WO2022121940A1 - Procédé de traitement d'informations pour clé de service, et extrémité de desserte et système - Google Patents

Procédé de traitement d'informations pour clé de service, et extrémité de desserte et système Download PDF

Info

Publication number
WO2022121940A1
WO2022121940A1 PCT/CN2021/136418 CN2021136418W WO2022121940A1 WO 2022121940 A1 WO2022121940 A1 WO 2022121940A1 CN 2021136418 W CN2021136418 W CN 2021136418W WO 2022121940 A1 WO2022121940 A1 WO 2022121940A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
key
service key
license
client
Prior art date
Application number
PCT/CN2021/136418
Other languages
English (en)
Chinese (zh)
Inventor
孙吉平
念龙龙
Original Assignee
北京深思数盾科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN202011449128.8A external-priority patent/CN112565281B/zh
Priority claimed from CN202011511456.6A external-priority patent/CN112671534B/zh
Priority claimed from CN202011610457.6A external-priority patent/CN112733200B/zh
Application filed by 北京深思数盾科技股份有限公司 filed Critical 北京深思数盾科技股份有限公司
Publication of WO2022121940A1 publication Critical patent/WO2022121940A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/146—Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/10—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols with particular housing, physical features or manual controls

Definitions

  • the present application relates to the field of information security, and in particular, to an information processing method, server and system for a business key.
  • the purpose of the embodiments of the present application is to provide a service key information processing method, server and system, which can effectively prevent the service key from being leaked or illegally used, so that users can flexibly use the service key At the same time, the security of the business key is also guaranteed.
  • an information processing method for a service key, applied to a server including:
  • the first request information is used to request the server to use the stored service key to process the data to be processed, and the first request information includes at least one of the following: User information, personal key information and service key identification in a client;
  • license information corresponding to the service key based on the first request information, wherein the license information includes at least one license clause for using the service key;
  • the service key is invoked to process the data to be processed, and a corresponding processing result is generated.
  • invoking the service key to process the data to be processed includes:
  • the license signature is valid
  • the license information is valid, wherein the first preset condition includes a condition that the license information is valid.
  • invoking the service key to process the data to be processed includes:
  • the first preset condition includes a condition that the first use information is consistent with the second use information.
  • the invoking the service key to process the data to be processed includes:
  • the encryption machine is called to process the data to be processed by using the service key, and a corresponding processing result is generated.
  • the obtaining the license information corresponding to the service key based on the first request information specifically includes:
  • the first request information further includes the first biometric feature of the user who requests the service key; the method further includes:
  • invoking the service key to process the data to be processed includes:
  • the service key is invoked to process the data to be processed.
  • the method further includes an operation of obtaining the service key, including:
  • Acquire second request information sent by a second client wherein the second request information includes user information and/or client key information in the second client, wherein the client key information includes all the public key of the personal key and/or the identity of the personal key in the second client;
  • Binding the user information and/or client key information with the generated service key Binding the user information and/or client key information with the generated service key.
  • the method further includes an operation of obtaining the service key, including:
  • client key information includes the public key of the personal key in the second client and/or or the identification of a personal key
  • the method further includes receiving license information sent by the second client and signed by the license, wherein the license information further includes licensee information and/or licensee personal key information.
  • the method further includes receiving the data to be processed sent by the first client, wherein the data to be processed is signed based on a personal key.
  • the method further includes:
  • the encrypted processing result is sent to the first client, so that the first client decrypts the processing result through the private key of the personal key.
  • the license terms include at least one of the following: license effective time, license expiration time, license usage times, and usage information.
  • the embodiment of the present application also provides a method for processing information of a service key, which is applied to the first client and includes:
  • the server sends the first request information to the server, so that the server obtains the license information corresponding to the service key based on the first request information, wherein the first request information is used to request the server to use the stored service key processing data to be processed;
  • the first request information includes at least one of the following: user information, personal key information and service key identification in the first client;
  • the license information includes at least one License terms for Business Keys;
  • the embodiment of the present application also provides a server, including:
  • a first obtaining module configured to: obtain first request information sent by a first client, wherein the first request information is used to request the server to use the stored service key to process data to be processed, and the first request
  • the information includes at least one of the following: user information, personal key information and service key identification in the first client;
  • a second obtaining module configured to: obtain license information corresponding to the service key based on the first request information, wherein the license information includes at least one license clause for using the service key;
  • a processing module which is configured to: in the case of determining that the license information meets the first preset condition, call the service key to process the data to be processed, and generate a corresponding processing result.
  • Embodiments of the present application further provide an information processing system, including the above-mentioned server, and at least one of the above-mentioned first clients.
  • Embodiments of the present application further provide a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the instructions are run on a computer, the following steps are implemented:
  • the first request information is used to request the server to use the stored service key to process the data to be processed, and the first request information includes at least one of the following: User information, personal key information and service key identification in a client;
  • license information corresponding to the service key based on the first request information, wherein the license information includes at least one license clause for using the service key;
  • the service key is invoked to process the data to be processed, and a corresponding processing result is generated.
