WO2022121940A1

WO2022121940A1 - Information processing method for service key, and serving end and system

Info

Publication number: WO2022121940A1
Application number: PCT/CN2021/136418
Authority: WO
Inventors: 孙吉平; 念龙龙
Original assignee: 北京深思数盾科技股份有限公司
Priority date: 2020-12-09
Filing date: 2021-12-08
Publication date: 2022-06-16

Abstract

Disclosed are an information processing method for a service key, and a serving end and a system. The method is applied to a serving end, and comprises: acquiring first request information sent by a first client, wherein the first request information is used for requesting a serving end to process, by using a stored service key, data to be processed, and the first request information comprises at least one of the following: user information, personal key information and a service key identifier which are in the first client; on the basis of the first request information, acquiring license information corresponding to the service key, wherein the license information comprises at least one license article for using the service key; and when it is determined that the license information meets a first preset condition, calling the service key to process said data, so as to generate a corresponding processing result. By means of the method, a service key can be effectively prevented from being divulged or being illegitimately used, such that the security of the service key is also ensured while a user can flexibly use the service key.

Description

Information processing method, server and system for business key

This application requires an invention patent application titled "Information Processing Method, Server and System for Business Keys" with application number 2020114491288 submitted to the China Patent Office on December 09, 2020, and an invention patent application submitted to China on December 30, 2020 The Patent Office submitted an invention patent application titled "Business Key Information Processing Method, Encryption Machine and Information Processing System" with application number 2020116104576, and an invention patent application submitted to the China Patent Office on December 18, 2020 with the title "Biological-based Featured Service Key Management Method, Server, and System", the priority right of the patent application for invention with application number 2020115114566, which is incorporated herein by reference.

technical field

The present application relates to the field of information security, and in particular, to an information processing method, server and system for a business key.

Background technique

In the field of information security, users need to use business keys to process target tasks, such as digital signatures or data decryption using business keys. But at present, once the service key is sent to a specific handler, the usage of the service key cannot be effectively controlled. For example, the processor sometimes needs to handle business on behalf of the company, and in this case, the corresponding business key needs to be obtained. After the processor is given the business key, the company can no longer effectively control it. This includes: during the processing of the business, the processor can also use the business key that originally belonged to the company without restrictions, and after the processor completes the business, the company The service key cannot be recovered either. Therefore, this way of using the service key will cause great security risks.

SUMMARY OF THE INVENTION

The purpose of the embodiments of the present application is to provide a service key information processing method, server and system, which can effectively prevent the service key from being leaked or illegally used, so that users can flexibly use the service key At the same time, the security of the business key is also guaranteed.

In order to solve the above technical problems, the embodiments of the present application adopt the following technical solutions: an information processing method for a service key, applied to a server, including:

Obtain the first request information sent by the first client, where the first request information is used to request the server to use the stored service key to process the data to be processed, and the first request information includes at least one of the following: User information, personal key information and service key identification in a client;

Obtain license information corresponding to the service key based on the first request information, wherein the license information includes at least one license clause for using the service key;

When it is determined that the license information meets the first preset condition, the service key is invoked to process the data to be processed, and a corresponding processing result is generated.

As an option, when it is determined that the license information meets the first preset condition, invoking the service key to process the data to be processed includes:

obtain a license signature of the license information;

In the case that the license signature is valid, based on the license signature, it is determined whether the license information is valid, wherein the first preset condition includes a condition that the license information is valid.

acquiring first usage information of the service key in the license clause, and acquiring second usage information of the service key in the first request information;

It is determined whether the first use information is consistent with the second use information, wherein the first preset condition includes a condition that the first use information is consistent with the second use information.

As an option, the invoking the service key to process the data to be processed includes:

decrypt the service key with a specific key;

The encryption machine is called to process the data to be processed by using the service key, and a corresponding processing result is generated.

Optionally, the obtaining the license information corresponding to the service key based on the first request information specifically includes:

Obtain license information corresponding to the service key based on at least one of user information, personal key information and service key identification in the first client.

Optionally, the first request information further includes the first biometric feature of the user who requests the service key; the method further includes:

Analyzing the permission information and the first biometric feature respectively, to determine whether the permission information meets the first preset condition, and whether the first biometric feature meets the second preset condition;

Correspondingly, when it is determined that the license information meets the first preset condition, invoking the service key to process the data to be processed includes:

When it is determined that the license information meets the first preset condition and the first biometric feature meets the second preset condition, the service key is invoked to process the data to be processed.

