WO2022143358A1 - 一种密钥管理的方法、相应装置及系统 - Google Patents

一种密钥管理的方法、相应装置及系统 Download PDF

Info

Publication number
WO2022143358A1
WO2022143358A1 PCT/CN2021/140654 CN2021140654W WO2022143358A1 WO 2022143358 A1 WO2022143358 A1 WO 2022143358A1 CN 2021140654 W CN2021140654 W CN 2021140654W WO 2022143358 A1 WO2022143358 A1 WO 2022143358A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
salt value
token
key
ciphertext
Prior art date
Application number
PCT/CN2021/140654
Other languages
English (en)
French (fr)
Inventor
郭亮
朱金伟
程胜飞
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022143358A1 publication Critical patent/WO2022143358A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the present application relates to the field of computer technology, and in particular, to a method, a corresponding device and a system for key management.
  • Various applications are installed in terminal devices such as mobile phones, personal computers (PCs), and notebook computers, and these APPs involve the user's personal user data (such as pictures, videos, and information, etc.). Because the storage space on the terminal device is limited, these user data are usually sent to the cloud for storage, and then obtained from the cloud when necessary. In order to ensure the security and privacy of user data stored in the cloud, these user data will be encrypted by the user key. In order to ensure the security of the user key, the user key is usually only stored in the terminal device.
  • the user key stored in the terminal device will be lost, and the user data stored in the cloud cannot be decrypted in the new terminal device, which will cause great losses to the user. Therefore, it is necessary to back up the user's key.
  • the user's key is usually backed up in one or more other terminal devices of the user, which undoubtedly increases the backup conditions, and the user must have other terminal devices. .
  • the user key is backed up in a dedicated security-hardened proprietary device, which requires multiple layers of authentication to obtain the qualification to be backed up in the server, which is not universal.
  • the embodiments of the present application provide a method for key management, which can safely back up user keys in a cloud device, and has no high requirements on the cloud device. While ensuring the security of user keys, it also takes into account Universality. Embodiments of the present application also provide corresponding apparatuses, systems, computer-readable storage media, computer program products, and the like.
  • a first aspect of the present application provides a method for key management, including: generating a first master key and a first token according to a first user password; encrypting a first user key based on the first master key to obtain a first The first ciphertext of the user key, which is used to encrypt and/or decrypt user data; back up the first token and the first ciphertext of the first user key to the cloud device, where when the terminal device When the first ciphertext of the first user key is requested from the cloud device based on the target user password input by the user, the first token is used by the cloud device to verify the correctness of the target user password.
  • the implementation manner of the backup process may be: sending the first ciphertext of the first token and the first user key stored on the cloud device to the cloud device, or sending the first ciphertext to the cloud device through other devices The token and the first ciphertext of the first user key, or send the address storing the first ciphertext of the first token and the first user key to the cloud device.
  • the first user key is used to encrypt and/or decrypt user data.
  • Encryption and/or decryption in the embodiments of this application should be understood as at least one of encryption and decryption, that is, encryption, or decryption, or, encryption and decryption.
  • the first user secret key can be used to encrypt user data, and can also be used to decrypt the encrypted user data.
  • the first user password may be a password of an application (APP) in which user data is stored in the cloud, and the password is used to manage encrypted user data stored in the cloud.
  • APP application
  • the first user password is only a description of the user password in this application.
  • the "user password” involved in this application is described by the "Xth user password” or the "target user password”.
  • the user password can be in the form of It is numbers, graphics, gestures, facial features, iris features, or a combination of numbers and characters.
  • the first master key is used to encrypt or decrypt the first user key
  • the first token (token) is used by the cloud device to verify whether the target user password input by the user is the same as the first user password.
  • User data refers to the data stored in the cloud, because the cloud is usually a distributed device, and the user data for a user ID is usually not stored on the same cloud device as the user key that decrypts the user data.
  • the user Keys and user data can also be stored on the same cloud device.
  • the first master key generated by the first user password is used to encrypt the first user key to obtain the first ciphertext of the first user key, and the first user password is used to generate the first token , before the user wants to obtain the first user key, the first ciphertext of the first user key needs to be verified by the token, so that the first user key has a double security guarantee.
  • the user wants to obtain the first ciphertext of the first user key only the token generated by entering the correct user password can pass the token verification of the cloud device. If the user does not have the correct user password, it cannot be obtained.
  • the key management scheme in this application has no special requirements for the cloud device, as long as an ordinary cloud device can be implemented, Compared with a dedicated hardware device that is specially reinforced at the hardware level to store user keys, the key management solution of the present application is more versatile.
  • generating the first master key and the first token according to the first user password includes: generating the first master key according to the first user password and the salt value; A master key and the salt value to generate the first token; wherein the salt value is a random number.
  • the method further includes: backing up the salt value to the cloud device, for example, sending the salt value to the cloud device, where the salt value is stored in association with the first token and the first ciphertext on the cloud device.
  • the above step: generating the first master key and the first token according to the first user password includes: generating the first master key according to the first user password and the first salt value key; generate the first token according to the first master key and the second salt value; wherein, the first salt value and the second salt value are both random numbers, and the first salt value and the second salt value are backed up on the cloud device superior.
  • the process of backing up the first salt value and the second salt value on the cloud device may be: sending the first salt value and the second salt value to the cloud device, and the first salt value and the second salt value are used to communicate with the cloud device on the cloud device.
  • a token is stored in association with the first ciphertext.
  • the first salt value and the second salt value may be random numbers generated by a random number generator in the terminal device, and in this application, the first salt value and the second salt value may be the same one value, or two different values.
  • the first salt value, the second salt value, the first ciphertext of the first token and the first user key may be stored in association with a user ID, and the user ID may be a user registration APP user account.
  • the cloud device interacts with the terminal device, it can find the salt value, token or ciphertext requested by the terminal device through the user ID.
  • the first master key generated by using the first salt value and the first user password, as well as the first token generated by using the first master key and the second salt value, have better security and will not be cracked basically.
  • the security of the first token and the first ciphertext further ensures the security of the first user key.
  • the method further includes: in response to the user key recovery instruction, sending a ciphertext acquisition request to the cloud device, where the ciphertext acquisition request is used to acquire the first key of the first user key.
  • ciphertext a ciphertext acquisition request to the cloud device
  • receive the first salt value and the second salt value, the first salt value and the second salt value are sent by the cloud device in response to the ciphertext acquisition request; input the second user password according to the user, and the first salt value and the second salt value Two-salt value, generate the second master key and the second token; send the second token to the cloud device; receive the first ciphertext of the first user key sent by the cloud device, the first ciphertext of the first user key
  • the text is sent by the cloud device after verifying that the second token is the same as the first token; the first ciphertext of the first user key is decrypted according to the second master key to obtain the first user key.
  • the second user password may be the same as the first user password, or may be different from the second user password.
  • the second master key will be the same as the first master key
  • the second token will be the same as the first token
  • the cloud device will pass the token verification and return the first ciphertext to the terminal device. If the second user password is different from the first user password, the second master key generated by the second user password combined with the first salt value and the second salt value will be different from the first master key, and the second token will be different from the first master key.
  • the first tokens are different. In this way, the cloud device will not pass the token verification, but will return the verification failure to the terminal device, and the terminal device can output a prompt message that the user password is incorrect.
  • This possible implementation describes the process of recovering the key of the first user. From this process, we can see that the first ciphertext can be returned to the terminal device only after the cloud device has successfully verified the token, which ensures the security of the key of the first user. sex.
  • the above steps generating the second master key and the second token according to the first salt value, the second salt value, and the second user password, including: verifying the first a salt value and a second salt value; if the verification of the first salt value and the second salt value is successful, a second master key is generated according to the first salt value and the second user password, and a second master key is generated according to the second salt value and the second salt value
  • the master key generates the second token.
  • the terminal device after receiving the first salt value and the second salt value returned by the cloud device, the terminal device will perform advanced verification, and the process of the first salt value and the second salt value may be: If the value and the second salt value are within the preset salt value range, the verification is successful. If they are not within the preset salt value range, the verification fails. The salt value verification is successful only according to the received first salt value.
  • the corresponding second master key and second token are generated from the value and the second salt value, which can prevent other attacking devices from forging false salt values to obtain the first user password and ensure the security of the first user password.
  • the method further includes: in response to the user key recovery instruction, sending a ciphertext acquisition request to the cloud device, where the ciphertext acquisition request is used to acquire the first key of the first user key.
  • Ciphertext a ciphertext acquisition request to the cloud device, where the ciphertext acquisition request is used to acquire the first key of the first user key.
  • Ciphertext receive the third salt value and the fourth salt value corresponding to the ciphertext acquisition request, the third salt value and the fourth salt value are random numbers; verify the third salt value and the fourth salt value, if the third salt value and the fourth salt value are random numbers If the verification of the value and the fourth salt value fails, a risk prompt is output.
  • the ciphertext acquisition request sent by the terminal device is intercepted by the malicious attack device, and the third salt value and the fourth salt value are forged and sent to the terminal device, and the third salt value and the fourth salt value are forged and sent to the terminal device.
  • the third salt value and the fourth salt value are usually set to a simple number, such as "0 or 1", so that the attacking device can easily deduce the token generated by the third salt value or the fourth salt value.
  • User password therefore, in this application, the third salt value and the fourth salt value will be checked.
  • the verification process can be judged by the preset salt value range. If the third salt value and the fourth salt value are both within the preset salt value range, the verification is successful.
  • the preset salt value range in this application is usually the range of a long series of numbers, such as 1452785 to 5412861.
  • an example is indicated here, and the specific representation of the salt value range is not limited in this application. . Therefore, the solution of the present application can effectively avoid the risk brought by malicious attacks by the attacking device.
  • the method further includes: in response to a password modification instruction input by the user, sending a ciphertext acquisition request to the cloud device, where the ciphertext acquisition request is used to acquire the first key of the first user key.
  • a ciphertext receive the first salt value and the second salt value, the first salt value and the second salt value are sent by the cloud device in response to the ciphertext acquisition request; according to the third user password input by the user, the first salt value and the The second salt value is used to generate the third master key and the third token; the third token is sent to the cloud device; the first ciphertext of the first user key sent by the cloud device is received, and the first ciphertext is the cloud device sent after verifying that the third token is the same as the first token; decrypt the first ciphertext of the first user key based on the third master key to obtain the first user key; according to the fourth user password input by the user, Generate the fourth master key and the fourth token; encrypt the first user key according to the fourth master key to obtain the second ciphertext of the first user key; combine the fourth token and the first user key The second ciphertext is backed up to the cloud device.
  • the process of backing up the fourth token and the second ciphertext may be: sending the third token to the cloud device again, and the second cipher for the fourth token and the first user key stored on the cloud device. After the third token sent again is used by the cloud device to verify that it is the same as the first token, the first token and the first ciphertext are updated according to the fourth token and the second ciphertext. It is also possible to directly store the fourth token and the second ciphertext without overwriting the original first token and the first ciphertext.
  • the third user password should be the original user password, that is, the first user password.
  • the fourth user password should be the new user password for the user to rely on.
  • the user wants to modify the user password he needs to obtain the first ciphertext of the first user key from the cloud device, decrypt the first ciphertext, and then encrypt the first user password with the master key generated according to the new user password.
  • the key is encrypted to obtain the second ciphertext, which is then sent to the cloud device for storage.
  • a third token needs to be generated through the original user password input by the user, and the cloud device verifies whether the third token is the same as the first token, and if it is the same, the first ciphertext will be returned. If not, the cloud device will return a notification of verification failure. In this way, the security in the process of modifying the user password can be ensured, and the malicious modification of the user password can be avoided.
  • the above steps generating the fourth master key and the fourth token according to the fourth user password input by the user, including: according to the fourth user password and the first salt value, generating a fourth master key; generating a fourth token according to the fourth master key and the second salt value; wherein the fourth token and the second ciphertext are combined with the first salt value and the second salt value on the cloud device associative storage.
  • the new fourth user password can be combined with the original first salt value and the second salt value to generate the fourth master key and the fourth token, so that the cloud device only needs to use the fourth master key
  • the key and the fourth token can be stored in association with the original first salt value and the second salt value, which can reduce the amount of data transmission.
  • the above steps generating the fourth master key and the fourth token according to the fourth user password input by the user, including: according to the fourth user password and the fifth salt value, generating a fourth master key; generating a fourth token according to the fourth master key and the sixth salt value; wherein the fifth salt value and the sixth salt value are newly generated random numbers for the fourth user password, and the fifth The salt value and the sixth salt value are backed up on the cloud device.
  • the process of backing up the fifth salt value and the sixth salt value may be: sending the fifth salt value and the sixth salt value to the cloud device, and the fifth salt value and the sixth salt value are used on the cloud device with the fourth token and The second ciphertext is associated with storage.
  • the newly generated fifth salt value and the sixth salt value can be used, so that the difference between the fourth token and the second ciphertext can be improved. safety.
  • the method further includes: in response to the user key modification instruction, acquiring a second user key for replacing the first user key, and sending a salt value acquisition to the cloud device request; receive the first salt value and the second salt value sent by the cloud device in response to the salt value acquisition request; generate the fifth master key and the second salt value according to the fifth user password, the first salt value and the second salt value input by the user The fifth token; send a token verification request to the cloud device, where the token verification request includes the fifth token; receive a verification success message sent by the cloud device, and the verification success message indicates that the fifth token is the same as the fifth token.
  • One token is the same; the second user key is encrypted according to the fifth master key to obtain the ciphertext of the second user key; the ciphertext of the second user key and the fifth token are backed up to the cloud device.
  • the terminal device when the user wants to modify the user key, the terminal device also needs to first generate the fifth master key and the fifth token according to the fifth user password, the first salt value and the second salt value, The cloud device first verifies whether the fifth token is the same as the first token. If the fifth token is the same as the first token, it means that the fifth user password is the correct user password, and the user key modification operation can be performed. The terminal device Then encrypt the second user key according to the fifth master key to obtain the ciphertext of the second user key. In this application, token verification is performed first in the process of modifying the user key, so that the security of modifying the user key can be ensured and the malicious modification of the user key can be avoided.
  • the above steps: generating the fifth master key and the fifth token according to the fifth user password, the first salt value and the second salt value include: Five user passwords and the first salt value generate a fifth master key; generate a fifth token according to the fifth master key and the second salt value; wherein, the ciphertext of the fifth token and the second user key is stored in the cloud device is stored in association with the first salt value and the second salt value.
  • the fifth master key and the fifth token may be generated by combining the fifth user password with the original first salt value and the second salt value, and the cloud device only needs to combine the fifth master key and the second salt value.
  • the fifth token can be stored in association with the original first salt value and the second salt value, which can reduce the amount of data transmission.
  • the first master key is generated using a second-level hash algorithm
  • the first token is generated using a millisecond-level hash algorithm or a microsecond-level hash algorithm of.
  • Second-level hash algorithm means that it takes one or more seconds to complete a hash.
  • Second-level hash algorithms usually set the number of iterations in the operation parameters to one million or several million times. , or 10 million times, in this way, taking a 6-digit user password as an example, it will take several months to brute force the user password, so the first master key is the user password and the first salt value in seconds.
  • the hash algorithm which can prevent the first master key from being brute force cracked, because the first token is generated according to the first master key and the second salt value through the hash algorithm, and the first master key can be prevented from being cracked.
  • Brute-force cracking is done, so the first token does not have the problem of being cracked by brute force.
  • the first token only needs to be generated quickly. Therefore, the first token is completed with a millisecond-level hash algorithm or a microsecond-level hash algorithm. , which can increase the speed at which the first token is obtained.
  • other "Xth master key" and "Xth token” can be understood with reference to the generation method of the first master key and the first token, and the Xth represents the above-mentioned Second, third, fourth....
  • a second aspect of the present application provides a method for key management, including: receiving a first token from a terminal device and a first ciphertext of a first user key, where the first ciphertext of the first user key is the terminal
  • the device is obtained by encrypting the first user key based on the first master key, and the first master key and the first token are generated by the terminal device according to the first user password;
  • the first ciphertext when receiving a request for the first ciphertext from the terminal device in response to the target user password input by the user, verify the correctness of the target user password according to the first token.
  • the first ciphertext of the first token, the first master key and the first user key can be understood with reference to the description of the first aspect.
  • the cloud device described in the second aspect will store the first ciphertext of the first token and the first user key sent by the terminal device, and when the terminal device needs the first ciphertext, the first ciphertext will be stored according to the first ciphertext.
  • the token is verified first, and after the verification is passed, the first ciphertext of the first user key is returned to the terminal device. In this way, the first user key has double security guarantee not only through self-encryption, but also through token verification.
  • the token is generated by the user password.
  • the key management scheme in this application has no special requirements for the cloud device, as long as An ordinary cloud device can be implemented, and the key management scheme of the present application is more versatile than storing user keys in a dedicated hardware device that is specially reinforced at the hardware level.
  • the method further includes: receiving a first salt value and a second salt value for generating the first token and the first master key from the terminal device, the first salt value Both the value and the second salt value are random numbers; the first salt value and the second salt value are stored in association with the first ciphertext of the first token and the first user key.
  • the first salt value and the second salt value may be random numbers generated by a random number generator in the terminal device, and in this application, the first salt value and the second salt value may be the same one value, it can be the same two values, or it can be two different values.
  • the first ciphertext of the first salt value, the second salt value, the first token, and the first user key may be stored in association with a user ID, and the user ID may be a user account of the user registering the APP.
  • the cloud device interacts with the terminal device, it can find the salt value, token or ciphertext requested by the terminal device through the user ID.
  • the first master key generated by using the first salt value and the first user password, as well as the first token generated by using the first master key and the second salt value, have better security and will not be cracked basically.
  • the security of the first token and the first ciphertext further ensures the security of the first user key.
  • the method further includes: receiving a ciphertext acquisition request for the terminal device, where the ciphertext acquisition request is used to acquire the first ciphertext of the first user key; Obtain the request, send the first salt value and the second salt value to the terminal device; receive the second token for the terminal device, the second token is the terminal device according to the second user password, the first salt value and the second salt value If it is verified that the second token is the same as the first token, the first ciphertext of the first user key is sent to the terminal device.
  • the second user password may be the same as the first user password, or may be different from the second user password.
  • the second master key will be the same as the first master key
  • the second token will be the same as the first token
  • the cloud device will pass the token verification and return the first ciphertext to the terminal device. If the second user password is different from the first user password, the second master key generated by the second user password combined with the first salt value and the second salt value will be different from the first master key, and the second token will be different from the first master key.
  • the first tokens are different. In this way, the cloud device will not pass the token verification, but will return the verification failure to the terminal device, and the terminal device can output a prompt message that the user password is incorrect.
  • This possible implementation describes the process of recovering the key of the first user. From this process, we can see that the first ciphertext can be returned to the terminal device only after the cloud device has successfully verified the token, which ensures the security of the key of the first user. sex.
  • the method further includes: receiving a ciphertext acquisition request from the terminal device, where the ciphertext acquisition request is used to acquire the first ciphertext of the first user key; Obtain the request, send the first salt value and the second salt value to the terminal device; receive the third token from the terminal device, the third token is the terminal device according to the third user password, the first salt value and the second salt value generated; if it is verified that the third token is the same as the first token, send the first ciphertext of the first user key to the terminal device; receive the fourth token and the first user key from the terminal device
  • the second ciphertext, the second ciphertext is encrypted with the fourth master key, and the fourth master key and the fourth token are generated according to the fourth user password input by the user; the fourth token and the second ciphertext are stored arts.
  • the third user password should be the original user password, that is, the first user password.
  • the fourth user password should be the new user password for the user to rely on.
  • the user wants to modify the user password such as: modifying the login password of the APP, he needs to obtain the first ciphertext of the first user key from the cloud device, decrypt the first ciphertext, and then generate a new password based on the new user password.
  • the master key encrypts the first user key to obtain the second ciphertext, which is then sent to the cloud device for storage.
  • a third token needs to be generated through the original user password input by the user, and the cloud device verifies whether the third token is the same as the first token, and if it is the same, the first ciphertext will be returned. If not, the cloud device will return a notification of verification failure. In this way, the security in the process of modifying the user password can be ensured, and the malicious modification of the user password can be avoided.
  • the fourth token and the fourth master key are generated according to the first salt value and the second salt value
  • the fourth token and the second ciphertext are combined with The first salt value and the second salt value are stored in association.
  • the new fourth user password can be combined with the original first salt value and the second salt value to generate the fourth master key and the fourth token, so that the cloud device only needs to use the fourth master key
  • the key and the fourth token can be stored in association with the original first salt value and the second salt value, which can reduce the amount of data transmission.
  • the method further includes: receiving a message from the terminal device.
  • the fifth salt value and the sixth salt value; the fourth token and the second ciphertext are stored in association with the fifth salt value and the sixth salt value.
  • the newly generated fifth salt value and the sixth salt value can be used, so that the difference between the fourth token and the second ciphertext can be improved. safety.
  • the method further includes: receiving a salt value acquisition request from the terminal device, where the salt value acquisition request is used to acquire the first salt value and the second salt value; according to the salt value Obtain the request, send the first salt value and the second salt value to the terminal device; receive the token verification request sent by the terminal device, the token verification request contains the fifth token, and the fifth token is based on the first token entered by the user. Five user passwords, and the first salt value and the second salt value are generated; if the fifth token is the same as the first token, send a verification success message to the terminal device; receive and store the second user sent by the terminal device.
  • the ciphertext of the key and the fifth token, and the ciphertext of the second user key are encrypted using the fifth master key, and the fifth master key and the fifth token are generated according to the fifth user password.
  • the terminal device when the user wants to modify the user key, the terminal device also needs to first generate a fifth token according to the fifth user password, the first salt value and the second salt value, and the cloud device first verifies the fifth token. Whether the token is the same as the first token, if the fifth token is the same as the first token, it means that the fifth user password is the correct user password, and the user key modification operation can be performed. Encrypt the second user key with the key to obtain the ciphertext of the second user key. In this application, token verification is performed first in the process of modifying the user key, so that the security of modifying the user key can be ensured and the malicious modification of the user key can be avoided.
  • the ciphertexts of the fifth token and the second user key are stored in association with the first salt value and the second salt value.
  • the fifth master key and the fifth token may be generated by combining the fifth user password with the original first salt value and the second salt value, and the cloud device only needs to combine the fifth master key and the second salt value.
  • the fifth token can be stored in association with the original first salt value and the second salt value, which can reduce the amount of data transmission.
  • a third aspect of the present application provides a method for key management.
  • the method includes: in response to a first operation by a user, a terminal device displays a password input interface; in response to a user's input operation on the password input interface, the terminal device obtains a user input The first user password is used for the terminal device to generate the first master key and the first token; the terminal device encrypts the first user key based on the first master key to obtain the first user key of the first user key.
  • a ciphertext the first user key is used to encrypt and/or decrypt user data; the terminal device backs up the first ciphertext and the first token to the cloud device; When requesting the first ciphertext, the first token is used by the cloud device to verify the correctness of the target user's password.
  • the first operation may be a backup operation of the user key triggered by the user
  • the password input interface may be a password input interface for managing user data stored in the cloud.
  • the first master key is generated according to the first user password and the first salt value
  • the first token is generated according to the first master key and the second salt value ; where the first salt value and the second salt value are both random numbers; the first salt value and the second salt value are backed up on the cloud device.
  • the method further includes: in response to the second operation of the user, the terminal device obtains the first salt value and the second salt value from the cloud device; in response to the third operation of the user, The terminal device displays a password input interface; the terminal device obtains the second user password input by the user; the terminal device sends the second token to the cloud device; the terminal device receives the first ciphertext of the first user key, and decrypts it based on the second master key The first ciphertext to obtain the first user key; wherein, the first ciphertext is sent after the cloud device verifies that the second token is the same as the first token; the second master key is based on the second user password and the first salt value, the second token is generated according to the second master key and the second salt value.
  • the second operation may be a user key recovery operation
  • the third operation may be a password input operation
  • the method further includes: in response to the fourth operation of the user, the terminal device obtains the first salt value and the second salt value from the cloud device; in response to the fifth operation of the user, The terminal device displays a password input interface; the terminal device obtains the third user password and the fourth user password input by the user; the terminal device sends the third token to the cloud device; the terminal device receives the first ciphertext of the first user key, based on the The three master keys decrypt the first ciphertext to obtain the first user key; the first ciphertext is sent after the cloud device verifies that the third token is the same as the first token; the third master key is is generated according to the third user password and the first salt value, and the third token is generated according to the third master key and the second salt value; the terminal device stores the fourth token and the second ciphertext of the first user key Backup to the cloud device, where the second ciphertext of the first user key is obtained by encrypting the first user key according to the fourth master key,
  • the fourth operation may be an operation of modifying a user's password
  • the fifth operation may be an operation of entering a password
  • the method further includes: in response to the sixth operation of the user, the terminal device obtains encrypted user data from the cloud device; and the terminal device decrypts the encrypted user data based on the first user key.
  • the sixth operation may be an operation of acquiring user data.
  • a terminal device for executing the method in the first aspect or any possible implementation manner of the first aspect.
  • the apparatus includes modules or units for executing the method in the first aspect or any possible implementation manner of the first aspect, such as: a first processing unit, a second processing unit, a sending unit, and a receiving unit, which require It should be noted that, the functions performed by the first processing unit and the second processing unit may also be implemented by one processing unit.
  • a cloud device for executing the method in the second aspect or any possible implementation manner of the second aspect.
  • the apparatus includes modules or units for executing the method in the second aspect or any possible implementation manner of the second aspect, such as: a receiving unit, a storage unit, a processing unit, and a sending unit.
  • a terminal device for executing the method in the third aspect or any possible implementation manner of the third aspect.
  • the apparatus includes modules or units for executing the method in the third aspect or any possible implementation manner of the third aspect, such as: a processing unit, a sending unit, and a receiving unit.
  • a terminal device may include at least one processor, memory and a communication interface.
  • the processor is coupled with the memory and the communication interface.
  • the memory is used to store instructions
  • the processor is used to execute the instructions
  • the communication interface is used to communicate with other network elements under the control of the processor.
  • the instructions when executed by the processor, cause the processor to perform the method of the first aspect or any possible implementation of the first aspect.
  • a cloud device may include at least one processor, memory, and a communication interface.
  • the processor is coupled with the memory and the communication interface.
  • the memory is used to store instructions
  • the processor is used to execute the instructions
  • the communication interface is used to communicate with other network elements under the control of the processor.
  • the instructions when executed by the processor, cause the processor to perform the method of the second aspect or any possible implementation of the second aspect.
  • a ninth aspect of the present application provides a terminal device.
  • the terminal device may include at least one processor, memory and a communication interface.
  • the processor is coupled with the memory and the communication interface.
  • the memory is used to store instructions
  • the processor is used to execute the instructions
  • the communication interface is used to communicate with other network elements under the control of the processor.
