CN101330379B - A key distribution method and device - Google Patents

Abstract

The invention belongs to the technical field of mobile communication, and discloses a method and device for issuing a key. The method for issuing a key includes the steps of: receiving a key request carrying time-related information; changing the key according to the current specific time and setting Frequency, obtaining at least one key corresponding to the time-related information from the set key chain, and delivering the key. This method can meet the key corresponding to the time-related information requested by the user through one message interaction, and does not need to be issued separately when the key is replaced, so the number of key issuances can be reduced, and the resources of the network device can be reduced. Consumption, saving network transmission resources.

Description

A key distribution method and device

technical field

The present invention relates to the technical field of mobile communication, in particular to a method and device for issuing a key.

Background technique

With the rapid development of mobile communication technology, the widespread use of mobile communication networks and the rapid growth of the number of mobile communication users, broadcast and multicast technology is rapidly applied to mobile communication networks. The broadcast and multicast technology refers to broadcast or multicast multimedia data to mobile terminals by sharing a transmission link. In order to realize the broadcast multicast technology in the mobile communication system, the standardization organizations 3GPP and 3GPP2 of the third generation of mobile communication have developed the global system for mobile communication/Wideband Code Division Multiple Access (GSM/WCDMA, Global System for Mobile Communications/Wideband Code Division Multiple Access) In 3GPP, this project is called Multimedia Broadcast Multicast Service (MBMS, Multimedia Broadcast Multicast Service), and in 3GPP2, this project is called Broadcast and Multicast Service (BCMCS, Broadcast Multicast Service).

In order to ensure data security, it is necessary to authenticate the identity of the user and encrypt the data with a key. For example, in MBMS, the user equipment (UE, User Equipment) and the broadcast multicast service center (BM-SC, Broadcast Multicast-Service Center) pre-store MBMS request key (MRK, MBMS Request Key), and the two respectively pass The same algorithm generates MBMS User Key (MUK, MBMS User Key); among them, MRK is used for BM-SC to identify UE according to MRK when receiving the request key sent by UE; MUK is used for BM-SC to send UE When using a point-to-point MBMS service key (MSK, MBMS Service Key), the MSK is encrypted to protect the MSK. Referring to Fig. 1, it is a flow chart of issuing a key in the prior art and using the key for encryption and decryption, specifically including the following steps:

11. UE sends HTTP Digest Authentication (MRK) message to BM-SC for identity authentication and key request;

12. The BM-SC authenticates the UE according to the MRK. After the authentication is passed, the MSK is encrypted by the MUK, and the MUK-encrypted data packet containing the MSK is sent to the UE through the MIKEY MSK delivery (protect with MUK) message;

13. The UE decrypts the data packet sent in step 12 through the MUK to obtain the MSK;

14. The BM-SC encrypts the MBMS transmission key (MTK, MBMS Traffic Key) through MSK, and sends the MSK-encrypted data packet containing MTK to the UE through the MIKEY MTK delivery (protect with MSK) message; for mobile phones For user terminal equipment, MTK is used for UE to decrypt received MBMS data.

15. The UE decrypts the MSK obtained in step 13 to decrypt the data packet delivered in step 14 to obtain the MTK;

16. The BM-SC encrypts the MBMS media stream provided by the content provider through MTK and transmits it to the UE;

17. The UE decrypts the MBMS media stream transmitted in step 16 through the MTK obtained through decryption in step 15 to obtain correct data.

In order to ensure the security of data transmission, the MSK needs to be replaced at regular intervals. In the prior art, when the BM-SC judges that the MSK time limit has been modified, the MIKEY MSK delivery message is transmitted to the UE through the User Datagram Protocol (UDP, User Data Protocol) transmission mode, and the MIKEY MSK delivery message carries the MUK Encrypted modified MSK data packets; since the UDP transmission method is unreliable, when the user terminal receives the MIKEY MSK delivery (protect with MUK) message, it will return the MIKEY ACK (protect with MUK) confirmation message to the BM-SC to ensure transmission reliability.