  • the server can escrow the service key to prevent the service key from being leaked or illegally used.
  • the request information sent by the client corresponding to the user can be analyzed and judged to determine whether the request information conforms to the license terms set by the service key owner, so that the user can flexibly use the service key.
  • the security of the business key is also guaranteed.
  • FIG. 1 is a flowchart of a service key information processing method according to an embodiment of the application applied to a server;
  • FIG. 2 is a flowchart of an embodiment of step S3 in FIG. 1 according to an embodiment of the application;
  • step S3 in FIG. 1 is a flowchart of another embodiment of step S3 in FIG. 1 according to an embodiment of the application;
  • FIG. 4 is a flowchart of the application of the method for processing service key information according to an embodiment of the present application to a first client;
  • FIG. 5 is a structural block diagram of a server according to an embodiment of the present application.
  • An information processing method for a service key is applied to a server, where the server may be a server or other electronic device with functions similar to the server, and the method can use the server to escrow the service key.
  • the server can connect with at least one client and implement data interaction.
  • the first client sends first request information to the server, where the first request information is used to request the server to process the data to be processed by using the stored service key.
  • the service key is stored on the server so that it can be called at any time. It should be noted that the service key of this application is not handed over to the client but is kept by the server to ensure the security of the service key.
  • the service key can also be sent to the server in advance by the first client with authority or other clients (such as the client where the owner of the service key is located), so that the service key is stored when used. on the server for use.
  • the server can obtain the license information corresponding to the service key based on the first request information, including the user information, personal key information and / or service key identification to obtain license information.
  • the server can start the acquisition action.
  • the license information can be provided by the client to the server, and the server can also obtain it from the storage in real time.
  • the license information and/or the service key meet the first preset condition, if the license information is valid, the license information and the first request information do not logically contradict, and the content and service represented by the first request information If the purpose of the key is the same, the business key is called to process the data to be processed, and the processing result is obtained.
  • the server can escrow the service key to prevent the service key from being leaked or illegally used.
  • the server can analyze and judge the request information sent by the client corresponding to the user to determine whether the request information conforms to the license terms set by the service key owner, so that the user can use the service flexibly At the same time, the security of the business key is also guaranteed.
  • FIG. 1 is a flowchart of a service key information processing method according to an embodiment of the present application applied to a server.
  • the information processing method of the embodiment of the present application can be applied to a server, including a server or other electronic equipment with a service function. As shown in FIG. 1 , the method includes the following steps:
  • S1 Acquire first request information sent by a first client, where the first request information is used to request the server to use the stored service key to process data to be processed, and the first request information includes at least one of the following: User information, personal key information and service key identifier in the first client.
  • the server can be connected with one or more clients, and the user of the service key or the owner of the service key has corresponding clients.
  • the owner of the service key can also be the user of the service key, which is not limited here.
  • the first client may be the client corresponding to the user of the service key.
  • the first client sends first request information to the server, so as to request the server to process the data to be processed by using the kept service key.
  • the first request information includes at least one of the following: user information, personal key information and service key identification in the first client.
  • the user information can be the relevant information of the user of the service key;
  • the personal key information can be the personal key possessed by the user, such as the public key of the personal key and/or the ID of the personal key, etc.;
  • the key identifier may be information related to the service key requested by the user, such as the ID of the requested service key.
  • S2 Acquire license information corresponding to the service key based on the first request information, where the license information includes at least one license clause for using the service key.
  • the server can obtain the license information corresponding to the service key according to at least one feature information included in the first request information.
  • the corresponding license information is obtained according to the user's user information, personal key information and service key identifier.
  • the license information can be pre-stored by the server or obtained by the server from the client.
  • the license information includes at least one license term for using the service key.
  • the license terms can be specific to what is licensed by the owner of the service key. Of course, if the same service key corresponds to different first clients, the license terms may not be the same. This enables the service key to have different usage modes for different users, and the usage modes are flexible.
  • the license terms characterize how the service key is used. For example, the validity time of the license, the expiration time of the license, the number of times of use of the license, and the usage information, etc., so as to ensure that the user can use the service key while also ensuring that the service key cannot be illegally used.
  • the server needs to analyze and judge the license information to ensure that the license information is valid and the license information also needs to be adapted to the functions of the user and the service key expressed by the first request information.
  • the license information needs to be analyzed and judged to determine that the license information complies with the first preset condition. If the license information meets the first preset condition, the server can call the service key to process the data to be processed, and generate a corresponding The processing result is processed, and the server can also send the processing result to the first client, thereby meeting the usage requirements of the user of the service key.
  • the specific content of the first preset condition may be set according to actual usage requirements, for example, it may be set according to the specific content of the service key and the degree of confidentiality of the service key by the server.
  • the service key is invoked to process the data to be processed, as shown in FIG. 2 , including the following: step:
  • the license signature determines whether the license information is valid based on the license signature, wherein the first preset condition includes a condition that the license information is valid.