  • the instructions when executed by the processor, cause the processor to perform the method of the third aspect or any possible implementation of the third aspect.
  • a tenth aspect of the present application provides a computer-readable storage medium, where a program is stored in the computer-readable storage medium, and the program causes a processor to execute the first aspect and any one of the various implementation manners thereof.
  • a computer-readable storage medium stores a program, and the program causes a processor to execute the second aspect and any one of the various implementation manners thereof.
  • a twelfth aspect of the present application provides a computer-readable storage medium, where a program is stored in the computer-readable storage medium, and the program causes a processor to execute the third aspect and any one of the various implementation manners thereof. .
  • a computer program product includes computer-executable instructions, and the computer-executable instructions are stored in a computer-readable storage medium; at least one processor of the device can be read from the computer-readable storage medium.
  • the computer-executable instructions are fetched, and at least one processor executes the computer-executable instructions to cause the device to implement the first aspect or a method provided by any possible implementation manner of the first aspect.
  • a fourteenth aspect provides a computer program product, the computer program product comprising computer-executable instructions stored in a computer-readable storage medium; at least one processor of the device can read the computer-readable storage medium. Computer-executed instructions, and at least one processor executes the computer-executed instructions to cause the device to implement the second aspect or a method provided by any possible implementation manner of the second aspect.
  • a fifteenth aspect of the present application provides a computer program product, the computer program product comprising computer-executable instructions stored in a computer-readable storage medium; at least one processor of the device can read from the computer-readable storage medium The computer-executable instructions are fetched, and at least one processor executes the computer-executable instructions to cause the device to implement the third aspect or a method provided by any possible implementation manner of the third aspect.
  • a sixteenth aspect of the present application provides a chip system, where the chip system includes a processor for supporting a terminal device to implement the functions involved in the first aspect or any possible implementation manner of the first aspect.
  • the chip system may further include a memory for storing necessary program instructions and data of the terminal device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • a seventeenth aspect of the present application provides a chip system, where the chip system includes a processor for supporting a cloud device to implement the functions involved in the second aspect or any possible implementation manner of the second aspect.
  • the chip system may further include a memory for storing necessary program instructions and data of the cloud device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • An eighteenth aspect of the present application provides a chip system, where the chip system includes a processor for supporting a terminal device to implement the functions involved in the third aspect or any possible implementation manner of the third aspect.
  • the chip system may further include a memory for storing necessary program instructions and data of the terminal device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • a nineteenth aspect of the present application provides a key management system.
  • the key management system includes a terminal device and a cloud device, where the terminal device is configured to execute the functions involved in the first aspect or any possible implementation manner of the first aspect, and the cloud device is configured to execute the second aspect or the first aspect. The functions involved in any possible implementation manner of the second aspect.
  • a twentieth aspect of the present application provides a key management system.
  • the key management system includes a terminal device and a cloud device, where the terminal device is configured to execute the functions involved in the third aspect or any possible implementation manner of the third aspect, and the cloud device is configured to execute the second aspect or the third aspect.
  • the functions involved in any possible implementation manner of the second aspect is configured to execute the first aspect or the third aspect.
  • terminal equipment, cloud equipment, computer storage medium, computer program product or chip system provided above are all used to execute the corresponding key management method provided above, so the beneficial effects that can be achieved can be achieved. With reference to the beneficial effects in the corresponding methods provided above, details are not repeated here.
  • FIG. 1 is a schematic diagram of a scenario of a key management system provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of an embodiment of a method for key management provided by an embodiment of the present application
  • FIG. 3 is a schematic diagram of another embodiment of the method for key management provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of a scenario of a method for key management provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of another embodiment of the method for key management provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of another embodiment of the method for key management provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of another scenario of the method for key management provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of another embodiment of the method for key management provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of another scenario of the method for key management provided by an embodiment of the present application.
  • FIG. 10 is a schematic diagram of another embodiment of the method for key management provided by an embodiment of the present application.
  • FIG. 11 is a schematic diagram of another scenario of the method for key management provided by an embodiment of the present application.
  • FIG. 12 is a schematic diagram of another embodiment of the method for key management provided by an embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of a terminal device provided by an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of a cloud device provided by an embodiment of the present application.
  • FIG. 15 is another schematic structural diagram of a terminal device provided by an embodiment of the present application.
  • FIG. 16 is another schematic structural diagram of a cloud device provided by an embodiment of the present application.
  • the embodiments of the present application provide a method for key management, which can safely back up user keys in a cloud device, and has no high requirements on the cloud device. While ensuring the security of user keys, it also takes into account Universality.
  • Embodiments of the present application also provide corresponding apparatuses, systems, computer-readable storage media, computer program products, and the like. Each of them will be described in detail below.
  • the cloud-side database not only manages user data, but also manages user keys, which can not only ensure the security of user data, but also the security of user keys, so as to avoid user secret If the key is lost, the user can no longer decrypt the user data stored in the cloud.
  • FIG. 1 is a schematic diagram of a scenario of a key management system provided by an embodiment of the present application.
  • the key management system includes a terminal device and a cloud device.
  • some cloud devices are used to store user data of various APPs, and some cloud devices are used to store user keys of users of various APPs.
  • the user data and user key of the same user can be stored separately on different cloud devices, or can be stored on the same cloud device.
  • User data for each user may be indexed by the user's user ID (eg, user account). User keys can also be indexed by user ID.
  • the user equipment may also be managed by using multiple cloud devices, and these cloud devices may separately manage user keys of different users.
  • cloud device 1 manages user keys and tokens of users in province 1
  • cloud device 2 manages user keys and tokens of users in province 2.
  • cloud device 1 is responsible for performing token verification
  • cloud device 2 is responsible for storing user keys.
  • Terminal equipment also known as user equipment (UE) is a device with wireless transceiver functions that can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on water (such as ships). etc.); can also be deployed in the air (eg on airplanes, balloons, satellites, etc.).
  • the terminal may be a mobile phone (mobile phone), a tablet computer (pad), a computer with a wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, or a terminal in an industrial control (industrial control).
  • VR virtual reality
  • AR augmented reality
  • Wireless terminal wireless terminal in self driving, wireless terminal in remote medical, wireless terminal in smart grid, wireless terminal in transportation safety, smart city Wireless terminals in (smart city), wireless terminals in smart homes (smart home), wireless terminals in the Internet of Things (IoT), etc.
  • Cloud devices can be physical machines or virtual machines (VMs) or containers.
  • VMs virtual machines
  • the terminal device After the user generates user data according to the APP installed on the terminal device, the terminal device encrypts the generated user data according to the user key, and then sends it to the database in the cloud for processing. storage. In the embodiment of the present application, the terminal device also protects the user key in combination with the user password, and then sends the protected user key to the cloud device for storage. The following describes the key management method provided by the embodiments of the present application.
  • the key management method provided by the embodiment of the present application includes: storage of user key, recovery of user key, modification of user password, and modification of user key four parts, recovery of user key, modification of user password , and the modification of the user key is based on the storage of the user key, which will be introduced separately below.
  • an embodiment of the method for key management provided by the embodiment of the present application includes:
  • the terminal device generates a first master key and a first token according to the first user password.
  • the first user password can be the login password of the application (APP) whose user data is stored in the cloud.
  • the first user password is only a description of the user password in this application.
  • the user password can be in the form of numbers, graphics, gestures, facial features, iris features, or a combination of numbers and characters.
  • the first master key is used to encrypt or decrypt the first user key
  • the first token is used by the cloud device to verify whether the target user password input by the user is the same as the first user password.
  • PBKDF2 password-based key derivation function
  • the terminal device encrypts the first user key based on the first master key to obtain a first ciphertext of the first user key.
  • the first user key is used to encrypt and/or decrypt user data.
  • the first user key is used to encrypt and/or decrypt user data.
  • Encryption and/or decryption in the embodiments of this application should be understood as at least one of encryption and decryption, that is, encryption, or decryption, or, encryption and decryption.
  • the first user secret key can be used to encrypt user data, and can also be used to decrypt the encrypted user data.
  • User data refers to data generated by users according to various APPs, and the user data can be in the form of numbers, texts, pictures, or videos.
  • the user key for decrypting the user data is usually not stored on the same cloud device.
  • the user key and the user data can also be stored on the same cloud device.
  • the terminal device backs up the first ciphertext of the first token and the first user key to the cloud device.
  • the backup process in step 103 may be implemented by: sending the first ciphertext of the first token and the first user key stored on the cloud device to the cloud device, or sending the first ciphertext to the cloud device through other devices A token and the first ciphertext of the first user key, or send the address storing the first ciphertext of the first token and the first user key to the cloud device.
  • the terminal device when the terminal device requests the cloud device for the first ciphertext of the first user key based on the target user password input by the user, the first token is used by the cloud device to verify the correctness of the target user password.
  • the terminal device When sending the first ciphertext, the terminal device also sends a first initialization vector (initialization vector, IV).
  • the first IV is used to improve the security of the first ciphertext.
  • the first IV is a string of random numbers.
  • the terminal device After the terminal device sends the first ciphertext of the first token and the first user key, it will store the first user key in the cache.
  • the encrypted user data is decrypted by directly extracting the first user key from the cache.
  • the cloud device stores the first ciphertext of the first token and the first user key.
  • the first master key generated by the first user password is used to encrypt the first user key to obtain the first ciphertext of the first user key
  • the first user password is used to generate the first token.
  • the user wants to obtain the first user key he needs to go through token verification to obtain the first ciphertext of the first user key, so that the first user key has a double security guarantee.
  • the user wants to obtain the first ciphertext of the first user key only the token generated by entering the correct user password can pass the token verification of the cloud device. If the user does not have the correct user password, it cannot be obtained.
  • the key management scheme in this application has no special requirements for the cloud device, and can be implemented only by an ordinary cloud device. Compared with storing user keys in dedicated hardware devices that are specially reinforced at the hardware level, the key management scheme of the present application is more versatile.
  • both the first master key and the first token may be generated directly using a password-based key generation algorithm for the first user password, and the above step 101 may also be: according to the first user The password and the first salt value are used to generate the first master key; the first token is generated according to the first master key and the second salt value; wherein, the first salt value and the second salt value are both random numbers, and the first The salt value and the second salt value are backed up on the cloud device.
  • the terminal device when the first master key and the first token are generated according to the first salt value and the second salt value, the terminal device will also send the first salt value and the second salt value to the cloud device.
  • the salt value and the second salt value are stored in association with the first token and the first ciphertext on the cloud device.
  • the first master key may be generated according to the first user password and the salt value; the first token may be generated according to the first master key and the salt value; wherein, The salt value is a random number. Then, the salt value needs to be backed up to the cloud device, for example, the salt value is sent to the cloud device, and the salt value is stored in association with the first token and the first ciphertext on the cloud device.
  • the user inputs the first user password into the terminal device.
  • the random number generator in the terminal device generates the first salt value and the second salt value, and then the terminal device generates the first master key according to the first user password and the first salt value according to the password-based key generation algorithm, and then according to the The first master key and the second salt value, again according to the password-based key generation algorithm to generate the first token.
  • the terminal device encrypts the first user key according to the first master key to obtain the first ciphertext of the first user key, and then converts the first salt value, the second salt value, the first token and the first user
  • the first ciphertext of the key is sent to the associated storage on the cloud device.
  • the first salt value and the second salt value may be random numbers generated by a random number generator in the terminal device.
  • the first salt value and the second salt value may be the same one value, or may be the same two values, or may be two different values.
  • the first ciphertext of the first salt value, the second salt value, the first token, and the first user key may be stored in association with a user ID, and the user ID may be a user account of the user registering the APP.
  • the cloud device interacts with the terminal device, it can find the salt value, token or ciphertext requested by the terminal device through the user ID.
  • the first master key generated by using the first salt value and the first user password, as well as the first token generated by using the first master key and the second salt value, have better security and will not be cracked basically.
  • the security of the first token and the first ciphertext further ensures the security of the first user key.
  • the storage process of the user key described above in FIG. 3 can also be understood by referring to the schematic diagram of the scenario shown in FIG. 4 , which exemplarily introduces the storage process of the user key.
  • APP1 is installed on the terminal device.
  • the APP1 may be an APP whose user sensitive data such as finance, shopping or health needs to be encrypted and stored in the cloud.
  • the key used for encrypting these sensitive data is the user key.
  • the user account of the user registered in the APP1 is "13400001234".
  • the terminal device can respond to this operation and display a password input interface. This operation may be referred to as the first operation, or may be described as an operation of backing up the user key, the terminal device will enter the interface as shown in interface 1 in Figure 4, and the user needs to set a "password".
  • the password is the user password, which is usually the password used to manage the encrypted user data stored in the cloud database. In this process, you can enter the password once or twice. In order to avoid the first input because the input error is not the password that the user wants to set, usually set the password twice.
  • the user can enter the first password and re-confirm the password in sequence, as shown in interface 2 in Figure 4, the password entered by the user is "745896", and the user enters the confirmation password again as "745896", if the passwords are the same twice, the user will be executed. Stored procedure for the key.
  • the password "745896" of the user account is the first user password in the embodiment described in FIG. 2 above.
  • the terminal device After acquiring the first user password, the terminal device triggers the random number generator in the terminal device to generate the first salt value and the second salt value, and according to the password-based key generation algorithm, the first user password and the first salt value are first Generate the first master key, then generate the first token according to the first master key and the second salt value, and then encrypt the first user key according to the first master key, the first user key can be a terminal device It is generated by the random number generator in , and can also be obtained by other methods, such as: the user imports the first user key from other devices.
  • the first ciphertext of the first user key After encrypting the first user key according to the first master key, the first ciphertext of the first user key is obtained, and then the first token and the first ciphertext, the first salt value and the first ciphertext of the first user key are combined.
  • the two-salt value is sent to the cloud device for storage, and the cloud device can associate and store the first ciphertext of the first token and the first user key through the user account "13400001234".
  • the cloud device can search for the first salt value and the second salt value through the user account "13400001234", and find the corresponding first token for verification. After the verification is successful, the first ciphertext of the corresponding first user key is returned to the terminal device.
  • FIG. 5 is a schematic diagram of another embodiment of the method for key management provided by an embodiment of the present application.
  • another embodiment of the method for key management provided by the embodiment of the present application includes:
  • the terminal device In response to the user key recovery instruction, the terminal device sends a ciphertext acquisition request to the cloud device, and accordingly, the cloud device receives the ciphertext acquisition request.
  • the ciphertext acquisition request is used to acquire the first ciphertext of the first user key.
  • the ciphertext acquisition request usually carries a user ID, such as the user account of the APP.
  • the cloud device After receiving the ciphertext acquisition request, the cloud device sends the first salt value and the second salt value to the terminal device.
  • the terminal device receives the first salt value and the second salt value sent by the cloud device.
  • the cloud device After receiving the ciphertext acquisition request, the cloud device will find the first salt value and the second salt value stored in association with the user ID according to the user ID.
  • the terminal device generates a second master key and a second token according to the user's input of the second user password, and the first salt value and the second salt value.
  • the second user password may be the same as the first user password, or may be different from the second user password. If it is the same as the first user password, the second user password generated by combining the first salt value and the second salt value The master key would be the same as the first master key and the second token would be the same as the first token.
  • the terminal device sends the second token to the cloud device.
  • the second token is used for the cloud device to verify with the first token.
  • step 206 The cloud device verifies whether the second token is the same as the first token. If it is verified that the second token is the same as the first token, step 206 is executed. If not, the cloud device returns the verification to the terminal device. Response failed.
  • the second token is the same as the first token means: the second user password is the same as the first user password, and the second master key is the same as the first master key.
  • the second master key generated by the second user password combined with the first salt value and the second salt value will be different from the first master key, and the second token will be different from the first master key.
  • the first tokens are different. In this way, the cloud device will not pass the token verification, but will return the verification failure to the terminal device, and the terminal device can output a prompt message that the user password is incorrect.
  • the cloud device sends the first ciphertext of the first user key to the terminal device, and correspondingly, the terminal device receives the first ciphertext of the first user key sent by the cloud device.
  • the terminal device decrypts the first ciphertext of the first user key according to the second master key.
  • the first ciphertext of the first user key can be returned to the terminal device only after the cloud device token verification is successful, which ensures the security of the first user key.
  • the process introduced in FIG. 5 can also be understood with reference to FIG. 6 .
  • the user inputs the second user password into the terminal device.
  • the terminal device requests the corresponding salt value from the cloud device, and the cloud device returns the first salt value and the second salt value.
  • the terminal device generates a second master key according to the second user password and the first salt value according to the password-based key generation algorithm, and then according to the second master key and the second salt value, again according to the password-based key
  • the generation algorithm generates the second token.
  • the terminal device sends the second token to the cloud device for token verification.
  • the cloud device sends the first user key to the terminal device
  • the terminal device decrypts the first ciphertext of the first user key according to the second master key to obtain the first user key.
  • the recovery process of the user key described in FIG. 5 or FIG. 6 can also be understood in conjunction with the scenario shown in FIG. 7 .
  • the user key When the user key is lost, when the user wants to restore the user key, the user can log in to APP1, respond to the user key restoration operation input by the user, and obtain the first salt value and the second salt value from the cloud device.
  • the key recovery operation can also be referred to as the second operation, and then the terminal device will respond to the third operation and enter the user password interface, such as entering the interface shown in interface 1 in FIG. 7 .
  • Input the recovery password that is, the user password, on the interface 1 in FIG. 7 .
  • the user enters the correct password 745896 where the recovery password is entered, and then the terminal device requests the corresponding salt value from the cloud device, and the cloud device returns the first salt value and the second salt value. Then, the terminal device generates a second master key according to 745896 and the first salt value according to the password-based key generation algorithm, and then generates the second master key according to the second master key and the second salt value again according to the password-based key generation algorithm second token. Then, the terminal device sends the second token to the cloud device for token verification.
  • the second master key is the same as the first master key
  • the second token is the same as the first token. Therefore, the cloud The verification result of the device will be that the verification is successful, then the cloud device sends the first ciphertext of the first user key to the terminal device, and the terminal device decrypts the first ciphertext of the first user key according to the second master key, In order to obtain the first user key, the terminal device will then display the interface 3 as shown in FIG. 7 , and the interface 3 displays “the user key is recovered successfully”.
  • the second master key will not be the same as the first master key, and the second token will not be the same as the first token.
  • the result of the cloud device token verification will be If the verification fails, the cloud device will return a verification failure response to the terminal device, and the terminal device will output the content of interface 4 in Figure 7, that is, "password error".
  • the above step 203 may include: verifying the first salt value and the second salt value; if the verification of the first salt value and the second salt value is successful, generating a second salt value according to the first salt value and the second user password a master key, and generating a second token based on the second salt value and the second master key.
  • verifying the first salt value and the second salt value if the verification of the first salt value and the second salt value is successful, generating a second salt value according to the first salt value and the second user password a master key, and generating a second token based on the second salt value and the second master key.
  • the verification process of the first salt value and the second salt value may be as follows: if the first salt value and the second salt value are within the preset salt value range, the verification is successful, if not within the preset salt value range , it means that the verification failed,
  • the key management method provided by the embodiment of the present application further includes: in response to the user key recovery instruction, sending the ciphertext acquisition request to the cloud device. request, the ciphertext acquisition request is used to acquire the first ciphertext of the first user key; receive the third salt value and the fourth salt value corresponding to the ciphertext acquisition request, the third salt value and the fourth salt value are random numbers ; Verify the third salt value and the fourth salt value. If the verification of the third salt value and the fourth salt value fails, a risk prompt is output.
  • the risk prompt may indicate that there is a risk of information leakage in the communication connection with the cloud device. If the user enters the user key recovery instruction to the terminal device, the ciphertext acquisition request sent by the terminal device is intercepted by a malicious attack device, and the third salt value and the fourth salt value are forged and sent to the terminal device.
  • the four-salt value is usually set to a simple number, such as "0 or 1", so that the attacking device can easily deduce the user's password through the token generated by the third or fourth salt value. Therefore, In this application, the third salt value and the fourth salt value are checked. The verification process can be judged by the preset salt value range.
  • the verification is successful. If one of them is not within the preset salt value range inside, the verification fails.
  • the preset salt value range in this application is usually the range of a long series of numbers, such as 1452785 to 5412861. Of course, an example is indicated here, and the specific representation of the salt value range is not limited in this application. . Therefore, the solution of the present application can effectively avoid the risk brought by malicious attacks by the attacking device.
  • FIG. 8 is a schematic diagram of another embodiment of the method for key management provided by an embodiment of the present application.
  • another embodiment of the method for key management provided by the embodiment of the present application includes:
  • the terminal device sends a ciphertext acquisition request to the cloud device in response to the password modification instruction input by the user, and accordingly, the cloud device receives the ciphertext acquisition request.
  • the ciphertext acquisition request is used to acquire the first ciphertext of the first user key.
  • the cloud device sends the first salt value and the second salt value to the terminal device according to the ciphertext acquisition request.
  • the terminal device receives the first salt value and the second salt value sent by the cloud device.
  • the terminal device generates a third master key and a third token according to the third user password, the first salt value and the second salt value input by the user.
  • the third user password should be the original user password, that is, the first user password.
  • the terminal device sends a third token to the cloud device.
  • step 306 is executed, and if not, a verification failure response is returned.
  • the cloud device will perform the steps 306. If the third user password input by the user is different from the first user password, the third master key is different from the first master key, and the third token is different from the first token. In this case, the cloud device A validation failure response will be returned.
  • the cloud device sends the first ciphertext of the first user key to the terminal device.
  • the terminal device receives the first ciphertext of the first user key.
  • the terminal device decrypts the first ciphertext of the first user key according to the third master key to obtain the first user key.
  • the token verification it can be determined that the third master key is the same as the first master key, and then the first ciphertext can be decrypted according to the third master key to obtain the first user key.
  • the terminal device generates a fourth master key and a fourth token according to the fourth user password input by the user.
  • the fourth user password should be the new user password for the user to rely on. That is, the new password for the APP to be based on.
  • the terminal device encrypts the first user key according to the fourth master key to obtain the second ciphertext of the first user key.
  • the terminal device backs up the fourth token and the second ciphertext of the first user key to the cloud device.
  • the backup process of this step 310 may be to send the third token to the cloud device again, and the second ciphertext for the fourth token and the first user key stored on the cloud device.
  • the cloud device receives the third token that is sent again by the terminal device, as well as the fourth token and the second ciphertext of the first user key.
  • the cloud device stores the quad token and the second ciphertext of the first user key.
  • the cloud device may update the first token and the first ciphertext according to the fourth token and the second ciphertext after verifying that the third token is the same as the first token again.
  • the cloud device can also send a notification of user password modification to the user's other terminal devices, and the other terminal devices will notify the user to re-enter the new user password by listening to the callback method.
  • token verification is required first, and the token verification is successful before returning the first ciphertext. If not, the cloud device will return a verification failure notification. In this way, the security in the process of modifying the user password can be ensured, and the malicious modification of the user password can be avoided.
  • the above step 308 includes generating a fourth master key according to the fourth user password and the first salt value; generating a fourth token according to the fourth master key and the second salt value; wherein the fourth token and the second ciphertext are stored in association with the first salt value and the second salt value on the cloud device.
  • the new fourth user password can be combined with the original first salt value and the second salt value to generate the fourth master key and the fourth token, so that the cloud device only needs to use the fourth master key and the fourth token.
  • the key and the fourth token may be stored in association with the original first salt value and the second salt value, which can reduce the amount of data transmission.
  • the above step 308 includes generating a fourth master key according to the fourth user password and the fifth salt value; generating a fourth token according to the fourth master key and the sixth salt value; wherein the fifth salt value and the sixth salt value are newly generated random numbers for the fourth user password; the method further includes: sending the fifth salt value and the sixth salt value to the cloud device, where the fifth salt value and the sixth salt value are used in the cloud device is stored in association with the fourth token and the second ciphertext.
  • the fourth token and the second ciphertext can be improved according to the newly generated fifth salt value and the sixth salt value. security.
  • the terminal device will respond to the user-triggered user password modification operation, which can also be described as the fourth operation.
  • the terminal device obtains the first salt value and the second salt value from the cloud device, and then responds to the fifth operation entered by the user.
  • the password input interface is displayed, for example, it can be understood by referring to the schematic diagram of the scene shown in FIG. 9 .
  • the user wants to modify the password of APP1 used to manage the encrypted user data in the cloud database, the user needs to open the interface shown in Interface 1 in Figure 9.
  • the user account is 13400001234, which is usually displayed as "134" ****1234". Then, you need to enter the old password first, and then enter the new password twice in a row.
  • enter the old password 745896 enter the new password 423518 for the first time, and enter the new password 423518 for the second time.
  • the terminal device will first request the corresponding salt value from the cloud device, and the cloud device will return the first salt value and the second salt value.
  • the device sends a third token.
  • the cloud device verifies whether the third token is the same as the first token, because the old password entered by the user is the password 745896 at the time of registration, then the third token and the first token, the token verification is successful, the cloud device will Return the first ciphertext of the first user key to the terminal device.
  • the terminal device decrypts the first ciphertext of the first user key according to the third master key to obtain the first user key.
  • the terminal device generates a fourth master key and a fourth token according to the new password 423518, and then encrypts the first user key according to the fourth master key to obtain the second ciphertext of the first user key,
  • the second ciphertext and the fourth token of the first user key are then sent to the cloud device for storage.
  • the terminal device will display "Password Changed Successfully" as shown in interface 3 in Figure 9.
  • the fourth master key and the fourth token can be generated according to the original first salt value and the second salt value, or can be generated according to the fifth salt value and the sixth salt value.
  • the cloud device associates and stores the first salt value, the second salt value, the fourth token and the second ciphertext of the first user key. If the fourth master key and the fourth token are generated according to the fifth salt value and the sixth salt value, the cloud device associates and stores the fifth salt value, the sixth salt value, the fourth token and the first user key. Two ciphertext.
  • FIG. 10 is a schematic diagram of another embodiment of the method for key management in the embodiment of the present application.
  • another embodiment of the method for key management provided by the embodiment of the present application includes:
  • the terminal device acquires, in response to the user key modification instruction, a second user key for replacing the first user key.
  • the second user key can be generated by a random number generator, or set by the user, or generated by other means.
  • the terminal device sends a request for obtaining the salt value to the cloud device.
  • the salt value obtaining request is used to obtain the first salt value and the second salt value.
  • the cloud device sends the first salt value and the second salt value to the terminal device according to the salt value acquisition request.
  • the terminal device receives the first salt value and the second salt value sent by the cloud device.
  • the terminal device generates a fifth master key and a fifth token according to the fifth user password, the first salt value and the second salt value input by the user.
  • the cloud device verifies whether the fifth token is the same as the first token. If it is verified that the fifth token is the same as the first token, step 407 is executed, and if not, a verification failure response is returned to the terminal device.
