encryption request sent by the second server;

Searching for a target encryption key and a corresponding target key identifier according to the encryption requirement;

Sending the target key identifier to the first server.
The key management method according to claim 2, wherein the finding a target encryption key and a corresponding target key identifier according to the encryption requirement comprises:

Extracting a target cipher text type from the encryption requirement;

Searching for a target encryption key set corresponding to the target ciphertext type from a first preset mapping relationship table, where the first preset mapping relationship table includes a correspondence between the ciphertext type and the encryption key set;

Randomly selecting an encryption key from the target encryption key set as the target encryption key;

Finding a target key identifier corresponding to the target encryption key.
The key management method according to claim 3, wherein after decrypting the ciphertext according to the target decryption key, obtaining a plaintext, and sending the plaintext to the second server, the The key management method also includes:

Receiving a key update instruction sent by the first server, and extracting a target key identifier from the key update instruction;

Randomly selecting an encryption key from the encryption keys in the encryption key set other than the target encryption key corresponding to the target key identifier as a new target encryption key;

Find a new target key identifier corresponding to the new target encryption key, and send the new target key identifier to the first server, so that the first server sends the plain text and new Identifying the target key to the key management device to encrypt the plaintext.
The key management method according to claim 4, wherein before the finding a target encryption key corresponding to the target key identifier, the key management method further comprises:

Acquiring a first device identifier of the first server, and determining whether the first server belongs to a registered user of the key management device according to the first device identifier;

If it belongs, the step of finding a target encryption key corresponding to the target key identifier is performed.
The key management method according to claim 5, wherein before the finding a target decryption key corresponding to the target key identifier, the key management method further comprises:

Acquiring a second device identifier of the second server, and determining whether the second server belongs to a registered user of the key management device according to the second device identifier;

If it belongs, the step of finding a target decryption key corresponding to the target key identifier is performed.
The key management method according to claim 4, wherein said searching for a target decryption key corresponding to the target key identifier comprises:

Find a target decryption key corresponding to the target key identifier from the second preset mapping relationship table, and the second preset mapping relationship table includes a key identifier, an encryption key, and a decryption key Corresponding relationship.
A key management device, wherein the key management device includes: a memory, a processor, and a key management program stored on the memory and operable on the processor, and the key management program is configured To achieve the following steps:

The key management device receives the plain text and the target key identifier sent by the first server;

Find a target encryption key corresponding to the target key identifier;

Encrypt the plaintext according to the target encryption key to obtain a ciphertext, and feed back the ciphertext to the first server, so that the first server sends the ciphertext and the target key Sending the identification to the second server;

Receiving the ciphertext and the target key identifier sent by the second server;

Find a target decryption key corresponding to the target key identifier;

Decrypt the ciphertext according to the target decryption key, obtain a plaintext, and send the plaintext to the second server.
The key management device according to claim 8, wherein the key management program is configured to implement the following steps:

Receiving the encryption request sent by the second server;

Searching for a target encryption key and a corresponding target key identifier according to the encryption requirement;

Sending the target key identifier to the first server.
The key management device according to claim 9, wherein the key management program is configured to implement the following steps:

Extracting a target cipher text type from the encryption requirement;

Searching for a target encryption key set corresponding to the target ciphertext type from a first preset mapping relationship table, where the first preset mapping relationship table includes a correspondence between the ciphertext type and the encryption key set;

Randomly selecting an encryption key from the target encryption key set as the target encryption key;

Finding a target key identifier corresponding to the target encryption key.
The key management device of claim 10, wherein the key management program is configured to implement the following steps:

Receiving a key update instruction sent by the first server, and extracting a target key identifier from the key update instruction;

Randomly selecting an encryption key from the encryption keys in the encryption key set other than the target encryption key corresponding to the target key identifier as a new target encryption key;

Find a new target key identifier corresponding to the new target encryption key, and send the new target key identifier to the first server, so that the first server sends the plain text and new Identifying the target key to the key management device to encrypt the plaintext.
The key management device according to claim 11, wherein the key management program is configured to implement the following steps:

Acquiring a first device identifier of the first server, and determining whether the first server belongs to a registered user of the key management device according to the first device identifier;

If it belongs, the step of finding a target encryption key corresponding to the target key identifier is performed.
The key management device according to claim 12, wherein the key management program is configured to implement the following steps:

Acquiring a second device identifier of the second server, and determining whether the second server belongs to a registered user of the key management device according to the second device identifier;

If it belongs, the step of finding a target decryption key corresponding to the target key identifier is performed.
A storage medium, wherein a key management program is stored on the storage medium, and when the key management program is executed by a processor, the following steps are implemented:

The key management device receives the plain text and the target key identifier sent by the first server;

Find a target encryption key corresponding to the target key identifier;

Encrypt the plaintext according to the target encryption key to obtain a ciphertext, and feed back the ciphertext to the first server, so that the first server sends the ciphertext and the target key Sending the identification to the second server;

Receiving the ciphertext and the target key identifier sent by the second server;

Find a target decryption key corresponding to the target key identifier;

Decrypt the ciphertext according to the target decryption key, obtain a plaintext, and send the plaintext to the second server.
The storage medium according to claim 14, wherein when the key management program is executed by a processor, the following steps are implemented:

Receiving the encryption request sent by the second server;

Searching for a target encryption key and a corresponding target key identifier according to the encryption requirement;

Sending the target key identifier to the first server.
The storage medium according to claim 15, wherein a key management program is stored on the storage medium, and when the key management program is executed by a processor, the following steps are implemented:

Extracting a target cipher text type from the encryption requirement;

Searching for a target encryption key set corresponding to the target ciphertext type from a first preset mapping relationship table, where the first preset mapping relationship table includes a correspondence between the ciphertext type and the encryption key set;

Randomly selecting an encryption key from the target encryption key set as the target encryption key;

Finding a target key identifier corresponding to the target encryption key.
The storage medium according to claim 16, wherein a key management program is stored on the storage medium, and when the key management program is executed by a processor, the following steps are implemented:

Receiving a key update instruction sent by the first server, and extracting a target key identifier from the key update instruction;

Randomly selecting an encryption key from the encryption keys in the encryption key set other than the target encryption key corresponding to the target key identifier as a new target encryption key;

Find a new target key identifier corresponding to the new target encryption key, and send the new target key identifier to the first server, so that the first server sends the plain text and new Identifying the target key to the key management device to encrypt the plaintext.
The storage medium according to claim 17, wherein a key management program is stored on the storage medium, and when the key management program is executed by a processor, the following steps are implemented:

Acquiring a first device identifier of the first server, and determining whether the first server belongs to a registered user of the key management device according to the first device identifier;

If it belongs, the step of finding a target encryption key corresponding to the target key identifier is performed.
The storage medium according to claim 18, wherein a key management program is stored on the storage medium, and when the key management program is executed by a processor, the following steps are implemented:

Acquiring a second device identifier of the second server, and determining whether the second server belongs to a registered user of the key management device according to the second device identifier;

If it belongs, the step of finding a target decryption key corresponding to the target key identifier is performed.
A key management device, wherein the key management device includes a receiving module, a searching module, an encryption module, and a decryption module;

The receiving module is configured to receive a plain text and a target key identifier sent by the first server;

The search module is configured to search for a target encryption key corresponding to the target key identifier;

The encryption module is configured to encrypt the plaintext according to the target encryption key, obtain a ciphertext, and feed back the ciphertext to the first server, so that the first server will encrypt the plaintext Sending the text and the target key identifier to a second server;

The receiving module is further configured to receive the ciphertext and the target key identifier sent by a second server;

The search module is further configured to search for a target decryption key corresponding to the target key identifier;

The decryption module is configured to decrypt the ciphertext according to the target decryption key, obtain a plaintext, and send the plaintext to the second server. Ranch