WO2020168546A1 - 密钥迁移方法和装置 - Google Patents
密钥迁移方法和装置 Download PDFInfo
- Publication number
- WO2020168546A1 WO2020168546A1 PCT/CN2019/075838 CN2019075838W WO2020168546A1 WO 2020168546 A1 WO2020168546 A1 WO 2020168546A1 CN 2019075838 W CN2019075838 W CN 2019075838W WO 2020168546 A1 WO2020168546 A1 WO 2020168546A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- key
- client device
- key component
- component
- server
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
Definitions
- This application relates to the field of Internet technology, and in particular to a method and device for key migration.
- a key component is often stored by the client device used by the user or bound to the user account.
- the user needs to provide the stored key component through the client device to generate a transaction signature corresponding to the user, and then use the transaction signature as a voucher to smoothly call the user's account Complete the specific transaction data processing in the fund data in the.
- the new client device often does not have the above key component.
- user A has always used mobile phone A bound to his account for transaction data processing, and mobile phone A stores the key component used to generate transaction signatures locally.
- mobile phone B does not have the key component stored on mobile phone A.
- user A cannot directly use mobile phone B to generate transaction signatures for transaction data processing. Therefore, the key component needs to be migrated from mobile phone A to mobile phone B first.
- the existing key migration methods are relatively simple, and most of them are to directly send the stored key components to the new client device (such as mobile phone B) through the previously used client device (such as mobile phone A).
- the new client device such as mobile phone B
- the previously used client device such as mobile phone A
- the above key components are easily leaked or stolen by a third party. That is, when the existing key migration method is specifically implemented, there are often technical problems that the key migration is insecure and easy to leak.
- the embodiments of the present application provide a key migration method and device to solve the technical problem of insecure and easy leakage of key migration.
- the embodiment of the present application provides a key migration method, which is applied to a system including a first client device, a second client device, and a server, wherein the second client device stores a second The key component, the server stores the first key component, and the method includes:
- the first client device initiates a key migration request
- the server and the second client device call the stored first key component and the second key component as input, and perform functional operations according to preset rules to obtain the third A key component and a fourth key component; wherein the server obtains and saves the third key component, and the second client device obtains and saves the fourth key component;
- the second client device obtains the first public key generated by the first client device, wherein the first client device is used to generate a first public key and a first private key that match each other;
- the second client device generates first ciphertext data according to the first public key and the fourth key component, and sends the first ciphertext to the first client device;
- the first client device uses the first private key to decrypt the first ciphertext data to obtain the fourth key component.
- the preset rule is generated in advance according to the MPC protocol.
- the method further includes:
- the second client device destroys the stored second key component and the fourth key component in response to the confirmation information; the server destroys the stored first key component in response to the confirmation information.
- the method further includes:
- the user initiates a transaction data processing request through the first client device
- the first client device and the server respond to the transaction data processing request, call and generate a transaction signature according to the fourth key component and the third key component stored respectively;
- the first client device performs transaction data processing according to the transaction signature.
- the method before the first client device initiates the key migration request, the method further includes:
- the first client device receives a key migration instruction
- the first client device In response to the key migration instruction, the first client device verifies the identity information of the account logging in to the first client device, and verifies the identity information of the account logging in to the first client device and the second client device If the identity information of the account matches, initiate the key migration request.
- An embodiment of the present application also provides a key migration method, which is applied to a second client device, and the second client device stores a second key component, and the method includes:
- the server receives and responding to the key migration request, and the server calls the separately saved second key component and the first key component as input, and performs function operations according to preset rules to obtain and save the fourth key component, where , The server obtains and saves the third key component;
- obtaining the first public key generated by the first client device includes:
- the embodiment of the present application also provides a key migration method, the method is applied to the first client device, and the method includes:
- the fourth key component is that the second client device and the server respond to the key migration request, call the respectively saved second key component and the first key component as input, and perform functions according to preset rules Calculated
- the embodiment of the present application also provides a key migration device, including:
- the first processing module is used to receive and respond to the key migration request, and the server calls the separately saved second key component and the first key component as input, performs function operations according to preset rules, and obtains and saves The fourth key component, wherein the server obtains and saves the third key component;
- An obtaining module configured to obtain a first public key generated by a first client device, where the first client device is used to generate a first public key and a first private key that match each other;
- the second processing module is configured to generate first ciphertext data according to the first public key and the fourth key component, and send the first ciphertext to the first client device, where all The first client device is configured to use the first private key to decrypt the first ciphertext data to obtain the fourth key component.
- the embodiment of the present application also provides a computer-readable storage medium on which computer instructions are stored.
- the instructions When the instructions are executed, they receive and respond to the key migration request, and the server invokes the second key component stored separately And the first key component as input, perform function operations according to preset rules to obtain and save the fourth key component, wherein the server obtains and saves the third key component; obtains the generated by the first client device
- the first public key wherein the first client device is used to generate a first public key and a first private key that match each other; and a first ciphertext is generated according to the first public key and the fourth key component Data, and send the first ciphertext to the first client device, wherein the first client device is configured to use the first private key to decrypt the first ciphertext data, Obtain the fourth key component.
- the second client device and the server first call the second client device and the server according to the preset rules.
- the second key component and the first key component on the other side perform functional operations to generate a new key component, that is, the fourth key component and the third key component to replace the previously used second key component and first key component.
- the key component; the newly generated fourth key component is encrypted and sent to the first client device to realize the migration of the key component between different client devices, thereby solving the key migration in the existing method
- the technical problem of insecurity and easy leakage achieves the technical effect of safely and efficiently migrating the key components stored by the second client device to the first client device.
- Fig. 1 is a processing flowchart of a key migration method according to an embodiment of the present application
- FIG. 2 is a schematic diagram of applying the key migration method provided by an embodiment of the present application in an example scenario
- Fig. 3 is a processing flowchart of a key migration method provided according to an embodiment of the present application.
- Fig. 4 is a processing flowchart of a key migration method provided according to an embodiment of the present application.
- Figure 5 is a structural diagram of the key migration device provided according to an embodiment of the present application.
- FIG. 6 is a schematic diagram of the composition structure of an electronic device based on the key migration method provided by an embodiment of the present application.
- the existing key migration methods are often relatively simple in design, the keys are prone to leakage or stolen during the migration and transmission process, and even cause user losses. That is, the existing key migration methods often have technical problems that the key migration is insecure and easy to leak during the specific implementation.
- this application considers that a processing method based on MPC (ie, secure multi-party computing) can be introduced to improve the security of key migration.
- the second client device and the server may first call the second key component and the first key component stored on both sides according to a preset rule generated based on the MPC protocol, and perform function operations together to generate a new
- the fourth key component and the third key component are used to replace the previously used second key component and the first key component; the newly generated fourth key component is encrypted and sent to the first
- a client device realizes the migration of key components between different client devices, thereby solving the technical problems of insecure and easy leakage of key migration in existing methods, and achieving safe and efficient transfer of the second client
- the embodiment of the present application provides a key migration method.
- a key migration method For details, please refer to the processing flowchart of the key migration method according to the embodiment of the present application shown in FIG. 1.
- the key migration method provided in the embodiments of the present application can be specifically applied to a system including a first client device, a second client device, and a server.
- the above-mentioned second client device (may be denoted as client2) can be specifically understood as a client device that stores the key component (for example, the second key component) to be migrated.
- client2 may be a mobile phone or tablet that was previously used by the user or previously bound to the user's account.
- the second client device listed above is only a schematic illustration.
- the above-mentioned second client device may also be another type of electronic device, or a software program running in the above-mentioned electronic device, and so on. This specification does not limit the specific form and type of the second client device.
- the above-mentioned first client device (which can be recorded as client1) can be specifically understood as a target device to which the key component to be migrated is to be migrated.
- a target device to which the key component to be migrated is to be migrated can be a new mobile phone or tablet computer that the user uses.
- the first client device listed above is only a schematic illustration.
- the above-mentioned first client device may also be other types of electronic devices, or software programs running in the above-mentioned electronic devices, and so on. This specification does not limit the specific form and type of the first client device.
- the above-mentioned server (which can be recorded as KMS) can be understood as a background server that provides users with a platform for transaction data processing and other services related to the use of key components.
- the aforementioned server may be a backend server of a certain online payment platform.
- the servers listed above are only schematic illustrations. During specific implementation, the server may also be other types of electronic devices, or software programs running in the electronic devices, and so on. This manual does not limit the specific form and type of the server.
- the key used for subsequent transaction data processing may be split into two key components and stored on the server and the client device, respectively.
- the server and the client device can separately store a part of the key components.
- the server and the client device are required to provide their own key components to perform specific transaction data processing. For example, it is necessary to use the key components kept by the above two sides at the same time to call the fund data in the user's account and complete the transaction. In this way, even if a third party steals any of the key components kept by the server and the client, the user's account cannot be called, thereby improving the security of the user's transaction data processing.
- the foregoing server may store the first key component
- the second client device may store the second key component.
- the server and the second client device are required to separately store the first key component (which can be recorded as sk1) and the second key component (which can be recorded as sk2) as inputs to perform operations.
- Generate the corresponding transaction signature and then use the transaction signature as a voucher to complete the corresponding transaction data processing.
- the above transaction signature also called public key digital signature or electronic signature, etc.
- the aforementioned transaction signature may be a character string corresponding to the user's identity and not easy to forge.
- the user wants to smoothly and securely migrate the second key component originally stored in the second client device to the first client device.
- the above method may include the following content:
- S11 The first client device initiates a key migration request.
- the above key migration request can be specifically understood as a type for a second client device that stores a second key component, and is used to instruct to migrate the stored second key component to the first client.
- Request data of the end device can be specifically understood as a type for a second client device that stores a second key component, and is used to instruct to migrate the stored second key component to the first client.
- the first client device may also communicate with the server first to verify that the login uses the first Whether the user of the client device is the same as the user who uses the second client device. That is, it is determined whether the account of the user logging in to the first client device is the same as the account of the user on the second client terminal, and the account of the user logging in to the first client device is the same as the account of the user on the second client terminal. In this case, a key migration request is initiated to the second client device and the server.
