CN110166226A - A kind of method and apparatus generating code key - Google Patents

Abstract

The invention discloses a method and a device for generating a secret key, and relates to the technical field of computers. A specific implementation of the method includes: after the first server sends the first security information including its own first public key to the second server, and then receives the second secret key returned by the second server, wherein the second secret key The first security information is verified by the second server, and is generated by the second server using the first public key after the verification is passed; the first server receives the second public key containing the second public key sent by the second server. After receiving the security information, verify the second security information, and use the second public key to generate the first secret key of the first server after the verification is passed. This embodiment improves the security reliability when generating the secret key, and effectively prevents attacks and eavesdropping by third-party devices.

Description

A method and device for generating a secret key

technical field

The present invention relates to the field of computer technology, in particular to a method and device for generating a secret key.

Background technique

Key exchange is a protocol for obtaining authentication keys.

The key exchange method used in the prior art is based on the ECDH key exchange algorithm. Specifically, as shown in Figure 1, Master and Slave are used to identify the communication parties, and the process is as follows:

1. (A1) The master establishes a communication connection with the slave, and both parties generate their own publickey and privatekey.

2. (A2) Master writes its own publickey_m into Slave.

3. (A3) After receiving publickey_m, Slave uses publickey_m and privatekey_s to generate a sharekey, and returns the confirmation result to Master.

4. (A4) Macter sends a read command to obtain the slave public key publickey_s.

5. (A5) Slave returns its own public key publickey_s to Master, and Master generates sharekey after receiving Slave's public key.

6. (A6) Both parties use their generated sharekeys for encrypted data communication.

In the course of realizing the present invention, the inventor finds that there are at least the following problems in the prior art:

The way of key exchange in the prior art cannot resist man-in-the-middle attacks. Specifically, as shown in FIG. 2 , the Attaker acts as the Slave to the Master, and the Attaker acts as the Master to the Slave. Therefore, the flow after the attack is as follows:

1. The Master establishes a communication connection with the Attacker, and the Attacker establishes a communication connection with the Slave. The Master, Attacker, and Slave each generate their own publickey and privatekey.

2. The Master writes its own publickey_m into the Attacker (at this time, the Master judges that it is written into the Slave).

3. After receiving publickey_m, Attacker uses publickey_m and privatekey_a to generate sharekey_am, and returns the confirmation result to Master.

4. The Attacker writes its own publickey_a into the Slave (at this time, the Slave determines that it has received the Master's public key).

5. After receiving publickey_a, Slave uses publickey_a and privatekey_s to generate sharekey_sa, and returns the confirmation result to Attacker.

6. Macter sends a read command to obtain the public key publickey_a of the Attacker.

7. Attacker returns its public key publickey_a to Master, and Master generates sharekey_ma after receiving Attacker's public key.

8. The Attacker sends a read command to obtain the public key publickey_s of the Slave.

9. The Attacker uses the public key publickey_s on the Slave side and its own private key to generate a shared key sharekey_as.

10. Master and Attacker use sharekey_ma (equal to sharekey_am) to communicate; Attacker and Slave use sharekey_as (equal to sharekey_sa) to communicate.

At this time, the content of the communication between the Master and the Slave is all known by the Attacker.

Therefore, how to improve the security and reliability of key generation is particularly important.

Contents of the invention

In view of this, embodiments of the present invention provide a method and device for generating a secret key, which can improve the security and reliability of key generation.

To achieve the above purpose, according to an aspect of the embodiments of the present invention, a method for generating a secret key is provided.

A method for generating a secret key implemented in the present invention includes: after the first server sends the first security information including its own first public key to the second server, and then receives the second secret key returned by the second server, wherein, The second secret key is verified by the second server on the first security information, and after the verification is passed, it is generated by the second server using the first public key; After receiving the second security information of the public key, the second security information is verified, and after the verification is passed, the second public key is used to generate the first secret key of the first server.