  • the license signature may be a signature possessed by the owner of the service key, thereby ensuring that the owner of the service key agrees to license the service key, and also ensuring the legality and validity of the license information.
  • the validity of the signature can be verified based on the public key of the owner of the business key when having the permission to verify that the signature is valid.
  • the owner's public key may be provided by the second client corresponding to the owner. If the license signature is valid, it can be verified whether the license information is valid based on the license signature.
  • the first preset condition includes a condition that the license information is valid, that is, the validity of the license information may be a precondition that the license information meets the first preset condition. Of course, the first preset condition may also include other conditions.
  • the service key is invoked to process the data to be processed, as shown in FIG. 3 , including the following: step:
  • S34 Determine whether the first usage information is consistent with the second usage information, wherein the first preset condition includes a condition that the first usage information is consistent with the second usage information.
  • the service key is invoked to process the data to be processed; on the other hand, when it is determined that the license information and/or the service key meet the first preset condition In the case of conditions, call the business key to process the data to be processed.
  • the license clause includes first usage information for using the service key
  • the first request information also includes second usage information for using the service key, such as encryption, signature and other purposes. If the first usage information is consistent with the second usage information, it may be a sub-condition of the first preset condition. That is to say, the first purpose information and the second purpose information need to be consistent to start calling the service key.
  • the service key in the license clause is used for signature, and the purpose of the requested service key in the first request information is also used for signature, you can It is considered that the first usage information and the second usage information match.
  • the service key itself has third purpose information, such as the purpose of encryption, decryption, signature, signature verification, calculation of mac, and so on.
  • the first usage information, the second usage information, and the third usage information are all consistent, it can be considered that the sub-conditions of the first preset condition are satisfied.
  • the first client corresponding to the user initiates a "signature" request, and the server checks whether the licensed use of the business key includes the "signature" function. signature function, and the first request information also requests to use the service key to sign, it can be considered that the situation cannot satisfy the first preset condition.
  • the invoking of the service key to process the data to be processed includes the following steps:
  • the encryption machine is called to process the data to be processed by using the service key, and a corresponding processing result is generated.
  • the server can use the service key to process the data to be processed; on the other hand, the server can also call the encryption machine to process the data to be processed on the service key.
  • the encryption machine can be connected with the server and can exchange data with the server, and the business key can be encrypted by the encryption machine and stored in the server.
  • the service key is encrypted with a specific key possessed by the encryption machine, the check value is calculated, and then the service key is stored in the server, so as to ensure the security of the service key.
  • the encryption machine can call the service key through the server, and decrypt the service key with its own specific key, for example, use a unique AES symmetric key to decrypt the service key. key for encryption and/or decryption.
  • the encryption machine uses the service key to process the data to be processed to generate a corresponding processing result. and send the processing result to the server.
  • the server can send the processing result to the first client, thereby meeting the usage requirements of the user of the service key.
  • the specific content of the first preset condition can be set according to actual use requirements, and can also be set according to the specific content of the service key and the degree of confidentiality of the service key.
  • the encryption machine can use the decrypted service key to process the data to be processed, without the need for the server to use the service key to process the data to be processed, which also saves system resources of the server.
  • the encryption machine sends the generated processing result to the server, and the server can return the processing result to the first client to meet the request user's requirement of using the service key.
  • the processing result can be encrypted based on the public key of the requesting user's personal key, thereby ensuring the security of the processing result during transmission. It also enables the server to ensure the security of the encrypted processing result when it is sent to the first client. After receiving the processing result, the first client can use the personal key corresponding to the first client. The private key is decrypted to obtain the specific processing data.
  • the obtaining the license information corresponding to the service key based on the first request information specifically includes:
  • the first client may be the client corresponding to the user who requests to use the service key, and the user information may be related information of the user of the service key; the personal key information may be owned by the user.
  • Personal keys such as the public key of the personal key and/or the ID of the personal key, etc.
  • the server may acquire the license information based on the above-mentioned user information, personal key information and/or service key identifier.
  • the first request information further includes the first biometric feature of the user who requests the service key; the method further includes:
  • invoking the service key to process the data to be processed includes:
  • the service key is invoked to process the data to be processed.
  • the first biometric feature may be one or more of the features requested to the user, such as facial features, fingerprint features, and iris features.
  • the first biometric feature can be used to authenticate the identity of the requesting user.
  • the first request information also includes user information, personal key information and/or service key identification of the requesting user.
  • the first request information includes the first biometric feature of the user requesting the service key, and the first biometric feature may be one or more of the features requested for the user, such as facial features, fingerprint features, and iris features.
  • the first request information may also include at least one of the following: user information, personal key information and service key identifiers in the first client.
  • the user information can be the relevant information of the requesting user of the service key
  • the personal key information can be the personal key possessed by the requesting user, such as the public key of the personal key and/or the ID of the personal key, etc.
  • the service key identifier may be information related to the service key requested by the user provided by the user, such as the ID of the requested service key.