In the process of implementing the present invention, the inventors found that in the process of issuing the key in the prior art solution, each time the time limit for replacing the MSK is reached, the BM-SC and the UE must transmit the MSK through a corresponding message, and the message There are many. At the same time, due to the unreliable transmission method of UDP, in order to ensure the reliability of transmission, confirmation messages need to be sent, and in order to ensure data security, MSK needs to be replaced frequently, so there will be many confirmation messages. And because MBMS generally has many users, in this way, the number of messages interacting with the BM-SC server will be very large.

Contents of the invention

The technical problem to be solved by the embodiments of the present invention is to provide a key distribution method and device, which can reduce the number of interactive messages during the key distribution process.

In order to solve the above technical problems, the purpose of the embodiments of the present invention is achieved through the following technical solutions:

An embodiment of the present invention provides a method for issuing a key, the method including:

Receive a key request carrying time-related information;

According to the current specific time and the set key change frequency, at least one key corresponding to the time-related information is obtained from the set key chain, and the key is issued.

The embodiment of the present invention also provides a key delivery device, the device includes:

a receiving unit, configured to receive a key request carrying time-related information;

The storage unit is used to store the set key change frequency and the set key chain;

A key acquisition unit, configured to acquire at least one key corresponding to the time-related information from the key chain stored in the storage unit according to the current specific moment and the set key change frequency stored in the storage unit. key;

A key delivery unit, configured to deliver the key obtained from the key acquisition unit.

As can be seen from the above technical solutions, since the embodiment of the present invention obtains the key corresponding to the time-related information from the set key chain according to the current specific time and the key change frequency, and stores the key once It is not necessary to issue separately every time the key is changed, so the number of times of key delivery can be reduced, which in turn can reduce the resource consumption of network devices and save network transmission resources.

Description of drawings

Fig. 1 is a flow chart of issuing a key and using the key for encryption and decryption in the prior art;

FIG. 2 is a flowchart of a method for issuing a key according to an embodiment of the present invention;

FIG. 3 is a flowchart of a method for issuing a key according to Embodiment 2 of the present invention;

FIG. 4 is a flowchart of a method for issuing a third key according to Embodiment 3 of the present invention;

FIG. 5 is a flowchart of a method for issuing a key according to Embodiment 4 of the present invention;

FIG. 6 is a structural diagram of a key issuing device according to Embodiment 5 of the present invention;

FIG. 7 is a structural diagram of a key delivery device according to Embodiment 6 of the present invention;

FIG. 8 is a structural diagram of a key delivery device according to Embodiment 7 of the present invention;

FIG. 9 is a structural diagram of an eight-key issuing device according to an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below through specific applications in MBMS with reference to the accompanying drawings.

Embodiment 1: According to different durations requested by the UE, the BM-SC will generate a key corresponding to the duration requested by the user, and deliver the key to the UE.

Referring to FIG. 2 , it is a flow chart of issuing a key according to an embodiment of the present invention. The following describes in detail the process of the BM-SC delivering the key corresponding to the duration of the user request to the UE according to the duration of the user request:

21. Set the key chain in BM-SC, and set the key change frequency;

The key chain can be generated by a root key and a one-way function, for example: if a root key is set to k1, and the one-way function is a key chain generated by f, then the key chain generated by k1 and f The keys in are sequentially k1, k2, k3, ... among them, k2=f(k1), k3=f(k2), k3=f ² (k1), ...

Set the key change frequency to once every 10 minutes.

For example, starting from 00:00 every day, 00:00-00:10 minutes, use k3 encryption; 00:10-00:20 minutes, use k2 encryption, 00:20-00:30 minutes, use k1 encryption, …

22. The UE sends a key request carrying the duration requested by the user;

For example, the UE sends a key request to the BM-SC through an HTTP POST (List of Key Domain ID-MSK ID Pairs) message, and the message carries the duration of the user request.

23. The BM-SC obtains the key corresponding to the duration requested by the user from the key chain set in step 21 according to the current specific time and the key change frequency set in step 21;

Since the relationship of the keys in the key chain set in step 21 is: k2=f(k1), k3=f(k2), k3=f ² (k1), ... so for utilizing k3 For encrypted media streams, the UE with k1 and k2 can directly launch k3, so it can decrypt the media stream encrypted by k3, and the UE with k1 can launch k2, so it can decrypt the media stream encrypted by k2.

Assuming that the key request sent by the UE is received at 00:00, and a 10-minute media stream is requested, the key obtained from the key chain is k3, and the UE can unlock the 00:00-00:10 key according to this key. The media stream after 00:10 minutes cannot be decomposed according to k3.