Optionally, the method further includes an operation of obtaining the service key, including:

Acquire second request information sent by a second client, wherein the second request information includes user information and/or client key information in the second client, wherein the client key information includes all the public key of the personal key and/or the identity of the personal key in the second client;

generating a corresponding service key based on the second request information;

Binding the user information and/or client key information with the generated service key.

receiving the service key directly imported by an external device or imported through a second client;

Obtain user information and/or client key information in the second client sent by the second client, wherein the client key information includes the public key of the personal key in the second client and/or or the identification of a personal key;

Bind the user information and/or client key information with the acquired service key.

Optionally, the method further includes receiving license information sent by the second client and signed by the license, wherein the license information further includes licensee information and/or licensee personal key information.

Optionally, the method further includes receiving the data to be processed sent by the first client, wherein the data to be processed is signed based on a personal key.

Optionally, the method further includes:

encrypting the processing result based on the public key of the personal key;

The encrypted processing result is sent to the first client, so that the first client decrypts the processing result through the private key of the personal key.

Optionally, the license terms include at least one of the following: license effective time, license expiration time, license usage times, and usage information.

The embodiment of the present application also provides a method for processing information of a service key, which is applied to the first client and includes:

Send the first request information to the server, so that the server obtains the license information corresponding to the service key based on the first request information, wherein the first request information is used to request the server to use the stored service key processing data to be processed; the first request information includes at least one of the following: user information, personal key information and service key identification in the first client; the license information includes at least one License terms for Business Keys;

Receive the processing result sent by the server, wherein the processing result is that the server calls the service key to process the data to be processed when it is determined that the license information meets the first preset condition generated result.

The embodiment of the present application also provides a server, including:

a first obtaining module, configured to: obtain first request information sent by a first client, wherein the first request information is used to request the server to use the stored service key to process data to be processed, and the first request The information includes at least one of the following: user information, personal key information and service key identification in the first client;

A second obtaining module, configured to: obtain license information corresponding to the service key based on the first request information, wherein the license information includes at least one license clause for using the service key;

A processing module, which is configured to: in the case of determining that the license information meets the first preset condition, call the service key to process the data to be processed, and generate a corresponding processing result.

Embodiments of the present application further provide an information processing system, including the above-mentioned server, and at least one of the above-mentioned first clients.

Embodiments of the present application further provide a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the instructions are run on a computer, the following steps are implemented:

The beneficial effect of the embodiments of the present application is that in the information processing method, the server can escrow the service key to prevent the service key from being leaked or illegally used. When in use, the request information sent by the client corresponding to the user can be analyzed and judged to determine whether the request information conforms to the license terms set by the service key owner, so that the user can flexibly use the service key. At the same time, the security of the business key is also guaranteed.

Description of drawings

FIG. 1 is a flowchart of a service key information processing method according to an embodiment of the application applied to a server;

FIG. 2 is a flowchart of an embodiment of step S3 in FIG. 1 according to an embodiment of the application;

3 is a flowchart of another embodiment of step S3 in FIG. 1 according to an embodiment of the application;

FIG. 4 is a flowchart of the application of the method for processing service key information according to an embodiment of the present application to a first client;

FIG. 5 is a structural block diagram of a server according to an embodiment of the present application.

Detailed ways

Various aspects and features of the present application are described herein with reference to the accompanying drawings.

It should be understood that various modifications may be made to the embodiments claimed herein. Therefore, the above description should not be regarded as limiting, but merely as exemplifications of embodiments. Those skilled in the art will envision other modifications within the scope and spirit of this application.

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the present application and, together with the general description of the application given above and the detailed description of the embodiments given below, serve to explain the advantages of the present application. principle.

These and other features of the present application will become apparent from the following description of preferred forms of embodiment, given as non-limiting examples, with reference to the accompanying drawings.

It should also be understood that although the present application has been described with reference to some specific examples, those skilled in the art will be able to ascertain the realization of many other equivalents of the present application.

The above and other aspects, features and advantages of the present application will become more apparent in view of the following detailed description when taken in conjunction with the accompanying drawings.

Specific embodiments of the present application are hereinafter described with reference to the accompanying drawings; however, it is to be understood that the claimed embodiments are merely examples of the present application, which may be implemented in various ways. Well-known and/or repeated functions and constructions have not been described in detail to avoid obscuring the application with unnecessary or redundant detail. Therefore, specific structural and functional details claimed herein are not intended to be limiting, but merely serve as a basis for the claims and a representative basis for teaching one skilled in the art to variously employ the present invention in substantially any suitable detailed structure. Application.