In another embodiment of the present invention, the first server sends the first public key and the first identity information of the first server to the certificate center, and the certificate center uses the certificate private key of the certificate center to generate the first certificate, and sends the second A certificate is returned to the first server, and then the first server forms the first security information with the first public key and the first certificate; the second server sends the second public key and the second identity information of the second server to the certificate center, and the The certificate center uses the private key of the certificate to generate the second certificate, and returns the second certificate to the second server, and then the second server forms the second security information with the second public key and the second certificate.

In another embodiment of the present invention, the first security information is verified by the second server, and after the verification is passed, the step of generating the second secret key by the second server using the first public key includes: by the second server Use the certificate public key of the certificate center to verify the first certificate in the first security information. If the verification is passed, it is determined that the first public key in the first security information comes from the first server, and then use the first public key to generate Second secret key; verify the second security information, and after the verification is passed, the step of using the second public key to generate the first secret key of the first server includes: the first server uses the certificate public key to verify the second security information The second certificate is verified, and if the verification is passed, it is determined that the second public key in the second security information is from the second server, and then the second public key is used to generate the first secret key.

In another embodiment of the present invention, after the first server generates the first key, it encrypts the first key according to a preset algorithm to obtain the first encryption key of the first server; After the second key is generated, the second key is encrypted according to a preset algorithm to obtain a second encryption key of the second server.

In another embodiment of the present invention, the step of encrypting the first secret key according to a preset algorithm includes: cyclically shifting the first secret key to the left by three bits, and then combining the left-shifted first secret key with the preset Let the character string be logically ANDed to obtain the first encryption key; the step of encrypting the second key according to the preset algorithm includes: shifting the second secret key to the left by three bits, and then shifting the left key The second secret key and the preset character string are logically ANDed to obtain the second encryption key.

To achieve the above purpose, according to another aspect of the embodiments of the present invention, a device for generating a secret key is provided.

An apparatus for generating a secret key according to an embodiment of the present invention includes: a first generating module, configured to receive the second security information returned by the second server after sending the first security information including its own first public key to the second server. A secret key, wherein the second secret key is verified by the second server on the first security information, and is generated by the second server using the first public key after the verification is passed; the second generating module is configured to receive After the second security information including the second public key is sent by the second server, the second security information is verified, and after the verification is passed, the second public key is used to generate the first secret key of the first server.

In another embodiment of the present invention, the first server sends the first public key and the first identity information of the first server to the certificate center, and the certificate center uses the certificate private key of the certificate center to generate the first certificate, and sends the second A certificate is returned to the first server, and then the first server forms the first security information with the first public key and the first certificate; the second server sends the second public key and the second identity information of the second server to the certificate center, and the The certificate center uses the private key of the certificate to generate the second certificate, and returns the second certificate to the second server, and then the second server forms the second security information with the second public key and the second certificate.

In another embodiment of the present invention, the first generation module is also used for: the second server uses the certificate public key of the certificate center to verify the first certificate in the first security information, and if the verification is passed, determine The first public key in the first security information comes from the first server, and then uses the first public key to generate the second secret key; the second generating module is also used for: the first server uses the certificate public key to verify the first public key in the second security information The second certificate is verified, and if the verification is passed, it is determined that the second public key in the second security information is from the second server, and then the second public key is used to generate the first secret key.

In another embodiment of the present invention, after the first server generates the first key, it encrypts the first key according to a preset algorithm to obtain the first encryption key of the first server; After the second key is generated, the second key is encrypted according to a preset algorithm to obtain a second encryption key of the second server.

In another embodiment of the present invention, it also includes a first processing module, configured to: cyclically shift the first secret key to the left by three bits, and then perform a logical AND on the left-shifted first secret key and the preset character string processing to obtain the first encryption key; a second processing module is also included, configured to: cyclically shift the second key to the left by three bits, and then perform the left-shifted second key with a preset character string Logical AND processing to obtain the second encryption key.

To achieve the above object, according to another aspect of the present invention, an electronic device is provided.

An electronic device according to an embodiment of the present invention includes: one or more processors; a storage device for storing one or more programs, and when one or more programs are executed by one or more processors, one or more The processor implements the method for generating a secret key in the present invention.