- the first client device before the first client device initiates the key migration request, when the method is specifically implemented, it may further include the following content:
- S1 The first client device receives a key migration instruction
- the first client device verifies the identity information of the account logging in to the first client device in response to the key migration instruction, and verifies the identity information of the account logging in to the first client device and the second client device. In the case that the identity information of the account on the device matches, the key migration request is initiated.
- the above key migration instruction can be specifically understood as the instruction data sent by the user through the first client device to instruct the migration of the second key component to the first client device.
- the user can log in to his account on the first client device, and generate the above-mentioned key migration instruction by clicking the key migration icon displayed on the account page and the like.
- the first client device may receive the foregoing operation, and determine the key migration instruction according to the foregoing operation.
- the first client device may first verify the identity information of the account that logs in to the first client device. Specifically, the first client device may obtain the account number or account name used by the user when logging in, and the identity information of the account such as the login key entered when logging in; and then save the identity information of the above account with the second client The identity information of the accounts on the client device is compared.
- the account of the first client device is determined The identity information matches the identity information of the account on the second client device, that is, it is determined that the account that is currently logged in to the first client device and requires key migration is the same account that was previously logged in and used the second client device, and then can initiate Key migration request.
- the identity information of the accounts of the two client devices are different or the difference value is relatively large, and is greater than a certain preset difference threshold, the identity information of the account logging in the first client device is determined to be the same as that of the second client device.
- the identity information of the account on the computer does not match, that is, it is determined that the account that is currently logged in to the first client device and requires key migration is not the same account that was previously logged in and used the second client device. It is determined that the received key migration instruction may not Legal, the user who issued the instruction may not have the right to request key migration. At this time, in order to protect the security of the user's account, the first client device may not initiate a key migration request. At the same time, a prompt message can be displayed to the user to prompt the user to confirm that the identity information of the entered account is correct, and then trigger the key migration instruction.
- S12 The server and the second client device respond to the key migration request, call the stored first key component and the second key component as input, and perform function operations according to preset rules to obtain The third key component and the fourth key component; wherein the server obtains and saves the third key component, and the second client device obtains and saves the fourth key component.
- the foregoing preset rule can be specifically understood as a data processing rule generated in advance according to the Secure Multi-Party Computation (MPC) protocol.
- MPC Secure Multi-Party Computation
- the above-mentioned MPC protocol can be specifically understood as a secure computing protocol based on cryptography, where the participating parties input their own information and data locally and jointly participate in calculations without sharing their data with each other.
- MPC nodes that can participate in MPC operations may be set in advance on both sides of the second client device and the server.
- the MPC node preset on the second client device and the MPC node preset on the server can use the data saved on both sides of the second client device and the server as input respectively to participate in the common Function calculations to obtain calculation results, but during the calculation process, the other party can prevent the other party from obtaining the data entered by himself, thereby effectively preventing the data stored by each from being leaked or stolen, and protecting the privacy and security of data on each side.
- the server and the second client device respond to the key migration request, call the first key component and the second key component separately saved as input, and perform the process according to preset rules. Function calculations to obtain the third key component and the fourth key component.
- it may include: the server and the second client device receive and respond to the key migration request, by presetting the server one The MPC node on the side calls the first key component stored in the server as input, and at the same time, the second key component stored in the second client device is called as the input by the MPC node preset on the second client device side.
- the server can obtain an operation result, and according to the operation result, obtain a new key component, that is, the third key component (can Denoted as sk1'), at the same time, the second client device can also obtain an operation result, and obtain another new key component according to the operation result, namely the fourth key component (can be denoted as sk2').
- the third key component can Denoted as sk1'
- the second client device can also obtain an operation result, and obtain another new key component according to the operation result, namely the fourth key component (can be denoted as sk2').
- the second client device and the server may generate the third key component and the fourth key component in the following manner: MPC(sk1,sk2)->(sk1',sk2' ).
- the above-mentioned MPC() may specifically represent a function operation performed according to a preset rule based on the MPC protocol.
- the third key component and the fourth key component are a new group of key components that are different from the first key component and the second key component, but because the third key component And the fourth key component are a set of key components obtained by function operations based on preset rules according to the first key component and the second key component. Therefore, according to the third key component and the fourth key component The generated transaction signature is consistent with the transaction signature generated according to the first key component and the second key component. Subsequently, the aforementioned third key component and fourth key component can be used to replace the previously used first key component and second key component to generate a user's transaction signature, and perform corresponding transaction data processing.
- the server may store the third key component locally on the server after obtaining the above-mentioned third key component.
- the second client device may store the fourth key component locally in the second client device. The server cannot obtain the fourth key component, and the second client device cannot obtain the third key component.
- the second client device obtains the first public key generated by the first client device, where the first client device is used to generate a first public key and a first private key that match each other.
- the first public key and the first private key may specifically be a set of mutually matched key pairs generated by the first client device, and the key pairs may be used for data processing such as subsequent data encryption. .
- the first client device may respond to the key migration request and generate the first public key and the first private key that match each other through key generation methods such as re-encryption. Furthermore, the second client device can obtain the first public key therein, and the first client device saves the corresponding first private key.
- the first client device may generate the first public key and the first private key in the following manner: keyGen()->(pk_n,sk_n).
- keyGen() may be specifically expressed as a key generation formula
- pk_n may be specifically expressed as the first public key
- sk_n may be specifically expressed as the first private key.
- the above-mentioned second client device may obtain the first public key generated by the first client device in multiple ways. Specifically, the second client device may determine the first public key by querying information such as the device identification of the first client device. It is also possible that the first client device directly sends the first public key to the second client device, and the second client device receives the above-mentioned first public key and so on.
- the first client device and the second client device can be electronic devices with cameras such as mobile phones or tablets used by users, in order to take into account the data security in the public key transmission process, and also for convenience
- the user operation may be that the first client device first generates the corresponding preset two-dimensional code according to the first public key. Then, the preset two-dimensional code is displayed to the second client device, so that the second client device can scan and obtain the preset two-dimensional code through a camera. After obtaining the foregoing preset two-dimensional code, the second client device may further perform analysis processing on the preset two-dimensional code to extract the first public key therein.
- the second client device generates first ciphertext data according to the first public key and the fourth key component, and sends the first ciphertext to the first client device.
- the transmission security is improved.
- the fourth key component may be encrypted in an encryption manner that can be decrypted by the first client device, and then sent to the first client device.
- the second client device can use the first public key generated by the first client device to encrypt the fourth key component to obtain the encrypted fourth key component, that is, the first public key.
- a ciphertext data is sent to the first client device through a wired or wireless transmission method.
- the second client device may perform encryption processing on the fourth key component in the following manner: Enc(pk_n,sk2')->cxt.
- Enc may specifically represent an encryption operation
- cxt may specifically represent the first ciphertext data.
- the first client device uses the first private key to decrypt the first ciphertext data to obtain the fourth key component.
- the first client device may further decrypt the first ciphertext data using the stored first private key to obtain the fourth key component, This completes the migration of key components between different client devices.
- the user's transaction signature can be generated by the first client device and the server using the fourth key component and the third key component respectively stored thereafter, and corresponding transaction data processing can be performed.
- the foregoing first client device may perform decryption processing in the following manner to obtain the fourth key component: Dec(sk_n,sk2')->sk2'.
- the aforementioned Dec() can be specifically expressed as a decryption operation.
- the second client device and the server call and save in the two respectively according to preset rules generated based on the MPC protocol.
- the second key component and the first key component on the other side perform functional operations to generate a new key component, that is, the fourth key component and the third key component to replace the previously used second key component and first key component.
- the key component; the newly generated fourth key component is encrypted and sent to the first client device to realize the migration of the key component between different client devices, thereby solving the key migration in the existing method
- the technical problem of insecurity and easy leakage achieves the technical effect of safely and efficiently migrating the key components stored by the second client device to the first client device.
- the key components used are updated while the key components are being migrated.
- the first client device uses the first private key to decrypt the first ciphertext data to obtain the fourth key component, when the method is specifically implemented, It can also include the following:
- S1 The first client device sends confirmation information of the fourth key component to the second client device and the server;
- the second client device destroys the stored second key component and the fourth key component in response to the confirmation information; the server destroys the stored first key in response to the confirmation information Weight.
- the first client device after the first client device obtains and saves the foregoing fourth key component, it can determine that the fourth key component has been successfully migrated, and the first client device can subsequently be used to replace the previously used second client device.
- the device and the server process the user's transaction data together. That is, the second client device will no longer participate in the transaction data processing of the user subsequently, and the second client device no longer needs to store the second key component and the fourth key component.
- the first client device can generate And send the confirmation information of the fourth key component to the second client.
- the second client device can respond to the confirmation message by destroying the second key component and the fourth key component originally stored in the second client device to avoid subsequent second secrets.
- the key component and the fourth key component may be leaked or stolen through the second client device that is not in use, so that the user's transaction data processing security can be further improved.
- the new set of key components, the third key component and the fourth key component will be used to replace the second key component of the first key component used before.
- the first key component stored locally on the server will not be used later.
- the first client device may also send the above confirmation information to the server. After receiving the confirmation information, the server can respond to the confirmation information and destroy the first key component originally stored locally on the server.
- the first client device uses the first private key to decrypt the first ciphertext data to obtain the fourth key component
- the method may also include the following content: a user initiates a transaction data processing request through the first client device; the first client device and the server respond to the transaction data processing request, call and store the fourth key according to the Component and the third key component to generate a transaction signature; the first client device performs transaction data processing according to the transaction signature.
- the used key components are also updated. That is, the subsequent first client device and server will use the newly generated fourth key component and third key component to replace the previously used second key component and first key component to generate a transaction signature, and perform specific Transaction data processing can also improve the security of transaction data processing from another dimension.
- the key migration method provided by the embodiments of the present application, because the solution introduces the MPC-based data processing method, the second client device and the server generate preset data based on the MPC protocol.
- the rule is to call the second key component and the first key component stored on both sides, and perform function operations to generate a new key component, that is, the fourth key component and the third key component to replace the first used key component.