  • the token verification is consistent, but the key status is updating, it means that the user key is being updated, and the stored ciphertext data has not been completely re-encrypted, the user key is not allowed to be modified again, and the update fails; After receiving the update failure on the cloud side, clear the new user key generated locally, return the key modification failure, and terminate the process.
  • the cloud device also saves the ciphertext of the new user key + the second IV value, sets the key status to updating, and returns a successful update.
  • the terminal device will also cache the new user key in the memory, and request the database on the cloud side to query all the ciphertext user data of the user, re-encrypt the ciphertext user data, and then re-encrypt the newly encrypted ciphertext.
  • User data is sent to the cloud-side database for storage.
  • the cloud device sends a verification success message to the terminal device.
  • the terminal device receives the verification success message sent by the cloud device.
  • the verification success message indicates that the fifth token is the same as the first token, and that the fifth token is the same as the first token indicates that the fifth user password is the same as the first user password.
  • the terminal device encrypts the second user key according to the fifth master key to obtain the ciphertext of the second user key.
  • the terminal device backs up the ciphertext of the second user key and the fifth token to the cloud device.
  • the terminal device may send the ciphertext of the second user key and the fifth token to the cloud device.
  • the cloud device associates and stores the ciphertext of the second user key and the fifth token.
  • the terminal device After the update is completed, the terminal device requests the cloud device to set the key status to update complete, and the cloud side will always save the first ciphertext + the first IV value of the old user key.
  • the cloud device During the re-encryption process, only this terminal is allowed to operate, and the cloud device does not allow other terminal operations of the user until all ciphertext user data is re-encrypted and stored in the cloud-side database.
  • the user's other terminal devices need to register and listen to the user key. After the cloud device sets the key status to update, it will notify the user's other terminal devices. key update, whether it is necessary to update the user's key to the local, if the user selects yes, the user's other terminal devices will request the latest user key ciphertext from the cloud device, and use the locally cached master key to decrypt it into the user key . If the user chooses No, the user's other terminal devices will not obtain the user key from the cloud device. Here, the user needs to be prompted in the data. If the latest user key is not obtained from the cloud device, the encrypted data will not be synchronized to the cloud side. .
  • the terminal device when the user wants to modify the user key, the terminal device also needs to first generate a fifth token according to the fifth user password, the first salt value and the second salt value, and the cloud device first verifies the fifth token Whether it is the same as the first token, if the fifth token is the same as the first token, it means that the fifth user password is the correct user password, the user key modification operation can be performed, and the terminal device encrypts it according to the fifth master key.
  • the ciphertext of the second user key can be obtained by obtaining the second user key.
  • token verification is performed first in the process of modifying the user key, so that the security of modifying the user key can be ensured and the malicious modification of the user key can be avoided.
  • the process of modifying the user key can also be understood by referring to the schematic diagram of the scenario shown in FIG. 11 .
  • the user still needs to input the correct password 745896 in the process of modifying the key, which is the fifth user password in the above embodiment.
  • the terminal device will first request the corresponding salt value from the cloud device, and the cloud device will Returning the first salt value and the second salt value, the terminal device first generates the fifth master key and the fifth token according to the password 745896, and then sends the fifth token to the cloud device.
  • the cloud device verifies whether the fifth token is the same as the first token, because the password entered by the user is the password 745896 at the time of registration, then the fifth token and the first token, the token verification is successful, the cloud device will send a message to the terminal The device returns a verification success message. Then the terminal device can send the fifth master key and the fifth token to the cloud device and store them in association with the first salt value and the second salt value. The cloud device can also continue to retain the first user key of the original first user key. ciphertext.
  • both the first user key and the second user key will be cached in the terminal device. If the user needs to obtain user data from the cloud, the terminal device can respond to the sixth operation, and the sixth operation can Described as the user's data acquisition operation, the encrypted user data is obtained from the cloud, and then decrypted using the first user key or the second user key cached in the cache when the data is obtained to obtain the user data.
  • the first master key is generated by using a second-level hash algorithm
  • the first token is generated by using a millisecond-level hash algorithm or a microsecond-level hash algorithm.
  • Second-level hash algorithm means that it takes one or more seconds to complete a hash.
  • Second-level hash algorithms usually set the number of iterations in the operation parameters to one million or several million times. , or 10 million times, in this way, taking a 6-digit user password as an example, it will take several months to brute force the user password, so the first master key is the user password and the first salt value in seconds.
  • the hash algorithm which can prevent the first master key from being brute force cracked, because the first token is generated according to the first master key and the second salt value through the hash algorithm, and the first master key can be prevented from being cracked.
  • Brute-force cracking is done, so the first token does not have the problem of being cracked by brute force.
  • the first token only needs to be generated quickly. Therefore, the first token is completed with a millisecond-level hash algorithm or a microsecond-level hash algorithm. , which can increase the speed at which the first token is obtained.
  • other "Xth master key" and "Xth token” can be understood with reference to the generation method of the first master key and the first token, and the Xth represents the above-mentioned Second, third, fourth....
  • the key management solution described above can be implemented by setting a key management module in the terminal device and setting an isolated storage area in the cloud device through software.
  • the following describes the process of implementing the above-mentioned key management in combination with the terminal device and the cloud device from the perspective of modularization.
  • the terminal device includes a terminal-side application programming interface (API) 5001, a synchronization management module 5002, a security management module 5003, a key management module 5004, a storage management module 5005, a communication management module 5006 and a terminal Cloud communication module 5007.
  • the key management module 5004 is configured in the security management module 5003, and the terminal-cloud communication module 5007 is configured in the communication management module 5006.
  • the cloud device includes a communication management module 5008, a security management module 5009, a synchronization management module 5010, and a storage management module 5011.
  • the storage management module 5011 is provided with an isolated storage area 5012.
  • the communication between the terminal device and the cloud device is completed through the terminal-cloud communication module 5007 and the communication management module 5008, and the key management module 5004 is used to perform the key management process of the terminal device in the above key management method,
  • the isolated storage area 5012 is used to store the salt value, the token and the ciphertext of the user key in the above key management method.
  • an embodiment of the terminal device 60 provided by the embodiment of the present application includes:
  • the first processing unit 601 is configured to generate a first master key and a first token according to the first user password. For example, step 101 is executed.
  • the second processing unit 602 is configured to encrypt the first user key according to the first master key generated by the first processing unit 601 to obtain the first ciphertext of the first user key, and the first user key is used to encrypt or Decrypt user data. For example, step 102 is executed.
  • the sending unit 603 is configured to back up the first token generated by the first processing unit 601 and the first ciphertext of the first user key obtained by the second processing unit 602 to the cloud device.
  • the target user password requests the cloud device for the first ciphertext of the first user key
  • the first token is used by the cloud device to verify the correctness of the target user password. For example, step 103 is executed.
  • the first master key generated by the first user password is used to encrypt the first user key to obtain the first ciphertext of the first user key
  • the first user password is used to generate the first token.
  • the user wants to obtain the first user key he needs to go through token verification to obtain the first ciphertext of the first user key, so that the first user key has a double security guarantee.
  • the user wants to obtain the first ciphertext of the first user key only the token generated by entering the correct user password can pass the token verification of the cloud device. If the user does not have the correct user password, it cannot be obtained.
  • the key management scheme in this application has no special requirements for the cloud device, as long as an ordinary cloud device can be implemented, Compared with a dedicated hardware device that is specially reinforced at the hardware level to store user keys, the key management solution of the present application is more versatile.
  • the first processing unit 601 is configured to generate a first master key according to the first user password and the first salt value; generate a first token according to the first master key and the second salt value; wherein, The first salt value and the second salt value are both random numbers, and the first salt value and the second salt value are backed up on the cloud device.
  • the sending unit 603 is further configured to send the first salt value and the second salt value to the cloud device, where the first salt value and the second salt value are used to communicate with the first token and the first ciphertext on the cloud device associative storage.
  • the terminal device further includes a receiving unit 604 .
  • the sending unit 603 is further configured to, in response to the user key recovery instruction, send a ciphertext acquisition request to the cloud device, where the ciphertext acquisition request is used to acquire the first ciphertext of the first user key.
  • a receiving unit 604 configured to receive the first salt value and the second salt value, where the first salt value and the second salt value are sent by the cloud device in response to the ciphertext acquisition request.
  • the first processing unit 601 is further configured to generate a second master key and a second token according to the user's input of the second user password and the first salt value and the second salt value.
  • the sending unit 603 is further configured to send the second token to the cloud device.
  • the receiving unit 604 is further configured to receive the first ciphertext of the first user key, where the first ciphertext of the first user key is when the cloud device verifies the second password. Sent after the token is the same as the first token.
  • the second processing unit 602 is further configured to decrypt the first ciphertext of the first user key based on the second master key to obtain the first user key.
  • the first processing unit 601 is configured to verify the first salt value and the second salt value; if the verification of the first salt value and the second salt value is successful, generate the password according to the first salt value and the second user password.
  • the second master key, the second token is generated according to the second salt value and the second master key.
  • the sending unit 603 is further configured to, in response to the user key recovery instruction input by the user, send a ciphertext acquisition request to the cloud device, where the ciphertext acquisition request is used to acquire the first ciphertext of the first user key.
  • the receiving unit 604 is further configured to receive a third salt value and a fourth salt value corresponding to the ciphertext acquisition request, where the third salt value and the fourth salt value are random numbers.
  • the first processing unit 601 is further configured to verify the third salt value and the fourth salt value, and output a risk prompt if the verification of the third salt value and the fourth salt value fails.
  • the sending unit 603 is further configured to, in response to the password modification instruction input by the user, send a ciphertext acquisition request to the cloud device, where the ciphertext acquisition request is used to acquire the first ciphertext of the first user key.
  • the receiving unit 604 is further configured to receive a first salt value and a second salt value, where the first salt value and the second salt value are sent by the cloud device in response to the ciphertext acquisition request.
  • the first processing unit 601 is further configured to generate a third master key and a third token according to the third user password, the first salt value and the second salt value input by the user.
  • the sending unit 603 is further configured to send a third token to the cloud device.
  • the receiving unit 604 is further configured to receive the first ciphertext of the first user key sent by the cloud device, where the first ciphertext is sent by the cloud device after verifying that the third token is the same as the first token.
  • the second processing unit 602 is further configured to decrypt the first ciphertext of the first user key based on the third master key to obtain the first user key.
  • the first processing unit 601 is further configured to generate a fourth master key and a fourth token according to the fourth user password input by the user.
  • the second processing unit 602 is further configured to encrypt the first user key according to the fourth master key to obtain the second ciphertext of the first user key.
  • the sending unit 603 is further configured to back up the fourth token and the second ciphertext of the first user key to the cloud device.
  • the first processing unit 601 is configured to generate a fourth master key according to the fourth user password and the first salt value; generate a fourth token according to the fourth master key and the second salt value; wherein, The fourth token and the second ciphertext are stored on the cloud device in association with the first salt value and the second salt value.
  • the first processing unit 601 is configured to generate a fourth master key according to the fourth user password and the fifth salt value; generate a fourth token according to the fourth master key and the sixth salt value; wherein, The fifth salt value and the sixth salt value are newly generated random numbers for the fourth user password, and the fifth salt value and the sixth salt value are backed up on the cloud device.
  • the sending unit 603 is further configured to send the fifth salt value and the sixth salt value to the cloud device, where the fifth salt value and the sixth salt value are used to communicate with the fourth token and the second ciphertext on the cloud device associative storage.
  • the first processing unit 601 is further configured to obtain a second user key for replacing the first user key in response to the user key modification instruction.
  • the sending unit 603 is further configured to send a salt value acquisition request to the cloud device, where the salt value acquisition request is used to acquire the first salt value and the second salt value.
  • the receiving unit 604 is further configured to receive the first salt value and the second salt value sent by the cloud device in response to the salt value acquisition request.
  • the first processing unit 601 is further configured to generate a fifth master key and a fifth token according to the fifth user password, the first salt value and the second salt value input by the user.
  • the sending unit 603 is further configured to send a token verification request to the cloud device, where the token verification request includes a fifth token.
  • the receiving unit 604 is further configured to receive a verification success message sent by the cloud device, where the verification success message indicates that the fifth token is the same as the first token, and that the fifth token is the same as the first token indicates the fifth user password Same as the first user password.
  • the second processing unit 602 is further configured to encrypt the second user key according to the fifth master key to obtain the ciphertext of the second user key.
  • the sending unit 603 is further configured to back up the ciphertext of the second user key and the fifth token to the cloud device.
  • the first master key is generated by using a second-level hash algorithm
  • the first token is generated by using a millisecond-level hash algorithm or a microsecond-level hash algorithm.
  • the terminal device provided by the embodiment of the present application further includes the following functional units.
  • the display unit is used for displaying a password input interface in response to the user's first operation.
  • the obtaining unit is used for obtaining the first user password input by the user in response to the user's input operation on the password input interface, and the first user password is used for the terminal device to generate the first master key and the first token.
  • An encryption unit configured to encrypt the first user key based on the first master key to obtain a first ciphertext of the first user key, where the first user key is used to encrypt and/or decrypt user data.
  • the backup unit is used for backing up the first ciphertext and the first token to the cloud device; when the terminal device requests the cloud device for the first ciphertext based on the target user password input by the user, the first token is used by the cloud device to verify the Verify the correctness of the target user's password.
  • the first master key is generated according to the first user password and the first salt value
  • the first token is generated according to the first master key and the second salt value; wherein the first salt value and the first salt value are generated.
  • Both salt values are random numbers; the first salt value and the second salt value are backed up on the cloud device.
  • the obtaining unit is further configured to obtain the first salt value and the second salt value from the cloud device in response to the second operation of the user.
  • the display unit is further configured to display a password input interface in response to the third operation of the user.
  • the obtaining unit is further configured to obtain the second user password input by the user.
  • a sending unit configured to send the second token to the cloud device.
  • the receiving unit is configured to receive the first ciphertext of the first user key, and decrypt the first ciphertext based on the second master key to obtain the first user key; wherein, the first ciphertext is when the cloud device verifies the first ciphertext
  • the second token is sent after being identical to the first token; the second master key is generated according to the second user password and the first salt value, and the second token is generated according to the second master key and the second salt value .
  • the obtaining unit is further configured to obtain the first salt value and the second salt value from the cloud device in response to the fourth operation of the user.
  • the display unit is further configured to display a password input interface in response to the fifth operation of the user.
  • the obtaining unit is further configured to obtain the third user password and the fourth user password input by the user.
  • the sending unit is further configured to send the third token to the cloud device.
  • the receiving unit is further configured to receive the first ciphertext of the first user key, and decrypt the first ciphertext based on the third master key to obtain the first user key; wherein, the first ciphertext is when the cloud device checks
  • the third token is sent after the same as the first token; the third master key is generated according to the third user password and the first salt value, and the third token is generated according to the third master key and the second salt value of.
  • the backup unit is further configured to back up the second ciphertext of the fourth token and the first user key to the cloud device, wherein the second ciphertext of the first user key is to encrypt the first user according to the fourth master key
  • the fourth master key is generated according to the fourth user password and the first salt value
  • the fourth token is generated according to the fourth master key and the second salt value.
  • the obtaining unit is further configured to obtain encrypted user data from the cloud device in response to the sixth operation of the user.
  • a decryption unit for decrypting the encrypted user data based on the first user key.
  • the acquisition unit, the encryption unit and the decryption unit may be implemented by the above-mentioned first processing unit 601 or the second processing unit 602
  • the backup unit may be implemented by the sending unit 603 .
  • an embodiment of the cloud device 70 provided by this embodiment of the present application includes:
  • the receiving unit 701 is configured to receive a first token from a terminal device and a first ciphertext of a first user key, where the first ciphertext of the first user key is a
  • the first master key and the first token are obtained by encrypting the user key, and the first master key and the first token are generated by the terminal device according to the first user password.
  • the storage unit 702 is configured to store the first token and the first ciphertext of the first user key received by the receiving unit 701, and the first token is used for current.
  • the processing unit 703 is configured to verify the correctness of the target user password according to the first token when the receiving unit 701 receives the request for the first ciphertext sent by the terminal device in response to the target user password input by the user.
  • the cloud device will store the first ciphertext of the first token and the first user key sent by the terminal device, and when the terminal device needs the first ciphertext, it will follow the first command
  • the card is verified first, and the first ciphertext of the first user key is returned to the terminal device only after the verification is passed.
  • the first user key has double security guarantee not only through self-encryption, but also through token verification.
  • the token is generated by the user password. If the user wants to obtain the first ciphertext of the first user key, only the token generated by entering the correct user password can pass the token verification of the cloud device.
  • the key management scheme in this application has no special requirements for the cloud device, as long as An ordinary cloud device can be implemented, and the key management scheme of the present application is more versatile than storing user keys in a dedicated hardware device that is specially reinforced at the hardware level.
  • the receiving unit 701 is further configured to generate the first salt value and the second salt value of the first token and the first master key from the receiving terminal device, and the first salt value and the second salt value are both. is a random number.
  • the storage unit 702 is further configured to store the first salt value and the second salt value in association with the first ciphertext of the first token and the first user key.
  • the cloud device 70 further includes a sending unit 704 .
  • the receiving unit 701 is further configured to receive a ciphertext acquisition request from the terminal device, where the ciphertext acquisition request is used to acquire the first ciphertext of the first user key.
  • the sending unit 704 is further configured to send the first salt value and the second salt value to the terminal device according to the ciphertext acquisition request.
  • the receiving unit 701 is further configured to receive a second token from the terminal device, where the second token is generated by the terminal device according to the second user password, the first salt value and the second salt value.
  • the sending unit 704 is further configured to send the first ciphertext of the first user key to the terminal device if the processing unit verifies that the second token is the same as the first token, and the second token is the same as the first token Indicates: the second user password is the same as the first user password.
  • the receiving unit 701 is further configured to receive a ciphertext acquisition request from the terminal device, where the ciphertext acquisition request is used to acquire the first ciphertext of the first user key.
  • the sending unit 704 is further configured to send the first salt value and the second salt value to the terminal device according to the ciphertext acquisition request.
  • the receiving unit 701 is further configured to receive a third token from the terminal device, where the third token is generated by the terminal device according to the third user password, the first salt value and the second salt value.
  • the sending unit 704 is further configured to send the first ciphertext of the first user key to the terminal device if it is verified that the third token is the same as the first token, the third token being the same as the first token means:
  • the third user password is the same as the first user password.
  • the receiving unit 701 is further configured to receive the second ciphertext from the fourth token of the terminal device and the first user key, the second ciphertext is encrypted with the fourth master key, the fourth master key and the fourth The token is generated based on the fourth user password entered by the user.
  • the storage unit 702 is further configured to store the fourth token and the second ciphertext.
  • the storage unit 702 is configured to store the fourth token and the second ciphertext with the first salt if the fourth token and the fourth master key are generated according to the first salt value and the second salt value The value is stored in association with the second salt value.
  • the receiving unit 701 is further configured to receive the fifth salt value and the sixth salt from the terminal device if the fourth token and the fourth master key are generated according to the fifth salt value and the sixth salt value value.
  • the storage unit 702 is configured to store the fourth token and the second ciphertext in association with the fifth salt value and the sixth salt value.
  • the receiving unit 701 is further configured to receive a salt value acquisition request from the terminal device, where the salt value acquisition request is used to acquire the first salt value and the second salt value.
  • the sending unit 704 is further configured to send the first salt value and the second salt value to the terminal device.
  • the receiving unit 701 is further configured to receive a token verification request from a terminal device, where the token verification request includes a fifth token, the fifth token is a fifth user password input by a user, and the first salt value and The second salt value is generated.
  • the sending unit 704 is further configured to send a verification success message to the terminal device if the fifth token is the same as the first token, the fifth token being the same as the first token indicates that the fifth user password is the same as the first user password same.
  • the receiving unit 701 is further configured to receive the ciphertext of the second user key and the fifth token from the terminal device, the ciphertext of the second user key is encrypted by the fifth master key, and the fifth master key and the fifth token is generated based on the fifth user password.
  • the storage unit 702 is further configured to store the ciphertext of the second user key and the fifth token.
  • FIG. 15 is a block diagram showing a partial structure of a mobile phone related to a terminal provided by an embodiment of the present application.
  • the mobile phone includes: a radio frequency (: Radio Frequency,: RF) circuit 810, a memory 820, an input unit 830, a display unit 840, a sensor 850, an audio circuit 860, a wireless fidelity (WiFi) module 870, a processing 880, and the power supply 890 and other components.
  • RF Radio Frequency
  • the RF circuit 810 can be used for receiving and sending signals during sending and receiving of information or during a call. In particular, after receiving the downlink information of the base station, it is processed by the processor 880; in addition, the designed uplink data is sent to the base station.
  • the RF circuit 810 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a Low Noise Amplifier (LNA), a duplexer, and the like.
  • LNA Low Noise Amplifier
  • the memory 820 can be used to store software programs and modules, and the processor 880 executes various functional applications and data processing of the mobile phone by running the software programs and modules stored in the memory 820 .
  • the memory 820 may mainly include a stored program area and a stored data area, wherein the stored program area may store an operating system, an application program required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; According to the data created by the mobile phone (such as audio data, phone book, etc.) and so on.
  • memory 820 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.
  • the input unit 830 can be used to receive information input by the user, such as a user password, and generate key signal input related to user settings and function control of the mobile phone.
  • the input unit 830 may include a touch panel 831 and other input devices 832 .
  • the touch panel 831 also referred to as a touch screen, can collect the user's touch operations on or near it (such as the user's finger, stylus, etc., any suitable object or attachment on or near the touch panel 831). operation), and drive the corresponding connection device according to the preset program.
  • the touch panel 831 may include two parts, a touch detection device and a touch controller.
  • the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it to the touch controller.
  • the touch panel 831 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves.
  • the input unit 830 may further include other input devices 832 .
  • other input devices 832 may include, but are not limited to, one or more of physical keyboards, function keys (such as volume control keys, switch keys, etc.), trackballs, mice, joysticks, and the like.
  • the display unit 840 may be used to display the interface content of the APP.
  • the display unit 840 may include a display panel 841.
  • a liquid crystal display (English full name: Liquid Crystal Display, English abbreviation: LCD), an organic light-emitting diode (English full name: Organic Light-Emitting Diode, English abbreviation: OLED), etc.
  • the display panel 841 is configured in the form.
  • the touch panel 831 can cover the display panel 841, and when the touch panel 831 detects a touch operation on or near it, it transmits it to the processor 880 to determine the type of the touch event, and then the processor 880 determines the type of the touch event according to the touch event. Type provides corresponding visual output on display panel 841 .
  • the touch panel 831 and the display panel 841 are used as two independent components to realize the input and input functions of the mobile phone, in some embodiments, the touch panel 831 and the display panel 841 can be integrated to form Realize the input and output functions of the mobile phone.
  • the cell phone may also include at least one sensor 850, such as a light sensor, a motion sensor, and other sensors.
  • the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 841 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 841 and/or when the mobile phone is moved to the ear. or backlight.
  • the accelerometer sensor can detect the magnitude of acceleration in all directions (usually three axes), and can detect the magnitude and direction of gravity when it is stationary. games, magnetometer attitude calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors such as gyroscope, barometer, hygrometer, thermometer, infrared sensor, etc. Repeat.
  • the audio circuit 860, the speaker 861, and the microphone 862 can provide an audio interface between the user and the mobile phone.
  • the audio circuit 860 can transmit the received audio data converted electrical signals to the speaker 861, and the speaker 861 converts them into sound signals for output; on the other hand, the microphone 862 converts the collected sound signals into electrical signals, and the audio circuit 860 converts the collected sound signals into electrical signals. After receiving, it is converted into audio data, and then the audio data is output to the processor 880 for processing, and then sent to, for example, another mobile phone through the RF circuit 810, or the audio data is output to the memory 820 for further processing.
  • WiFi is a short-distance wireless transmission technology.
  • the mobile phone can help users to send and receive emails, browse web pages, and access streaming media through the WiFi module 870. It provides users with wireless broadband Internet access.
  • FIG. 15 shows the WiFi module 870, it can be understood that it is not a necessary component of the mobile phone, and can be completely omitted as required within the scope of not changing the essence of the invention.
  • the processor 880 is the control center of the mobile phone, using various interfaces and lines to connect various parts of the entire mobile phone, by running or executing the software programs and/or modules stored in the memory 820, and calling the data stored in the memory 820.
  • the processor 880 may include one or more processing units; preferably, the processor 880 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc. , the modem processor mainly deals with wireless communication. It can be understood that, the above-mentioned modulation and demodulation processor may not be integrated into the processor 880.
  • the mobile phone also includes a power supply 890 (such as a battery) for supplying power to various components.
  • a power supply 890 (such as a battery) for supplying power to various components.
  • the power supply can be logically connected to the processor 880 through a power management system, so as to manage charging, discharging, and power consumption management functions through the power management system.
  • the mobile phone may also include a camera, a Bluetooth module, and the like, which will not be repeated here.
  • the processor 880 included in the terminal also has the function of key management described above.
  • FIG. 16 is a schematic diagram of a possible logical structure of the cloud device involved in the above-mentioned embodiment provided by the embodiment of the present application.
  • the cloud device 90 includes: a processor 901 , a communication interface 902 , a memory 903 and a bus 904 .
  • the processor 901 , the communication interface 902 , and the memory 903 are connected to each other through a bus 904 .
  • the processor 901 is configured to control and manage the actions of the cloud device 90.
  • the processor 901 is configured to perform the verification process of the token by the cloud device in FIG. 2 to FIG. 11, and/or Additional procedures for the techniques described herein.
  • the communication interface 902 is used to support the cloud device 90 to communicate.
  • the communication interface 902 can perform the steps of sending and receiving data in the above method embodiments.
  • the memory 903 is used to store program codes and data of the cloud device 90 .
  • the processor 901 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute the various exemplary logical blocks, modules and circuits described in connection with this disclosure.
  • a processor may also be a combination that performs computing functions, such as a combination comprising one or more microprocessors, a combination of a digital signal processor and a microprocessor, and the like.
  • the bus 904 may be a peripheral component interconnect standard (Peripheral Component Interconnect, PCI) bus or an Extended Industry Standard Architecture (Extended Industry Standard Architecture, EISA) bus or the like.
  • PCI peripheral component interconnect standard
  • EISA Extended Industry Standard Architecture
  • a computer-readable storage medium is also provided, where computer-executable instructions are stored in the computer-readable storage medium, and when at least one processor of a device executes the computer-executable instructions, the device executes the above diagram 2 to the method of key management described in some embodiments of FIG. 11 .
  • a computer program product in another embodiment, includes computer-executable instructions, and the computer-executable instructions are stored in a computer-readable storage medium; at least one processor of the device can be obtained from a computer-readable storage medium. Reading the storage medium reads the computer-executable instructions, and at least one processor executes the computer-executable instructions to cause the device to perform the key management methods described in the above-mentioned partial embodiments of FIG. 2 to FIG. 11 .
  • a chip system in another embodiment of the present application, is further provided, the chip system includes a processor, and is used for supporting a terminal device to implement the key management methods described in the above-mentioned partial embodiments of FIG. 2 to FIG. 11 .
  • the chip system may further include a memory for storing necessary program instructions and data.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • a chip system is further provided.
  • the chip system includes a processor, which is used to support a cloud device to implement the key management methods described in the above-mentioned partial embodiments of FIG. 2 to FIG. 11 .
  • the chip system may further include a memory for storing necessary program instructions and data.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • Units described as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the embodiments of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer-readable storage medium.
  • the technical solutions of the embodiments of the present application can be embodied in the form of software products in essence, or the parts that make contributions to the prior art or the parts of the technical solutions, and the computer software products are stored in a storage medium , including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in the embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephonic Communication Services (AREA)
  • Lock And Its Accessories (AREA)