To achieve the above purpose, according to still another aspect of the present invention, a computer-readable storage medium is provided.

A computer-readable storage medium according to an embodiment of the present invention, on which a computer program is stored, is characterized in that, when the program is executed by a processor, the method for generating a secret key of the present invention is implemented.

An embodiment of the above invention has the following advantages or beneficial effects: because the security information is sent to the other server for verification, and only when the verification is passed, will the technical means of further generating the secret key overcome the problem of generating The technical problem of poor security and reliability in the process of generating the secret key, and then achieve the technical effect of improving the security and reliability of generating the secret key. Through the technical scheme of the invention, the security reliability when generating the secret key is improved, and the attack and eavesdropping of the third-party equipment are effectively prevented.

The further effects of the above-mentioned non-conventional alternatives will be described below in conjunction with specific embodiments.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained based on these drawings without creative effort. In the attached picture:

Fig. 1 is an existing sequence diagram of key exchange using the ECDH key exchange algorithm;

Figure 2 is a schematic diagram of being attacked when exchanging according to an existing key exchange algorithm;

3 is a schematic diagram of the main flow of a method for generating a secret key according to an embodiment of the present invention;

4 is a schematic diagram of main modules of a device for generating a secret key according to an embodiment of the present invention;

FIG. 5 is an exemplary system architecture diagram to which the embodiment of the present invention can be applied;

Fig. 6 is a schematic structural diagram of a computer system suitable for implementing a terminal device or a server according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present invention are described below in conjunction with the accompanying drawings, which include various details of the embodiments of the present invention to facilitate understanding, and they should be regarded as exemplary only. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.

FIG. 3 is a schematic diagram of the main flow of a method for generating a secret key according to an embodiment of the present invention. As shown in FIG. 3 , a method for generating a secret key in an embodiment of the present invention mainly includes the following steps:

Step S301: After the first server sends the first security information including its first public key to the second server, it receives the second secret key returned by the second server. Wherein, the second secret key is verified by the second server on the first security information, and is generated by the second server using the first public key after the verification is passed. By sending the first security information to the second server, the second server performs subsequent verification and key generation. It should be noted that the first security information may also include a security certificate for verification. In the embodiment of the present invention, the first server sends the first public key and the first identity information of the first server to the certificate center , the certificate center uses the certificate private key of the certificate center to generate the first certificate, and returns the first certificate to the first server, and then the first server forms the first security information with the first public key and the first certificate. In this way, the first security information composed of the first public key and the first certificate is obtained, and then the second server can first perform verification according to the first certificate, and then use the first public key to generate the second secret key. It should be noted that the first identity information can be any unique identity.

Specifically, in another application scenario of the present invention, the first security information is verified by the second server, and after the verification is passed, the step of generating the second secret key by the second server using the first public key includes: The second server uses the certificate public key of the certificate center to verify the first certificate in the first security information. The public key generates the second secret key.

Step S302: After the first server receives the second security information containing the second public key sent by the second server, it verifies the second security information, and after the verification is passed, uses the second public key to generate the first server security information. the first secret key. In step S101, the second server generates its own second secret key according to the first public key sent by the first server. Therefore, the second server also needs to send its second public key to the first server, so that the first server can generate the first public key of the first server according to the second public key.

In the embodiment of the present invention, the second server sends the second public key and the second identity information of the second server to the certificate center, and the certificate center uses the certificate private key to generate the second certificate, and returns the second certificate to the first The second server, and then the second server forms the second security information with the second public key and the second certificate. Similarly, in order to increase security and reliability, the second server will also generate a second certificate and send it to the first server together with the second public key, and then the first server will verify and generate the first public key. It should be noted that the second identity information may be any unique identity.

Specifically, in another usage scenario of the present invention, the step of verifying the second security information and using the second public key to generate the first secret key of the first server after the verification is passed includes: the first server uses the certificate The public key verifies the second certificate in the second security information, and if the verification is passed, it is determined that the second public key in the second security information comes from the second server, and then the second public key is used to generate the first secret key.