- Two key components and the first key component; the newly generated fourth key component is encrypted and sent to the first client device to realize the migration of the key component between different client devices, thereby solving the existing
- the technical problem of insecure and easy leakage of key migration in the method achieves the technical effect of safely and efficiently migrating the key components stored by the second client device to the first client device.
- the update of the used key components is completed; after obtaining the fourth key component, the first client device sends the confirmation information to the second client device so that The second client device can destroy the stored second key component and the fourth key component in time according to the above confirmation information, avoiding the second key component and the fourth key component stored locally by the second client device
- the subsequent leakage or theft further improves the security of user key data.
- the embodiment of the present application also provides another key migration method.
- the key migration method provided in the embodiment of the present application can be specifically applied to the second client device.
- the second client device stores the second key component.
- the method can include the following:
- S31 Receive and respond to the key migration request, and the server calls the separately stored second key component and the first key component as input, and performs function operations according to preset rules to obtain and save the fourth key component , Wherein the server obtains and saves the third key component;
- S32 Obtain a first public key generated by a first client device, where the first client device is used to generate a first public key and a first private key that match each other;
- S33 Generate first ciphertext data according to the first public key and the fourth key component, and send the first ciphertext to the first client device, where the first client The device is configured to use the first private key to decrypt the first ciphertext data to obtain the fourth key component.
- the foregoing acquisition of the first public key generated by the first client device may include the following content during specific implementation:
- S1 Scan to obtain the preset QR code generated by the first client device
- the above-mentioned method of obtaining the first public key is only a schematic illustration. During specific implementation, according to specific conditions and processing requirements, other suitable methods may also be used to obtain the first public key. In this regard, this manual is not limited.
- the embodiment of the present application also provides another key migration method.
- the key migration method provided in the embodiment of the present application can be specifically applied to the first client device.
- the method may include the following:
- S41 Initiate a key migration request, and generate a first public key and a first private key;
- S42 Receive the first ciphertext data sent by the second client device, where the first ciphertext data is obtained by the second client device using the first public key to encrypt the fourth key component ,
- the fourth key component is that the second client device and the server respond to the key migration request and call the separately saved second key component and the first key component as input, according to a preset rule , Perform function operation, get;
- an embodiment of the present application also provides a key migration device, as described in the following embodiment. Since the principle of the key migration device to solve the problem is similar to the key migration method, the implementation of the key migration device can refer to the implementation of the key migration method, and the repetition will not be repeated.
- the term "unit” or "module” can be a combination of software and/or hardware that implements predetermined functions.
- the devices described in the following embodiments are preferably implemented by software, hardware or a combination of software and hardware is also possible and conceived. Please refer to the content shown in FIG. 5, which is a structural diagram of a key migration device provided by an embodiment of the present application.
- the device may specifically include: a first processing module 501, an acquisition module 502, and a second processing module 503. The structure is described in detail.
- the first processing module 501 can be specifically used to receive and respond to the key migration request, and the server to call the separately stored second key component and the first key component as input, and perform function operations according to preset rules, Obtaining and storing the fourth key component, wherein the server obtains and stores the third key component;
- the obtaining module 502 may be specifically used to obtain a first public key generated by a first client device, where the first client device is used to generate a first public key and a first private key that match each other;
- the second processing module 503 may be specifically configured to generate first ciphertext data according to the first public key and the fourth key component, and send the first ciphertext to the first client device, Wherein, the first client device is configured to use the first private key to decrypt the first ciphertext data to obtain the fourth key component.
- the aforementioned preset rule may specifically be a data processing rule generated in advance according to the MPC protocol.
- the above-mentioned obtaining module 502 may specifically include the following structural units:
- the scanning unit may be specifically used to scan and obtain a preset QR code generated by the first client device
- the parsing unit may be specifically used to analyze the preset two-dimensional code to obtain the first public key.
- the device further includes a destruction module, which can be specifically used to receive and respond to the confirmation information of the fourth key component of the first client device, and destroy the stored second key component and the fourth key. Weight.
- adjectives such as first and second can only be used to distinguish one element or action from another element or action, without requiring or implying any actual relationship or order. Where circumstances permit, the reference element or component or step (etc.) should not be interpreted as being limited to only one of the element, component, or step, but may be one or more of the element, component, or step.
- the key migration device performs specific processing due to the introduction of preset rules generated based on the MPC protocol, and the second client device and the server perform specific processing based on the MPC protocol.
- the generated preset rules call the second key component and the first key component stored on both sides, and perform function operations to generate new key components, namely the fourth key component and the third key component. Replace the original second key component and the first key component; then encrypt the newly generated fourth key component and send it to the first client device to realize the migration of the key component between different client devices. Therefore, the technical problem of insecure and easy leakage of key migration in the existing method is solved, and the technical effect of safely and efficiently migrating the key component stored by the second client device to the first client device is achieved.
- the embodiment of the present application also provides an electronic device.
- the electronic device may specifically include an input device 61, processing ⁇ 62, memory 63.
- the input device 61 may be specifically used to receive a key migration request.
- the processor 62 may be specifically configured to respond to the key migration request, and to call the second key component and the first key component stored separately by the server as input, perform function operations according to preset rules, and obtain and save The fourth key component, wherein the server obtains and saves the third key component; obtains the first public key generated by the first client device, wherein the first client device is used to generate a first A public key and a first private key; generating first ciphertext data according to the first public key and the fourth key component, and sending the first ciphertext to the first client device, wherein, The first client device is configured to use the first private key to decrypt the first ciphertext data to obtain the fourth key component.
- the memory 63 may be specifically used to store program instructions on which the processor 62 is based.
- the input device may specifically be one of the main devices for information exchange between the user and the computer system.
- the input device may include a keyboard, a mouse, a camera, a scanner, a light pen, a handwriting input board, a voice input device, etc.; the input device is used to input raw data and programs for processing these numbers into the computer.
- the input device can also obtain and receive data transmitted from other modules, units, and devices.
- the processor can be implemented in any suitable way.
- the processor may take the form of a microprocessor or a processor and a computer-readable medium, logic gates, switches, application specific integrated circuits ( Application Specific Integrated Circuit (ASIC), programmable logic controller and embedded microcontroller form, etc.
- ASIC Application Specific Integrated Circuit
- the memory may specifically be a memory device used to store information in modern information technology.
- the memory can include multiple levels. In a digital system, as long as it can store binary data, it can be a memory; in an integrated circuit, a circuit with a storage function without a physical form is also called a memory, such as RAM, FIFO, etc.; In the system, storage devices in physical form are also called memory, such as memory sticks, TF cards, etc.
- the embodiment of the present application also provides a computer storage medium based on the key migration method, the computer storage medium stores computer program instructions, which are implemented when the computer program instructions are executed: receiving and responding to a key migration request, and
- the server calls the separately saved second key component and the first key component as input, performs function operations according to preset rules, and obtains and saves the fourth key component.
- the server obtains and saves the third key component.
- Component obtain a first public key generated by a first client device, where the first client device is used to generate a first public key and a first private key that match each other; according to the first public key and the The fourth key component generates the first ciphertext data, and sends the first ciphertext to the first client device, wherein the first client device is configured to use the first private key to The first ciphertext data is decrypted to obtain the fourth key component.
- the above-mentioned storage medium includes but is not limited to random access memory (Random Access Memory, RAM), read-only memory (Read-Only Memory, ROM), cache (Cache), and hard disk (Hard Disk Drive, HDD) Or memory card (Memory Card).
- the memory can be used to store computer program instructions.
- the network communication unit may be an interface set up in accordance with a standard stipulated by the communication protocol and used for network connection communication.
- the devices or modules described in the above embodiments may be specifically implemented by computer chips or entities, or implemented by products with certain functions.
- the functions are divided into various modules and described separately.
- the function of each module can be implemented in the same one or more software and/or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules.
- the device embodiments described above are merely illustrative.
- the division of the modules is only a logical function division, and there may be other divisions in actual implementation, for example, multiple modules or components can be combined or integrated. To another system, or some features can be ignored, or not implemented.
- controllers in addition to implementing the controller in a purely computer-readable program code manner, it is entirely possible to program the method steps to make the controller use logic gates, switches, application specific integrated circuits, programmable logic controllers and embedded The same function can be realized in the form of a microcontroller, etc. Therefore, such a controller can be regarded as a hardware component, and the devices included in the controller for realizing various functions can also be regarded as a structure within the hardware component. Or even, the device for realizing various functions can be regarded as both a software module for realizing the method and a structure within a hardware component.
- program modules include routines, programs, objects, components, data structures, classes, etc. that perform specific tasks or implement specific abstract data types.
- This application can also be practiced in distributed computing environments. In these distributed computing environments, remote processing devices connected through a communication network perform tasks.