This specification may use the phrases "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," which may all refer to the same in accordance with the present application or one or more of different embodiments.

An information processing method for a service key according to an embodiment of the present application is applied to a server, where the server may be a server or other electronic device with functions similar to the server, and the method can use the server to escrow the service key. The server can connect with at least one client and implement data interaction. In this embodiment, the first client sends first request information to the server, where the first request information is used to request the server to process the data to be processed by using the stored service key. The service key is stored on the server so that it can be called at any time. It should be noted that the service key of this application is not handed over to the client but is kept by the server to ensure the security of the service key. Of course, the service key can also be sent to the server in advance by the first client with authority or other clients (such as the client where the owner of the service key is located), so that the service key is stored when used. on the server for use. After receiving the first request information, the server can obtain the license information corresponding to the service key based on the first request information, including the user information, personal key information and / or service key identification to obtain license information. When the license information is used, the server can start the acquisition action. At this time, the license information can be provided by the client to the server, and the server can also obtain it from the storage in real time. In the case where the license information and/or the service key meet the first preset condition, if the license information is valid, the license information and the first request information do not logically contradict, and the content and service represented by the first request information If the purpose of the key is the same, the business key is called to process the data to be processed, and the processing result is obtained.

In the information processing method, the server can escrow the service key to prevent the service key from being leaked or illegally used. When in use, the server can analyze and judge the request information sent by the client corresponding to the user to determine whether the request information conforms to the license terms set by the service key owner, so that the user can use the service flexibly At the same time, the security of the business key is also guaranteed.

In order to better understand the above technical solutions, the technical solutions of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It is not intended to limit the technical solutions of the present invention, and the embodiments of the present application and the technical features in the embodiments may be combined with each other without conflict.

FIG. 1 is a flowchart of a service key information processing method according to an embodiment of the present application applied to a server. The information processing method of the embodiment of the present application can be applied to a server, including a server or other electronic equipment with a service function. As shown in FIG. 1 , the method includes the following steps:

S1: Acquire first request information sent by a first client, where the first request information is used to request the server to use the stored service key to process data to be processed, and the first request information includes at least one of the following: User information, personal key information and service key identifier in the first client.

The server can be connected with one or more clients, and the user of the service key or the owner of the service key has corresponding clients. Of course, the owner of the service key can also be the user of the service key, which is not limited here. In this implementation, the first client may be the client corresponding to the user of the service key. The first client sends first request information to the server, so as to request the server to process the data to be processed by using the kept service key. The first request information includes at least one of the following: user information, personal key information and service key identification in the first client. Wherein, the user information can be the relevant information of the user of the service key; the personal key information can be the personal key possessed by the user, such as the public key of the personal key and/or the ID of the personal key, etc.; The key identifier may be information related to the service key requested by the user, such as the ID of the requested service key.

S2: Acquire license information corresponding to the service key based on the first request information, where the license information includes at least one license clause for using the service key.

After receiving the first request information, the server can obtain the license information corresponding to the service key according to at least one feature information included in the first request information. For example, the corresponding license information is obtained according to the user's user information, personal key information and service key identifier. The license information can be pre-stored by the server or obtained by the server from the client. The license information includes at least one license term for using the service key. The license terms can be specific to what is licensed by the owner of the service key. Of course, if the same service key corresponds to different first clients, the license terms may not be the same. This enables the service key to have different usage modes for different users, and the usage modes are flexible. The license terms characterize how the service key is used. For example, the validity time of the license, the expiration time of the license, the number of times of use of the license, and the usage information, etc., so as to ensure that the user can use the service key while also ensuring that the service key cannot be illegally used.

S3: In the case that it is determined that the license information meets the first preset condition, the service key is invoked to process the data to be processed, and a corresponding processing result is generated.

The server needs to analyze and judge the license information to ensure that the license information is valid and the license information also needs to be adapted to the functions of the user and the service key expressed by the first request information. In this embodiment, the license information needs to be analyzed and judged to determine that the license information complies with the first preset condition. If the license information meets the first preset condition, the server can call the service key to process the data to be processed, and generate a corresponding The processing result is processed, and the server can also send the processing result to the first client, thereby meeting the usage requirements of the user of the service key. In addition, the specific content of the first preset condition may be set according to actual usage requirements, for example, it may be set according to the specific content of the service key and the degree of confidentiality of the service key by the server.