In addition, in order to make the first secret key generated by the first server and the second secret key generated by the second server more confidential, the first secret key and the second secret key may be encrypted. Specifically, in an embodiment of the present invention, after the first server generates the first secret key, it encrypts the first secret key according to a preset algorithm to obtain the first encryption key of the first server; the second server After the second key is generated, the second key is encrypted according to a preset algorithm to obtain a second encryption key of the second server.

It should be noted that the preset algorithm is preset in the first server and the second server, and can be any algorithm, as long as the secret key can be encrypted and the first server and the second server can communicate normally. , in an embodiment of the present invention, the step of encrypting the first secret key according to a preset algorithm includes: shifting the first secret key to the left by three bits, and then combining the left-shifted first secret key with the preset The character string is logically AND processed to obtain the first encryption key; the step of encrypting the second key according to the preset algorithm includes: shifting the second secret key to the left by three bits, and then shifting the left Logical AND processing is performed on the second key and the preset character string to obtain the second encryption key. It should be noted that the preset character string is preset, and only needs to be a character string that can be logically ANDed with the left-shifted key.

The concrete flow process of the present invention is described in detail below, at first, need to prestore the public key publickey_CA (above-mentioned certificate public key) of CA (above-mentioned certificate center) at Master (above-mentioned first server); Public key publickey_CA.

Then taking Fig. 1 as an example, it is an existing sequence diagram of using the ECDH key exchange algorithm to carry out key exchange, and the specific process involved in the present invention is as follows:

1. The Master establishes a communication connection with the Slave, and both parties generate their own publickey and privatekey.

2. The Master sends the public key publickey_m and its own identity information (the above-mentioned first identity information, which can be any unique identity) to the CA, and the CA uses the private key privatekey_CA to generate the certificate certificate_m (the above-mentioned first certificate), and sends the certificate_m Return to Master.

3. Slave sends the public key publickey_s and its own identity information (the above-mentioned second identity information, which can be any unique identity) to the CA, and the CA uses the private key privatekey_CA to generate the certificate certificate_s (the above-mentioned second certificate), and sends the certificate_s Return to Slave.

4. Master writes its own publickey_m and certificate certificate_m into Slave.

5. After Slave receives publickey_m and certificate_m, it first uses publickey_CA to process certificate_m to verify whether publickey_m really comes from the Master. If it does come from the Master, proceed further, otherwise exit.

6. Slave uses publickey_m and privatekey_s to generate sharekey (the second secret key above), and returns the confirmation result to Master.

7. The Master sends a read command to obtain the Slave public key publickey_s and certificate certificate_s.

8. Slave returns its public key publickey_s and certificate certificate_s to Master.

9. After the Master receives the publickey_s and the certificate_s, it first uses the publickey_CA to process the certificate_s to verify whether the publickey_s really comes from the Slave. If it does come from the Slave, proceed further, otherwise exit.

10. Master uses publickey_s and privatekey_m to generate sharekey (the first secret key above), and returns the confirmation result to Slave.

11. Both parties use their generated sharekeys for encrypted data communication.

Further, in order to increase the security and reliability of the generated secret key, the generated secret key may be encrypted. The specific process is as follows:

1. The Master encrypts the sharekey with a preset preset algorithm to obtain sharekey_changed.

2. The Slave encrypts the sharekey with a preset preset algorithm to obtain sharekey_changed.

Here, the preset algorithm may be any algorithm, as long as the key can be encrypted and normal communication between the first server and the second server can be guaranteed. For example, the length of the sharekey is 128bit, and the processing flow using the preset algorithm is:

1. Rotate the sharekey to the left by 3 bits.

2. Perform logical AND processing on the result of step (1) and 0x00112233445566778899aabbccddeeff, and the obtained result is taken as sharekey_changed.

According to the method for generating a secret key according to the embodiment of the present invention, it can be seen that because the security information is sent to the other party’s server for verification, and only when the verification is passed, the secret key will be further generated, so it overcomes the problem of The technical problem of poor security and reliability existing in the process of generating the secret key, thereby achieving the technical effect of improving the security and reliability of generating the secret key. Through the technical scheme of the invention, the security reliability when generating the secret key is improved, and the attack and eavesdropping of the third-party equipment are effectively prevented.