Abstract

本申请公开了一种密钥管理的方法，终端设备根据用户口令生成主密钥和令牌(token)根据主密钥加密用户密钥，以得到用户密钥的密文，然后将用户密钥的密文和令牌备份到云设备中。在终端设备要恢复用户密钥时，需要通过用户口令生成一个令牌，然后将生成的令牌发送到云设备去做校验，云设备在令牌校验成功后，才会给终端设备返回用户密钥的密文。本申请实施例由于对用户密钥进行了加密以及采用令牌进行验证，为用户密钥提供了双重安全保障，而且，本申请对云设备没有特殊要求，相比对用在硬件层面专门做了安全加固的专用硬件设备存储用户密钥，本申请的密钥管理方案的通用性更好。

Description

一种密钥管理的方法、相应装置及系统
本申请要求于2020年12月29日提交中国专利局、申请号为202011613318.9、发明名称为“一种密钥管理的方法、相应装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，具体涉及一种密钥管理的方法、相应装置及系统。
背景技术
在手机、个人计算机(personal computer，PC)和笔记本电脑等终端设备中都会安装各种应用(application，APP)，这些APP会涉及到用户个人的用户数据(如：图片、视频和信息等)。因为终端设备上的存储空间有限，这些用户数据通常都会发送到云端进行存储，根据时再从云端获取。为了确保存储在云端的用户数据的安全性和私密性，这些用户数据都会通过用户密钥进行加密，为了确保用户密钥的安全性，用户密钥通常都只保存在终端设备中。
然而，由于终端设备的损坏或丢失，会造成保存在终端设备中的用户密钥丢失，进而导致云端存储的用户数据在新的终端设备中无法解密，会对用户造成很大损失。因此就需要对用户密钥进行备份，目前现有技术通常采用将用户密钥备份在用户的另外一个或多个终端设备中，这无疑增加了备份的条件限制，一定需要用户具有其他的终端设备。还有现有技术将用户密钥备份在一个专有的经过安全加固的专有设备中，需要经过层层认证才能获得在服务器中备份的资格，不具备通用性。
目前也有将用户密钥备份在云端的方案，但目前将用户密钥备份在云端的方案通常是直接备份或者采用简单口令加密后备份的方案，都很容易被破解，安全性不好。
发明内容
本申请实施例提供一种密钥管理的方法，可以安全的将用户密钥备份在云设备中，而且对云设备没有过高的要求，在保证了用户密钥安全性的同时，还兼顾了通用性。本申请实施例还提供了相应的装置、系统、计算机可读存储介质以及计算机程序产品等。
本申请第一方面提供一种密钥管理的方法，包括：根据第一用户口令生成第一主密钥和第一令牌；基于第一主密钥加密第一用户密钥，以得到第一用户密钥的第一密文，第一用户密钥用于加密和/或解密用户数据；将第一令牌和第一用户密钥的第一密文备份至云设备，其中，当终端设备基于用户输入的目标用户口令向云设备请求第一用户密钥的第一密文时，第一令牌被云设备用于校验目标用户口令的正确性。
其中，备份过程的实现方式可以是：向云设备发送用于在云设备上存储的第一令牌和第一用户密钥的第一密文，也可以是通过其他设备向云设备发送第一令牌和第一用户密钥的第一密文，或者，向云设备发送存放第一令牌和第一用户密钥的第一密文的地址。
上述第一方面中，第一用户密钥用于加密和/或解密用户数据。本申请实施例中的“加密和/或解密”应理解为加密和解密中的至少一项，即加密，或者解密，或者，加密和解密。具体地，当使用对称加密模式时，第一用户秘钥即可以用于加密用户数据，也可以用于解密经过加密的用户数据。第一用户口令可以是用户数据存储在云端的应用(APP)的密码， 该密码用于管理存储在云端的加密的用户数据。另外，第一用户口令只是用户口令在本申请中的一种描述，本申请中涉及的“用户口令”无论是用“第X用户口令”或“目标用户口令”来描述，用户口令的形式可以是数字、图形、手势、脸部特征、虹膜特征，或者数字与字符的组合等。第一主密钥用于给第一用户密钥加密或解密，第一令牌(token)用于云设备验证用户所输入的目标用户口令是否与第一用户口令相同。用户数据指的是存储在云端的数据，因为云端通常是分布式的设备，针对一个用户标识的用户数据，与解密该用户数据的用户密钥通常不存储在同一个云设备上，当然，用户密钥与用户数据也可以存储在同一个云设备上。由该第一方面可知，采用第一用户口令生成的第一主密钥加密第一用户密钥，以得到第一用户密钥的第一密文，并且采用第一用户口令生成第一令牌，在用户想要获取第一用户密钥前，需要先经过令牌验证，才能得到该第一用户密钥的第一密文，使得第一用户密钥具有了双重安全保障。另外，用户想要获取第一用户密钥的第一密文，只有输入正确的用户口令生成的令牌，才能通过云设备的令牌校验，如果用户不具有正确的用户口令，就无法获取到第一密文，极大的保证了第一用户密钥的安全性，而且本申请中的这种密钥管理方案，对云设备没有特殊的要求，只要一个普通的云设备就可以实现，相比对用在硬件层面专门做了安全加固的专用硬件设备存储用户密钥，本申请的密钥管理方案的通用性更好。
在第一方面的一种可能的实现方式中，根据第一用户口令生成第一主密钥和第一令牌，包括：根据第一用户口令和盐值，生成第一主密钥；根据第一主密钥和该盐值，生成第一令牌；其中，该盐值是随机数。该方法还包括：将该盐值备份至所述云设备，例如，向云设备发送该盐值，该盐值在云设备上与第一令牌和第一密文关联存储。
在第一方面的一种可能的实现方式中，上述步骤：根据第一用户口令生成第一主密钥和第一令牌，包括：根据第一用户口令和第一盐值，生成第一主密钥；根据第一主密钥和第二盐值，生成第一令牌；其中，第一盐值和第二盐值都是随机数，第一盐值和第二盐值备份在云设备上。
第一盐值和第二盐值备份在云设备上的过程可以是：向云设备发送第一盐值和第二盐值，第一盐值和第二盐值用于在云设备上与第一令牌和第一密文关联存储。
该种可能的实现方式中，第一盐值和第二盐值可以是终端设备中的随机数发生器生成的随机数，本申请中，第一盐值和第二盐值可以是相同的一个值，也可以是不相同的两个值。在一种可能的实现方式中，第一盐值、第二盐值、第一令牌和第一用户密钥的第一密文可以用过用户标识关联存储，该用户标识可以是用户注册APP的用户账号。云设备在与终端设备交互时，可以通过该用户标识查找到终端设备所请求的盐值、令牌或密文。采用第一盐值和第一用户口令生成的第一主密钥，以及采用第一主密钥和第二盐值生成的第一令牌的安全性更好，基本不会被破解，提高了第一令牌和第一密文的安全性，也进一步保证了第一用户密钥的安全性。
在第一方面的一种可能的实现方式中，该方法还包括：响应于用户密钥恢复指令，向云设备发送密文获取请求，密文获取请求用于获取第一用户密钥的第一密文；接收第一盐值和第二盐值，第一盐值和第二盐值是云设备响应于密文获取请求发送的；根据用户输入 第二用户口令，以及第一盐值和第二盐值，生成第二主密钥和第二令牌；向云设备发送第二令牌；接收云设备发送的第一用户密钥的第一密文，第一用户密钥的第一密文是云设备校验第二令牌与第一令牌相同后发送的；根据第二主密钥解密第一用户密钥的第一密文，以得到第一用户密钥。
该种可能的实现方式中，第二用户口令可以与第一用户口令相同，也可以与第二用户口令不同，若与第一用户口令相同，则结合第一盐值和第二盐值生成的第二主密钥会与第一主密钥相同，第二令牌会与第一令牌相同，则云设备会通过令牌校验，返回第一密文给终端设备。若第二用户口令与第一用户口令不同，则第二用户口令结合第一盐值和第二盐值生成的第二主密钥会与第一主密钥不相同，第二令牌会与第一令牌不相同，这样，云设备就不会通过令牌校验，而是会返回校验失败给终端设备，终端设备就可以输出用户口令错误的提示信息。该种可能的实现方式描述了恢复第一用户密钥的过程，从该过程可知，需要云设备对令牌校验成功才能给终端设备返回第一密文，保证了第一用户密钥的安全性。
在第一方面的一种可能的实现方式中，上述步骤：根据第一盐值和第二盐值，以及第二用户口令，生成第二主密钥和第二令牌，包括：校验第一盐值和第二盐值；若第一盐值和第二盐值校验成功，则根据第一盐值和第二用户口令生成第二主密钥，以及根据第二盐值和第二主密钥生成第二令牌。
该种可能的实现方式中，终端设备接收到云设备返回的第一盐值和第二盐值后，会先进性校验，第一盐值和第二盐值过程可以是：如第一盐值和第二盐值位于预设的盐值范围内则表示校验成功，若不位于预设的盐值范围内，则表示校验失败，盐值校验成功才根据接收到的第一盐值和第二盐值生成相应的第二主密钥和第二令牌，这样可以避免因为其他攻击设备伪造虚假的盐值来获取第一用户口令，保障了第一用户口令的安全性。
在第一方面的一种可能的实现方式中，该方法还包括：响应于用户密钥恢复指令，向云设备发送密文获取请求，密文获取请求用于获取第一用户密钥的第一密文；接收与密文获取请求对应的第三盐值和第四盐值，第三盐值和第四盐值为随机数；校验第三盐值和第四盐值，若第三盐值和第四盐值校验失败，则输出风险提示。
该种可能的实现方式中，若用户发起用户密钥恢复指令后，终端设备发送的密文获取请求被恶意的攻击设备截获，伪造了第三盐值和第四盐值发送给终端设备，第三盐值和第四盐值通常会设置的较为简单，如“0或1”这种简单的数字，这样，攻击设备比较容易通过第三盐值或第四盐值生成的令牌来反推出用户口令，因此，本申请中，会对第三盐值和第四盐值进行校验。校验过程可以通过预设的盐值范围来判断，若第三盐值和第四盐值都位于预设的盐值范围内，则校验成功，若有一个不位于预设的盐值范围内，则校验失败。本申请的预设的盐值范围通常是较长的一串数字的范围，如1452785至5412861，当然，本处指示列举的一个示例，具体该盐值范围的表示形式，本申请中不做限定。因此，本申请的方案可以有效的规避掉被攻击设备恶意攻击的而带来的风险。
在第一方面的一种可能的实现方式中，该方法还包括：响应于用户输入的口令修改指令，向云设备发送密文获取请求，密文获取请求用于获取第一用户密钥的第一密文；接收第一盐值和第二盐值，第一盐值和第二盐值是云设备响应于密文获取请求发送的；根据用 户输入的第三用户口令、第一盐值和第二盐值，生成第三主密钥和第三令牌；向云设备发送第三令牌；接收云设备发送的第一用户密钥的第一密文，第一密文是云设备校验第三令牌与第一令牌相同后发送的；基于第三主密钥解密第一用户密钥的第一密文，以得到第一用户密钥；根据用户输入的第四用户口令，生成第四主密钥和第四令牌；根据第四主密钥加密第一用户密钥，以得到第一用户密钥的第二密文；将第四令牌和第一用户密钥的第二密文备份至云设备。
备份第四令牌和第二密文的过程可以是:向云设备再次发送所述第三令牌，以及用于在云设备上存储的第四令牌和第一用户密钥的第二密文，再次发送的第三令牌用于云设备校验与第一令牌相同后，根据第四令牌和第二密文更新第一令牌和第一密文。也可以是不覆盖原来的第一令牌和第一密文，直接存储第四令牌和第二密文。
该种可能的实现方式中，正常情况下用户修改用户口令，则第三用户口令应为原来的用户口令，也就是第一用户口令。第四用户口令应为用户要根据的新的用户口令。当用户要修改用户口令，则需要从云设备获取到第一用户密钥的第一密文，对该第一密文解密后，再根据新的用户口令生成的主密钥对第一用户密钥进行加密，得到第二密文，再发送到云设备上进行存储。在获取第一密文前，需要通过用户输入的原来的用户口令生成第三令牌，由云设备校验第三令牌是否与第一令牌相同，如果相同才会返回第一密文，如果不相同，云设备会返回校验失败的通知。这样，可以确保修改用户口令过程中的安全性，避免用户口令被恶意修改。
在第一方面的一种可能的实现方式中，上述步骤：根据用户输入的第四用户口令，生成第四主密钥和第四令牌，包括：根据第四用户口令和第一盐值，生成第四主密钥；根据第四主密钥和第二盐值，生成第四令牌；其中，第四令牌和第二密文在云设备上与第一盐值和第二盐值关联存储。
该种可能的实现方式中，新的第四用户口令可以结合原来的第一盐值和第二盐值生成第四主密钥和第四令牌，这样，云设备只要将该第四主密钥和第四令牌和原来的第一盐值和第二盐值关联存储即可，该种方式可以减少数据传输量。
在第一方面的一种可能的实现方式中，上述步骤：根据用户输入的第四用户口令，生成第四主密钥和第四令牌，包括：根据第四用户口令和第五盐值，生成第四主密钥；根据第四主密钥和第六盐值，生成第四令牌；其中，第五盐值和第六盐值为针对第四用户口令新生成的随机数，第五盐值和第六盐值备份在云设备上。
备份第五盐值和第六盐值的过程可以是：向云设备发送第五盐值和第六盐值，第五盐值和第六盐值用于在云设备上与第四令牌和第二密文关联存储。
该种可能的实现方式中，在生成第四主密钥和第四令牌时，可以根据新产生的第五盐值和第六盐值，这样可以提高第四令牌和第二密文的安全性。
在第一方面的一种可能的实现方式中，该方法还包括：响应于用户密钥修改指令，获取用于替换第一用户密钥的第二用户密钥，并向云设备发送盐值获取请求；接收云设备响应于盐值获取请求而发送的第一盐值和第二盐值；根据用户输入的第五用户口令、第一盐值和第二盐值，生成第五主密钥和第五令牌；向云设备发送令牌校验请求，该令牌校验请 求包含第五令牌；接收云设备发送的校验成功的消息，校验成功的消息指示第五令牌与第一令牌相同；根据第五主密钥加密第二用户密钥，以得到第二用户密钥的密文；将第二用户密钥的密文和第五令牌备份至云设备。
该种可能的实现方式中，在用户要修改用户密钥时，也需要终端设备先根据第五用户口令、第一盐值和第二盐值，生成第五主密钥和第五令牌，云设备先验证第五令牌与第一令牌是否相同，若第五令牌与第一令牌相同，则说明第五用户口令是正确的用户口令，可以执行用户密钥修改操作，终端设备再根据第五主密钥加密第二用户密钥得到第二用户密钥的密文即可。本申请中，用户密钥修改过程中先进行令牌验证，这样，可以确保修改用户密钥的安全性，避免用户密钥被恶意修改。
在第一方面的一种可能的实现方式中，上述步骤：根据第五用户口令，第一盐值和所述第二盐值、生成第五主密钥和第五令牌，包括：根据第五用户口令和第一盐值生成第五主密钥；根据第五主密钥和第二盐值生成第五令牌；其中，第五令牌和第二用户密钥的密文在云设备上与第一盐值和第二盐值关联存储。
该种可能的实现方式中，第五主密钥和第五令牌可以是第五用户口令结合原来的第一盐值和第二盐值生成的，云设备只要将该第五主密钥和第五令牌和原来的第一盐值和第二盐值关联存储即可，该种方式可以减少数据传输量。
在第一方面的一种可能的实现方式中，第一主密钥是采用秒级哈希算法生成的，第一令牌是采用的是采用毫秒级哈希算法或微秒级哈希算法生成的。
该种可能的实现方式中，上述生成主密钥和令牌的过程都可以是采用基于口令的密钥生成算法(password-based key derivation function，PBKDF2)生成的。秒级哈希算法(hash)指的是完成一次hash需要一秒或几秒或者更多秒，秒级哈希算法通常会将运算参数中的迭代次数设置为一百万次、几百万次，或者一千万次，这样，以一个6位数的用户口令为例，暴力破解该用户口令需要几个月的时间，所以第一主密钥是对用户口令和第一盐值采用秒级哈希算法生成的，可以防止第一主密钥被暴力破解，因为第一令牌是根据第一主密钥和第二盐值进行哈希算法生成的，第一主密钥已经可以防止被暴力破解了，所以，第一令牌不存在被暴力破解的问题了，第一令牌只要快速生成就好，所以，第一令牌用毫秒级哈希算法或微秒级哈希算法来完成，可以提高第一令牌获得的速度。另外，本申请中，其他的“第X主密钥”和“第X令牌”都可以参照第一主密钥和第一令牌的生成方式进行理解，第X表示上面所提到的第二、第三、第四…。
本申请第二方面提供一种密钥管理的方法，包括：接收来自于终端设备的第一令牌和第一用户密钥的第一密文，第一用户密钥的第一密文是终端设备基于第一主密钥对第一用户密钥加密得到的，第一主密钥和第一令牌是终端设备根据第一用户口令生成的；存储第一令牌和第一用户密钥的第一密文；当接收到终端设备响应于用户输入的目标用户口令发来的对第一密文的请求时，根据第一令牌校验目标用户口令的正确性。
该第二方面中，关于第一令牌、第一主密钥和第一用户密钥的第一密文可以参阅第一方面的描述进行理解。该第二方面所描述的云设备会存储终端设备发送来的第一令牌和第一用户密钥的第一密文，在终端设备对该第一密文有需求时，会按照该第一令牌先进行校 验，校验通过后才会给终端设备返回第一用户密钥的第一密文。这样使得第一用户密钥不仅通过自身加密，而且还通过令牌验证具有了双重安全保障。另外，令牌是通过用户口令生成的，用户想要获取第一用户密钥的第一密文，只有输入正确的用户口令生成的令牌，才能通过云设备的令牌校验，如果用户不具有正确的用户口令，就无法获取到第一密文，极大的保证了第一用户密钥的安全性，而且本申请中的这种密钥管理方案，对云设备没有特殊的要求，只要一个普通的云设备就可以实现，相比对用在硬件层面专门做了安全加固的专用硬件设备存储用户密钥，本申请的密钥管理方案的通用性更好。
在第二方面的一种可能的实现方式中，该方法还包括：接收来自于终端设备用于生成第一令牌和第一主密钥的第一盐值和第二盐值，第一盐值和第二盐值都是随机数；将第一盐值和第二盐值与第一令牌和第一用户密钥的第一密文关联存储。
该种可能的实现方式中，第一盐值和第二盐值可以是终端设备中的随机数发生器生成的随机数，本申请中，第一盐值和第二盐值可以是相同的一个值，也可以是相同的两个值，也可以是不相同的两个值。第一盐值、第二盐值、第一令牌和第一用户密钥的第一密文可以用过用户标识关联存储，该用户标识可以是用户注册APP的用户账号。云设备在与终端设备交互时，可以通过该用户标识查找到终端设备所请求的盐值、令牌或密文。采用第一盐值和第一用户口令生成的第一主密钥，以及采用第一主密钥和第二盐值生成的第一令牌的安全性更好，基本不会被破解，提高了第一令牌和第一密文的安全性，也进一步保证了第一用户密钥的安全性。
在第二方面的一种可能的实现方式中，该方法还包括：接收用于终端设备的密文获取请求，密文获取请求用于获取第一用户密钥的第一密文；根据密文获取请求，向终端设备发送第一盐值和第二盐值；接收用于终端设备的第二令牌，第二令牌是终端设备根据第二用户口令、第一盐值和第二盐值生成的；若校验出第二令牌和第一令牌相同，则向终端设备发送第一用户密钥的第一密文。
该种可能的实现方式中，第二用户口令可以与第一用户口令相同，也可以与第二用户口令不同，若与第一用户口令相同，则结合第一盐值和第二盐值生成的第二主密钥会与第一主密钥相同，第二令牌会与第一令牌相同，则云设备会通过令牌校验，返回第一密文给终端设备。若第二用户口令与第一用户口令不同，则第二用户口令结合第一盐值和第二盐值生成的第二主密钥会与第一主密钥不相同，第二令牌会与第一令牌不相同，这样，云设备就不会通过令牌校验，而是会返回校验失败给终端设备，终端设备就可以输出用户口令错误的提示信息。该种可能的实现方式描述了恢复第一用户密钥的过程，从该过程可知，需要云设备对令牌校验成功才能给终端设备返回第一密文，保证了第一用户密钥的安全性。
在第二方面的一种可能的实现方式中，该方法还包括：接收来自于终端设备的密文获取请求，密文获取请求用于获取第一用户密钥的第一密文；根据密文获取请求，向终端设备发送第一盐值和第二盐值；接收来自于终端设备的第三令牌，第三令牌是终端设备根据第三用户口令、第一盐值和第二盐值生成的；若校验出第三令牌和第一令牌相同，则向终端设备发送第一用户密钥的第一密文；接收来自于终端设备第四令牌和第一用户密钥的第二密文，第二密文是采用第四主密钥加密的，第四主密钥和第四令牌是根据用户输入的第 四用户口令生成的；存储第四令牌和第二密文。
该种可能的实现方式中，正常情况下用户修改用户口令，则第三用户口令应为原来的用户口令，也就是第一用户口令。第四用户口令应为用户要根据的新的用户口令。当用户要修改用户口令，如：修改APP的登录密码，则需要从云设备获取到第一用户密钥的第一密文，对该第一密文解密后，再根据新的用户口令生成的主密钥对第一用户密钥进行加密，得到第二密文，再发送到云设备上进行存储。在获取第一密文前，需要通过用户输入的原来的用户口令生成第三令牌，由云设备校验第三令牌是否与第一令牌相同，如果相同才会返回第一密文，如果不相同，云设备会返回校验失败的通知。这样，可以确保修改用户口令过程中的安全性，避免用户口令被恶意修改。
在第二方面的一种可能的实现方式中，若第四令牌和第四主密钥是根据第一盐值和第二盐值生成的，则将第四令牌和第二密文与第一盐值和第二盐值关联存储。
该种可能的实现方式中，新的第四用户口令可以结合原来的第一盐值和第二盐值生成第四主密钥和第四令牌，这样，云设备只要将该第四主密钥和第四令牌和原来的第一盐值和第二盐值关联存储即可，该种方式可以减少数据传输量。