In an embodiment of the present application, when it is determined that the license information meets the first preset condition, the service key is invoked to process the data to be processed, as shown in FIG. 2 , including the following: step:

S31, obtain the permission signature of the permission information;

S32. In the case that the license signature is valid, determine whether the license information is valid based on the license signature, wherein the first preset condition includes a condition that the license information is valid.

Specifically, the license signature may be a signature possessed by the owner of the service key, thereby ensuring that the owner of the service key agrees to license the service key, and also ensuring the legality and validity of the license information. The validity of the signature can be verified based on the public key of the owner of the business key when having the permission to verify that the signature is valid. The owner's public key may be provided by the second client corresponding to the owner. If the license signature is valid, it can be verified whether the license information is valid based on the license signature. The first preset condition includes a condition that the license information is valid, that is, the validity of the license information may be a precondition that the license information meets the first preset condition. Of course, the first preset condition may also include other conditions.

In an embodiment of the present application, when it is determined that the license information meets the first preset condition, the service key is invoked to process the data to be processed, as shown in FIG. 3 , including the following: step:

S33, acquiring first usage information of the service key in the license clause, and acquiring second usage information of the service key in the first request information;

S34: Determine whether the first usage information is consistent with the second usage information, wherein the first preset condition includes a condition that the first usage information is consistent with the second usage information.

In this embodiment, on the one hand, when it is determined that the license information meets the first preset condition, the service key is invoked to process the data to be processed; on the other hand, when it is determined that the license information and/or the service key meet the first preset condition In the case of conditions, call the business key to process the data to be processed. From the first aspect, the license clause includes first usage information for using the service key, and the first request information also includes second usage information for using the service key, such as encryption, signature and other purposes. If the first usage information is consistent with the second usage information, it may be a sub-condition of the first preset condition. That is to say, the first purpose information and the second purpose information need to be consistent to start calling the service key. If the license service key in the license clause is used for signature, and the purpose of the requested service key in the first request information is also used for signature, you can It is considered that the first usage information and the second usage information match. On the other hand, the service key itself has third purpose information, such as the purpose of encryption, decryption, signature, signature verification, calculation of mac, and so on. When the first usage information, the second usage information, and the third usage information are all consistent, it can be considered that the sub-conditions of the first preset condition are satisfied. For example, the first client corresponding to the user initiates a "signature" request, and the server checks whether the licensed use of the business key includes the "signature" function. signature function, and the first request information also requests to use the service key to sign, it can be considered that the situation cannot satisfy the first preset condition.

In an embodiment of the present application, the invoking of the service key to process the data to be processed includes the following steps:

decrypt the service key with a specific key;

Exemplarily, on the one hand, the server can use the service key to process the data to be processed; on the other hand, the server can also call the encryption machine to process the data to be processed on the service key.

When encryption is used, the encryption machine can be connected with the server and can exchange data with the server, and the business key can be encrypted by the encryption machine and stored in the server. For example, the service key is encrypted with a specific key possessed by the encryption machine, the check value is calculated, and then the service key is stored in the server, so as to ensure the security of the service key.

When the license information meets the first preset condition, the encryption machine can call the service key through the server, and decrypt the service key with its own specific key, for example, use a unique AES symmetric key to decrypt the service key. key for encryption and/or decryption. After the service key is decrypted, the encryption machine uses the service key to process the data to be processed to generate a corresponding processing result. and send the processing result to the server. The server can send the processing result to the first client, thereby meeting the usage requirements of the user of the service key. In addition, the specific content of the first preset condition can be set according to actual use requirements, and can also be set according to the specific content of the service key and the degree of confidentiality of the service key.

The encryption machine can use the decrypted service key to process the data to be processed, without the need for the server to use the service key to process the data to be processed, which also saves system resources of the server. The encryption machine sends the generated processing result to the server, and the server can return the processing result to the first client to meet the request user's requirement of using the service key.

When the encryption machine sends the processing result to the server, the processing result can be encrypted based on the public key of the requesting user's personal key, thereby ensuring the security of the processing result during transmission. It also enables the server to ensure the security of the encrypted processing result when it is sent to the first client. After receiving the processing result, the first client can use the personal key corresponding to the first client. The private key is decrypted to obtain the specific processing data.