Fig. 4 is a schematic diagram of main modules of a device for generating a secret key according to an embodiment of the present invention. As shown in Fig. 4 , a device 400 for generating a secret key according to an embodiment of the present invention mainly includes: a first generating module 401 and a second A module 402 is generated, wherein:

The first generating module 401 is configured to receive the second secret key returned by the second server after sending the first security information including its own first public key to the second server, wherein the second secret key is provided by the second The server verifies the first security information, and after the verification is passed, it is generated by the second server using the first public key; the second generating module 402 is configured to, after receiving the second public key sent by the second server, After the second security information, verify the second security information, and use the second public key to generate the first secret key of the first server after the verification is passed.

In another embodiment of the present invention, the first server sends the first public key and the first identity information of the first server to the certificate center, and the certificate center uses the certificate private key of the certificate center to generate the first certificate, and sends the second A certificate is returned to the first server, and then the first server forms the first security information with the first public key and the first certificate; the second server sends the second public key and the second identity information of the second server to the certificate center, and the The certificate center uses the private key of the certificate to generate the second certificate, and returns the second certificate to the second server, and then the second server forms the second security information with the second public key and the second certificate.

In another embodiment of the present invention, the first generation module 401 is further configured to: use the certificate public key of the certificate center to verify the first certificate in the first security information by the second server, and if the verification is passed, Determine that the first public key in the first security information comes from the first server, and then use the first public key to generate a second secret key; the second generation module 402 is also used for: the first server uses the certificate public key to generate the second secret key in the second security information The second certificate is verified, and if the verification is passed, it is determined that the second public key in the second security information is from the second server, and then the second public key is used to generate the first secret key.

In another embodiment of the present invention, after the first server generates the first key, it encrypts the first key according to a preset algorithm to obtain the first encryption key of the first server; After the second key is generated, the second key is encrypted according to a preset algorithm to obtain a second encryption key of the second server.

In another embodiment of the present invention, a first processing module (not shown in the figure) is also included, configured to: cyclically shift the first secret key to the left by three bits, and then combine the left-shifted first secret key with Preset character strings are subjected to logical AND processing to obtain the first encryption key; a second processing module (not shown in the figure) is also included for: cyclically shifting the second key to the left by three bits, and then shifting the left Logical AND processing is performed on the shifted second key and the preset character string to obtain a second encryption key.

As can be seen from the above description, because the security information is sent to the server of the other party for verification, and only when the verification is passed, the technical means of further generating the secret key is adopted, so the existing problems in the process of generating the secret key are overcome. The technical problem of poor safety and reliability, and then achieve the technical effect of improving the safety and reliability when generating the secret key. Through the technical scheme of the invention, the security reliability when generating the secret key is improved, and the attack and eavesdropping of the third-party equipment are effectively prevented.

Fig. 5 shows an exemplary system architecture 500 to which the method for generating a secret key or the device for generating a secret key according to an embodiment of the present invention can be applied.

As shown in FIG. 5 , a system architecture 500 may include terminal devices 501 , 502 , and 503 , a network 504 and a server 505 . The network 504 is used as a medium for providing communication links between the terminal devices 501 , 502 , 503 and the server 505 . Network 504 may include various connection types, such as wires, wireless communication links, or fiber optic cables, among others.

Users can use terminal devices 501 , 502 , 503 to interact with server 505 through network 504 to receive or send messages and the like. Various communication client applications can be installed on the terminal devices 501, 502, and 503, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (just for example).

The terminal devices 501, 502, 503 may be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers and the like.

The server 505 may be a server that provides various services, such as a background management server that provides support for shopping websites browsed by users using the terminal devices 501 , 502 , 503 (just an example). The background management server can analyze and process the received data such as product information query requests, and feed back the processing results (such as target push information, product information—just an example) to the terminal device.

It should be noted that the method for generating a secret key provided in the embodiment of the present invention is generally executed by the server 505 , and correspondingly, the device for generating a secret key is generally set in the server 505 .