- program modules can be located in local and remote computer storage media including storage devices.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Telephonic Communication Services (AREA)
Abstract
本申请实施例提供了一种密钥迁移方法和装置,其中,该方法通过第二客户端设备和服务器根据基于MPC协议生成的预设的规则,调用分别保存于第二客户端设备和服务器两侧的第二密钥分量和第一密钥分量,进行函数运算以生成新的密钥分量,即第四密钥分量和第三密钥分量来替换原有的第二密钥分量和第一密钥分量;再将新生成的第四密钥分量加密后发送给第一客户端设备,实现密钥分量在不同客户端设备之间的迁移,从而解决了现有方法中存在的密钥迁移不安全、容易泄漏的技术问题,达到了安全、高效地将第二客户端设备所保存的密钥分量迁移到第一客户端设备的技术效果。
Description
本申请涉及互联网技术领域,特别涉及一种密钥迁移方法和装置。
随着互联网技术的发展和普及,越来越多的用户开始***板电脑等)完成相关的交易数据处理。例如,使用手机进行线上购物或者支付线下账单等。
为了保证用户能够拥有对自己账户中资金数据使用的控制权,往往会由用户所使用的或者与用户账户绑定的客户端设备保存一个密钥分量。在响应用户指示,进行交易数据处理时,需要用户通过该客户端设备提供所保存的密钥分量,才能生成对应该用户的交易签名,进而才可以以该交易签名作为凭证,顺利调用用户的账户中的资金数据,完成具体的交易数据处理。
如果用户更换自己所使用的或者绑定的客户端设备,在新的客户端设备上往往还没有上述密钥分量。例如,用户甲之前一直使用绑定了自己账户的手机A进行交易数据处理,在手机A本地保存有用于生成交易签名的密钥分量。当用户甲更换使用新买的手机B时,虽然可以在手机B上登录自己的账户,但是开始时手机B上并没有保存在手机A上的密钥分量。这时用户甲还无法直接利用手机B生成交易签名,进行交易数据处理的。因此,需要先将该密钥分量从手机A迁移到手机B中。
但现有的密钥迁移方法相对较简单,大多是通过之前使用的客户端设备(例如手机A)直接将所保存的密钥分量发送至新的客户端设备(例如手机B)。在发送、传输的过程中上述密钥分量很容易被泄漏或者被第三方窃取。即,现有的密钥迁移方法具体实施时,往往存在密钥迁移不安全、容易泄漏的技术问题。
针对上述问题,目前尚未提出有效的解决方案。
发明内容
本申请实施例提供了一种密钥迁移方法和装置,以解决密钥迁移不安全、容易泄漏的技术问题。
本申请实施例提供了一种密钥迁移方法,所述方法应用于包含有第一客户端设备、第二客户端设备和服务器的***中,其中,所述第二客户端设备保存有第二密钥分量, 所述服务器保存有第一密钥分量,所述方法包括:
所述第一客户端设备发起密钥迁移请求;
所述服务器和所述第二客户端设备响应所述密钥迁移请求,调用分别保存的第一密钥分量和第二密钥分量作为输入,根据预设的规则,进行函数运算,得到第三密钥分量和第四密钥分量;其中,所述服务器获取并保存所述第三密钥分量,所述第二客户端设备获取并保存第四密钥分量;
所述第二客户端设备获取第一客户端设备生成的第一公钥,其中,所述第一客户端设备用于生成相互匹配的第一公钥和第一私钥;
所述第二客户端设备根据所述第一公钥和所述第四密钥分量,生成第一密文数据,并将所述第一密文发送至所述第一客户端设备;
所述第一客户端设备利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。
在一个实施例中,所述预设的规则为预先根据MPC协议生成的。
在一个实施例中,在所述第一客户端设备利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量后,所述方法还包括:
所述第一客户端设备向所述第二客户端设备和所述服务器发送第四密钥分量的确收信息;
所述第二客户端设备响应所述确收信息,销毁所保存的第二密钥分量和第四密钥分量;所述服务器响应所述确收信息,销毁所保存的第一密钥分量。
在一个实施例中,在所述第一客户端设备利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量后,所述方法还包括:
用户通过所述第一客户端设备发起交易数据处理请求;
所述第一客户端设备和所述服务器响应所述交易数据处理请求,调用并根据分别保存的第四密钥分量和第三密钥分量,生成交易签名;
所述第一客户端设备根据所述交易签名,进行交易数据处理。
在一个实施例中,在所述第一客户端设备发起密钥迁移请求前,所述方法还包括:
所述第一客户端设备接收密钥迁移指令;
所述第一客户端设备响应所述密钥迁移指令,对登录第一客户端设备的账户的身份信息进行验证,在验证登录第一客户端设备的账户的身份信息与第二客户端设备上的账户的身份信息匹配的情况下,发起所述密钥迁移请求。
本申请实施例还提供了一种密钥迁移方法,所述方法应用于第二客户端设备,所述第二客户端设备保存有第二密钥分量,所述方法包括:
接收并响应所述密钥迁移请求,和服务器调用分别保存的第二密钥分量和第一密钥分量作为输入,根据预设的规则,进行函数运算,得到并保存第四密钥分量,其中,所述服务器得到并保存第三密钥分量;
获取第一客户端设备生成的第一公钥,其中,所述第一客户端设备用于生成相互匹配的第一公钥和第一私钥;
根据所述第一公钥和所述第四密钥分量生成第一密文数据,并将所述第一密文发送至所述第一客户端设备,其中,所述第一客户端设备用于利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。
在一个实施例中,获取第一客户端设备生成的第一公钥,包括:
扫描获取第一客户端设备生成的预设二维码;
解析所述预设二维码,得到所述第一公钥。
本申请实施例还提供了一种密钥迁移方法,所述方法应用于第一客户端设备,所述方法包括:
发起密钥迁移请求,并生成第一公钥和第一私钥;
接收第二客户端设备发送的第一密文数据,其中,所述第一密文数据为所述第二客户端设备利用所述第一公钥对第四密钥分量进行加密处理得到的,所述第四密钥分量为所述第二客户端设备和服务器响应所述密钥迁移请求,调用分别保存的第二密钥分量和第一密钥分量作为输入,根据预设的规则进行函数运算得到的;
利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。
本申请实施例还提供了一种密钥迁移装置,包括:
第一处理模块,用于接收并响应所述密钥迁移请求,和服务器调用分别保存的第二密钥分量和第一密钥分量作为输入,根据预设的规则,进行函数运算,得到并保存第四密钥分量,其中,所述服务器得到并保存第三密钥分量;
获取模块,用于获取第一客户端设备生成的第一公钥,其中,所述第一客户端设备用于生成相互匹配的第一公钥和第一私钥;
第二处理模块,用于根据所述第一公钥和所述第四密钥分量生成第一密文数据,并将所述第一密文发送至所述第一客户端设备,其中,所述第一客户端设备用于利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。
本申请实施例还提供了一种计算机可读存储介质,其上存储有计算机指令,所述指令被执行时实现接收并响应所述密钥迁移请求,和服务器调用分别保存的第二密钥分量和第一密钥分量作为输入,根据预设的规则,进行函数运算,得到并保存第四密钥分量,其中,所述服务器得到并保存第三密钥分量;获取第一客户端设备生成的第一公钥,其中,所述第一客户端设备用于生成相互匹配的第一公钥和第一私钥;根据所述第一公钥和所述第四密钥分量生成第一密文数据,并将所述第一密文发送至所述第一客户端设备,其中,所述第一客户端设备用于利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。
在本申请实施例中,由于该方案通过引入基于MPC协议生成的预设的规则,由第二客户端设备和服务器先根据上述预设的规则,调用分别保存于第二客户端设备和服务器两侧的第二密钥分量和第一密钥分量,进行函数运算以生成新的密钥分量,即第四密钥分量和第三密钥分量来替换原先使用的第二密钥分量和第一密钥分量;再将新生成的第四密钥分量加密后发送给第一客户端设备,实现密钥分量在不同客户端设备之间的迁移,从而解决了现有方法中存在的密钥迁移不安全、容易泄漏的技术问题,达到了安全、高效地将第二客户端设备所保存的密钥分量迁移到第一客户端设备的技术效果。
为了更清楚地说明本申请实施例或现有技术中的技术方案,下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍,显而易见地,下面描述中的附图仅仅是本申请中记载的一些实施例,对于本领域普通技术人员来讲,在不付出创造性劳动性的前提下,还可以根据这些附图获得其他的附图。
图1是根据本申请实施方式提供的密钥迁移方法的处理流程图;
图2是在一个场景示例中应用本申请实施例提供的密钥迁移方法的示意图;
图3是根据本申请实施方式提供的密钥迁移方法的处理流程图;
图4是根据本申请实施方式提供的密钥迁移方法的处理流程图;
图5是根据本申请实施方式提供的密钥迁移装置的组成结构图;
图6是基于本申请实施例提供的密钥迁移方法的电子设备组成结构示意图。
为了使本技术领域的人员更好地理解本申请中的技术方案,下面将结合本申请实施 例中的附图,对本申请实施例中的技术方案进行清楚、完整地描述,显然,所描述的实施例仅仅是本申请一部分实施例,而不是全部的实施例。基于本申请中的实施例,本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例,都应当属于本申请保护的范围。
考虑到现有的密钥迁移方法往往设计相对较为简单,导致密钥在迁移传输的过程中很容易出现泄漏,或者被窃取的情况,甚至造成用户损失。即,现有的密钥迁移方法具体实施时往往存在密钥迁移不安全、容易泄漏的技术问题。
针对产生上述技术问题的根本原因,本申请考虑可以引入基于MPC(即安全多方计算)的处理方式来提高密钥迁移的安全性。具体的,可以先由第二客户端设备和服务器根据基于MPC协议生成的预设的规则,调用分别保存于两侧的第二密钥分量和第一密钥分量,共同进行函数运算以生成新的密钥分量,即第四密钥分量和第三密钥分量,来替换原先使用的第二密钥分量和第一密钥分量;再将新生成的第四密钥分量加密后发送给第一客户端设备,实现密钥分量在不同客户端设备之间的迁移,从而解决了现有方法中存在的密钥迁移不安全、容易泄漏的技术问题,达到了安全、高效地将第二客户端设备所保存的密钥分量迁移到第一客户端设备的技术效果。
基于上述思考思路,本申请实施例提供了一种密钥迁移方法。具体请参阅图1所示的根据本申请实施方式提供的密钥迁移方法的处理流程图。本申请实施例提供的密钥迁移方法,具体可以应用于包含有第一客户端设备、第二客户端设备和服务器的***中。
其中,上述第二客户端设备(可以记为client2)具体可以理解为一种保存有待迁移的密钥分量(例如第二密钥分量)的客户端设备。例如,可以是用户之前使用的,或者之前绑定了用户的账户的手机或平板电脑等。当然,需要说明的是,上述所列举的第二客户端设备只是一种示意性说明。具体实施时,上述第二客户端设备还可以是其他类型的电子设备,或者运行于上述电子设备中的软件程序等等。对于第二客户端设备的具体形式、类型,本说明书不作限定。