  • one or more of the facial features, fingerprint features, and iris features in the first biometric feature of the requesting user may be analyzed. It is determined whether the above-mentioned first biometric feature meets the second preset condition, for example, whether it meets the biometric feature required by the owner of the service key. Moreover, the server also needs to analyze the license information to determine whether it meets the first preset condition. For example, the server needs to determine whether the license information is valid, whether the license information logically contradicts the first request information, and whether the request content contained in the first request information is consistent with the purpose of the service key, etc. When the above sub-conditions are all If the requirements are met, it can be determined that the license information meets the first preset condition.
  • the server can call the service key to process the data to be processed, and generate a corresponding processing result, thereby further improving the security of using the service key.
  • the server can also send the processing result to the first client, thereby meeting the usage requirements of the user of the service key.
  • the specific content of the first preset condition and the second preset condition can be set according to actual usage requirements.
  • the first preset condition can be set according to the specific content of the service key and the server-side pairing of the service key. the degree of confidentiality to be set.
  • the second preset condition may be adjusted according to the change of the appearance of the requested user, for example, the adjustment may be made according to the change of the fatness or thinness of the facial features of the requested user.
  • the method further includes an operation of generating the service key, including:
  • Acquire second request information sent by a second client wherein the second request information includes user information and/or client key information in the second client, wherein the client key information includes all the public key of the personal key and/or the identity of the personal key in the second client;
  • Binding the user information and/or client key information with the generated service key Binding the user information and/or client key information with the generated service key.
  • the second client may be a client corresponding to the owner of the service key, and the second client may generate all its service keys at the server.
  • the owner of the company can be the owner of the service key, so it can generate the service key it owns on the server through the second client.
  • the generating operation includes: the second client sends second request information to the server, where the second request information includes information about the authorization intention of the owner of the service key, and also includes user information of the second client corresponding to the owner and/or or client key information.
  • the client key information includes the public key of the personal key of the second client and/or the identification of the personal key, such as the personal key ID, according to the user information associated with the owner, the public key of the personal key and/or The identity of the personal key, and the corresponding business key can be generated according to the owner's authorization intent.
  • the user information and/or client key information can be bound with the generated service key, for example, the service key, user information, and client information are packaged into data packets, and the data packets are calculated to make them Has a key check code, which can be a digital signature, HMAC, CMAC, etc.
  • the service key can be associated with its owner's information.
  • the owner of the service key can also be the user of the service key
  • the second client also needs to send the service key to the server.
  • the first request information is to request the server to call the service key to process the preprocessed data.
  • the second client corresponding to the owner of the service key is equivalent to the first client.
  • the method further includes an operation of obtaining the service key, including:
  • client key information includes the public key of the personal key in the second client and/or or the identification of a personal key
  • the manner in which the server obtains the service key is not limited to its own generation, and can also be obtained in other manners.
  • the service key can be imported by an external device (such as a mobile phone shield or a device of other business organization), and the import method can be that the external device is directly connected to the server, so as to implement the import operation, so that the server can obtain the key. and store.
  • the external device sends the service key to the second client, that is, the client corresponding to the owner of the service key, and the second client sends the service key to the server, so that the server can obtain and store the service key. .
  • the second client sends user information and/or client key information associated with the owner to the server, wherein the client key information includes the public key of the personal key in the second client and/or the client key information. / or the identification of the personal key, such as the personal key ID.
  • the second client sends the service key and user information and/or client key information, it may send them separately, or may simultaneously send the service key, user information and/or client key information
  • the key information is sent to the server, and the sending method is not limited here.
  • the server After the server receives the user information and/or client key information, it can bind the user information and/or client key information with the obtained business key, and can associate the business key with the owner's information. link.
  • the method further includes receiving license information that is signed by the second client and sent by the second client, wherein the license information further includes licensee information and/or the licensee personally key information.
  • the license signature is a personal key signature of the second client corresponding to the owner of the service key.
  • the license information includes licensee information and/or licensee personal key information. Therefore, when the server obtains the license information, it can analyze the licensee information and/or the licensee's personal key information in the license information, and then judge whether the license information is suitable for the first request information sent by the first client. For example, if the user information of the user contained in the first request information is consistent with the authorized person information in the license information, the corresponding license information can be obtained.
  • the method further includes receiving the data to be processed sent by the first client, wherein the data to be processed is signed based on a personal key.
  • the data to be processed in this implementation may be that the first client sends the data to be processed to the server while sending the first request information to the server, and the data to be processed may be the data to be processed by the first client. It is signed by the personal key related to the user, so as to ensure that the data to be processed is not modified in the process of transmission to the server, which increases the security of the data to be processed.
  • the method further includes the following steps:
  • the encrypted processing result is sent to the first client, so that the first client decrypts the processing result through the private key of the personal key.
  • the server obtains a corresponding processing result after processing the data to be processed by using the service key, and the server can feed back the processing result to the first client, so as to meet the usage requirements of the user of the service key.