It should be understood that the numbers of terminal devices, networks and servers in Fig. 5 are only illustrative. According to the implementation needs, there can be any number of terminal devices, networks and servers.

Referring now to FIG. 6 , it shows a schematic structural diagram of a computer system 600 suitable for implementing a terminal device according to an embodiment of the present invention. The terminal device shown in FIG. 6 is only an example, and should not limit the functions and scope of use of this embodiment of the present invention.

As shown in FIG. 6 , a computer system 600 includes a central processing unit (CPU) 601 that can be programmed according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage section 608 into a random-access memory (RAM) 603 Instead, various appropriate actions and processes are performed. In the RAM 603, various programs and data necessary for the operation of the system 600 are also stored. The CPU 601 , ROM 602 , and RAM 603 are connected to each other via a bus 604 . An input/output (I/O) interface 605 is also connected to the bus 604 .

The following components are connected to the I/O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 608 including a hard disk, etc. and a communication section 609 including a network interface card such as a LAN card, a modem, or the like. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I/O interface 605 as needed. A removable medium 611 such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc. is mounted on the drive 610 as necessary so that a computer program read therefrom is installed into the storage section 608 as necessary.

In particular, according to the disclosed embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the disclosed embodiments of the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, where the computer program includes program codes for executing the methods shown in the flowcharts. In such an embodiment, the computer program may be downloaded and installed from a network via communication portion 609 and/or installed from removable media 611 . When this computer program is executed by a central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present invention are performed.

It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. A computer readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, electrical connections with one or more wires, portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable Programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, however, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, in which computer-readable program codes are carried. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. . Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or portion of code that includes one or more logical functions for implementing specified executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved. It is also to be noted that each block in the block diagrams or flowchart illustrations, and combinations of blocks in the block diagrams or flowchart illustrations, can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a A combination of dedicated hardware and computer instructions.

The modules involved in the embodiments described in the present invention may be implemented by software or by hardware. The described modules may also be set in a processor, for example, it may be described as: a processor includes a first generating module and a second generating module. Wherein, the names of these modules do not constitute a limitation on the module itself under certain circumstances.

As another aspect, the present invention also provides a computer-readable medium. The computer-readable medium may be contained in the device described in the above embodiments, or it may exist independently without being assembled into the device. The above-mentioned computer-readable medium carries one or more programs, and when the one or more programs are executed by one device, the device includes: the first server sends the first security information containing its own first public key to the second server. After the second server receives the second secret key returned by the second server, the second secret key is verified by the second server on the first security information, and after the verification is passed, the second secret key is used by the second server to Key generation; after receiving the second security information containing the second public key sent by the second server, the first server verifies the second security information, and uses the second public key to generate the first The server's first secret key.

According to the technical solution of the embodiment of the present invention, because the security information is sent to the other party's server for verification, and only when the verification is passed, the technical means of further generating the secret key will be overcome, so it overcomes the problem in the process of generating the secret key. The technical problem of poor safety and reliability exists, and then achieves the technical effect of improving the safety and reliability when generating the secret key. Through the technical scheme of the invention, the security reliability when generating the secret key is improved, and the attack and eavesdropping of the third-party equipment are effectively prevented.

The above specific implementation methods do not constitute a limitation to the protection scope of the present invention. It should be apparent to those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (12)

1. a kind of method for generating code key characterized by comprising

After the first security information comprising itself the first public key is sent to second server by first server, receive by institute State the second code key of second server return, wherein second code key is by the second server to first safety Information is verified, and after being verified, and is generated by the second server using first public key；

The first server receive the second security information comprising the second public key for being sent by the second server it Afterwards, second security information is verified, and after being verified, generates first clothes using second public key First code key of business device.

2. the method according to claim 1, wherein including:

First identity information of first public key and the first server is sent to certificate center by the first server, First Certificate is generated using the certificate and private key of the certificate center by the certificate center, and the First Certificate is returned into institute First server is stated, then the first server believes first public key and First Certificate composition first safety Breath；

Second identity information of second public key and the second server is sent to the certificate by the second server Center generates the second certificate using the certificate and private key by the certificate center, and second certificate is returned to described the Two servers, then second public key and second certificate are formed second security information by the second server.