上述第一客户端设备(可以记为client1)具体可以理解为一种待迁移的密钥分量所要迁移的目标设备。例如,可以是用户新更换使用的手机或平板电脑等。类似的,需要说明的是,上述所列举的第一客户端设备只是一种示意性说明。具体实施时,上述第一客户端设备还可以是其他类型的电子设备,或者运行于上述电子设备中的软件程序等等。对于第一客户端设备的具体形式、类型,本说明书不作限定。
上述服务器具体(可以记为KMS)可以理解为一种为用户提供交易数据处理等涉及 密钥分量使用业务的平台的后台服务器。例如,上述服务器可以是某网络支付平台的后台服务器等。当然,需要说明的是,上述所列举的服务器只是一种示意性说明。具体实施时,上述服务器还可以是其他类型的电子设备,或者运行于上述电子设备中的软件程序等等。对于服务器的具体形式、类型,本说明书不作限定。
在本实施例中,为了保证用户交易数据处理的安全,可以将用于后续交易数据处理的密钥拆分成两部分的密钥分量分别存储于服务器和客户端设备上。服务器和客户端设备可以分别保管一部分的密钥分量,后续在响应用户指令,进行交易数据处理时,需要服务器和客户端设备一起提供各自所保管的密钥分量,才能进行具体的交易数据处理。例如,需要同时利用上述两侧各自保管的密钥分量,才能调用用户的账户中的资金数据,完成交易。这样即使第三方窃取到了服务器和客户端各自保管的密钥分量中的任意一个,也无法调用用户的账户,从而可以提高用户的交易数据处理的安全性。
在本实施例中,上述服务器可以存储有第一密钥分量,第二客户端设备可以存储第二密钥分量。具体进行交易数据处理时,需要服务器和第二客户端设备分别将各自所保存的第一密钥分量(可以记为sk1)和第二密钥分量(可以记为sk2)作为输入进行运算,才能生成对应的交易签名,进而可以以该交易签名作为凭证,完成相应的交易数据处理。其中,上述交易签名(也可以称为公钥数字签名或电子签章等)具体可以理解为是一种基于公钥加密技术,用于证明用户身份的数字签名。具体的,上述交易签名可以是一段与用户身份对应,且不易伪造的字符串。在进行具体的交易数据处理时,例如,可以根据上述交易签名,验证用户的身份,并调用用户账户中的资金数据进行具体的交易数据处理。
在本实施例中,用户想要将原本保存于第二客户端设备的第二密钥分量顺利、安全地迁移到第一客户端设备。具体可以参阅图2所示的在一个场景示例中应用本申请实施例提供的密钥迁移方法的示意图,具体实施时,上述方法可以包括以下内容:
S11:所述第一客户端设备发起密钥迁移请求。
在本实施例中,上述密钥迁移请求具体可以理解为一种针对存储有第二密钥分量的第二客户端设备的,用于指示将所存储的第二密钥分量迁移到第一客户端设备的请求数据。
在一个实施例中,为了进一步提高用户交易数据处理的安全性,在第一客户端设备发起密钥迁移请求前,第一客户端设备还可以先与服务器进行通信,以验证确定登录使用第一客户端设备的用户与使用第二客户端设备的用户身份是否一致。即确定登录第一 客户端设备的用户的账户是否与第二客户端上的用户的账户是否相同,在确定登录第一客户端设备的用户的账户与第二客户端上的用户的账户相同的情况下,再向第二客户端设备和服务器发起密钥迁移请求。
在一个实施例中,在所述第一客户端设备发起密钥迁移请求前,所述方法具体实施时,还可以包括以下内容:
S1:所述第一客户端设备接收密钥迁移指令;
S2:所述第一客户端设备响应所述密钥迁移指令,对登录第一客户端设备的账户的身份信息进行验证,在验证登录第一客户端设备的账户的身份信息与第二客户端设备上的账户的身份信息匹配的情况下,发起所述密钥迁移请求。
在本实施例中,上述密钥迁移指令具体可以理解为用户通过第一客户端设备发出的用于指示将第二密钥分量迁移至第一客户端设备的指令数据。
具体的,例如,用户可以在第一客户端设备上登录自己的账户,并通过点击账户页面中所展示的密钥迁移图标等操作以生成上述密钥迁移指令。第一客户端设备可以接收到上述操作,并根据上述操作确定出密钥迁移指令。
在本实施例中,第一客户端设备在接收到上述密钥迁移指令后,可以先对登录第一客户端设备的账户的身份信息进行验证。具体的,第一客户端设备可以获取用户登录时所使用的账户编号或者账户名称,以及登录时所输入的登录密钥等账户的身份信息;再将上述账户的身份信息与保存在第二客户端设备上的账户的身份信息进行比较,在上述两个客户端设备的账户的身份信息相同或者差异值相对较小,小于某一预设差异阈值时,确定登录第一客户端设备的账户的身份信息与第二客户端设备上的账户的身份信息匹配,即确定当前登录第一客户端设备并要求密钥迁移的账户与之前登录使用第二客户端设备的账户为同一账户,进而可以发起密钥迁移请求。相对的,在上述两个客户端设备的账户的身份信息不同或者差异值相对较大,大于某一预设差异阈值时,确定登录第一客户端设备的账户的身份信息与第二客户端设备上的账户的身份信息不匹配,即确定当前登录第一客户端设备并要求密钥迁移的账户与之前登录使用第二客户端设备的账户不是同一账户,判断所接收的密钥迁移指令可能不合法,发出该指令的用户可能无权要求进行密钥迁移。这时为了保护用户的账户安全,第一客户端设备可以不发起密钥迁移请求。同时,还可以向用户展示提示信息,以提示用户请确认所输入的账户的身份信息准确无误后,再触发密钥迁移指令。
S12:所述服务器和所述第二客户端设备响应所述密钥迁移请求,调用分别保存的第 一密钥分量和第二密钥分量作为输入,根据预设的规则,进行函数运算,得到第三密钥分量和第四密钥分量;其中,所述服务器获取并保存所述第三密钥分量,所述第二客户端设备获取并保存第四密钥分量。
在一个实施例中,上述预设的规则具体可以理解为一种预先根据MPC(Secure Multi-Party Computation,安全多方计算)协议等生成的数据处理规则。其中,上述MPC协议具体可以理解为一种基于密码学,参与各方在不互相泄露各自数据的前提下,分别在本地输入各自所拥有的信息数据,共同参与运算的安全计算协议。
具体实施时,根据上述基于MPC协议的预设的规则,可以预先在第二客户端设备和服务器两侧分别设置能够参与MPC运算的MPC节点。具体进行函数运算时,预设于第二客户端设备上的MPC节点和预设于服务器上的MPC节点可以分别以第二客户端设备和服务器两侧所各自保存的数据作为输入,参与共同的函数运算,得到运算结果,但在运算的过程可以避免对方获取自己输入的数据,进而可以有效地避免各自所保存的数据遭到泄露或窃取,保护各侧数据的隐私安全。
在本实施例中,所述服务器和所述第二客户端设备响应所述密钥迁移请求,调用分别保存的第一密钥分量和第二密钥分量作为输入,根据预设的规则,进行函数运算,得到第三密钥分量和第四密钥分量,具体实施时,可以包括:所述服务器和所述第二客户端设备接收并响应所述密钥迁移请求,通过预设在服务器一侧的MPC节点调用在服务器所保存的第一密钥分量作为输入,同时,通过预设在第二客户端设备一侧的MPC节点调用在第二客户端设备所保存的第二密钥分量作为输入,根据基于MPC协议的预设的规则,共同进行函数运算;通过上述函数运算,服务器可以得到一个运算结果,并根据该运算结果得到一个新的密钥分量,即第三密钥分量(可以记为sk1’),同时,第二客户端设备也可以得到一个运算结果,并根据该运算结果得到另一个新的密钥分量,即第四密钥分量(可以记为sk2’)。
具体的,例如,可以参阅图2所示,第二客户端设备和服务器可以按照以下方式生成第三密钥分量和第四密钥分量:MPC(sk1,sk2)->(sk1’,sk2’)。其中,上述MPC()具体可以表示根据基于MPC协议的预设的规则进行的函数运算。
在本实施例中,上述第三密钥分量和第四密钥分量是一组不同于第一密钥分量和第二密钥分量的新的一组密钥分量,但由于第三密钥分量和第四密钥分量是根据第一密钥分量和第二密钥分量通过基于预设的规则的函数运算得到的一组密钥分量,因此,根据第三密钥分量和第四密钥分量生成的交易签名与根据第一密钥分量和第二密钥分量生成 的交易签名保持一致。后续可以利用上述第三密钥分量和第四密钥分量替换之前使用的第一密钥分量和第二密钥分量来生成用户的交易签名,进行相应的交易数据的处理。
在本实施例中,服务器在得到上述第三密钥分量后,可以在服务器本地保存第三密钥分量。同样的,第二客户端设备在得到上述第四密钥分量后,可以在第二客户端设备本地保存第四密钥分量。其中,服务器无法获取第四密钥分量,第二客户端设备也无法获取第三密钥分量。
S13:所述第二客户端设备获取第一客户端设备生成的第一公钥,其中,所述第一客户端设备用于生成相互匹配的第一公钥和第一私钥。
在本实施例中,上述第一公钥和第一私钥具体可以是一组由第一客户端设备生成的相互匹配的密钥对,上述密钥对可以用于例如后续数据加密等数据处理。
在本实施例中,具体实施时,第一客户端设备可以响应密钥迁移请求,通过重加密等密钥生成方式生成相互匹配的第一公钥和第一私钥。进而,第二客户端设备可以获取其中的第一公钥,而第一客户端设备则会保存对应的第一私钥。
具体的,例如,可以参阅图2所示,第一客户端设备可以按照以下方式生成第一公钥和第一私钥:keyGen()->(pk_n,sk_n)。其中,上述keyGen()具体可以表示为一种密钥生成公式,上述pk_n具体可以表示为第一公钥,sk_n具体可以表示为第一私钥。
在本实施例中,上述第二客户端设备可以通过多种方式获取第一客户端设备生成的第一公钥。具体的,第二客户端设备可以通过查询第一客户端设备的设备标识等信息确定第一公钥。也可以由第一客户端设备直接将第一公钥发送至第二客户端设备,由第二客户端设备接收上述第一公钥等等。
在本实施例中,考虑到第一客户端设备和第二客户端设备可以为用户使用的手机或平板电脑等携带有摄像头的电子设备,为了兼顾公钥传输过程中的数据安全,也为了便于用户操作,具体实施时,可以是先由第一客户端设备根据第一公钥,生成对应的预设二维码。再将上述预设的二维码展示给第二客户端设备,以便第二客户端设备可以通过摄像头扫描获取上述预设二维码。第二客户端设备在得到上述预设二维码后,可以进一步对该预设二维码进行解析处理,以提取得到其中的第一公钥。当然,需要说明的是,上述所列举的第二客户端获取第一公钥的方式只是为了更好地说明本说明书实施例。具体实施时,根据具体的应用场景和客户端设备特点,还可以采用其他方式获取上述第一公钥。对此,本说明书不作限定。
S14:所述第二客户端设备根据所述第一公钥和所述第四密钥分量,生成第一密文数 据,并将所述第一密文发送至所述第一客户端设备。
在本实施例中,第二客户端设备在得到上述第四密钥分量后,为了保证在将第四密钥分量传输至第一客户端设备的过程中不被窃取或泄露,提高传输的安全性,具体可以先以第一客户端设备能够解密的加密方式对第四密钥分量进行加密后,再发送给第一客户端设备。
在本实施例中,具体实施时,第二客户端设备可以利用第一客户端设备生成的第一公钥对第四密钥分量进行加密处理,得到加密后的第四密钥分量,即第一密文数据。再通过有线或无线的传输方式,将上述第一密文数据发送至第一客户端设备。
具体的,例如,可以参阅图2所述,第二客户端设备可以按照以下方式对第四密钥分量进行加密处理:Enc(pk_n,sk2’)->cxt。其中,上述Enc具体可以表示加密运算,上述cxt具体可以表示第一密文数据。
S15:所述第一客户端设备利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。