在第二方面的一种可能的实现方式中，若第四令牌和第四主密钥是根据第五盐值和第六盐值生成的，则该方法还包括：接收来自于终端设备的第五盐值和第六盐值；将第四令牌和第二密文与第五盐值和第六盐值关联存储。
该种可能的实现方式中，在生成第四主密钥和第四令牌时，可以根据新产生的第五盐值和第六盐值，这样可以提高第四令牌和第二密文的安全性。
在第二方面的一种可能的实现方式中，该方法还包括：接收来自于终端设备的盐值获取请求，该盐值获取请求用于获取第一盐值和第二盐值；根据盐值获取请求，向终端设备发送第一盐值和第二盐值；接收终端设备发送的令牌校验请求，该令牌校验请求包含第五令牌，第五令牌是根据用户输入的第五用户口令，以及第一盐值和第二盐值生成的；若第五令牌与第一令牌相同，则向终端设备发送校验成功的消息；接收并存储终端设备发送的第二用户密钥的密文和第五令牌，第二用户密钥的密文是采用第五主密钥加密的，第五主密钥和第五令牌是根据第五用户口令生成的。
该种可能的实现方式中，在用户要修改用户密钥时，也需要终端设备先根据第五用户口令、第一盐值和第二盐值，生成第五令牌，云设备先验证第五令牌与第一令牌是否相同，若第五令牌与第一令牌相同，则说明第五用户口令是正确的用户口令，可以执行用户密钥修改操作，终端设备再根据第五主密钥加密第二用户密钥得到第二用户密钥的密文即可。本申请中，用户密钥修改过程中先进行令牌验证，这样，可以确保修改用户密钥的安全性，避免用户密钥被恶意修改。
在第二方面的一种可能的实现方式中，将第五令牌和第二用户密钥的密文与第一盐值和第二盐值关联存储。
该种可能的实现方式中，第五主密钥和第五令牌可以是第五用户口令结合原来的第一盐值和第二盐值生成的，云设备只要将该第五主密钥和第五令牌和原来的第一盐值和第二盐值关联存储即可，该种方式可以减少数据传输量。
本申请第三方面提供一种密钥管理的方法，该方法包括：响应于用户的第一操作，终端设备显示口令输入界面；响应于用户在口令输入界面上的输入操作，终端设备获取用户输入的第一用户口令，第一用户口令用于终端设备生成第一主密钥和第一令牌；终端设备基于第一主密钥加密第一用户密钥，以得到第一用户密钥的第一密文，第一用户密钥用于加密和/或解密用户数据；终端设备并将第一密文以及第一令牌备份至云设备；当终端设备基于用户输入的目标用户口令向云设备请求第一密文时，第一令牌被云设备用于校验目标用户口令的正确性。
该第三方面中，第一操作可以是用户触发的用户密钥的备份操作，口令输入界面可以是用于管理存储在云端的用户数据的密码输入界面。用户在密码输入界面上输入第一用户口令后，终端设备即可执行如上述第一方面所描述的过程。
在第三方面的一种可能的实现方式中，第一主密钥是根据第一用户口令和第一盐值生成的，第一令牌是根据第一主密钥和第二盐值生成的；其中，第一盐值和第二盐值都是随机数；第一盐值和第二盐值备份在云设备上。
在第三方面的一种可能的实现方式中，该方法还包括：响应于用户的第二操作，终端设备从云设备获取第一盐值和第二盐值；响应于用户的第三操作，终端设备显示口令输入界面；终端设备获取用户输入的第二用户口令；终端设备向云设备发送第二令牌；终端设备接收第一用户密钥的第一密文，基于第二主密钥解密第一密文，以得到第一用户密钥；其中，第一密文是当云设备校验第二令牌与第一令牌相同后发送的；第二主密钥是根据第二用户口令和第一盐值生成的，第二令牌是根据第二主密钥和第二盐值生成的。
该种可能的实现方式中，第二操作可以是用户密钥的恢复操作，第三操作可以口令输入操作。
在第三方面的一种可能的实现方式中，该方法还包括：响应于用户的第四操作，终端设备从云设备获取第一盐值和第二盐值；响应于用户的第五操作，终端设备显示口令输入界面；终端设备获取用户输入的第三用户口令和第四用户口令；终端设备向云设备发送第三令牌；终端设备接收第一用户密钥的第一密文，基于第三主密钥解密第一密文，以得到第一用户密钥；其中，第一密文是当云设备校验第三令牌与第一令牌相同后发送的；第三主密钥是根据第三用户口令和第一盐值生成的，第三令牌是根据第三主密钥和第二盐值生成的；终端设备将第四令牌和第一用户密钥的第二密文备份到云设备，其中，第一用户密钥的第二密文是根据第四主密钥加密第一用户密钥得到的，第四主密钥是根据第四用户口令和第一盐值生成的，第四令牌是根据第四主密钥和第二盐值生成的。
该种可能的实现方式中，第四操作可以是用户口令修改的操作，第五操作可以口令输入操作。
在第三方面的一种可能的实现方式中，该还包括：响应于用户的第六操作，终端设备从云设备获取加密的用户数据；终端设备基于第一用户密钥解密加密的用户数据。
该种可能的实现方式中，第六操作可以是用户数据获取的操作。
本申请第三方面以及第三方面任一种可能的实现方式的相关内容可以参阅第一方面以及第一方面的任一种可能的实现方式进行理解，此处不再重复赘述。
本申请第四方面，提供了一种终端设备，用于执行上述第一方面或第一方面的任意可能的实现方式中的方法。具体地，该装置包括用于执行上述第一方面或第一方面的任意可能的实现方式中的方法的模块或单元，如：第一处理单元、第二处理单元、发送单元和接收单元，需要说明的是，第一处理单元和第二处理单元所执行的功能也可以通过一个处理单元来实现。
本申请第五方面，提供了一种云设备，用于执行上述第二方面或第二方面的任意可能的实现方式中的方法。具体地，该装置包括用于执行上述第二方面或第二方面的任意可能的实现方式中的方法的模块或单元，如：接收单元、存储单元、处理单元和发送单元。
本申请第六方面，提供了一种终端设备，用于执行上述第三方面或第三方面的任意可能的实现方式中的方法。具体地，该装置包括用于执行上述第三方面或第三方面的任意可能的实现方式中的方法的模块或单元，如：处理单元、发送单元和接收单元。
本申请第七方面，提供了一种终端设备。该终端设备可以包括至少一个处理器、存储器和通信接口。处理器与存储器和通信接口耦合。存储器用于存储指令，处理器用于执行该指令，通信接口用于在处理器的控制下与其他网元进行通信。该指令在被处理器执行时，使处理器执行第一方面或第一方面的任意可能的实现方式中的方法。
本申请第八方面，提供了一种云设备。该云设备可以包括至少一个处理器、存储器和通信接口。处理器与存储器和通信接口耦合。存储器用于存储指令，处理器用于执行该指令，通信接口用于在处理器的控制下与其他网元进行通信。该指令在被处理器执行时，使处理器执行第二方面或第二方面的任意可能的实现方式中的方法。
本申请第九方面，提供了一种终端设备。该终端设备可以包括至少一个处理器、存储器和通信接口。处理器与存储器和通信接口耦合。存储器用于存储指令，处理器用于执行该指令，通信接口用于在处理器的控制下与其他网元进行通信。该指令在被处理器执行时，使处理器执行第三方面或第三方面的任意可能的实现方式中的方法。
本申请第十方面，提供了一种计算机可读存储介质，该计算机可读存储介质存储有程序，该程序使得处理器执行上述第一方面，及其各种实现方式中的任一种方法。
本申请第十一方面，提供了一种计算机可读存储介质，该计算机可读存储介质存储有程序，该程序使得处理器执行上述第二方面，及其各种实现方式中的任一种方法。
本申请第十二方面，提供了一种计算机可读存储介质，该计算机可读存储介质存储有程序，该程序使得处理器执行上述第三方面，及其各种实现方式中的任一种方法。
本申请第十三方面，提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中；设备的至少一个处理器可以从计算机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令使得设备实施上述第一方面或者第一方面的任一种可能的实现方式所提供的一种方法。
第十四方面，提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中；设备的至少一个处理器可以从计算机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令使得设备实施上述第二方面或者第二方面的任一种可能的实现方式所提供的一种方法。
本申请第十五方面，提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中；设备的至少一个处理器可以从计算机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令使得设备实施上述第三方面或者第三方面的任一种可能的实现方式所提供的一种方法。
本申请第十六方面提供了一种芯片系统，该芯片系统包括处理器，用于支持终端设备实现上述第一方面或第一方面任意一种可能的实现方式中所涉及的功能。在一种可能的设计中，芯片系统还可以包括存储器，存储器用于保存终端设备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本申请第十七方面提供了一种芯片系统，该芯片系统包括处理器，用于支持云设备实现上述第二方面或第二方面任意一种可能的实现方式中所涉及的功能。在一种可能的设计中，芯片系统还可以包括存储器，存储器用于保存云设备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本申请第十八方面提供了一种芯片系统，该芯片系统包括处理器，用于支持终端设备实现上述第三方面或第三方面任意一种可能的实现方式中所涉及的功能。在一种可能的设计中，芯片系统还可以包括存储器，存储器用于保存终端设备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本申请第十九方面，提供了一种密钥管理系统。该密钥管理系统包括终端设备和云设备，该终端设备用于执行上述第一方面或第一方面任意一种可能的实现方式中所涉及的功能，云设备用于执行上述第二方面或第二方面任意一种可能的实现方式中所涉及的功能。
本申请第二十方面，提供了一种密钥管理系统。该密钥管理系统包括终端设备和云设备，该终端设备用于执行上述第三方面或第三方面任意一种可能的实现方式中所涉及的功能，云设备用于执行上述第二方面或第二方面任意一种可能的实现方式中所涉及的功能。
可以理解地，上述提供的终端设备、云设备、计算机存储介质、计算机程序产品或者芯片系统均用于执行上文所提供的对应的密钥管理的方法，因此，其所能达到的有益效果可参考上文所提供的对应的方法中的有益效果，此处不再赘述。
附图说明
图1是本申请实施例提供的密钥管理系统的一场景示意图；
图2是本申请实施例提供的密钥管理的方法的一实施例示意图；
图3是本申请实施例提供的密钥管理的方法的另一实施例示意图；
图4是本申请实施例提供的密钥管理的方法的一场景示意图；
图5是本申请实施例提供的密钥管理的方法的另一实施例示意图；
图6是本申请实施例提供的密钥管理的方法的另一实施例示意图；
图7是本申请实施例提供的密钥管理的方法的另一场景示意图；
图8是本申请实施例提供的密钥管理的方法的另一实施例示意图；
图9是本申请实施例提供的密钥管理的方法的另一场景示意图；
图10是本申请实施例提供的密钥管理的方法的另一实施例示意图；
图11是本申请实施例提供的密钥管理的方法的另一场景示意图；
图12是本申请实施例提供的密钥管理的方法的另一实施例示意图；
图13是本申请实施例提供的终端设备的一结构示意图；
图14是本申请实施例提供的云设备的一结构示意图；
图15是本申请实施例提供的终端设备的另一结构示意图；
图16是本申请实施例提供的云设备的另一结构示意图。
具体实施方式
下面结合附图，对本申请的实施例进行描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着技术发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本申请实施例提供一种密钥管理的方法，可以安全的将用户密钥备份在云设备中，而且对云设备没有过高的要求，在保证了用户密钥安全性的同时，还兼顾了通用性。本申请实施例还提供了相应的装置、系统、计算机可读存储介质以及计算机程序产品等。以下分别进行详细说明。
随着互联网的发展，各种类型的应用(application，APP)层出不穷，因为终端设备的存储空间有限，所以很多应用的用户数据都存储在云侧数据库中。为了用户数据的安全性，这些用户数据通常都会根据用户密钥进行加密。本申请实施例中，云侧数据库不仅会对用户数据进行管理，还会对用户密钥进行管理，不仅可以确保用户数据的安全性，还可以确保用户密钥的安全性，以避免因为用户密钥丢失，而造成用户无法再解密存储在云端的用户数据。
图1为本申请实施例提供的密钥管理系统的一场景示意图。
如图1所示，本申请实施例提供的密钥管理系统包括终端设备和云设备，云设备可以有一个，也可以有多个，通常云端会有多个云设备。多个云设备中有的云设备用于存储各种APP的用户数据，有的云设备用于存储各种APP的用户的用户密钥。同一个用户的用户数据和用户密钥可以分离式存储在不同的云设备上，也可以存储在同一个云设备上。每个用户的用户数据可以通过该用户的用户标识(例如：用户账号)来索引。用户密钥也可以通过用户标识来索引。
另外，本申请实施例中，用户设备也可以使用多个云设备来管理，这些云设备可以分别管理不同用户的用户密钥。如：云设备1管理省份1的用户的用户密钥和令牌，云设备2管理省份2的用户的用户密钥和令牌。当然，也可以有其他划分方式，如：云设备1负责执行令牌校验，云设备2负责存储用户密钥。
终端设备(也可以称为用户设备(user equipment，UE))是一种具有无线收发功能的设备，可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。终端可以是手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端、以物联网(internet of things，IoT)中的无线终端等。
云设备可以是物理机也可以是虚拟机(virtual machine，VM)或容器(container)。
该图1所示的密钥管理系统中，用户在根据终端设备上安装的APP产生用户数据后，终端设备会根据用户密钥对所产生的用户数据进行加密，然后发送到云端的数据库中进行存储。本申请实施例中终端设备还会结合用户口令对用户密钥进行保护，然后将被保护的用户密钥发送到云设备进行存储。下面介绍本申请实施例提供的密钥管理的方法。
本申请实施例提供的密钥管理的方法包括：用户密钥的存储、用户密钥的恢复、用户口令的修改，以及用户密钥的修改四个部分，用户密钥的恢复、用户口令的修改，以及用户密钥的修改都是以用户密钥的存储为基础的，下面分别进行介绍。
1、用户密钥的存储。
如图2所示，本申请实施例提供的密钥管理的方法的一实施例包括：
101、终端设备根据第一用户口令生成第一主密钥和第一令牌。
第一用户口令可以是用户数据存储在云端的应用(APP)的登录密码，另外，第一用户口令只是用户口令在本申请中的一种描述，本申请中涉及的“用户口令”无论是用“第X用户口令”或“目标用户口令”来描述，用户口令的形式可以是数字、图形、手势、脸部特征、虹膜特征，或者数字与字符的组合等。
第一主密钥用于给第一用户密钥加密或解密，第一令牌用于云设备验证用户所输入的目标用户口令是否与第一用户口令相同。
本申请中，可以对第一用户口令采用基于口令的密钥生成算法(password-based key derivation function，PBKDF2)生成第一主密钥和第一令牌。
102、终端设备基于第一主密钥加密第一用户密钥，以得到第一用户密钥的第一密文。
第一用户密钥用于加密和/或解密用户数据。
第一用户密钥用于加密和/或解密用户数据。本申请实施例中的“加密和/或解密”应理解为加密和解密中的至少一项，即加密，或者解密，或者，加密和解密。具体地，当使用对称加密模式时，第一用户秘钥即可以用于加密用户数据，也可以用于解密经过加密的用户数据。
用户数据指的是用户根据各种APP产生的数据，该用户数据的形式可以是数字、文本、图片或视频等。
针对一个用户标识的用户数据，与解密该用户数据的用户密钥通常不存储在同一个云 设备上，当然，用户密钥与用户数据也可以存储在同一个云设备上。
103、终端设备将第一令牌和第一用户密钥的第一密文备份至云设备。
该步骤103备份过程的实现方式可以是：向云设备发送用于在云设备上存储的第一令牌和第一用户密钥的第一密文，也可以是通过其他设备向云设备发送第一令牌和第一用户密钥的第一密文，或者，向云设备发送存放第一令牌和第一用户密钥的第一密文的地址。
其中，当终端设备基于用户输入的目标用户口令向云设备请求第一用户密钥的第一密文时，第一令牌被云设备用于校验目标用户口令的正确性。
终端设备在发送第一密文时，还会发送第一初始化向量(initialization vector，IV)。该第一IV用于提高第一密文的安全性。第一IV是一串随机数。
终端设备发送第一令牌和第一用户密钥的第一密文后，会将第一用户密钥存放在缓存中，这样，在需要根据云端的数据库中存储的加密的用户数据时，可以直接从缓存中提取第一用户密钥对加密的用户数据进行解密。
104、云设备存储第一令牌和第一用户密钥的第一密文。
本申请实施例，采用第一用户口令生成的第一主密钥加密第一用户密钥，以得到第一用户密钥的第一密文，并且采用第一用户口令生成第一令牌，在用户想要获取第一用户密钥前，需要先经过令牌验证，才能得到该第一用户密钥的第一密文，使得第一用户密钥具有了双重安全保障。另外，用户想要获取第一用户密钥的第一密文，只有输入正确的用户口令生成的令牌，才能通过云设备的令牌校验，如果用户不具有正确的用户口令，就无法获取到第一密文，极大的保证了第一用户密钥的安全性，而且本申请中的这种密钥管理方案，对云设备没有特殊的要求，只要一个普通的云设备就可以实现，相比对用在硬件层面专门做了安全加固的专用硬件设备存储用户密钥，本申请的密钥管理方案的通用性更好。
可选地，上述步骤101中，第一主密钥和第一令牌都可以是直接对第一用户口令采用基于口令的密钥生成算法生成的，上述步骤101也可以是：根据第一用户口令和第一盐值，生成第一主密钥；根据第一主密钥和第二盐值，生成第一令牌；其中，第一盐值和第二盐值都是随机数，第一盐值和第二盐值备份在云设备上。
也就是说，当根据第一盐值和第二盐值生成第一主密钥和第一令牌的情况下，终端设备还会向云设备发送第一盐值和第二盐值，第一盐值和第二盐值用于在云设备上与第一令牌和第一密文关联存储。
若只有一个盐值的情况下，该步骤101还可以是根据第一用户口令和盐值，生成第一主密钥；根据第一主密钥和该盐值，生成第一令牌；其中，该盐值是随机数。然后还需要将该盐值备份至所述云设备，例如，向云设备发送该盐值，该盐值在云设备上与第一令牌和第一密文关联存储。
该过程结合上述图2的方案可以参阅图3进行理解，如图3所示，用户向终端设备输入第一用户口令。终端设备中的随机数发生器生成第一盐值和第二盐值，然后，终端设备根据基于口令的密钥生成算法根据第一用户口令和第一盐值生成第一主密钥，再根据第一主密钥和第二盐值，再一次根据基于口令的密钥生成算法生成第一令牌。另外，终端设备根据第一主密钥加密第一用户密钥，以得到第一用户密钥的第一密文，然后将第一盐值、第二 盐值、第一令牌和第一用户密钥的第一密文都发送到云设备上关联存储。
该种可选的实施例中，第一盐值和第二盐值可以是终端设备中的随机数发生器生成的随机数。本申请中，第一盐值和第二盐值可以是相同的一个值，也可以是相同的两个值，也可以是不相同的两个值。第一盐值、第二盐值、第一令牌和第一用户密钥的第一密文可以用过用户标识关联存储，该用户标识可以是用户注册APP的用户账号。云设备在与终端设备交互时，可以通过该用户标识查找到终端设备所请求的盐值、令牌或密文。采用第一盐值和第一用户口令生成的第一主密钥，以及采用第一主密钥和第二盐值生成的第一令牌的安全性更好，基本不会被破解，提高了第一令牌和第一密文的安全性，也进一步保证了第一用户密钥的安全性。
上述图3所描述的用户密钥的存储过程，还可以参阅图4所示的场景示意图进行理解，图4示例性的介绍该用户密钥的存储过程。
如图4所示，终端设备上安装有APP1，该APP1可以是金融、购物或健康等用户敏感数据需要加密存储在云端的APP，加密这些敏感数据所根据的密钥为用户密钥。该用户注册该APP1的用户账号为“13400001234”，成功登陆该用户账号以后，用户要设置管理备份用户密钥，则终端设备可以响应该操作，显示口令输入界面。该操作可以称为第一操作，也可以描述为备份用户密钥的操作，终端设备会进入如图4中界面1所示的界面，用户需要设置“密码”。该密码即为用户口令，该密码通常为用于管理存储在云端数据库中加密的用户数据的密码。该过程可以输入一次密码，也可以输入两次密码，为了避免第一次输入因为输入错误不是用户想设置的密码，通常会设置两次输入。用户可以依次输入第一次密码和再次确认密码，如图4中界面2所示，用户输入的密码为“745896”，用户再次输入确认密码为“745896”，两次密码相同，则开始执行用户密钥的存储过程。该场景中，该用户账号的密码“745896”即为上述图2所描述的实施例中的第一用户口令。