3. the method according to claim 1, wherein

It is described that first security information is verified by the second server, and after being verified, by described The step of generation second code key of first public key described in two server by utilizing includes: to utilize the card by the second server The CertPubKey at book center verifies the First Certificate in first security information, the case where being verified Under, determine that first public key in first security information comes from the first server, it is then public using described first Key generates the second code key；

It is described that second security information is verified, and after being verified, using described in second public key generation The step of first code key of first server includes: that the first server believes second safety using the CertPubKey Second certificate in breath is verified, and in the case where being verified, determines described the in second security information Two public keys come from the second server, then generate the first code key using second public key.

4. method according to claim 1-3, which is characterized in that

The first server carries out at encryption first code key according to preset algorithm after generating first code key Reason, to obtain the first encryption code key of the first server；

The second server adds second code key according to the preset algorithm after generating second code key Close processing, to obtain the second encryption code key of the second server.

5. according to the method described in claim 4, it is characterized in that, described add first code key according to preset algorithm The step of close processing includes:

By described first code key ring shift left, three bits, first code key after then moving to left and preset characters string into The processing of row logical AND, to obtain the first encryption code key；

Described the step of second code key is encrypted according to the preset algorithm includes:

Second code key and the preset word by described second code key ring shift left, three bits, after then moving to left Symbol string carries out the processing of logical AND, to obtain the second encryption code key.

6. a kind of device for generating code key characterized by comprising

First generation module, for that will include after the first security information of itself the first public key is sent to second server, to connect Receive the second code key returned by the second server, wherein second code key is by the second server to described First security information is verified, and after being verified, and is generated by the second server using first public key；

Second generation module, for receiving the second security information comprising the second public key sent by the second server Later, second security information is verified, and after being verified, generates described first using second public key First code key of server.

7. according to the method described in claim 6, it is characterised by comprising:

First identity information of first public key and the first server is sent to certificate center by the first server, First Certificate is generated using the certificate and private key of the certificate center by the certificate center, and the First Certificate is returned into institute First server is stated, then the first server believes first public key and First Certificate composition first safety Breath；

Second identity information of second public key and the second server is sent to the certificate by the second server Center generates the second certificate using the certificate and private key by the certificate center, and second certificate is returned to described the Two servers, then second public key and second certificate are formed second security information by the second server.

8. according to the method described in claim 6, it is characterized in that,

First generation module is also used to: by the second server using the CertPubKey of the certificate center to described the The First Certificate in one security information is verified, and in the case where being verified, is determined in first security information First public key come from the first server, then using first public key generate the second code key；

Second generation module is also used to: the first server is using the CertPubKey in second security information Second certificate verified, in the case where being verified, determine that described second in second security information is public Key comes from the second server, then generates the first code key using second public key.

9. according to the described in any item methods of claim 6-8, which is characterized in that

The first server carries out at encryption first code key according to preset algorithm after generating first code key Reason, to obtain the first encryption code key of the first server；

The second server adds second code key according to the preset algorithm after generating second code key Close processing, to obtain the second encryption code key of the second server.

10. according to the method described in claim 9, being used for it is characterized in that, further include first processing module:

By described first code key ring shift left, three bits, first code key after then moving to left and preset characters string into The processing of row logical AND, to obtain the first encryption code key；

Further include Second processing module, be used for:

Second code key and the preset word by described second code key ring shift left, three bits, after then moving to left Symbol string carries out the processing of logical AND, to obtain the second encryption code key.

11. a kind of electronic equipment characterized by comprising

One or more processors；

Storage device, for storing one or more programs,

When one or more of programs are executed by one or more of processors, so that one or more of processors are real Now such as method as claimed in any one of claims 1 to 5.

12. a kind of computer-readable medium, is stored thereon with computer program, which is characterized in that described program is held by processor Such as method as claimed in any one of claims 1 to 5 is realized when row.