Assuming that the key request sent by the UE is received at 00:07, and a 10-minute media stream is requested, the key obtained from the key chain is k2, and k2 can unlock the media stream at 00:10-00:20 , since the UE can launch k3 according to k2, it can unlock the media stream of 00:07-00:10. After 20 minutes, the media stream UE cannot be opened.

24. The BM-SC delivers the acquired key to the UE.

The BM-SC sends the obtained key to the UE through the MIKEY MSK delivery message.

Since the UDP transmission method is still used, in order to ensure reliability, when the BMSC receives the HTTP POST (List of Key Domain ID-MSK ID Pairs) message sent by the UE, it will return a response message HTTP 200 OK to the UE. When the UE receives the BM - When the key is issued by the SC, it will return a MIKEYACK confirmation message, which will not be described in detail.

In the prior art, every 10 minutes, the UE and the BM-SC need to exchange a message to change the key. If the program that the user watches lasts for 60 minutes, the UE and the BM-SC need to exchange messages 6 times due to key replacement, plus the confirmation message sent to ensure UDP transmission security, the number of message interactions is doubled. However, in the embodiment of the present invention, no matter how long the user request is, only one message interaction is required to complete all key delivery. For services with a large number of users such as MBMS, a large number of interactive messages can be saved, so the resource consumption of the BM-SC server can be reduced, and network transmission resources can be saved.

In the second embodiment, in order to ensure data security, on the basis of the first embodiment, the method of authenticating the identity of the user and constantly changing the root key of the set key chain can be used to ensure the security of the key.

Referring to FIG. 3 , it is a flow chart of a method for issuing a key according to Embodiment 2 of the present invention, which will be described in detail below:

31. Set the key chain in BM-SC, set the update frequency of the root key, and set the key change frequency;

Still set a root key as k1, a key chain generated by the one-way function as f, each key is k1, k2, k3,..., among them, k2=f(k1), k3=f (k2), k3=f ² (k1),  …

Set the key change frequency to once every 10 minutes.

Assume starting from 00:00 every day, 00:00-00:10 minutes, use k3 encryption; 00:10-00:20 minutes, use k2 encryption, 00:20-00:30 minutes, use k1 encryption, . .....

Set the update frequency of the root key to once every 30 minutes, after 00:30, use k1' as the root key, and the one-way function is still f, then you can get k2'=f(k1'), k3'= f(k2'), k3'=f ² (k1'),  …

32. The UE sends a key request carrying the duration requested by the user;

The UE can send a key request to the BM-SC through an HTTP POST (List of Key DomainID-MSK ID Pairs) message carrying the duration requested by the user.

33. The BM-SC sends an authentication request to the UE;

The BM-SC sends an HTTP 401 www-Authenticate message to the UE, and the www-Authenticate header field of the message contains at least one challenge to specify the authentication mechanism and parameters applicable to this field.

34. The UE re-initiates the key request with an appropriate certificate;

When the UE receives the HTTP 401 www-Authenticate message, it sends an HTTPPOST Authorization Request (List of Key Domain ID-MSK ID Pairs) message to the BM-SC to re-initiate the key request;

35. When the authentication passes, the BM-SC returns a response message to the UE;

After the authentication is passed, the BM-SC returns an HTTP 200 OK Authentication-Info (StatusCodes) response message to the user, and the message carries the specific status code of the authentication passing.

36. The BM-SC obtains the key corresponding to the duration requested by the user from the key chain set in step 31 according to the current specific time and the key change frequency set in step 31;

For the key request sent by the UE received at 00:00, if the duration of the user request is less than or equal to 30 minutes, the key obtained for the corresponding time period is the same as that obtained in Embodiment 1, and will not be described in detail.

For the key request sent by the UE received at 00:00, if the duration requested by the user is longer than 30 minutes, the key corresponding to the duration requested by the user may be acquired according to the following method.

For example, at 00:00, the key request sent by the UE is received for 40 minutes, because the media stream of 00:00-00:30 can be unlocked through k1, and the media stream of 00:30-00:40 can be unlocked by k3' The divided media stream, so the keys obtained from the key chain are k1 and k3'.