In an embodiment of the present application, the obtaining the license information corresponding to the service key based on the first request information specifically includes:

Exemplarily, the first client may be the client corresponding to the user who requests to use the service key, and the user information may be related information of the user of the service key; the personal key information may be owned by the user. Personal keys, such as the public key of the personal key and/or the ID of the personal key, etc. The server may acquire the license information based on the above-mentioned user information, personal key information and/or service key identifier.

In an embodiment of the present application, the first request information further includes the first biometric feature of the user who requests the service key; the method further includes:

Exemplarily, the first biometric feature may be one or more of the features requested to the user, such as facial features, fingerprint features, and iris features. The first biometric feature can be used to authenticate the identity of the requesting user. Of course, the first request information also includes user information, personal key information and/or service key identification of the requesting user.

The first request information includes the first biometric feature of the user requesting the service key, and the first biometric feature may be one or more of the features requested for the user, such as facial features, fingerprint features, and iris features. Of course, the first request information may also include at least one of the following: user information, personal key information and service key identifiers in the first client. Wherein, the user information can be the relevant information of the requesting user of the service key; the personal key information can be the personal key possessed by the requesting user, such as the public key of the personal key and/or the ID of the personal key, etc.; The service key identifier may be information related to the service key requested by the user provided by the user, such as the ID of the requested service key.

In this embodiment, one or more of the facial features, fingerprint features, and iris features in the first biometric feature of the requesting user may be analyzed. It is determined whether the above-mentioned first biometric feature meets the second preset condition, for example, whether it meets the biometric feature required by the owner of the service key. Moreover, the server also needs to analyze the license information to determine whether it meets the first preset condition. For example, the server needs to determine whether the license information is valid, whether the license information logically contradicts the first request information, and whether the request content contained in the first request information is consistent with the purpose of the service key, etc. When the above sub-conditions are all If the requirements are met, it can be determined that the license information meets the first preset condition.

If the first biometric feature meets the second preset condition, it can be determined that the identity of the requesting user meets the requirements of the owner of the service key, which further ensures the security of the service key. In this implementation, it is also necessary to determine that the license information complies with the first preset condition, before the server can call the service key to process the data to be processed, and generate a corresponding processing result, thereby further improving the security of using the service key. After the processing result is generated, the server can also send the processing result to the first client, thereby meeting the usage requirements of the user of the service key. In addition, the specific content of the first preset condition and the second preset condition can be set according to actual usage requirements. For example, the first preset condition can be set according to the specific content of the service key and the server-side pairing of the service key. the degree of confidentiality to be set. The second preset condition may be adjusted according to the change of the appearance of the requested user, for example, the adjustment may be made according to the change of the fatness or thinness of the facial features of the requested user.

In an embodiment of the present application, the method further includes an operation of generating the service key, including:

generating a corresponding service key based on the second request information;

Exemplarily, the second client may be a client corresponding to the owner of the service key, and the second client may generate all its service keys at the server. For example, the owner of the company can be the owner of the service key, so it can generate the service key it owns on the server through the second client. The generating operation includes: the second client sends second request information to the server, where the second request information includes information about the authorization intention of the owner of the service key, and also includes user information of the second client corresponding to the owner and/or or client key information. The client key information includes the public key of the personal key of the second client and/or the identification of the personal key, such as the personal key ID, according to the user information associated with the owner, the public key of the personal key and/or The identity of the personal key, and the corresponding business key can be generated according to the owner's authorization intent. In this embodiment, the user information and/or client key information can be bound with the generated service key, for example, the service key, user information, and client information are packaged into data packets, and the data packets are calculated to make them Has a key check code, which can be a digital signature, HMAC, CMAC, etc. By binding the user information and/or client key information with the generated service key, the service key can be associated with its owner's information.

In one embodiment, since the owner of the service key can also be the user of the service key, if the owner needs to use the service key, the second client also needs to send the service key to the server. The first request information is to request the server to call the service key to process the preprocessed data. In this case, the second client corresponding to the owner of the service key is equivalent to the first client.

In an embodiment of the present application, the method further includes an operation of obtaining the service key, including:

Exemplarily, the manner in which the server obtains the service key is not limited to its own generation, and can also be obtained in other manners. In this embodiment, the service key can be imported by an external device (such as a mobile phone shield or a device of other business organization), and the import method can be that the external device is directly connected to the server, so as to implement the import operation, so that the server can obtain the key. and store. Or the external device sends the service key to the second client, that is, the client corresponding to the owner of the service key, and the second client sends the service key to the server, so that the server can obtain and store the service key. . In addition, the second client sends user information and/or client key information associated with the owner to the server, wherein the client key information includes the public key of the personal key in the second client and/or the client key information. / or the identification of the personal key, such as the personal key ID. It should be noted that when the second client sends the service key and user information and/or client key information, it may send them separately, or may simultaneously send the service key, user information and/or client key information The key information is sent to the server, and the sending method is not limited here. After the server receives the user information and/or client key information, it can bind the user information and/or client key information with the obtained business key, and can associate the business key with the owner's information. link.