终端设备获取该第一用户口令后，触发终端设备中的随机数发生器生成第一盐值和第二盐值，根据基于口令的密钥生成算法，先根据第一用户口令和第一盐值生成第一主密钥，然后再根据第一主密钥和第二盐值生成第一令牌，然后根据第一主密钥加密第一用户密钥，该第一用户密钥可以是终端设备中的随机数发生器生成的，也可以是通过其他方式得到的，如：用户从其他设备导入该第一用户密钥。
根据第一主密钥加密第一用户密钥后得到该第一用户密钥的第一密文，然后将第一令牌和第一用户密钥的第一密文、第一盐值和第二盐值发送到云设备进行存储，云设备可以通过用户账号“13400001234”关联存储第一令牌和第一用户密钥的第一密文。这样，后续终端设备请求第一用户密钥的第一密文时，云设备就可以通过用户账号“13400001234”查找第一盐值、第二盐值，以及查找到相应的第一令牌进行校验，在校验成功后，向终端设备返回相应的第一用户密钥的第一密文。
2、用户密钥的恢复。
图5为本申请实施例提供的密钥管理的方法的另一实施例示意图。
如图5所示，本申请实施例提供的密钥管理的方法的另一实施例包括：
201、终端设备响应于用户密钥恢复指令，向云设备发送密文获取请求，相应地，云设 备接收到密文获取请求。
密文获取请求用于获取第一用户密钥的第一密文。密文获取请求中通常会携带用户标识，如：APP的用户账号。
202、云设备接收到密文获取请求后，向终端设备发送第一盐值和第二盐值。相应地，终端设备接收云设备发送的第一盐值和第二盐值。
云设备接收到密文获取请求后，会根据用户标识查找到与该用户标识关联存储的第一盐值和第二盐值。
203、终端设备根据用户输入第二用户口令，以及第一盐值和第二盐值，生成第二主密钥和第二令牌。
本申请实施例中，第二用户口令可以与第一用户口令相同，也可以与第二用户口令不同，若与第一用户口令相同，则结合第一盐值和第二盐值生成的第二主密钥会与第一主密钥相同，第二令牌会与第一令牌相同。
204、终端设备向云设备发送第二令牌。
第二令牌用于云设备与第一令牌进行校验。
205、云设备校验第二令牌与第一令牌是否相同，若校验出第二令牌和第一令牌相同，则执行步骤206，若不相同，则云设备向终端设备返回校验失败的响应。
第二令牌与第一令牌相同表示：第二用户口令与第一用户口令相同，第二主密钥与第一主密钥相同。
若第二用户口令与第一用户口令不同，则第二用户口令结合第一盐值和第二盐值生成的第二主密钥会与第一主密钥不相同，第二令牌会与第一令牌不相同，这样，云设备就不会通过令牌校验，而是会返回校验失败给终端设备，终端设备就可以输出用户口令错误的提示信息。
206、云设备向终端设备发送第一用户密钥的第一密文，相应地，终端设备接收云设备发送的第一用户密钥的第一密文。
207、终端设备根据第二主密钥解密第一用户密钥的第一密文。
本申请实施例中，云设备令牌校验成功才能给终端设备返回第一用户密钥的第一密文，保证了第一用户密钥的安全性。
该图5所介绍的过程也可以参阅图6进行理解。如图6所示，用户向终端设备输入第二用户口令。终端设备向云设备请求对应的盐值，云设备返回第一盐值和第二盐值。然后，终端设备根据基于口令的密钥生成算法根据第二用户口令和第一盐值生成第二主密钥，再根据第二主密钥和第二盐值，再一次根据基于口令的密钥生成算法生成第二令牌。然后，终端设备将第二令牌发送给云设备进行令牌校验。若第二令牌与第一令牌相同，则说明第二主密钥与第一主密钥相同，第二用户口令与第一用户口令相同，则云设备向终端设备发送第一用户密钥的第一密文，终端设备根据第二主密钥解密该第一用户密钥的第一密文，以得到第一用户密钥。
上述图5或图6所描述的用户密钥的恢复过程，还可以结合图7所示的场景进行理解。当用户密钥丢失的情况下，用户要恢复用户密钥时，用户可以登录APP1，响应用户输入的用 户密钥的恢复操作，从云设备获取第一盐值和第二盐值，该用户密钥恢复操作也可以称为第二操作，然后终端设备会再响应第三操作，进入用户口令界面，如：进入如图7中的界面1所示的界面。在图7中的界面1上输入恢复密码，也就是用户口令。如图7中的界面2所示，用户在输入恢复密码的位置输入了正确的密码745896，然后终端设备向云设备请求对应的盐值，云设备返回第一盐值和第二盐值。然后，终端设备根据基于口令的密钥生成算法根据745896和第一盐值生成第二主密钥，再根据第二主密钥和第二盐值，再一次根据基于口令的密钥生成算法生成第二令牌。然后，终端设备将第二令牌发送给云设备进行令牌校验。因为用户输入的第二用户口令745896与用户注册时所用的第一用户口令745896相同，所以第二主密钥与第一主密钥相同，第二令牌与第一令牌相同，所以，云设备的校验结果会是校验成功，则云设备向终端设备发送第一用户密钥的第一密文，终端设备根据第二主密钥解密该第一用户密钥的第一密文，以得到第一用户密钥，然后终端设备会显示如图7中的界面3，该界面3中显示“用户密钥恢复成功”。若用户输入的第二用户口令不是745896，则第二主密钥与第一主密钥不会相同，第二令牌与第一令牌也不会相同，云设备令牌校验的结果将会是校验失败，云设备会向终端设备返回校验失败的响应，终端设备会输出如图7中界面4的内容，即“密码错误”。
可选地，上述步骤203可以包括：校验第一盐值和第二盐值；若第一盐值和第二盐值校验成功，则根据第一盐值和第二用户口令生成第二主密钥，以及根据第二盐值和第二主密钥生成第二令牌。这样可以避免因为其他攻击设备伪造虚假的盐值来获取第一用户口令，保障了第一用户口令的安全性。
第一盐值和第二盐值的校验过程可以是：如第一盐值和第二盐值位于预设的盐值范围内则表示校验成功，若不位于预设的盐值范围内，则表示校验失败，
可选地，考虑到终端设备发送的密文获取请求可能会被拦截的可能，本申请实施例提供的密钥管理的方法还包括：响应于用户密钥恢复指令，向云设备发送密文获取请求，密文获取请求用于获取第一用户密钥的第一密文；接收与密文获取请求对应的第三盐值和第四盐值，第三盐值和第四盐值为随机数；校验第三盐值和第四盐值，若第三盐值和第四盐值校验失败，则输出风险提示。
该种可能的实施例中，该风险提示可以指示与云设备的通信连接存在信息泄露的风险。若用户向终端设备输入用户密钥恢复指令后，终端设备发送的密文获取请求被恶意的攻击设备截获，伪造了第三盐值和第四盐值发送给终端设备，第三盐值和第四盐值通常会设置的较为简单，如“0或1”这种简单的数字，这样，攻击设备比较容易通过第三盐值或第四盐值生成的令牌来反推出用户口令，因此，本申请中，会对第三盐值和第四盐值进行校验。校验过程可以通过预设的盐值范围来判断，若第三盐值和第四盐值都位于预设的盐值范围内，则校验成功，若有一个不位于预设的盐值范围内，则校验失败。本申请的预设的盐值范围通常是较长的一串数字的范围，如1452785至5412861，当然，本处指示列举的一个示例，具体该盐值范围的表示形式，本申请中不做限定。因此，本申请的方案可以有效的规避掉被攻击设备恶意攻击的而带来的风险。
3、用户口令的修改。
图8为本申请实施例提供的密钥管理的方法的另一实施例示意图。
如图8所示，本申请实施例提供的密钥管理的方法的另一实施例包括：
301、终端设备响应于用户输入的口令修改指令，向云设备发送密文获取请求，相应地，云设备接收密文获取请求。
该密文获取请求用于获取第一用户密钥的第一密文。
302、云设备根据密文获取请求，向终端设备发送第一盐值和第二盐值。相应地，终端设备接收云设备发送的第一盐值和第二盐值。
303、终端设备根据用户输入的第三用户口令、第一盐值和第二盐值，生成第三主密钥和第三令牌。
正常情况下用户修改用户口令，则第三用户口令应为原来的用户口令，也就是第一用户口令。
304、终端设备向云设备发送第三令牌。
305、云设备校验第三令牌与第一令牌是否相同。若校验出第三令牌和第一令牌相同，则执行步骤306，若不同，则返回校验失败的响应。
若用户输入的第三用户口令与第一用户口令相同，则第三主密钥与第一主密钥相同，第三令牌与第一令牌相同，这种情况下，云设备会执行步骤306。若用户输入的第三用户口令与第一用户口令不相同，则第三主密钥与第一主密钥不相同，第三令牌与第一令牌不相同，这种情况下，云设备会返回校验失败的响应。
306、云设备向终端设备发送第一用户密钥的第一密文。相应地，终端设备接收第一用户密钥的第一密文。
307、终端设备根据第三主密钥解密第一用户密钥的第一密文，以得到第一用户密钥。
前述通过令牌验证，可以确定第三主密钥与第一主密钥相同，则根据第三主密钥可以解密第一密文，以得到第一用户密钥。
308、终端设备根据用户输入的第四用户口令，生成第四主密钥和第四令牌。
第四用户口令应为用户要根据的新的用户口令。也就是APP要根据的新密码。
309、终端设备根据第四主密钥加密第一用户密钥，以得到第一用户密钥的第二密文。
310、终端设备将第四令牌和第一用户密钥的第二密文备份至云设备。
该步骤310的备份过程可以是向云设备再次发送第三令牌，以及用于在云设备上存储的第四令牌和第一用户密钥的第二密文。相应地，云设备接收终端设备发送再次发送的第三令牌，以及第四令牌和第一用户密钥的第二密文。
311、云设备存储四令牌和第一用户密钥的第二密文。
该步骤311可以是云设备再次校验第三令牌与第一令牌相同后，根据第四令牌和第二密文更新第一令牌和第一密文。
若该用户还有其他的终端设备，云设备还可以该用户的其他终端设备发送用户口令修改的通知，其他终端设备会通过侦听回调方式通知用户重新输入新的用户口令。
本申请实施例中，在修改用户口令时，需要先经过令牌校验，令牌校验成功，才会返回第一密文，如果不相同，云设备会返回校验失败的通知。这样，可以确保修改用户口令 过程中的安全性，避免用户口令被恶意修改。
可选地，上述步骤308包括根据第四用户口令和第一盐值，生成第四主密钥；根据第四主密钥和第二盐值，生成第四令牌；其中，第四令牌和第二密文在云设备上与第一盐值和第二盐值关联存储。
该种可选的实施例中，新的第四用户口令可以结合原来的第一盐值和第二盐值生成第四主密钥和第四令牌，这样，云设备只要将该第四主密钥和第四令牌和原来的第一盐值和第二盐值关联存储即可，该种方式可以减少数据传输量。
可选地，上述步骤308包括根据第四用户口令和第五盐值，生成第四主密钥；根据第四主密钥和第六盐值，生成第四令牌；其中，第五盐值和第六盐值为针对第四用户口令新生成的随机数；该方法还包括：向云设备发送第五盐值和第六盐值，第五盐值和第六盐值用于在云设备上与第四令牌和第二密文关联存储。
该种可选的实施例中，在生成第四主密钥和第四令牌时，可以根据新产生的第五盐值和第六盐值，这样可以提高第四令牌和第二密文的安全性。
该用户口令修改的过程，终端设备会响应用户触发的用户口令修改操作，也可以描述为第四操作，终端设备从云设备获取第一盐值和第二盐值，然后响应用户输入的第五操作，显示口令输入界面，如：可以参阅图9所示的场景示意图进行理解。如图9所示，用户要修改APP1的用于管理云端数据库中加密的用户数据的密码，则用户需要打开如图9中界面1所示的界面，用户账号是13400001234，通常会显示为“134****1234”。然后，需要先输入旧的密码，再连续两次输入新的密码。如图9中的界面2所示，输入旧的密码745896，第一次输入新的密码423518，第二次输入新的密码423518。终端设备会先向云设备请求对应的盐值，云设备会返回第一盐值和第二盐值，终端设备先根据旧的密码745896生成第三主密钥和第三令牌，然后向云设备发送第三令牌。云设备校验第三令牌与第一令牌是否相同，因为用户输入的旧的密码是注册时的密码745896，则第三令牌与第一令牌，令牌校验成功，云设备会向终端设备返回第一用户密钥的第一密文。终端设备根据第三主密钥解密该第一用户密钥的第一密文，以得到第一用户密钥。然后，终端设备再根据新的密码423518生成第四主密钥和第四令牌，然后根据第四主密钥加密该第一用户密钥，以得到第一用户密钥的第二密文，然后将该第一用户密钥的第二密文和第四令牌发送到云设备存储。终端设备上会显示如图9中的界面3所示的“密码修改成功”。关于第四主密钥和第四令牌可以根据原来的第一盐值和第二盐值生成，也可以根据第五盐值和第六盐值生成，若根据原来的第一盐值和第二盐值生成，则云设备关联存储第一盐值、第二盐值、第四令牌和第一用户密钥的第二密文。若第四主密钥和第四令牌根据第五盐值和第六盐值生成，则云设备关联存储第五盐值、第六盐值、第四令牌和第一用户密钥的第二密文。
4、用户密钥的修改。
图10为本申请实施例中密钥管理的方法的另一实施例示意图。
如图10所示，本申请实施例提供的密钥管理的方法的另一实施例包括：
401、终端设备响应于用户密钥修改指令，获取用于替换第一用户密钥的第二用户密钥。
第二用户密钥可以是随机数发生器生成的，也可以是用户设置的，或者通过其他方式 产生的。
402、终端设备向云设备发送盐值获取请求。
该盐值获取请求用于获取第一盐值和第二盐值。
403、云设备根据盐值获取请求，向终端设备发送第一盐值和第二盐值。相应地，终端设备接收云设备发送的第一盐值和第二盐值。
404、终端设备根据用户输入的第五用户口令、第一盐值和第二盐值，生成第五主密钥和第五令牌。
405、向云设备发送令牌校验请求，该令牌校验请求包含第五令牌。
406、云设备校验第五令牌与第一令牌是否相同。若校验出第五令牌与第一令牌相同，则执行步骤407，若不相同，则向终端设备返回校验失败的响应。
若令牌校验一致，但密钥状态为更新中，表示用户密钥正在更新，已保存的密文数据还未完全重新加密，则不允许再次修改用户密钥，返回更新失败；终端设备在收到云侧更新失败后，清理本地生成的新的用户密钥，返回修改密钥失败，流程终止。
若令牌检验一致，且密钥状态不为更新中，云设备将新的用户密钥的密文+第二IV值也保存，并将密钥状态设置为更新中，返回更新成功。终端设备也会将新的用户密钥缓存在内存中，并向云侧的数据库请求查询该用户所有的密文的用户数据，对密文的用户数据重新加密，再将新加密的密文的用户数据发送到云侧的数据库中保存。
407、云设备向终端设备发送校验成功的消息。相应地，终端设备接收云设备发送的校验成功的消息。
校验成功的消息指示第五令牌与第一令牌相同，第五令牌与第一令牌相同表示第五用户口令与第一用户口令相同。
408、终端设备根据第五主密钥加密第二用户密钥，以得到第二用户密钥的密文。
409、终端设备将第二用户密钥的密文和第五令牌备份至云设备。
该步骤可以是终端设备向云设备发送第二用户密钥的密文和第五令牌。
410、云设备关联存储第二用户密钥的密文和第五令牌。
更新完成后，终端设备向云设备请求将密钥状态设置为更新完成，云侧会一直保存旧的用户密钥的第一密文+第一IV值。在重新加密过程中只允许这一个终端操作，云设备不允许该用户其它终端操作，直到所有密文的用户数据被重新加密后保存在云侧的数据库中。
用户的其他终端设备需要注册侦听用户密钥，云设备将密钥状态设置为更新完成后，会通知该用户的其他终端设备，该用户的其他终端设备会回调侦听接口通知用户发生用户密钥更新，是否需要更新该用户密钥到本地，如果用户选择是，该用户的其他终端设备会向云设备请求最新的用户密钥的密文，用本地缓存的主密钥解密成用户密钥。如果用户选择否，该用户的其他终端设备就不会从云设备获取用户密钥，这里需要在资料中提示用户，如果不从云设备获取最新的用户密钥，加密数据将无法同步到云侧。
本申请实施例中，在用户要修改用户密钥时，也需要终端设备先根据第五用户口令、第一盐值和第二盐值，生成第五令牌，云设备先验证第五令牌与第一令牌是否相同，若第五令牌与第一令牌相同，则说明第五用户口令是正确的用户口令，可以执行用户密钥修改 操作，终端设备再根据第五主密钥加密第二用户密钥得到第二用户密钥的密文即可。本申请中，用户密钥修改过程中先进行令牌验证，这样，可以确保修改用户密钥的安全性，避免用户密钥被恶意修改。
该用户密钥修改的过程，还可以参阅图11所示的场景示意图进行理解。如图11所示，用户要修改密钥的过程中还是需要输入正确的密码745896，也就是上述实施例中的第五用户口令，终端设备会先向云设备请求对应的盐值，云设备会返回第一盐值和第二盐值，终端设备先根据密码745896生成第五主密钥和第五令牌，然后向云设备发送第五令牌。云设备校验第五令牌与第一令牌是否相同，因为用户输入的密码是注册时的密码745896，则第五令牌与第一令牌，令牌校验成功，云设备会向终端设备返回校验成功的消息。然后终端设备将第五主密钥和第五令牌发送到云设备与第一盐值和第二盐值关联存储即可，云设备中还可以继续保留原来的第一用户密钥的第一密文。
本申请实施例中，无论是第一用户密钥，还是第二用户密钥都会在终端设备中缓存，若用户需要从云端获取用户数据，则终端设备可以响应第六操作，该第六操作可以描述为用户的数据获取操作，从云端获取加密的用户数据，然后使用获取数据时缓存中所缓存的第一用户密钥或第二用户密钥进行解密，以得到用户数据。
可选地，本申请实施例中，第一主密钥是采用秒级哈希算法生成的，第一令牌是采用的是采用毫秒级哈希算法或微秒级哈希算法生成的。
该种可能的实现方式中，上述生成主密钥和令牌的过程都可以是采用基于口令的密钥生成算法生成的。秒级哈希算法(hash)指的是完成一次hash需要一秒或几秒或者更多秒，秒级哈希算法通常会将运算参数中的迭代次数设置为一百万次、几百万次，或者一千万次，这样，以一个6位数的用户口令为例，暴力破解该用户口令需要几个月的时间，所以第一主密钥是对用户口令和第一盐值采用秒级哈希算法生成的，可以防止第一主密钥被暴力破解，因为第一令牌是根据第一主密钥和第二盐值进行哈希算法生成的，第一主密钥已经可以防止被暴力破解了，所以，第一令牌不存在被暴力破解的问题了，第一令牌只要快速生成就好，所以，第一令牌用毫秒级哈希算法或微秒级哈希算法来完成，可以提高第一令牌获得的速度。另外，本申请中，其他的“第X主密钥”和“第X令牌”都可以参照第一主密钥和第一令牌的生成方式进行理解，第X表示上面所提到的第二、第三、第四…。
以上所描述的密钥管理的方案，可以通过软件在终端设备中设置密钥管理模块，在云设备中设置隔离存储区来实现。下面从模块化的角度介绍终端设备和云设备结合实现上述密钥管理的过程。
如图12所示，终端设备包括端侧应用程序接口(appilcation programming interface，API)5001、同步管理模块5002、安全管理模块5003、密钥管理模块5004、存储管理模块5005、通信管理模块5006和端云通信模块5007。其中，密钥管理模块5004配置在安全管理模块5003中，端云通信模块5007配置在通信管理模块5006中。云设备包括通信管理模块5008、安全管理模块5009、同步管理模块5010和存储管理模块5011，存储管理模块5011中设置有隔离存储区5012。
本申请中，终端设备和云设备之间的通信通过端云通信模块5007和通信管理模块5008 来完成，密钥管理模块5004用于执行上述密钥管理的方法中终端设备的密钥管理过程，隔离存储区5012用于存储上述密钥管理的方法中的盐值、令牌以及用户密钥的密文。
以上介绍了终端设备和云设备配合完成本申请实施例的密钥管理的方法，下面结合附图介绍本申请实施例提供的终端设备和云设备。
如图13所示，本申请实施例提供的终端设备60的一实施例包括：
第一处理单元601，用于根据第一用户口令生成第一主密钥和第一令牌。如执行步骤101。
第二处理单元602，用于根据第一处理单元601生成的第一主密钥加密第一用户密钥，以得到第一用户密钥的第一密文，第一用户密钥用于加密或解密用户数据。如执行步骤102。
发送单元603，用于将第一处理单元601生成的第一令牌和第二处理单元602得到的第一用户密钥的第一密文备份至云设备，其中，当终端设备基于用户输入的目标用户口令向云设备请求第一用户密钥的第一密文时，第一令牌被云设备用于校验目标用户口令的正确性。如执行步骤103。
本申请实施例，采用第一用户口令生成的第一主密钥加密第一用户密钥，以得到第一用户密钥的第一密文，并且采用第一用户口令生成第一令牌，在用户想要获取第一用户密钥前，需要先经过令牌验证，才能得到该第一用户密钥的第一密文，使得第一用户密钥具有了双重安全保障。另外，用户想要获取第一用户密钥的第一密文，只有输入正确的用户口令生成的令牌，才能通过云设备的令牌校验，如果用户不具有正确的用户口令，就无法获取到第一密文，极大的保证了第一用户密钥的安全性，而且本申请中的这种密钥管理方案，对云设备没有特殊的要求，只要一个普通的云设备就可以实现，相比对用在硬件层面专门做了安全加固的专用硬件设备存储用户密钥，本申请的密钥管理方案的通用性更好。