  • the server can encrypt the processing result, thereby ensuring the security of the processing result during transmission.
  • the server uses the personal public key corresponding to the first client to encrypt the processing result.
  • the first client can decrypt it using the personal private key corresponding to the first client to obtain the specific processing result. data.
  • the embodiment of the present application also provides a method for processing information of a service key, which is applied to the first client. As shown in FIG. 4 , the method includes the following steps:
  • S4 Send the first request information to the server, so that the server obtains the license information corresponding to the service key based on the first request information, wherein the first request information is used to request the server to use the stored data the service key to process the data to be processed; the first request information includes at least one of the following: user information, personal key information and service key identification in the first client; the license information includes at least one License terms for the service key.
  • the server can be connected to one or more clients, and the user of the service key or the owner of the service key has corresponding clients.
  • the owner of the service key can also be the user of the service key, which is not limited here.
  • the first client may be the client corresponding to the user of the service key.
  • the first client sends first request information to the server, so as to request the server to process the data to be processed by using the kept service key.
  • the first request information includes at least one of the following: user information, personal key information and service key identification in the first client.
  • the user information can be the relevant information of the user of the service key;
  • the personal key information can be the personal key possessed by the user, such as the public key of the personal key and/or the ID of the personal key, etc.;
  • the key identifier may be information related to the service key requested by the user, such as the ID of the requested service key.
  • the first client sends the first request information to the server, and the server can obtain the license information corresponding to the service key according to at least one characteristic information included in the first request information.
  • the corresponding license information is acquired according to the user's user information, personal key information, and service key identifier.
  • the license information may be pre-stored by the server or acquired by the server from the client.
  • the license information includes at least one license term for using the service key.
  • the license terms can be specific to what is licensed by the owner of the service key. Of course, if the same service key corresponds to different first clients, the license terms may not be the same. This enables the service key to have different usage modes for different users, and the usage modes are flexible.
  • the license terms characterize how the service key is used. For example, the validity time of the license, the expiration time of the license, the number of times of use of the license, and the usage information, etc., so as to ensure that the user can use the service key while also ensuring that the service key cannot be illegally used.
  • S5 Receive a processing result sent by the server, wherein the processing result is that the server calls the service key to the pending processing when determining that the license information meets the first preset condition. The result of data processing.
  • the server needs to analyze and judge the license information to ensure that the license information is valid and the license information also needs to be adapted to the functions of the user and the service key expressed by the first request information.
  • the license information needs to be analyzed and judged to determine that the license information complies with the first preset condition. If the license information meets the first preset condition, the server can call the service key to process the data to be processed, and generate the corresponding The processing result is processed, and the server can also send the processing result to the first client, thereby meeting the usage requirements of the user of the service key.
  • the specific content of the first preset condition may be set according to actual usage requirements, for example, it may be set according to the specific content of the service key and the degree of confidentiality of the service key by the server.
  • the embodiment of the present application also provides a server, and the server may be a server or other electronic device with functions similar to the server, as shown in FIG. 5 , including:
  • a first obtaining module configured to: obtain first request information sent by a first client, wherein the first request information is used to request the server to use the stored service key to process data to be processed, and the first request
  • the information includes at least one of the following: user information, personal key information and service key identification in the first client.
  • a second obtaining module configured to: obtain license information corresponding to the service key based on the first request information, wherein the license information includes at least one license clause for using the service key;
  • a processing module which is configured to: in the case of determining that the license information meets the first preset condition, call the service key to process the data to be processed, and generate a corresponding processing result.
  • the server can be connected to one or more clients, and the user of the service key or the owner of the service key has corresponding clients.
  • the owner of the service key can also be the user of the service key, which is not limited here.
  • the first client may be the client corresponding to the user of the service key.
  • the first client sends the first request information to the server, and the first obtaining module obtains the first request information sent by the first client.
  • the first request information is that the first client requests the server to use the kept service key to process the data to be processed.
  • the first request information includes at least one of the following: user information, personal key information and service key identification in the first client.
  • the user information can be the relevant information of the user of the service key;
  • the personal key information can be the personal key possessed by the user, such as the public key of the personal key and/or the ID of the personal key, etc.;
  • the key identifier may be information related to the service key requested by the user, such as the ID of the requested service key.
  • the second obtaining module can obtain the license information corresponding to the service key according to at least one feature information included in the first request information.
  • the corresponding license information is acquired according to the user's user information, personal key information, and service key identifier.
  • the license information may be pre-stored by the server or acquired by the server from the client.
  • the license information includes at least one license term for using the service key.
  • the license terms can be specific to what is licensed by the owner of the service key. Of course, if the same service key corresponds to different first clients, the license terms may not be the same. This enables the service key to have different usage modes for different users, and the usage modes are flexible.