在本实施例中,第一客户端设备在得到上述第一密文数据后,进一步,可以使用所保存的第一私钥对上述第一密文数据进行解密处理,得到第四密钥分量,从而完成密钥分量在不同客户端设备之间的迁移。这样后续可以通过第一客户端设备和服务器分别利用各自所保存的第四密钥分量和第三密钥分量生成用户的交易签名,进行相应的交易数据处理。
具体的,例如,上述第一客户端设备可以按照以下方式进行解密处理,得到第四密钥分量:Dec(sk_n,sk2’)->sk2’。其中,上述Dec()具体可以表示为解密运算。
在本申请实施例中,相较于现有方法,由于该方案通过引入基于MPC的数据处理方式,由第二客户端设备和服务器根据基于MPC协议生成的预设的规则,调用分别保存于两侧的第二密钥分量和第一密钥分量,进行函数运算以生成新的密钥分量,即第四密钥分量和第三密钥分量来替换原先使用的第二密钥分量和第一密钥分量;再将新生成的第四密钥分量加密后发送给第一客户端设备,实现密钥分量在不同客户端设备之间的迁移,从而解决了现有方法中存在的密钥迁移不安全、容易泄漏的技术问题,达到了安全、高效地将第二客户端设备所保存的密钥分量迁移到第一客户端设备的技术效果。此外,还在迁移密钥分量的同时,完成对所使用的密钥分量的更新。
在一个实施例中,在所述第一客户端设备利用所述第一私钥对所述第一密文数据进 行解密处理,得到所述第四密钥分量后,所述方法具体实施时,还可以包括以下内容:
S1:所述第一客户端设备向所述第二客户端设备和所述服务器发送第四密钥分量的确收信息;
S2:所述第二客户端设备响应所述确收信息,销毁所保存的第二密钥分量和第四密钥分量;所述服务器响应所述确收信息,销毁所保存的第一密钥分量。
在本实施例中,第一客户端设备在得到并保存上述第四密钥分量后,可以确定第四密钥分量已经迁移成功,后续可以使用第一客户端设备替换之前使用的第二客户端设备同服务器一起进行该用户的交易数据处理。即,第二客户端设备后续将不再参与进行该用户的交易数据处理,第二客户端设备也不再需要保存第二密钥分量,以及第四密钥分量。为了避免原先保存在第二客户端设备上的第二密钥分量、第四密钥分量泄漏或被窃取,对用户的交易安全造成影响,可以参阅图2所示,第一客户端设备可以生成并向第二客户端涉笔发送第四密钥分量的确收信息。第二客户端设备在接收到上述确收信息后,可以响应上述确收信息,销毁原先保存于第二客户端设备地的第二密钥分量,以及第四密钥分量,避免后续第二密钥分量、第四密钥分量可能通过不在使用的第二客户端设备被泄漏或被窃取,从而可以进一步提高用户的交易数据处理安全。
同时,又由于在完成密钥迁移后,将使用第三密钥分量和第四密钥分量这组新的密钥分量替换之前所使用的第一密钥分量的第二密钥分量,因此之前保存在服务器本地的第一密钥分量后续也不会使用。为了降低对服务器存储资源的消耗,第一客户端设备也可以向服务器发送上述确收信息。服务器在接收到上述确收信息后,可以响应上述确收信息,销毁原先保存于服务器本地的第一密钥分量。
在一个实施例中,在所述第一客户端设备利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量后,所述方法具体实施时,还可以包括以下内容:用户通过所述第一客户端设备发起交易数据处理请求;所述第一客户端设备和所述服务器响应所述交易数据处理请求,调用并根据分别保存的第四密钥分量和第三密钥分量,生成交易签名;所述第一客户端设备根据所述交易签名,进行交易数据处理。
在本实施例中,按照上述方式除了顺利、安全地完成在不同客户端设备之间的密钥分量的迁移,同时也对所使用的密钥分量进行更新。即,后续第一客户端设备和服务器将会使用新生成的第四密钥分量和第三密钥分量替换之前使用的第二密钥分量和第一密钥分量来生成交易签名,进行具体的交易数据处理,从而也能从另一个维度上提高交易数据处理的安全性。
从以上的描述中,可以看出,本申请实施例提供的密钥迁移方法,由于该方案通过引入基于MPC的数据处理方式,由第二客户端设备和服务器根据基于MPC协议生成的预设的规则,调用分别保存于两侧的第二密钥分量和第一密钥分量,进行函数运算以生成新的密钥分量,即第四密钥分量和第三密钥分量来替换原先使用的第二密钥分量和第一密钥分量;再将新生成的第四密钥分量加密后发送给第一客户端设备,实现密钥分量在不同客户端设备之间的迁移,从而解决了现有方法中存在的密钥迁移不安全、容易泄漏的技术问题,达到了安全、高效地将第二客户端设备所保存的密钥分量迁移到第一客户端设备的技术效果。此外,还在迁移密钥分量的同时,完成对所使用的密钥分量的更新;还通过第一客户端设备在得到第四密钥分量后,向第二客户端设备发送确收信息,以便第二客户端设备可以根据上述确收信息,及时销毁所保存的第二密钥分量和第四密钥分量,避免第二客户端设备本地所保存的第二密钥分量和第四密钥分量后续被泄漏或被窃取,进一步提高了用户密钥数据的安全性。
本申请实施例还提供了另一种密钥迁移方法。具体请参阅图3所示的根据本申请实施方式提供的密钥迁移方法的处理流程图。本申请实施例提供的密钥迁移方法,具体可以应用于第二客户端设备。其中,第二客户端设备保存有第二密钥分量。该方法具体实施时,可以包括以下内容:
S31:接收并响应所述密钥迁移请求,和服务器调用分别保存的第二密钥分量和第一密钥分量作为输入,根据预设的规则,进行函数运算,得到并保存第四密钥分量,其中,所述服务器得到并保存第三密钥分量;
S32:获取第一客户端设备生成的第一公钥,其中,所述第一客户端设备用于生成相互匹配的第一公钥和第一私钥;
S33:根据所述第一公钥和所述第四密钥分量生成第一密文数据,并将所述第一密文发送至所述第一客户端设备,其中,所述第一客户端设备用于利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。
在一个实施例中,上述获取第一客户端设备生成的第一公钥,具体实施时,可以包括以下内容:
S1:扫描获取第一客户端设备生成的预设二维码;
S2:解析所述预设二维码,得到所述第一公钥。
在本实施例中,需要说明的是,上述所列举的获取第一公钥的方式只是一种示意性 说明。具体实施时,根据具体情况和处理需求,还可以采用其他合适方式获取第一公钥。对此,本说明书不作限定。
本申请实施例还提供了另一种密钥迁移方法。具体请参阅图4所示的根据本申请实施方式提供的密钥迁移方法的处理流程图。本申请实施例提供的密钥迁移方法,具体可以应用于第一客户端设备。具体实施时,所述方法可以包括以下内容:
S41:发起密钥迁移请求,并生成第一公钥和第一私钥;
S42:接收第二客户端设备发送的第一密文数据,其中,所述第一密文数据为所述第二客户端设备利用所述第一公钥对第四密钥分量进行加密处理得到的,所述第四密钥分量为所述第二客户端设备和服务器响应所述密钥迁移请求,调用分别保存的第二密钥分量和第一密钥分量作为输入,根据预设的规则,进行函数运算,得到的;
S43:利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。
基于同一发明构思,本申请实施例中还提供了一种密钥迁移装置,如下面的实施例所述。由于密钥迁移装置解决问题的原理与密钥迁移方法相似,因此密钥迁移装置的实施可以参见密钥迁移方法的实施,重复之处不再赘述。以下所使用的,术语“单元”或者“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现,但是硬件,或者软件和硬件的组合的实现也是可能并被构想的。请参阅图5所示内容,是本申请实施例提供的密钥迁移装置的一种组成结构图,该装置具体可以包括:第一处理模块501、获取模块502、第二处理模块503,下面对该结构进行具体说明。
第一处理模块501,具体可以用于接收并响应所述密钥迁移请求,和服务器调用分别保存的第二密钥分量和第一密钥分量作为输入,根据预设的规则,进行函数运算,得到并保存第四密钥分量,其中,所述服务器得到并保存第三密钥分量;
获取模块502,具体可以用于获取第一客户端设备生成的第一公钥,其中,所述第一客户端设备用于生成相互匹配的第一公钥和第一私钥;
第二处理模块503,具体可以用于根据所述第一公钥和所述第四密钥分量生成第一密文数据,并将所述第一密文发送至所述第一客户端设备,其中,所述第一客户端设备用于利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。
在一个实施例中,上述预设的规则具体可以为预先根据MPC协议生成的数据处理规则。
在一个实施例中,为了能够获取第一客户端设备生成的第一公钥,上述获取模块502 具体可以包括以下结构单元:
扫描单元,具体可以用于扫描获取第一客户端设备生成的预设二维码;
解析单元,具体可以用于解析所述预设二维码,得到所述第一公钥。
在一个实施例中,所述装置还包括销毁模块,具体可以用于接收并响应第一客户端设备的第四密钥分量的确收信息,销毁所保存的第二密钥分量和第四密钥分量。
本说明书中的各个实施例均采用递进的方式描述,各个实施例之间相同相似的部分互相参见即可,每个实施例重点说明的都是与其他实施例的不同之处。尤其,对于***实施例而言,由于其基本相似于方法实施例,所以描述的比较简单,相关之处参见方法实施例的部分说明即可。
需要说明的是,上述实施方式阐明的***、装置、模块或单元,具体可以由计算机芯片或实体实现,或者由具有某种功能的产品来实现。为了描述的方便,在本说明书中,描述以上装置时以功能分为各种单元分别描述。当然,在实施本申请时可以把各单元的功能在同一个或多个软件和/或硬件中实现。
此外,在本说明书中,诸如第一和第二这样的形容词仅可以用于将一个元素或动作与另一元素或动作进行区分,而不必要求或暗示任何实际的这种关系或顺序。在环境允许的情况下,参照元素或部件或步骤(等)不应解释为局限于仅元素、部件、或步骤中的一个,而可以是元素、部件、或步骤中的一个或多个等。
从以上的描述中,可以看出,本申请实施例提供的密钥迁移装置,由于过引入基于MPC协议生成的预设的规则来进行具体处理,通过第二客户端设备和服务器根据基于MPC协议生成的预设的规则,调用分别保存于两侧的第二密钥分量和第一密钥分量,进行函数运算以生成新的密钥分量,即第四密钥分量和第三密钥分量来替换原有的第二密钥分量和第一密钥分量;再将新生成的第四密钥分量加密后发送给第一客户端设备,实现密钥分量在不同客户端设备之间的迁移,从而解决了现有方法中存在的密钥迁移不安全、容易泄漏的技术问题,达到了安全、高效地将第二客户端设备所保存的密钥分量迁移到第一客户端设备的技术效果。
本申请实施例还提供了一种电子设备,具体可以参阅图6所示的基于本申请实施例提供的密钥迁移方法的电子设备组成结构示意图,所述电子设备具体可以包括输入设备61、处理器62、存储器63。其中,所述输入设备61具体可以用于接收密钥迁移请求。所述处理器62具体可以用于响应所述密钥迁移请求,和服务器调用分别保存的第二密钥 分量和第一密钥分量作为输入,根据预设的规则,进行函数运算,得到并保存第四密钥分量,其中,所述服务器得到并保存第三密钥分量;获取第一客户端设备生成的第一公钥,其中,所述第一客户端设备用于生成相互匹配的第一公钥和第一私钥;根据所述第一公钥和所述第四密钥分量生成第一密文数据,并将所述第一密文发送至所述第一客户端设备,其中,所述第一客户端设备用于利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。所述存储器63具体可以用于存储所述处理器62所基于的程序指令。