可选地，第一处理单元601，用于根据第一用户口令和第一盐值，生成第一主密钥；根据第一主密钥和第二盐值，生成第一令牌；其中，第一盐值和第二盐值都是随机数，所述第一盐值和所述第二盐值备份在所述云设备上。
还可以是：发送单元603，还用于向云设备发送第一盐值和第二盐值，第一盐值和第二盐值用于在云设备上与第一令牌和第一密文关联存储。
可选地，终端设备还包括接收单元604。
发送单元603，还用于响应于用户密钥恢复指令，向云设备发送密文获取请求，密文获取请求用于获取第一用户密钥的第一密文。
接收单元604，用于接收所述第一盐值和第二盐值，所述第一盐值和第二盐值是所述云设备响应于所述密文获取请求发送的。
第一处理单元601，还用于根据用户输入第二用户口令，以及第一盐值和第二盐值，生成第二主密钥和第二令牌。
发送单元603，还用于向云设备发送第二令牌。
接收单元604，还用于接收所述第一用户密钥的所述第一密文，所述第一用户密钥的所述第一密文是当所述云设备校验所述第二令牌与所述第一令牌相同后发送的。
第二处理单元602，还用于基于第二主密钥解密第一用户密钥的第一密文，以得到所述第一用户密钥。
可选地，第一处理单元601，用于校验第一盐值和第二盐值；若第一盐值和第二盐值校验成功，则根据第一盐值和第二用户口令生成第二主密钥，根据第二盐值和第二主密钥生成第二令牌。
可选地，发送单元603，还用于响应于用户输入的用户密钥恢复指令，向云设备发送密文获取请求，密文获取请求用于获取第一用户密钥的第一密文。
接收单元604，还用于接收与密文获取请求对应的第三盐值和第四盐值，第三盐值和第四盐值为随机数。
第一处理单元601，还用于校验第三盐值和第四盐值，若第三盐值和第四盐值校验失败，则输出风险提示。
可选地，发送单元603，还用于响应于用户输入的口令修改指令，向云设备发送密文获取请求，密文获取请求用于获取第一用户密钥的第一密文。
接收单元604，还用于接收第一盐值和第二盐值，所述第一盐值和第二盐值是所述云设备响应于所述密文获取请求发送的。
第一处理单元601，还用于根据用户输入的第三用户口令、第一盐值和第二盐值，生成第三主密钥和第三令牌。
发送单元603，还用于向云设备发送第三令牌。
接收单元604，还用于接收云设备发送的第一用户密钥的第一密文，第一密文是云设备校验第三令牌与第一令牌相同后发送的。
第二处理单元602，还用于基于第三主密钥解密第一用户密钥的第一密文，以得到第一用户密钥。
第一处理单元601，还用于根据用户输入的第四用户口令，生成第四主密钥和第四令牌。
第二处理单元602，还用于根据第四主密钥加密第一用户密钥，以得到第一用户密钥的第二密文。
发送单元603，还用于将所述第四令牌和所述第一用户密钥的所述第二密文备份至所述云设备。
可选地，第一处理单元601，用于根据第四用户口令和第一盐值，生成第四主密钥；根据第四主密钥和第二盐值，生成第四令牌；其中，第四令牌和第二密文在云设备上与第一盐值和第二盐值关联存储。
可选地，第一处理单元601，用于根据第四用户口令和第五盐值，生成第四主密钥；根据第四主密钥和第六盐值，生成第四令牌；其中，第五盐值和第六盐值为针对第四用户口令新生成的随机数，所述第五盐值和所述第六盐值备份在所述云设备上。
还可以是：发送单元603，还用于向云设备发送第五盐值和第六盐值，第五盐值和第六盐值用于在云设备上与第四令牌和第二密文关联存储。
可选地，第一处理单元601，还用于响应于用户密钥修改指令，获取用于替换第一用户密钥的第二用户密钥。
发送单元603，还用于向云设备发送盐值获取请求，盐值获取请求用于获取第一盐值和第二盐值。
接收单元604，还用于接收云设备响应于所述盐值获取请求而发送的第一盐值和第二盐值。
第一处理单元601，还用于根据用户输入的第五用户口令、第一盐值和第二盐值，生成第五主密钥和第五令牌。
发送单元603，还用于向云设备发送令牌校验请求，该令牌校验请求包含第五令牌。
接收单元604，还用于接收云设备发送的校验成功的消息，校验成功的消息指示第五令牌与第一令牌相同，第五令牌与第一令牌相同表示第五用户口令与第一用户口令相同。
第二处理单元602，还用于根据第五主密钥加密第二用户密钥，以得到第二用户密钥的密文。
发送单元603，还用于将第二用户密钥的密文和第五令牌备份至云设备。
可选地，第一主密钥是采用秒级哈希算法生成的，第一令牌是采用的是采用毫秒级哈希算法或微秒级哈希算法生成的。
另外，本申请实施例提供的终端设备还包括如下功能单元。
显示单元，用于响应于用户的第一操作，显示口令输入界面。
获取单元，用于响应于用户在口令输入界面上的输入操作，获取用户输入的第一用户口令，第一用户口令用于终端设备生成第一主密钥和第一令牌。
加密单元，用于基于第一主密钥加密第一用户密钥，以得到第一用户密钥的第一密文，第一用户密钥用于加密和/或解密用户数据。
备份单元，用于将第一密文以及第一令牌备份至云设备；当终端设备基于用户输入的目标用户口令向云设备请求第一密文时，第一令牌被云设备用于校验目标用户口令的正确性。
可选地，第一主密钥是根据第一用户口令和第一盐值生成的，第一令牌是根据第一主密钥和第二盐值生成的；其中，第一盐值和第二盐值都是随机数；第一盐值和第二盐值备份在云设备上。
可选地，获取单元，还用于响应于用户的第二操作，从云设备获取第一盐值和第二盐值。
显示单元，还用于响应于用户的第三操作，显示口令输入界面。
获取单元，还用于获取用户输入的第二用户口令。
发送单元，用于向云设备发送第二令牌。
接收单元，用于接收第一用户密钥的第一密文，基于第二主密钥解密第一密文，以得到第一用户密钥；其中，第一密文是当云设备校验第二令牌与第一令牌相同后发送的；第二主密钥是根据第二用户口令和第一盐值生成的，第二令牌是根据第二主密钥和第二盐值生成的。
可选地，获取单元，还用于响应于用户的第四操作，从云设备获取第一盐值和第二盐值。
显示单元，还用于响应于用户的第五操作，显示口令输入界面。
获取单元，还用于获取用户输入的第三用户口令和第四用户口令。
发送单元，还用于向云设备发送第三令牌。
接收单元，还用于接收第一用户密钥的第一密文，基于第三主密钥解密第一密文，以得到第一用户密钥；其中，第一密文是当云设备校验第三令牌与第一令牌相同后发送的；第三主密钥是根据第三用户口令和第一盐值生成的，第三令牌是根据第三主密钥和第二盐值生成的。
备份单元，还用于将第四令牌和第一用户密钥的第二密文备份到云设备，其中，第一用户密钥的第二密文是根据第四主密钥加密第一用户密钥得到的，第四主密钥是根据第四用户口令和第一盐值生成的，第四令牌是根据第四主密钥和第二盐值生成的。
可选地，获取单元，还用于响应于用户的第六操作，从云设备获取加密的用户数据。
解密单元，用于基于第一用户密钥解密加密的用户数据。
可以理解的是，获取单元、加密单元和解密单元可以由上述第一处理单元601或第二处理单元602来实现，备份单元可以由发送单元603来实现。
如图14所示，本申请实施例提供的云设备70的一实施例包括：
接收单元701，用于接收来自于终端设备的第一令牌和第一用户密钥的第一密文，第一用户密钥的第一密文是终端设备基于第一主密钥对第一用户密钥加密得到的，第一主密钥和第一令牌是终端设备根据第一用户口令生成的。
存储单元702，用于存储接收单元701接收的第一令牌和第一用户密钥的第一密文，第一令牌用于当。
处理单元703，用于当接收单元701接收到终端设备响应于用户输入的目标用户口令发来的对第一密文的请求时，根据第一令牌校验目标用户口令的正确性。
本申请实施例中，云设备会存储终端设备发送来的第一令牌和第一用户密钥的第一密文，在终端设备对该第一密文有需求时，会按照该第一令牌先进行校验，校验通过后才会给终端设备返回第一用户密钥的第一密文。这样使得第一用户密钥不仅通过自身加密，而且还通过令牌验证具有了双重安全保障。另外，令牌是通过用户口令生成的，用户想要获取第一用户密钥的第一密文，只有输入正确的用户口令生成的令牌，才能通过云设备的令牌校验，如果用户不具有正确的用户口令，就无法获取到第一密文，极大的保证了第一用户密钥的安全性，而且本申请中的这种密钥管理方案，对云设备没有特殊的要求，只要一个普通的云设备就可以实现，相比对用在硬件层面专门做了安全加固的专用硬件设备存储用户密钥，本申请的密钥管理方案的通用性更好。
可选地，接收单元701，还用于来自于接收终端设备用于生成第一令牌和第一主密钥的第一盐值和第二盐值，第一盐值和第二盐值都是随机数。
存储单元702，还用于将第一盐值和第二盐值与第一令牌和第一用户密钥的第一密文关联存储。
可选地，云设备70还包括发送单元704。
接收单元701，还用于接收来自于终端设备的密文获取请求，密文获取请求用于获取第一用户密钥的第一密文。
发送单元704，还用于根据密文获取请求，向终端设备发送第一盐值和第二盐值。
接收单元701，还用于接收来自于终端设备的第二令牌，第二令牌是终端设备根据第二用户口令、第一盐值和第二盐值生成的。
发送单元704，还用于若处理单元校验出第二令牌和第一令牌相同，则向终端设备发送第一用户密钥的第一密文，第二令牌与第一令牌相同表示：第二用户口令与第一用户口令相同。
可选地，接收单元701，还用于接收来自于终端设备的密文获取请求，密文获取请求用于获取第一用户密钥的第一密文。
发送单元704，还用于根据密文获取请求，向终端设备发送第一盐值和第二盐值。
接收单元701，还用于接收来自于终端设备的第三令牌，第三令牌是终端设备根据第三用户口令、第一盐值和第二盐值生成的。
发送单元704，还用于若校验出第三令牌和第一令牌相同，则向终端设备发送第一用户密钥的第一密文，第三令牌与第一令牌相同表示：第三用户口令与第一用户口令相同。
接收单元701，还用于接收来自于终端设备第四令牌和第一用户密钥的第二密文，第二密文是采用第四主密钥加密的，第四主密钥和第四令牌是根据用户输入的第四用户口令生成的。
存储单元702，还用于存储所述第四令牌和所述第二密文。
可选地，存储单元702，用于若第四令牌和第四主密钥是根据第一盐值和第二盐值生成的，则将第四令牌和第二密文与第一盐值和第二盐值关联存储。
可选地，接收单元701，还用于若第四令牌和第四主密钥是根据第五盐值和第六盐值生成的，接收来自于终端设备的第五盐值和第六盐值。
存储单元702，用于将第四令牌和第二密文与第五盐值和第六盐值关联存储。
可选地，接收单元701，还用于接收来自于终端设备的盐值获取请求，盐值获取请求用于获取第一盐值和第二盐值。
发送单元704，还用于向终端设备发送第一盐值和第二盐值。
接收单元701，还用于接收来自于终端设备的令牌校验请求，令牌校验请求包含第五令牌，第五令牌是根据用户输入的第五用户口令，以及第一盐值和第二盐值生成的。
发送单元704，还用于若第五令牌与第一令牌相同，则向终端设备发送校验成功的消息，第五令牌与第一令牌相同表示第五用户口令与第一用户口令相同。
接收单元701，还用于接收来自于终端设备的第二用户密钥的密文和第五令牌，第二用户密钥的密文是采用第五主密钥加密的，第五主密钥和第五令牌是根据第五用户口令生成的。
存储单元702，还用于存储第二用户密钥的密文和第五令牌。
以上所描述的终端设备和云设备的功能可以参阅前述图1至图12部分的相应描述进行理解，此处不再重复赘述。
图15示出的是与本申请实施例提供的终端相关的手机的部分结构的框图。参考图15，手机包括：射频(：Radio Frequency，：RF)电路810、存储器820、输入单元830、显示单元840、传感器850、音频电路860、无线保真(wireless fidelity，WiFi)模块870、处 理器880、以及电源890等部件。本领域技术人员可以理解，图15中示出的手机结构并不构成对手机的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
下面结合图15对手机的各个构成部件进行具体的介绍：
RF电路810可用于收发信息或通话过程中，信号的接收和发送，特别地，将基站的下行信息接收后，给处理器880处理；另外，将设计上行的数据发送给基站。通常，RF电路810包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器(Low Noise Amplifier，LNA)、双工器等。
存储器820可用于存储软件程序以及模块，处理器880通过运行存储在存储器820的软件程序以及模块，从而执行手机的各种功能应用以及数据处理。存储器820可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如声音播放功能、图像播放功能等)等；存储数据区可存储根据手机的根据所创建的数据(比如音频数据、电话本等)等。此外，存储器820可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
输入单元830可用于接收用户输入的信息：如用户口令，以及产生与手机的用户设置以及功能控制有关的键信号输入。具体地，输入单元830可包括触控面板831以及其他输入设备832。触控面板831，也称为触摸屏，可收集用户在其上或附近的触摸操作(比如用户根据手指、触笔等任何适合的物体或附件在触控面板831上或在触控面板831附近的操作)，并根据预先设定的程式驱动相应的连接装置。可选的，触控面板831可包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给处理器880，并能接收处理器880发来的命令并加以执行。此外，可以采用电阻式、电容式、红外线以及表面声波等多种类型实现触控面板831。除了触控面板831，输入单元830还可以包括其他输入设备832。具体地，其他输入设备832可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。
显示单元840可用于显示APP的界面内容。显示单元840可包括显示面板841，可选的，可以采用液晶显示器(英文全称：Liquid Crystal Display，英文缩写：LCD)、有机发光二极管(英文全称：Organic Light-Emitting Diode，英文缩写：OLED)等形式来配置显示面板841。进一步的，触控面板831可覆盖显示面板841，当触控面板831检测到在其上或附近的触摸操作后，传送给处理器880以确定触摸事件的类型，随后处理器880根据触摸事件的类型在显示面板841上提供相应的视觉输出。虽然在图15中，触控面板831与显示面板841是作为两个独立的部件来实现手机的输入和输入功能，但是在某些实施例中，可以将触控面板831与显示面板841集成而实现手机的输入和输出功能。
手机还可包括至少一种传感器850，比如光传感器、运动传感器以及其他传感器。具体地，光传感器可包括环境光传感器及接近传感器，其中，环境光传感器可根据环境光线的 明暗来调节显示面板841的亮度，接近传感器可在手机移动到耳边时，关闭显示面板841和/或背光。作为运动传感器的一种，加速计传感器可检测各个方向上(一般为三轴)加速度的大小，静止时可检测出重力的大小及方向，可用于识别手机姿态的应用(比如横竖屏切换、相关游戏、磁力计姿态校准)、振动识别相关功能(比如计步器、敲击)等；至于手机还可配置的陀螺仪、气压计、湿度计、温度计、红外线传感器等其他传感器，在此不再赘述。
音频电路860、扬声器861，传声器862可提供用户与手机之间的音频接口。音频电路860可将接收到的音频数据转换后的电信号，传输到扬声器861，由扬声器861转换为声音信号输出；另一方面，传声器862将收集的声音信号转换为电信号，由音频电路860接收后转换为音频数据，再将音频数据输出处理器880处理后，经RF电路810以发送给比如另一手机，或者将音频数据输出至存储器820以便进一步处理。
WiFi属于短距离无线传输技术，手机通过WiFi模块870可以帮助用户收发电子邮件、浏览网页和访问流式媒体等，它为用户提供了无线的宽带互联网访问。虽然图15示出了WiFi模块870，但是可以理解的是，其并不属于手机的必须构成，完全可以根据需要在不改变发明的本质的范围内而省略。
处理器880是手机的控制中心，利用各种接口和线路连接整个手机的各个部分，通过运行或执行存储在存储器820内的软件程序和/或模块，以及调用存储在存储器820内的数据，执行手机的各种功能和处理数据，从而对手机进行整体监控。可选的，处理器880可包括一个或多个处理单元；优选的，处理器880可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器880中。
手机还包括给各个部件供电的电源890(比如电池)，优选的，电源可以通过电源管理系统与处理器880逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。
尽管未示出，手机还可以包括摄像头、蓝牙模块等，在此不再赘述。
在本申请实施例中，该终端所包括的处理器880还具有上述所描述的密钥管理的功能。
图16所示，为本申请的实施例提供的上述实施例中所涉及的云设备的一种可能的逻辑结构示意图。云设备90包括：处理器901、通信接口902、存储器903以及总线904。处理器901、通信接口902以及存储器903通过总线904相互连接。在本申请的实施例中，处理器901用于对云设备90的动作进行控制管理，例如，处理器901用于执行图2至图11中云设备对令牌的校验过程，和/或用于本文所描述的技术的其他过程。通信接口902用于支持云设备90进行通信，例如：通信接口902可以执行上述方法实施例中数据的发送和接收的步骤。存储器903，用于存储云设备90的程序代码和数据。
其中，处理器901可以是中央处理器单元，通用处理器，数字信号处理器，专用集成电路，现场可编程门阵列或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，数字信 号处理器和微处理器的组合等等。总线904可以是外设部件互连标准(Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图16中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
在本申请的另一实施例中，还提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机执行指令，当设备的至少一个处理器执行该计算机执行指令时，设备执行上述图2至图11部分实施例所描述的密钥管理的方法。
在本申请的另一实施例中，还提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中；设备的至少一个处理器可以从计算机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令使得设备执行上述图2至图11部分实施例所描述的密钥管理的方法。
在本申请的另一实施例中，还提供一种芯片系统，该芯片系统包括处理器，用于支持终端设备实现上述图2至图11部分实施例所描述的密钥管理的方法。在一种可能的设计中，芯片系统还可以包括存储器，存储器用于存储必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
在本申请的另一实施例中，还提供一种芯片系统，该芯片系统包括处理器，用于支持云设备实现上述图2至图11部分实施例所描述的密钥管理的方法。在一种可能的设计中，芯片系统还可以包括存储器，存储器用于存储必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来根据不同方法来实现所描述的功能，但是这种实现不应认为超出本申请实施例的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请实施例所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请实施例各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请实施例各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上，仅为本申请实施例的具体实施方式，但本申请实施例的保护范围并不局限于此。