  • the license terms characterize how the service key is used. For example, the validity time of the license, the expiration time of the license, the number of times of use of the license, and the usage information, etc., so as to ensure that the user can use the service key while also ensuring that the service key cannot be illegally used.
  • the processing module needs to analyze and judge the license information to ensure that the license information is valid and the license information also needs to be adapted to the functions of the user and the service key expressed by the first request information.
  • the processing module needs to analyze and judge the license information to determine that the license information complies with the first preset condition. If the license information meets the first preset condition, the server can call the service key to process the data to be processed and generate Corresponding processing results, and the server can also send the processing results to the first client, thereby meeting the usage requirements of users of the service key.
  • the specific content of the first preset condition can be set according to actual use requirements, for example, it can be set according to the specific content of the service key and the degree of confidentiality of the service key by the server.
  • the processing module is further configured to:
  • the license signature is valid
  • the license information is valid, wherein the first preset condition includes a condition that the license information is valid.
  • the processing module is further configured to:
  • the first preset condition includes a condition that the first use information is consistent with the second use information.
  • the second obtaining module is further configured to:
  • the server further includes a generation module, and the generation module is configured as:
  • Acquire second request information sent by a second client wherein the second request information includes user information and/or client key information in the second client, wherein the client key information includes all the public key of the personal key and/or the identity of the personal key in the second client;
  • Binding the user information and/or client key information with the generated service key Binding the user information and/or client key information with the generated service key.
  • the server further includes a generation module, and the generation module is configured as:
  • client key information includes the public key of the personal key in the second client and/or or the identification of a personal key
  • the second obtaining module is further configured to:
  • the license information further includes the licensee information and/or the licensee's personal key information.
  • the first acquisition module is further configured to:
  • the data to be processed sent by the first client is received, wherein the data to be processed is signed based on a personal key.
  • the processing module is further configured to:
  • the encrypted processing result is sent to the first client, so that the first client decrypts the processing result through the private key of the personal key.
  • the license terms include at least one of the following: license effective time, license expiration time, license usage times, and usage information.
  • Embodiments of the present application further provide an information processing system, including the above-mentioned server, and at least one of the above-mentioned first clients.
  • the system may also include a second client.
  • the first client may be the client corresponding to the user of the service key
  • the second client may be the client corresponding to the owner of the service key.
  • Embodiments of the present application further provide a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the instructions are run on a computer, the following steps are implemented:
  • the first request information is used to request the server to use the stored service key to process the data to be processed, and the first request information includes at least one of the following: User information, personal key information and service key identification in a client;
  • license information corresponding to the service key based on the first request information, wherein the license information includes at least one license clause for using the service key;
  • the service key is invoked to process the data to be processed, and a corresponding processing result is generated.
  • the server can be connected to one or more clients, and the user of the service key or the owner of the service key has corresponding clients.
  • the owner of the service key can also be the user of the service key, which is not limited here.
  • the first client may be the client corresponding to the user of the service key.
  • the first client sends first request information to the server, so as to request the server to process the data to be processed by using the kept service key.
  • the first request information includes at least one of the following: user information, personal key information and service key identification in the first client.
  • the user information can be the relevant information of the user of the service key;
  • the personal key information can be the personal key possessed by the user, such as the public key of the personal key and/or the ID of the personal key, etc.;
  • the key identifier may be information related to the service key requested by the user, such as the ID of the requested service key.
  • the server can obtain the license information corresponding to the service key according to at least one feature information included in the first request information.
  • the corresponding license information is obtained according to the user's user information, personal key information and service key identifier.
  • the license information can be pre-stored by the server or obtained by the server from the client.
  • the license information includes at least one license term for using the service key.
  • the license terms can be specific to what is licensed by the owner of the service key. Of course, if the same service key corresponds to different first clients, the license terms may not be the same. This enables the service key to have different usage modes for different users, and the usage modes are flexible.
  • the license terms characterize how the service key is used. For example, the validity time of the license, the expiration time of the license, the number of times of use of the license, and the usage information, etc., so as to ensure that the user can use the service key while also ensuring that the service key cannot be illegally used.
  • the server needs to analyze and judge the license information to ensure that the license information is valid and the license information also needs to be adapted to the functions of the user and the service key expressed by the first request information.
  • the license information needs to be analyzed and judged to determine that the license information complies with the first preset condition. If the license information meets the first preset condition, the server can call the service key to process the data to be processed, and generate the corresponding The processing result is processed, and the server can also send the processing result to the first client, thereby meeting the usage requirements of the user of the service key.
  • the specific content of the first preset condition may be set according to actual usage requirements, for example, it may be set according to the specific content of the service key and the degree of confidentiality of the service key by the server.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