在本实施方式中,所述输入设备具体可以是用户和计算机***之间进行信息交换的主要装置之一。所述输入设备可以包括键盘、鼠标、摄像头、扫描仪、光笔、手写输入板、语音输入装置等;输入设备用于把原始数据和处理这些数的程序输入到计算机中。所述输入设备还可以获取接收其他模块、单元、设备传输过来的数据。所述处理器可以按任何适当的方式实现。例如,处理器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用集成电路(Application Specific Integrated Circuit,ASIC)、可编程逻辑控制器和嵌入微控制器的形式等等。所述存储器具体可以是现代信息技术中用于保存信息的记忆设备。所述存储器可以包括多个层次,在数字***中,只要能保存二进制数据的都可以是存储器;在集成电路中,一个没有实物形式的具有存储功能的电路也叫存储器,如RAM、FIFO等;在***中,具有实物形式的存储设备也叫存储器,如内存条、TF卡等。
在本实施方式中,该电子设备具体实现的功能和效果,可以与其它实施方式对照解释,在此不再赘述。
本申请实施例还提供了一种基于密钥迁移方法的计算机存储介质,所述计算机存储介质存储有计算机程序指令,在所述计算机程序指令被执行时实现:接收并响应密钥迁移请求,和服务器调用分别保存的第二密钥分量和第一密钥分量作为输入,根据预设的规则,进行函数运算,得到并保存第四密钥分量,其中,所述服务器得到并保存第三密钥分量;获取第一客户端设备生成的第一公钥,其中,所述第一客户端设备用于生成相互匹配的第一公钥和第一私钥;根据所述第一公钥和所述第四密钥分量生成第一密文数据,并将所述第一密文发送至所述第一客户端设备,其中,所述第一客户端设备用于利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。
在本实施方式中,上述存储介质包括但不限于随机存取存储器(Random Access Memory,RAM)、只读存储器(Read-Only Memory,ROM)、缓存(Cache)、硬盘(Hard Disk Drive,HDD)或者存储卡(Memory Card)。所述存储器可以用于存储计算机程序指令。网络通信单元可以是依照通信协议规定的标准设置的,用于进行网络连接通信的接口。
在本实施方式中,该计算机存储介质存储的程序指令具体实现的功能和效果,可以与其它实施方式对照解释,在此不再赘述。
尽管本申请内容中提到不同的具体实施例,但是,本申请并不局限于必须是行业标准或实施例所描述的情况等,某些行业标准或者使用自定义方式或实施例描述的实施基础上略加修改后的实施方案也可以实现上述实施例相同、等同或相近、或变形后可预料的实施效果。应用这些修改或变形后的数据获取、处理、输出、判断方式等的实施例,仍然可以属于本申请的可选实施方案范围之内。
虽然本申请提供了如实施例或流程图所述的方法操作步骤,但基于常规或者无创造性的手段可以包括更多或者更少的操作步骤。实施例中列举的步骤顺序仅仅为众多步骤执行顺序中的一种方式,不代表唯一的执行顺序。在实际中的装置或客户端产品执行时,可以按照实施例或者附图所示的方法顺序执行或者并行执行(例如并行处理器或者多线程处理的环境,甚至为分布式数据处理环境)。术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含,从而使得包括一系列要素的过程、方法、产品或者设备不仅包括那些要素,而且还包括没有明确列出的其他要素,或者是还包括为这种过程、方法、产品或者设备所固有的要素。在没有更多限制的情况下,并不排除在包括所述要素的过程、方法、产品或者设备中还存在另外的相同或等同要素。
上述实施例阐明的装置或模块等,具体可以由计算机芯片或实体实现,或者由具有某种功能的产品来实现。为了描述的方便,描述以上装置时以功能分为各种模块分别描述。当然,在实施本申请时可以把各模块的功能在同一个或多个软件和/或硬件中实现,也可以将实现同一功能的模块由多个子模块的组合实现等。以上所描述的装置实施例仅仅是示意性的,例如,所述模块的划分,仅仅为一种逻辑功能划分,实际实现时可以有另外的划分方式,例如多个模块或组件可以结合或者可以集成到另一个***,或一些特征可以忽略,或不执行。
本领域技术人员也知道,除了以纯计算机可读程序代码方式实现控制器以外,完全可以通过将方法步骤进行逻辑编程来使得控制器以逻辑门、开关、专用集成电路、可编 程逻辑控制器和嵌入微控制器等的形式来实现相同功能。因此这种控制器可以被认为是一种硬件部件,而对其内部包括的用于实现各种功能的装置也可以视为硬件部件内的结构。或者甚至,可以将用于实现各种功能的装置视为既可以是实现方法的软件模块又可以是硬件部件内的结构。
本申请可以在由计算机执行的计算机可执行指令的一般上下文中描述,例如程序模块。一般地,程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构、类等等。也可以在分布式计算环境中实践本申请,在这些分布式计算环境中,由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中,程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。
通过以上的实施方式的描述可知,本领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件平台的方式来实现。基于这样的理解,本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来,该计算机软件产品可以存储在存储介质中,如ROM/RAM、磁碟、光盘等,包括若干指令用以使得一台计算机设备(可以是个人计算机,移动终端,服务器,或者网络设备等)执行本申请各个实施例或者实施例的某些部分所述的方法。
本说明书中的各个实施例采用递进的方式描述,各个实施例之间相同或相似的部分互相参见即可,每个实施例重点说明的都是与其他实施例的不同之处。本申请可用于众多通用或专用的计算机***环境或配置中。例如:个人计算机、服务器计算机、手持设备或便携式设备、平板型设备、多处理器***、基于微处理器的***、置顶盒、可编程的电子设备、网络PC、小型计算机、大型计算机、包括以上任何***或设备的分布式计算环境等等。
虽然通过实施例描绘了本申请,本领域普通技术人员知道,本申请有许多变形和变化而不脱离本申请的精神,希望所附的实施方式包括这些变形和变化而不脱离本申请。
Claims (10)
- 一种密钥迁移方法,其特征在于,所述方法应用于包含有第一客户端设备、第二客户端设备和服务器的***中,其中,所述第二客户端设备保存有第二密钥分量,所述服务器保存有第一密钥分量,所述方法包括:所述第一客户端设备发起密钥迁移请求;所述服务器和所述第二客户端设备响应所述密钥迁移请求,分别调用各自所保存的第一密钥分量和第二密钥分量作为输入,根据预设的规则,进行函数运算,得到第三密钥分量和第四密钥分量;其中,所述服务器获取并保存所述第三密钥分量,所述第二客户端设备获取并保存第四密钥分量;所述第二客户端设备获取第一客户端设备生成的第一公钥,其中,所述第一客户端设备用于生成相互匹配的第一公钥和第一私钥;所述第二客户端设备根据所述第一公钥和所述第四密钥分量,生成第一密文数据,并将所述第一密文发送至所述第一客户端设备;所述第一客户端设备利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。
- 根据权利要求1所述的方法,其特征在于,所述预设的规则为预先根据MPC协议生成的。
- 根据权利要求1所述的方法,其特征在于,在所述第一客户端设备利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量后,所述方法还包括:所述第一客户端设备向所述第二客户端设备和所述服务器发送第四密钥分量的确收信息;所述第二客户端设备响应所述确收信息,销毁所保存的第二密钥分量和第四密钥分量;所述服务器响应所述确收信息,销毁所保存的第一密钥分量。
- 根据权利要求1所述的方法,其特征在于,在所述第一客户端设备利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量后,所述方法还包括:通过所述第一客户端设备发起交易数据处理请求;所述第一客户端设备和所述服务器响应所述交易数据处理请求,调用并根据分别保 存的第四密钥分量和第三密钥分量,生成交易签名;所述第一客户端设备根据所述交易签名,进行交易数据处理。
- 根据权利要求1所述的方法,其特征在于,在所述第一客户端设备发起密钥迁移请求前,所述方法还包括:所述第一客户端设备接收密钥迁移指令;所述第一客户端设备响应所述密钥迁移指令,对登录第一客户端设备的账户的身份信息进行验证,在验证登录第一客户端设备的账户的身份信息与第二客户端设备上的账户的身份信息匹配的情况下,发起所述密钥迁移请求。
- 一种密钥迁移方法,其特征在于,所述方法应用于第二客户端设备,所述第二客户端设备保存有第二密钥分量,所述方法包括:接收并响应密钥迁移请求,和服务器调用分别保存的第二密钥分量和第一密钥分量作为输入,根据预设的规则,进行函数运算,得到并保存第四密钥分量,其中,所述服务器得到并保存第三密钥分量;获取第一客户端设备生成的第一公钥,其中,所述第一客户端设备用于生成相互匹配的第一公钥和第一私钥;根据所述第一公钥和所述第四密钥分量生成第一密文数据,并将所述第一密文发送至所述第一客户端设备,其中,所述第一客户端设备用于利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。
- 根据权利要求6所述的方法,其特征在于,获取第一客户端设备生成的第一公钥,包括:扫描获取第一客户端设备生成的预设二维码;解析所述预设二维码,得到所述第一公钥。
- 一种密钥迁移方法,其特征在于,所述方法应用于第一客户端设备,所述方法包括:发起密钥迁移请求,并生成第一公钥和第一私钥;接收第二客户端设备发送的第一密文数据,其中,所述第一密文数据为所述第二客 户端设备利用所述第一公钥对第四密钥分量进行加密处理得到的,所述第四密钥分量为所述第二客户端设备和服务器响应所述密钥迁移请求,调用分别保存的第二密钥分量和第一密钥分量作为输入,根据预设的规则,进行函数运算得到的;利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。
- 一种密钥迁移装置,其特征在于,包括:第一处理模块,用于接收并响应密钥迁移请求,和服务器调用分别保存的第二密钥分量和第一密钥分量作为输入,根据预设的规则,进行函数运算,得到并保存第四密钥分量,其中,所述服务器得到并保存第三密钥分量;获取模块,用于获取第一客户端设备生成的第一公钥,其中,所述第一客户端设备用于生成相互匹配的第一公钥和第一私钥;第二处理模块,用于根据所述第一公钥和所述第四密钥分量生成第一密文数据,并将所述第一密文发送至所述第一客户端设备,其中,所述第一客户端设备用于利用所述第一私钥对所述第一密文数据进行解密处理,得到所述第四密钥分量。
- 一种计算机可读存储介质,其上存储有计算机指令,其特征在于,所述指令被执行时实现权利要求6至7中任一项所述方法的步骤。