If the key request sent by the UE is received at 00:00 for 50 minutes, since the media stream of 00:00-00:30 can be unlocked through k1, and the media stream of 00:40-00:50 can be unlocked by k2' media stream, k3' can be deduced through k2', and k3' can unlock the media stream at 00:30-00:40, so the keys obtained from the key chain are k1 and k2'.

If the key request sent by the UE is received at 00:00 for 60 minutes, since the media stream from 00:00-00:30 can be unlocked through k1, and the media stream from 00:50-01:00 can be unlocked by k1' The media stream of k2' can be launched through k1', k2' can unlock the media stream of 00:40-00:50, and then k3' can be launched through k2', and k3' can unlock the media stream of 00:30-00:40 The divided media stream, so the keys obtained from the key chain are k1 and k1'.

In this way, it can be deduced that the duration of the user request is longer than 60 minutes, and will not be described one by one.

37. The BM-SC sends the generated key to the UE;

The BM-SC sends the generated key to the UE through the MIKEY MSK delivery message.

38. After receiving the key, the UE returns a confirmation message to the BM-SC.

Since the UDP transmission mode is used, in order to ensure the reliability of the transmission, the UE returns a MIKEYACK confirmation message.

It can be seen that in this embodiment, the root key of the generated key chain is updated at a certain frequency, which can enhance data security; and the authentication of user identity can prevent illegal requests from illegal users.

In order to ensure data security, the one-way function of the key chain can also be replaced according to the set frequency or the root key and one-way function can be replaced at the same time.

Before issuing the key, the generated key can also be encrypted before being issued to better ensure data security.

The BM-SC obtains the corresponding key within the specified time period from the set key chain within a certain time period according to the current specific time and the set frequency of the key change, and uses the key to process the media stream Encrypt and send. In addition to encrypting the media stream with the issued key, other data may also be encrypted, for example, another key. Moreover, this can better ensure data security.

For example, according to the current specific time and the key change frequency, the BM-SC selects the MSK corresponding to the time period from the key chain within a certain period of time to encrypt and deliver the MTK information, and then transmits the MTK information to the media through the MTK message. The stream is encrypted and delivered. Correspondingly, the UE decrypts the MTK information by selecting the MSK that should be selected within the time period from the MSK delivered by the previous BM-SC, and then uses the MTK to decrypt the received media stream.

In the third embodiment, in order for the UE to quickly use an appropriate key to decrypt the media stream, the BM-SC can add identifiers to different keys.

Referring to FIG. 4 , it is a flow chart of the method for issuing a key in Embodiment 3 of the present invention. The following specifically describes the specific process of issuing a key when adding an identifier to the obtained key:

41. Set the key chain in BM-SC, set the update frequency of the root key in the key chain, and set the key change frequency in the key chain;

42. The UE sends a key request carrying the duration requested by the user;

43. The BM-SC obtains the key corresponding to the duration requested by the user from the set key chain according to the current specific time and the key change frequency set in step 41;

44. Encrypt the key obtained in step 43 and add an identifier;

The identifier can be an index number. Assuming that the keys obtained from the key chain are k1 and k2', the index number added to k1 is 1, and the index number added to k2' is 2. The index number can be encrypted or Not encrypted. And add corresponding identifiers to the delivered media streams, for example, add corresponding identifiers to media streams encrypted by MTK according to different keys.

The identifier can also be a timestamp directly, for example, the timestamp of k1 is 00:00-00:30, and the timestamp of k2' is 00:30-00:50.

45. The BM-SC sends the obtained key to the UE;

46. The UE uses an appropriate key to decrypt the media stream according to the identification.

If the identifier is an index number, the UE selects a corresponding key to decrypt the media stream according to the index number in the media stream.

If the identifier is a time stamp, the UE keeps the time synchronized with the BM-SC time, determines the correct key by judging the time, and if the UE time is within the range of 00:00-00:30 at this time, use k1 to decrypt; If the UE time is within the range of 00:30-00:50 at this time, k2' is used for decryption.

It can be seen that in this embodiment, a corresponding identifier is added to each key corresponding to the obtained user request duration, and when the user receives a media stream containing the identifier, the corresponding key can be found directly through the identifier in the media stream. key for fast decryption. By setting the update frequency of the root key in the key chain, and encrypting the obtained key before issuing it, the security of media stream data transmission is enhanced.