Sont divulgués un procédé de traitement d'informations pour une clé de service, et une extrémité de desserte et un système. Le procédé est appliqué à une extrémité de desserte et consiste à : acquérir des premières informations de requête envoyées par un premier client, les premières informations de requête étant utilisées pour demander une extrémité de desserte au processus, à l'aide d'une clé de service stockée, des données à traiter et les premières informations de requête comprenant au moins l'un des éléments suivants : des informations d'utilisateur, des informations de clé personnelle et un identifiant de clé de service qui sont dans le premier client; sur la base des premières informations de requête, acquérir des informations de licence correspondant à la clé de service, les informations de licence comprenant au moins un article de licence pour utiliser la clé de service; et lorsqu'il est déterminé que les informations de licence satisfont à une première condition prédéfinie, appeler la clé de service pour traiter lesdites données, de sorte à générer un résultat de traitement correspondant. Au moyen du procédé, il est possible d'empêcher efficacement une clé de service d'être divulguée ou utilisée de manière illégitime, de sorte que la sécurité de la clé de service est également assurée tandis qu'un utilisateur peut utiliser de manière flexible la clé de service.
PCT/CN2021/136418 2020-12-09 2021-12-08 Procédé de traitement d'informations pour clé de service, et extrémité de desserte et système WO2022121940A1 (fr)