In an embodiment of the present application, the method further includes receiving license information that is signed by the second client and sent by the second client, wherein the license information further includes licensee information and/or the licensee personally key information.

Exemplarily, the license signature is a personal key signature of the second client corresponding to the owner of the service key. The license information includes licensee information and/or licensee personal key information. Therefore, when the server obtains the license information, it can analyze the licensee information and/or the licensee's personal key information in the license information, and then judge whether the license information is suitable for the first request information sent by the first client. For example, if the user information of the user contained in the first request information is consistent with the authorized person information in the license information, the corresponding license information can be obtained.

In an embodiment of the present application, the method further includes receiving the data to be processed sent by the first client, wherein the data to be processed is signed based on a personal key.

Exemplarily, the data to be processed in this implementation may be that the first client sends the data to be processed to the server while sending the first request information to the server, and the data to be processed may be the data to be processed by the first client. It is signed by the personal key related to the user, so as to ensure that the data to be processed is not modified in the process of transmission to the server, which increases the security of the data to be processed.

In an embodiment of the present application, the method further includes the following steps:

encrypting the processing result based on the public key of the personal key;

Exemplarily, the server obtains a corresponding processing result after processing the data to be processed by using the service key, and the server can feed back the processing result to the first client, so as to meet the usage requirements of the user of the service key. When sending the processing result, the server can encrypt the processing result, thereby ensuring the security of the processing result during transmission. For example, the server uses the personal public key corresponding to the first client to encrypt the processing result. After receiving the processing result, the first client can decrypt it using the personal private key corresponding to the first client to obtain the specific processing result. data.

The embodiment of the present application also provides a method for processing information of a service key, which is applied to the first client. As shown in FIG. 4 , the method includes the following steps:

S4: Send the first request information to the server, so that the server obtains the license information corresponding to the service key based on the first request information, wherein the first request information is used to request the server to use the stored data the service key to process the data to be processed; the first request information includes at least one of the following: user information, personal key information and service key identification in the first client; the license information includes at least one License terms for the service key.

Exemplarily, the server can be connected to one or more clients, and the user of the service key or the owner of the service key has corresponding clients. Of course, the owner of the service key can also be the user of the service key, which is not limited here. In this implementation, the first client may be the client corresponding to the user of the service key. The first client sends first request information to the server, so as to request the server to process the data to be processed by using the kept service key. The first request information includes at least one of the following: user information, personal key information and service key identification in the first client. Wherein, the user information can be the relevant information of the user of the service key; the personal key information can be the personal key possessed by the user, such as the public key of the personal key and/or the ID of the personal key, etc.; The key identifier may be information related to the service key requested by the user, such as the ID of the requested service key.

The first client sends the first request information to the server, and the server can obtain the license information corresponding to the service key according to at least one characteristic information included in the first request information. For example, the corresponding license information is acquired according to the user's user information, personal key information, and service key identifier. The license information may be pre-stored by the server or acquired by the server from the client. The license information includes at least one license term for using the service key. The license terms can be specific to what is licensed by the owner of the service key. Of course, if the same service key corresponds to different first clients, the license terms may not be the same. This enables the service key to have different usage modes for different users, and the usage modes are flexible. The license terms characterize how the service key is used. For example, the validity time of the license, the expiration time of the license, the number of times of use of the license, and the usage information, etc., so as to ensure that the user can use the service key while also ensuring that the service key cannot be illegally used.

S5: Receive a processing result sent by the server, wherein the processing result is that the server calls the service key to the pending processing when determining that the license information meets the first preset condition. The result of data processing.

The server needs to analyze and judge the license information to ensure that the license information is valid and the license information also needs to be adapted to the functions of the user and the service key expressed by the first request information. In this embodiment, the license information needs to be analyzed and judged to determine that the license information complies with the first preset condition. If the license information meets the first preset condition, the server can call the service key to process the data to be processed, and generate the corresponding The processing result is processed, and the server can also send the processing result to the first client, thereby meeting the usage requirements of the user of the service key. In addition, the specific content of the first preset condition may be set according to actual usage requirements, for example, it may be set according to the specific content of the service key and the degree of confidentiality of the service key by the server.