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/CN2019/075838 WO2020168546A1 (zh) | 2019-02-22 | 2019-02-22 | 密钥迁移方法和装置 |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/CN2019/075838 WO2020168546A1 (zh) | 2019-02-22 | 2019-02-22 | 密钥迁移方法和装置 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2020168546A1 true WO2020168546A1 (zh) | 2020-08-27 |
Family
ID=72143938
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2019/075838 WO2020168546A1 (zh) | 2019-02-22 | 2019-02-22 | 密钥迁移方法和装置 |
Country Status (1)
Country | Link |
---|---|
WO (1) | WO2020168546A1 (zh) |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN112349003A (zh) * | 2020-11-17 | 2021-02-09 | 深圳Tcl新技术有限公司 | 门锁密码的传输方法、锁体、服务器及可读存储介质 |
CN114268500A (zh) * | 2021-12-23 | 2022-04-01 | 国泰新点软件股份有限公司 | 电子签章***及装置 |
CN114710263A (zh) * | 2022-06-07 | 2022-07-05 | 苏州浪潮智能科技有限公司 | 密钥管理方法、密钥管理装置、密钥管理设备及存储介质 |
CN115632890A (zh) * | 2022-12-23 | 2023-01-20 | 北京锘崴信息科技有限公司 | 隐私数据及金融隐私数据的安全解密方法和装置 |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101005359A (zh) * | 2006-01-18 | 2007-07-25 | 华为技术有限公司 | 一种实现终端设备间安全通信的方法及装置 |
US20090249073A1 (en) * | 2005-06-30 | 2009-10-01 | Wiseman Williard M | Apparatus and method for group session key and establishment using a certified migration key |
US8259948B2 (en) * | 2007-12-29 | 2012-09-04 | Intel Corporation | Virtual TPM key migration using hardware keys |
CN103138939A (zh) * | 2013-03-28 | 2013-06-05 | 武汉大学 | 云存储模式下基于可信平台模块的密钥使用次数管理方法 |
-
2019
- 2019-02-22 WO PCT/CN2019/075838 patent/WO2020168546A1/zh active Application Filing
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20090249073A1 (en) * | 2005-06-30 | 2009-10-01 | Wiseman Williard M | Apparatus and method for group session key and establishment using a certified migration key |
CN101005359A (zh) * | 2006-01-18 | 2007-07-25 | 华为技术有限公司 | 一种实现终端设备间安全通信的方法及装置 |
US8259948B2 (en) * | 2007-12-29 | 2012-09-04 | Intel Corporation | Virtual TPM key migration using hardware keys |
CN103138939A (zh) * | 2013-03-28 | 2013-06-05 | 武汉大学 | 云存储模式下基于可信平台模块的密钥使用次数管理方法 |
Cited By (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN112349003A (zh) * | 2020-11-17 | 2021-02-09 | 深圳Tcl新技术有限公司 | 门锁密码的传输方法、锁体、服务器及可读存储介质 |
CN114268500A (zh) * | 2021-12-23 | 2022-04-01 | 国泰新点软件股份有限公司 | 电子签章***及装置 |
CN114268500B (zh) * | 2021-12-23 | 2023-10-27 | 国泰新点软件股份有限公司 | 电子签章***及装置 |
CN114710263A (zh) * | 2022-06-07 | 2022-07-05 | 苏州浪潮智能科技有限公司 | 密钥管理方法、密钥管理装置、密钥管理设备及存储介质 |
CN114710263B (zh) * | 2022-06-07 | 2022-08-05 | 苏州浪潮智能科技有限公司 | 密钥管理方法、密钥管理装置、密钥管理设备及存储介质 |
CN115632890A (zh) * | 2022-12-23 | 2023-01-20 | 北京锘崴信息科技有限公司 | 隐私数据及金融隐私数据的安全解密方法和装置 |
CN115632890B (zh) * | 2022-12-23 | 2023-04-07 | 北京锘崴信息科技有限公司 | 隐私数据及金融隐私数据的安全解密方法和装置 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10263969B2 (en) | Method and apparatus for authenticated key exchange using password and identity-based signature | |
WO2020168546A1 (zh) | 密钥迁移方法和装置 | |
Chuang et al. | An anonymous multi-server authenticated key agreement scheme based on trust computing using smart cards and biometrics | |
Jangirala et al. | A multi-server environment with secure and efficient remote user authentication scheme based on dynamic ID using smart cards | |
CN111431713B (zh) | 一种私钥存储方法、装置和相关设备 | |
CN109347835A (zh) | 信息传输方法、客户端、服务器以及计算机可读存储介质 | |
US20180176222A1 (en) | User friendly two factor authentication | |
CN109981576B (zh) | 密钥迁移方法和装置 | |
US10924289B2 (en) | Public-private key pair account login and key manager | |
CN104301107A (zh) | 经由相应WebRTC数据信道验证WebRTC媒体信道私密性的方法、*** | |
TW200818838A (en) | Mutual authentication and secure channel establishment between two parties using consecutive one-time passwords | |
US9137224B2 (en) | System and method for secure remote access | |
Darwish et al. | A cloud-based secure authentication (CSA) protocol suite for defense against Denial of Service (DoS) attacks | |
CN104967597A (zh) | 一种基于安全渠道的第三方应用消息鉴权方法及*** | |
US20180130056A1 (en) | Method and system for transaction security | |
CN104202163A (zh) | 一种基于移动终端的密码*** | |
US20210241270A1 (en) | System and method of blockchain transaction verification | |
US8923519B2 (en) | Method of efficient secure function evaluation using resettable tamper-resistant hardware tokens | |
SE540133C2 (en) | Improved system for establishing a secure communication channel | |
CN109903047A (zh) | 密钥迁移方法和装置 | |
Amintoosi et al. | TAMA: three-factor authentication for multi-server architecture | |
CN113630412B (zh) | 资源下载方法、资源下载装置、电子设备以及存储介质 | |
Andola et al. | An enhanced smart card and dynamic ID based remote multi-server user authentication scheme | |
Goel et al. | LEOBAT: Lightweight encryption and OTP based authentication technique for securing IoT networks | |
WO2020168545A1 (zh) | 密钥迁移方法和装置 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 19915618 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 19915618 Country of ref document: EP Kind code of ref document: A1 |