Claims (34)

  1. 一种密钥管理的方法，其特征在于，包括：
    根据第一用户口令生成第一主密钥和第一令牌；
    基于所述第一主密钥加密第一用户密钥，以得到所述第一用户密钥的第一密文，所述第一用户密钥用于加密和/或解密用户数据；
    将所述第一令牌和所述第一用户密钥的第一密文备份至云设备，其中，当终端设备基于用户输入的目标用户口令向所述云设备请求所述第一用户密钥的所述第一密文时，所述第一令牌被所述云设备用于校验所述目标用户口令的正确性。
  2. 根据权利要求1所述的方法，其特征在于，所述根据第一用户口令生成第一主密钥和第一令牌，包括：
    根据所述第一用户口令和第一盐值，生成所述第一主密钥；
    根据所述第一主密钥和第二盐值，生成所述第一令牌；
    其中，所述第一盐值和所述第二盐值都是随机数，所述第一盐值和所述第二盐值备份在所述云设备上。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    响应于用户密钥恢复指令，向所述云设备发送密文获取请求，所述密文获取请求用于获取所述第一用户密钥的所述第一密文；
    接收所述第一盐值和第二盐值，所述第一盐值和第二盐值是所述云设备响应于所述密文获取请求发送的；
    根据用户输入第二用户口令，以及所述第一盐值和所述第二盐值，生成第二主密钥和第二令牌；
    向所述云设备发送所述第二令牌；
    接收所述第一用户密钥的所述第一密文，所述第一用户密钥的所述第一密文是当所述云设备校验所述第二令牌与所述第一令牌相同后发送的；
    基于所述第二主密钥解密所述第一用户密钥的第一密文，以得到所述第一用户密钥。
  4. 根据权利要求3所述的方法，其特征在于，所述根据所述第一盐值和所述第二盐值，以及所述第二用户口令，生成第二主密钥和第二令牌，包括：
    校验所述第一盐值和所述第二盐值；
    若所述第一盐值和所述第二盐值检验成功，则根据所述第一盐值和所述第二用户口令生成所述第二主密钥，以及根据所述第二盐值和所述第二主密钥生成所述第二令牌。
  5. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    响应于用户密钥恢复指令，向所述云设备发送密文获取请求，所述密文获取请求用于获取所述第一用户密钥的所述第一密文；
    接收与所述密文获取请求对应的第三盐值和第四盐值，所述第三盐值和所述第四盐值为随机数；
    校验所述第三盐值和所述第四盐值，若所述第三盐值和所述第四盐值校验失败，则输出风险提示。
  6. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    响应于用户输入的口令修改指令，向所述云设备发送密文获取请求，所述密文获取请求用于获取所述第一用户密钥的所述第一密文；
    接收所述第一盐值和所述第二盐值，所述第一盐值和第二盐值是所述云设备响应于所述密文获取请求发送的；
    根据用户输入的第三用户口令、所述第一盐值和所述第二盐值，生成所述第三主密钥和所述第三令牌；
    向所述云设备发送所述第三令牌；
    接收所述云设备发送的所述第一用户密钥的所述第一密文，所述第一密文是所述云设备校验第三令牌与所述第一令牌相同后发送的；
    基于所述第三主密钥解密所述第一用户密钥的所述第一密文，以得到所述第一用户密钥；
    根据用户输入的第四用户口令，生成第四主密钥和第四令牌；
    根据所述第四主密钥加密所述第一用户密钥，以得到所述第一用户密钥的第二密文；
    将所述第四令牌和所述第一用户密钥的所述第二密文备份至所述云设备。
  7. 根据权利要求6所述的方法，其特征在于，所述根据用户输入的第四用户口令，生成第四主密钥和第四令牌，包括：
    根据所述第四用户口令和所述第一盐值，生成第四主密钥；
    根据所述第四主密钥和所述第二盐值，生成第四令牌；
    其中，所述第四令牌和所述第二密文在所述云设备上与所述第一盐值和所述第二盐值关联存储。
  8. 根据权利要求6所述的方法，其特征在于，所述根据用户输入的第四用户口令，生成第四主密钥和第四令牌，包括：
    根据所述第四用户口令和第五盐值，生成第四主密钥；
    根据所述第四主密钥和第六盐值，生成第四令牌；
    其中，所述第五盐值和所述第六盐值为针对所述第四用户口令新生成的随机数；
    所述第五盐值和所述第六盐值备份在所述云设备上。
  9. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    响应于用户密钥修改指令，获取用于替换所述第一用户密钥的第二用户密钥，并向所述云设备发送盐值获取请求；
    接收所述云设备响应于所述盐值获取请求而发送的所述第一盐值和所述第二盐值；
    根据用户输入的第五用户口令、所述第一盐值和所述第二盐值，生成第五主密钥和第五令牌；
    向所述云设备发送令牌校验请求，所述令牌校验请求包含所述第五令牌；
    接收所述云设备发送的校验成功的消息，所述校验成功的消息指示所述第五令牌与所述第一令牌相同；
    根据所述第五主密钥加密所述第二用户密钥，以得到所述第二用户密钥的密文；
    将所述第二用户密钥的密文和所述第五令牌备份至所述云设备。
  10. 根据权利要求1-9任一项所述的方法，其特征在于，所述第一主密钥是采用秒级哈希算法生成的，所述第一令牌是采用的是采用毫秒级哈希算法或微秒级哈希算法生成的。
  11. 一种密钥管理的方法，其特征在于，包括：
    接收来自于终端设备的第一令牌和第一用户密钥的第一密文，所述第一用户密钥的第一密文是所述终端设备基于第一主密钥对所述第一用户密钥加密得到的，所述第一主密钥和所述第一令牌是所述终端设备根据第一用户口令生成的；
    存储所述第一令牌和所述第一用户密钥的所述第一密文；
    当接收到所述终端设备响应于用户输入的目标用户口令发来的对所述第一密文的请求时，根据所述第一令牌校验所述目标用户口令的正确性。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    接收来自于所述终端设备用于生成所述第一令牌和所述第一主密钥的第一盐值和第二盐值，所述第一盐值和所述第二盐值都是随机数；
    将所述第一盐值和所述第二盐值与所述第一令牌和所述第一用户密钥的所述第一密文关联存储。
  13. 根据权利要求12所述的方法，其特征在于，所述方法还包括：
    接收来自于所述终端设备的密文获取请求，所述密文获取请求用于获取所述第一用户密钥的所述第一密文；
    根据所述密文获取请求，向所述终端设备发送所述第一盐值和所述第二盐值；
    接收来自于所述终端设备的第二令牌，所述第二令牌是所述终端设备根据第二用户口令、所述第一盐值和所述第二盐值生成的；
    若校验出所述第二令牌和所述第一令牌相同，则向所述终端设备发送所述第一用户密钥的所述第一密文。
  14. 根据权利要求12所述的方法，其特征在于，所述方法还包括：
    接收来自于所述终端设备的密文获取请求，所述密文获取请求用于获取所述第一用户密钥的所述第一密文；
    根据所述密文获取请求，向所述终端设备发送所述第一盐值和所述第二盐值；
    接收来自于所述终端设备的第三令牌，所述第三令牌是所述终端设备根据第三用户口令、所述第一盐值和所述第二盐值生成的；
    若校验出所述第三令牌和所述第一令牌相同，则向所述终端设备发送所述第一用户密钥的所述第一密文；
    接收来自于所述终端设备所述第四令牌和所述第一用户密钥的第二密文，所述第二密文是采用第四主密钥加密的，所述第四主密钥和所述第四令牌是根据用户输入的第四用户口令生成的；
    存储所述第四令牌和所述第二密文。
  15. 根据权利要求14所述的方法，其特征在于，若所述第四令牌和所述第四主密钥是根据所述第一盐值和所述第二盐值生成的，则将所述第四令牌和所述第二密文与所述第一盐 值和所述第二盐值关联存储。
  16. 根据权利要求14所述的方法，其特征在于，若所述第四令牌和所述第四主密钥是根据所述第五盐值和所述第六盐值生成的，则所述方法还包括：
    接收来自于所述终端设备的所述第五盐值和所述第六盐值；
    将所述第四令牌和所述第二密文与所述第五盐值和所述第六盐值关联存储。
  17. 根据权利要求12所述的方法，其特征在于，所述方法还包括：
    接收来自于所述终端设备的盐值获取请求，所述盐值获取请求用于获取所述第一盐值和所述第二盐值；
    根据所述盐值获取请求，向所述终端设备发送所述第一盐值和所述第二盐值；
    接收所述终端设备发送的令牌校验请求，所述牌校验请求包含第五令牌，所述第五令牌是根据用户输入的第五用户口令，以及所述第一盐值和所述第二盐值生成的；
    若第五令牌与所述第一令牌相同，则向所述终端设备发送校验成功的消息；
    接收并存储所述终端设备发送的第二用户密钥的密文和第五令牌，所述第二用户密钥的密文是采用第五主密钥加密的，所述第五主密钥和所述第五令牌是根据所述第五用户口令生成的。
  18. 一种终端设备，其特征在于，包括：
    第一处理单元，用于根据第一用户口令生成第一主密钥和第一令牌；
    第二处理单元，用于基于所述第一处理单元生成的所述第一主密钥加密第一用户密钥，以得到所述第一用户密钥的第一密文，所述第一用户密钥用于加密和/或解密用户数据；
    发送单元，用于将所述第一处理单元生成的所述第一令牌和所述第二处理单元得到的所述第一用户密钥的第一密文备份至云设备，其中，当终端设备基于用户输入的目标用户口令向所述云设备请求所述第一用户密钥的所述第一密文时，所述第一令牌被所述云设备用于校验所述目标用户口令的正确性。
  19. 根据权利要求18所述的终端设备，其特征在于，
    所述第一处理单元，用于根据所述第一用户口令和第一盐值，生成所述第一主密钥；根据所述第一主密钥和第二盐值，生成所述第一令牌；其中，所述第一盐值和所述第二盐值都是随机数，所述第一盐值和所述第二盐值备份在所述云设备上。
  20. 根据权利要求19所述的终端设备，其特征在于，所述终端设备还包括接收单元，
    所述发送单元，还用于响应于用户密钥恢复指令，向所述云设备发送密文获取请求，所述密文获取请求用于获取所述第一用户密钥的所述第一密文；
    所述接收单元，用于接收所述第一盐值和第二盐值，所述第一盐值和第二盐值是所述云设备响应于所述密文获取请求发送的；
    所述第一处理单元，还用于根据用户输入第二用户口令，以及所述第一盐值和所述第二盐值，生成第二主密钥和第二令牌；
    所述发送单元，还用于向所述云设备发送所述第二令牌；
    所述接收单元，还用于接收所述第一用户密钥的所述第一密文，所述第一用户密钥的所述第一密文是当所述云设备校验所述第二令牌与所述第一令牌相同后发送的；
    所述第二处理单元，还用于基于所述第二主密钥解密所述第一用户密钥的第一密文，以得到所述第一用户密钥。
  21. 一种云设备，其特征在于，包括：
    接收单元，用于接收来自于终端设备的第一令牌和第一用户密钥的第一密文，所述第一用户密钥的第一密文是所述终端设备基于第一主密钥对所述第一用户密钥加密得到的，所述第一主密钥和所述第一令牌是所述终端设备根据第一用户口令生成的；
    存储单元，用于存储所述接收单元接收的第一令牌和所述第一用户密钥的所述第一密文；
    处理单元，用于当所述接收单元接收到所述终端设备响应于用户输入的目标用户口令发来的对所述第一密文的请求时，根据所述第一令牌校验所述目标用户口令的正确性。
  22. 根据权利要求21所述的云设备，其特征在于，
    所述接收单元，还用于接收来自于所述终端设备用于生成所述第一令牌和所述第一主密钥的第一盐值和第二盐值，所述第一盐值和所述第二盐值都是随机数；
    存储单元，还用于将所述第一盐值和所述第二盐值与所述第一令牌和所述第一用户密钥的所述第一密文关联存储。
  23. 根据权利要求22所述的云设备，其特征在于，所述云设备还包括发送单元，
    所述接收单元，还用于接收来自于所述终端设备的密文获取请求，所述密文获取请求用于获取所述第一用户密钥的所述第一密文；
    所述发送单元，还用于根据所述密文获取请求，向所述终端设备发送所述第一盐值和所述第二盐值；
    所述接收单元，还用于接收来自于所述终端设备的第二令牌，所述第二令牌是所述终端设备根据第二用户口令、所述第一盐值和所述第二盐值生成的；
    所述发送单元，还用于若所述处理单元校验出所述第二令牌和所述第一令牌相同，则向所述终端设备发送所述第一用户密钥的所述第一密文。
  24. 一种终端设备，其特征在于，所述终端设备包括至少一个处理器、存储器及存储在所述存储器上并可被所述至少一个处理器执行的指令，其特征在于，所述至少一个处理器执行所述指令，以实现权利要求1至10中任一项所述的方法的步骤。
  25. 一种云设备，其特征在于，包括：所述云设备包括至少一个处理器、存储器及存储在所述存储器上并可被所述至少一个处理器执行的指令，其特征在于，所述至少一个处理器执行所述指令，以实现权利要求11至17中任一项所述的方法的步骤。
  26. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，该程序被处理器执行时实现权利要求1至10中任一项所述的方法。
  27. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，该程序被处理器执行时实现权利要求11至17中任一项所述的方法。
  28. 一种密钥管理系统，其特征在于，包括：终端设备和云设备，所述终端设备用于执行上述权利要求1至10中任一项所述的方法，所述云设备用于执行上述权利要求11至17中任一项所述的方法。
  29. 一种密钥管理的方法，其特征在于，包括：
    响应于用户的第一操作，终端设备显示口令输入界面；
    响应于用户在所述口令输入界面上的输入操作，所述终端设备获取用户输入的第一用户口令，所述第一用户口令用于所述终端设备生成第一主密钥和第一令牌；
    所述终端设备基于第一主密钥加密所述第一用户密钥，以得到所述第一用户密钥的第一密文，所述第一用户密钥用于加密和/或解密用户数据；
    所述终端设备将所述第一密文以及第一令牌备份至云设备；当所述终端设备基于用户输入的目标用户口令向所述云设备请求所述第一密文时，所述第一令牌被所述云设备用于校验所述目标用户口令的正确性。
  30. 根据权利要求29所述的方法，其特征在于，所述第一主密钥是根据所述第一用户口令和第一盐值生成的，所述第一令牌是根据所述第一主密钥和第二盐值生成的；
    其中，所述第一盐值和所述第二盐值都是随机数；所述第一盐值和所述第二盐值备份在所述云设备上。
  31. 根据权利要求30所述的方法，其特征在于，所述方法还包括：
    响应于用户的第二操作，所述终端设备从所述云设备获取所述第一盐值和第二盐值；
    响应于用户的第三操作，所述终端设备显示所述口令输入界面；
    所述终端设备获取用户输入的第二用户口令；
    所述终端设备向所述云设备发送第二令牌；
    所述终端设备接收所述第一用户密钥的所述第一密文，基于第二主密钥解密所述第一密文，以得到所述第一用户密钥；其中，所述第一密文是当所述云设备校验所述第二令牌与所述第一令牌相同后发送的；所述第二主密钥是根据所述第二用户口令和所述第一盐值生成的，所述第二令牌是根据所述第二主密钥和所述第二盐值生成的。
  32. 根据权利要求30所述的方法，其特征在于，所述方法还包括：
    响应于用户的第四操作，所述终端设备从所述云设备获取所述第一盐值和第二盐值；
    响应于用户的第五操作，所述终端设备显示所述口令输入界面；
    所述终端设备获取用户输入的第三用户口令和第四用户口令；
    所述终端设备向所述云设备发送第三令牌；
    所述终端设备接收所述第一用户密钥的所述第一密文，基于第三主密钥解密所述第一密文，以得到所述第一用户密钥；其中，所述第一密文是当所述云设备校验所述第三令牌与所述第一令牌相同后发送的；所述第三主密钥是根据所述第三用户口令和所述第一盐值生成的，所述第三令牌是根据所述第三主密钥和所述第二盐值生成的；
    所述终端设备将第四令牌和所述第一用户密钥的第二密文备份到所述云设备，其中，所述第一用户密钥的第二密文是根据第四主密钥加密所述第一用户密钥得到的，所述第四主密钥是根据所述第四用户口令和所述第一盐值生成的，所述第四令牌是根据所述第四主密钥和所述第二盐值生成的。
  33. 根据权利要求29-32任一项所述的方法，其特征在于，所述方法还包括：
    响应于用户的第六操作，所述终端设备从所述云设备获取加密的用户数据；
    所述终端设备基于所述第一用户密钥解密所述加密的用户数据。
  34. 一种终端设备，其特征在于，所述终端设备包括至少一个处理器、存储器及存储在所述存储器上并可被所述至少一个处理器执行的指令，其特征在于，所述至少一个处理器执行所述指令，以实现权利要求29至33中任一项所述的方法的步骤。
PCT/CN2021/140654 2020-12-29 2021-12-23 一种密钥管理的方法、相应装置及系统 WO2022143358A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011613318.9 2020-12-29
CN202011613318.9A CN114697007B (zh) 2020-12-29 2020-12-29 一种密钥管理的方法、相应装置及系统

Publications (1)

Publication Number Publication Date
WO2022143358A1 true WO2022143358A1 (zh) 2022-07-07

Family

ID=82131633

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/140654 WO2022143358A1 (zh) 2020-12-29 2021-12-23 一种密钥管理的方法、相应装置及系统

Country Status (2)

Country Link
CN (1) CN114697007B (zh)
WO (1) WO2022143358A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115599596A (zh) * 2022-09-16 2023-01-13 花瓣云科技有限公司（Cn） 数据处理方法、电子设备、系统及存储介质
CN116028979A (zh) * 2023-03-22 2023-04-28 新兴际华集团财务有限公司 密钥安全管理方法、装置、电子设备和计算机可读介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103391187A (zh) * 2012-05-09 2013-11-13 天津书生投资有限公司 一种云存储安全控制的方法
CN105429752A (zh) * 2015-11-10 2016-03-23 中国电子科技集团公司第三十研究所 一种云环境下用户密钥的处理方法及系统
US20180075451A1 (en) * 2015-11-30 2018-03-15 Inventec (Pudong) Technology Corp. Transaction Method and Transaction System
CN109194663A (zh) * 2018-09-13 2019-01-11 郑州云海信息技术有限公司 一种基于云计算的文件存储及下载的方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103391187A (zh) * 2012-05-09 2013-11-13 天津书生投资有限公司 一种云存储安全控制的方法
CN105429752A (zh) * 2015-11-10 2016-03-23 中国电子科技集团公司第三十研究所 一种云环境下用户密钥的处理方法及系统
US20180075451A1 (en) * 2015-11-30 2018-03-15 Inventec (Pudong) Technology Corp. Transaction Method and Transaction System
CN109194663A (zh) * 2018-09-13 2019-01-11 郑州云海信息技术有限公司 一种基于云计算的文件存储及下载的方法及装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115599596A (zh) * 2022-09-16 2023-01-13 花瓣云科技有限公司（Cn） 数据处理方法、电子设备、系统及存储介质
CN116028979A (zh) * 2023-03-22 2023-04-28 新兴际华集团财务有限公司 密钥安全管理方法、装置、电子设备和计算机可读介质

Also Published As

Publication number Publication date
CN114697007A (zh) 2022-07-01
CN114697007B (zh) 2024-01-16

Similar Documents

Publication Publication Date Title
US11088836B2 (en) Key updating method, apparatus, and system
CN111444528B (zh) 数据安全保护方法、装置及存储介质
CN109600223B (zh) 验证方法、激活方法、装置、设备及存储介质
US11488234B2 (en) Method, apparatus, and system for processing order information
CN106850220B (zh) 数据加密方法、数据解密方法及装置
US20180332041A1 (en) Network connection method, apparatus, storage medium and terminal
US11057216B2 (en) Protection method and protection system of system partition key data and terminal
US10944558B2 (en) Key storing method, key managing method and apparatus
US10187359B2 (en) Secure message transmission apparatus and processing method thereof
CN108809906B (zh) 数据处理方法、系统及装置
WO2022143358A1 (zh) 一种密钥管理的方法、相应装置及系统
WO2019184705A1 (zh) 数据保护方法和装置、终端、计算机可读存储介质
CN104954126B (zh) 敏感操作验证方法、装置及系统
KR20150128202A (ko) 전자 기기간 콘텐트 공유 방법 및 장치
US20140258734A1 (en) Data security method and electronic device implementing the same
US11343233B2 (en) Node control method and related apparatus in distributed system
CN107154935B (zh) 业务请求方法及装置
CN109886010B (zh) 验证图片发送方法、合成方法及装置、存储介质和终端
KR102544488B1 (ko) 인증을 수행하기 위한 전자 장치 및 방법
CN111475832B (zh) 一种数据管理的方法以及相关装置
CN108011879A (zh) 文件加密、解密的方法、装置、设备和存储介质
WO2019148397A1 (zh) 分解敏感数据存储在不同应用环境中
WO2021017720A1 (zh) 信息认证方法、电子设备及网络侧设备
WO2020132962A1 (zh) 安全元件、数据处理装置及数据处理方法
CN108737341B (zh) 业务处理方法、终端及服务器

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21914095

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21914095

Country of ref document: EP

Kind code of ref document: A1