The embodiment of the present application also provides a server, and the server may be a server or other electronic device with functions similar to the server, as shown in FIG. 5 , including:

a first obtaining module, configured to: obtain first request information sent by a first client, wherein the first request information is used to request the server to use the stored service key to process data to be processed, and the first request The information includes at least one of the following: user information, personal key information and service key identification in the first client.

Exemplarily, the server can be connected to one or more clients, and the user of the service key or the owner of the service key has corresponding clients. Of course, the owner of the service key can also be the user of the service key, which is not limited here. In this implementation, the first client may be the client corresponding to the user of the service key. The first client sends the first request information to the server, and the first obtaining module obtains the first request information sent by the first client. The first request information is that the first client requests the server to use the kept service key to process the data to be processed. The first request information includes at least one of the following: user information, personal key information and service key identification in the first client. Wherein, the user information can be the relevant information of the user of the service key; the personal key information can be the personal key possessed by the user, such as the public key of the personal key and/or the ID of the personal key, etc.; The key identifier may be information related to the service key requested by the user, such as the ID of the requested service key.

After receiving the first request information, the second obtaining module can obtain the license information corresponding to the service key according to at least one feature information included in the first request information. For example, the corresponding license information is acquired according to the user's user information, personal key information, and service key identifier. The license information may be pre-stored by the server or acquired by the server from the client. The license information includes at least one license term for using the service key. The license terms can be specific to what is licensed by the owner of the service key. Of course, if the same service key corresponds to different first clients, the license terms may not be the same. This enables the service key to have different usage modes for different users, and the usage modes are flexible. The license terms characterize how the service key is used. For example, the validity time of the license, the expiration time of the license, the number of times of use of the license, and the usage information, etc., so as to ensure that the user can use the service key while also ensuring that the service key cannot be illegally used.

The processing module needs to analyze and judge the license information to ensure that the license information is valid and the license information also needs to be adapted to the functions of the user and the service key expressed by the first request information. In this embodiment, the processing module needs to analyze and judge the license information to determine that the license information complies with the first preset condition. If the license information meets the first preset condition, the server can call the service key to process the data to be processed and generate Corresponding processing results, and the server can also send the processing results to the first client, thereby meeting the usage requirements of users of the service key. In addition, the specific content of the first preset condition can be set according to actual use requirements, for example, it can be set according to the specific content of the service key and the degree of confidentiality of the service key by the server.

In an embodiment of the present application, the processing module is further configured to:

obtain a license signature of the license information;

In an embodiment of the present application, the second obtaining module is further configured to:

In an embodiment of the present application, the server further includes a generation module, and the generation module is configured as:

generating a corresponding service key based on the second request information;

Receive the license information sent by the second client and signed by the license, wherein the license information further includes the licensee information and/or the licensee's personal key information.

In an embodiment of the present application, the first acquisition module is further configured to:

The data to be processed sent by the first client is received, wherein the data to be processed is signed based on a personal key.

encrypting the processing result based on the public key of the personal key;

In an embodiment of the present application, the license terms include at least one of the following: license effective time, license expiration time, license usage times, and usage information.

Embodiments of the present application further provide an information processing system, including the above-mentioned server, and at least one of the above-mentioned first clients. Of course, the system may also include a second client. The first client may be the client corresponding to the user of the service key, and the second client may be the client corresponding to the owner of the service key.

The above embodiments are only exemplary embodiments of the present application, and are not intended to limit the present application. The protection scope of the present application is defined by the claims. Those skilled in the art can make various modifications or equivalent replacements to the present application within the spirit and protection scope of the present application, and such modifications or equivalent replacements should also be regarded as falling within the protection scope of the present application.