Applications Claiming Priority (6)

Application Number Priority Date Filing Date Title
CN202011449128.8A CN112565281B (zh) 2020-12-09 2020-12-09 业务密钥的信息处理方法、服务端及系统
CN202011449128.8 2020-12-09
CN202011511456.6A CN112671534B (zh) 2020-12-18 2020-12-18 基于生物特征的业务密钥管理方法、服务端及系统
CN202011511456.6 2020-12-18
CN202011610457.6A CN112733200B (zh) 2020-12-30 2020-12-30 业务密钥的信息处理方法、加密机及信息处理系统
CN202011610457.6 2020-12-30

Publications (1)

Publication Number Publication Date
WO2022121940A1 true WO2022121940A1 (fr) 2022-06-16

Family

ID=81973076

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/136418 WO2022121940A1 (fr) 2020-12-09 2021-12-08 Procédé de traitement d'informations pour clé de service, et extrémité de desserte et système

Country Status (1)

Country Link
WO (1) WO2022121940A1 (fr)

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120051540A1 (en) * 2010-08-24 2012-03-01 Electronics And Telecommunications Research Institute Conditional access system and method of using conditional access image
CN107070879A (zh) * 2017-02-15 2017-08-18 北京深思数盾科技股份有限公司 数据保护方法及系统
CN108199838A (zh) * 2018-01-31 2018-06-22 北京深思数盾科技股份有限公司 一种数据保护方法及装置
CN111130803A (zh) * 2019-12-26 2020-05-08 信安神州科技(广州)有限公司 数字签名的方法、系统及装置
CN111327637A (zh) * 2020-03-10 2020-06-23 时时同云科技(成都)有限责任公司 业务密钥的管理方法及系统
CN111797430A (zh) * 2020-06-30 2020-10-20 平安国际智慧城市科技股份有限公司 数据校验方法、装置、服务器及存储介质
CN112565281A (zh) * 2020-12-09 2021-03-26 北京深思数盾科技股份有限公司 业务密钥的信息处理方法、服务端及系统
CN112671534A (zh) * 2020-12-18 2021-04-16 北京深思数盾科技股份有限公司 基于生物特征的业务密钥管理方法、服务端及系统
CN112733200A (zh) * 2020-12-30 2021-04-30 北京深思数盾科技股份有限公司 业务密钥的信息处理方法、加密机及信息处理系统

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120051540A1 (en) * 2010-08-24 2012-03-01 Electronics And Telecommunications Research Institute Conditional access system and method of using conditional access image
CN107070879A (zh) * 2017-02-15 2017-08-18 北京深思数盾科技股份有限公司 数据保护方法及系统
CN108199838A (zh) * 2018-01-31 2018-06-22 北京深思数盾科技股份有限公司 一种数据保护方法及装置
CN111130803A (zh) * 2019-12-26 2020-05-08 信安神州科技(广州)有限公司 数字签名的方法、系统及装置
CN111327637A (zh) * 2020-03-10 2020-06-23 时时同云科技(成都)有限责任公司 业务密钥的管理方法及系统
CN111797430A (zh) * 2020-06-30 2020-10-20 平安国际智慧城市科技股份有限公司 数据校验方法、装置、服务器及存储介质
CN112565281A (zh) * 2020-12-09 2021-03-26 北京深思数盾科技股份有限公司 业务密钥的信息处理方法、服务端及系统
CN112671534A (zh) * 2020-12-18 2021-04-16 北京深思数盾科技股份有限公司 基于生物特征的业务密钥管理方法、服务端及系统
CN112733200A (zh) * 2020-12-30 2021-04-30 北京深思数盾科技股份有限公司 业务密钥的信息处理方法、加密机及信息处理系统

Similar Documents

Publication Publication Date Title
US20200228335A1 (en) Authentication system for enhancing network security
WO2019233204A1 (fr) Procédé, appareil et système de gestion de clef, support de stockage, et dispositif informatique
US20180082050A1 (en) Method and a system for secure login to a computer, computer network, and computer website using biometrics and a mobile computing wireless electronic communication device
US9654468B2 (en) System and method for secure remote biometric authentication
TWI454111B (zh) 用於確保通訊之鑑別及完備性的技術
US7797544B2 (en) Attesting to establish trust between computer entities
TWI578749B (zh) 用於遷移金鑰之方法及設備
US20120284506A1 (en) Methods and apparatus for preventing crimeware attacks
US11556617B2 (en) Authentication translation
WO2020173332A1 (fr) Procédé et appareil d'activation d'application basée sur un environnement d'exécution de confiance
WO2021120615A1 (fr) Appareil de chiffrement, système de chiffrement et procédé de chiffrement de données
WO2021190197A1 (fr) Procédé et appareil d'authentification de dispositif de paiement biométrique, dispositif informatique et support d'informations
CN112565281B (zh) 业务密钥的信息处理方法、服务端及系统
US10867056B2 (en) Method and system for data protection
DK2414983T3 (en) Secure computer system
CN111954211B (zh) 一种移动终端新型认证密钥协商系统
KR102010776B1 (ko) 블록체인 기반의 패스워드 처리 방법, 사용자 로그인 인증 지원 방법 및 이를 이용한 서버
CN112733200B (zh) 业务密钥的信息处理方法、加密机及信息处理系统
CN112671534B (zh) 基于生物特征的业务密钥管理方法、服务端及系统
JPH10336172A (ja) 電子認証用公開鍵の管理方法
JPH11353280A (ja) 秘密データの暗号化による本人確認方法及びシステム
CN110807210B (zh) 一种信息处理方法、平台、系统及计算机存储介质
WO2022121940A1 (fr) Procédé de traitement d'informations pour clé de service, et extrémité de desserte et système
KR20090024482A (ko) 컨텐츠를 이용하기 위한 키 관리 시스템 및 그 방법
CN114238915A (zh) 数字证书添加方法、装置、计算机设备和存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21902645

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21902645

Country of ref document: EP

Kind code of ref document: A1