Claims

An information processing method for a business key, characterized in that, applied to a server, comprising:

Obtain the first request information sent by the first client, where the first request information is used to request the server to use the stored service key to process the data to be processed, and the first request information includes at least one of the following: User information, personal key information and service key identification in a client;

Obtain license information corresponding to the service key based on the first request information, wherein the license information includes at least one license clause for using the service key;

When it is determined that the license information meets the first preset condition, the service key is invoked to process the data to be processed, and a corresponding processing result is generated.
The method according to claim 1, wherein when it is determined that the license information complies with a first preset condition, invoking the service key to process the data to be processed comprises:

obtain a license signature of the license information;

In the case that the license signature is valid, based on the license signature, it is determined whether the license information is valid, wherein the first preset condition includes a condition that the license information is valid.
The method according to claim 1, wherein when it is determined that the license information complies with a first preset condition, invoking the service key to process the data to be processed comprises:

acquiring first usage information of the service key in the license clause, and acquiring second usage information of the service key in the first request information;

It is determined whether the first use information is consistent with the second use information, wherein the first preset condition includes a condition that the first use information is consistent with the second use information.
The method according to claim 1, wherein the invoking the service key to process the data to be processed comprises:

decrypt the service key with a specific key;

The encryption machine is called to process the data to be processed by using the service key, and a corresponding processing result is generated.
The method according to claim 1, wherein the obtaining the license information corresponding to the service key based on the first request information specifically includes:

Obtain license information corresponding to the service key based on at least one of user information, personal key information and service key identification in the first client.
The method according to claim 1, wherein the first request information further comprises a first biometric feature of a user who requests the service key; the method further comprises:

Analyzing the permission information and the first biometric feature respectively, to determine whether the permission information meets the first preset condition, and whether the first biometric feature meets the second preset condition;

Correspondingly, when it is determined that the license information meets the first preset condition, invoking the service key to process the data to be processed includes:

When it is determined that the license information meets the first preset condition and the first biometric feature meets the second preset condition, the service key is invoked to process the data to be processed.
The method according to claim 1, wherein the method further comprises the operation of obtaining the service key, which includes:

Acquire second request information sent by a second client, wherein the second request information includes user information and/or client key information in the second client, wherein the client key information includes all the public key of the personal key and/or the identity of the personal key in the second client;

generating a corresponding service key based on the second request information;

Binding the user information and/or client key information with the generated service key.
The method according to claim 1, wherein the method further comprises the operation of obtaining the service key, which includes:

receiving the service key directly imported by an external device or imported through a second client;

Obtain user information and/or client key information in the second client sent by the second client, wherein the client key information includes the public key of the personal key in the second client and/or or the identification of a personal key;

Bind the user information and/or client key information with the acquired service key.
The method according to claim 7, characterized in that, the method further comprises receiving license information that is signed by the second client and sent by the second client, wherein the license information further includes licensee information and/or Licensee personal key information.
The method of claim 1, further comprising receiving the data to be processed sent by the first client, wherein the data to be processed is signed based on a personal key .
The method according to claim 1, wherein the method further comprises:

encrypting the processing result based on the public key of the personal key;

The encrypted processing result is sent to the first client, so that the first client decrypts the processing result through the private key of the personal key.
The method according to claim 1, wherein the license terms include at least one of the following: license effective time, license expiration time, license usage times, and usage information.
An information processing method for a service key, characterized in that, applied to a first client, comprising:

Send the first request information to the server, so that the server obtains the license information corresponding to the service key based on the first request information, wherein the first request information is used to request the server to use the stored service key processing data to be processed; the first request information includes at least one of the following: user information, personal key information and service key identification in the first client; the license information includes at least one License terms for Business Keys;

Receive the processing result sent by the server, wherein the processing result is that the server calls the service key to process the data to be processed when it is determined that the license information meets the first preset condition generated result.
A server, characterized in that it includes:

a first obtaining module, configured to: obtain first request information sent by a first client, wherein the first request information is used to request the server to use the stored service key to process data to be processed, and the first request The information includes at least one of the following: user information, personal key information and service key identification in the first client;

A second obtaining module, configured to: obtain license information corresponding to the service key based on the first request information, wherein the license information includes at least one license clause for using the service key;

A processing module, which is configured to: in the case of determining that the license information meets the first preset condition, call the service key to process the data to be processed, and generate a corresponding processing result.
An information processing system, characterized by comprising the server according to any one of claims 1 to 12, and at least one first client according to any one of claims 1 to 12.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores instructions, and when the instructions are executed on a computer, the following steps are implemented:

Obtain the first request information sent by the first client, where the first request information is used to request the server to use the stored service key to process the data to be processed, and the first request information includes at least one of the following: User information, personal key information and service key identification in a client;

Obtain license information corresponding to the service key based on the first request information, wherein the license information includes at least one license clause for using the service key;

When it is determined that the license information meets the first preset condition, the service key is invoked to process the data to be processed, and a corresponding processing result is generated.