Of course, the BM-SC may not add an identifier to the issued key, and when the UE receives the key, it may adopt a trial-by-case method to select the correct key to decrypt the received media stream or other data.

For multicast and broadcast technologies in the field of mobile communications, from the perspective of service data, multicast broadcast charges users, while from the perspective of bearer, multicast charges users and content providers, and broadcast only charges content providers. merchant charges. In the prior art, charging is mainly based on the user's contract status, such as a monthly subscription service. However, the billing method based on the user's subscription status cannot meet the needs of the user. For example, the user only wants to enjoy MBMS in a certain period of time, but does not need it in other periods of time; or, a user first tries to watch a program for a few minutes , and then decide whether to continue reading, then the existing billing method based on the user's subscription status cannot meet the needs of these users.

Embodiment 4. On the basis of the above embodiments, how to implement time-sharing charging in the process of issuing keys will be specifically described below.

Referring to FIG. 5 , it is a flow chart of a method for issuing a key according to Embodiment 4 of the present invention, which specifically includes steps:

51. The UE sends a key request carrying the duration requested by the user to the BM-SC;

In the MBMS service, firstly, the BM-SC notifies the UE of the business service list in the form of broadcast through the service announcement message, and the UE selects the media stream to join, and notifies the BM-SC through the HTTP POST message, in which the message contains The duration option is used for the UE to select or fill in the duration of the service it wants to enjoy.

52. The BM-SC calculates and deducts the fee corresponding to the duration of the user request according to the duration of the user request carried in the key request and the set fee per unit duration.

For example, if the duration requested by the user is 40 minutes, and the unit duration fee is set as 1 yuan per 10 minutes, the user fee that should be deducted is 4 yuan.

Still assuming that the key replacement frequency is once every 10 minutes, the root key of the set key chain is k1, and the one-way function is f, then the keys in the key chain are k1, k2, k3, ..... ., among them, k2=f(k1), k3=f(k2), k3=f ² (k1),...Assume starting from 00:00 every day, 00:00-00:10 , use k3 encryption; 00:10-00:20 minutes, use k2 encryption, 00:20-00:30 minutes, use k1 encryption,...

If at 00:07 a key request with a duration of 10 minutes is received from the UE, the key used by the user should not be able to open the media stream after 00:17. The time will change, that is, until 00:20, so users may enjoy a few more minutes of service.

The faster the key change frequency, the more accurate the billing.

In the above embodiments and specific implementations, the duration requested by the user may also be other time-related information, for example, a certain period of time requested by the user, or a service program selected by the user, or these Any one or a combination of multiple items. For example, the BM-SC can know the broadcast duration and specific time of the program according to the service program selected by the user. The time period requested by the user may also be a specific period of time in the future. For example, the current time is 00:00, and the user may request a media stream within the time period of 01:00-01:40.

The key distribution method provided by the embodiment of the present invention has been described above in detail. In order to enable those skilled in the art to better realize the technical solution provided by the embodiment of the present invention, the key distribution method provided by the embodiment of the present invention is as follows: The equipment is described in detail.

Referring to FIG. 6, it is a structural diagram of a key delivery device according to Embodiment 5 of the present invention. The key delivery device includes:

A receiving unit 61, configured to receive a key request carrying time-related information;

The storage unit 62 is used to store the set key change frequency and the set key chain;

The key acquisition unit 63 is configured to obtain the time-related information corresponding to the time-related information from the set key chain stored in the storage unit 62 according to the current specific time and the set key change frequency stored in the storage unit 62. at least one key of the

The key delivery unit 64 is configured to deliver the key acquired by the key acquisition unit 63 .

With the key delivery device described in this embodiment, no matter how long the user request is, all key delivery can be completed with only one message interaction. For services with a large number of users such as MBMS, a large number of interactive messages can be saved, so server resources and network transmission resources can be saved.

The above-mentioned key delivery device may further include: an encryption unit and a data delivery unit, wherein:

An encryption unit, configured to encrypt data within a determined time period using the key corresponding to the time period obtained from the key chain according to the current specific time and the key change frequency;

The data delivery unit is configured to deliver the data encrypted by the encryption unit.

The data delivered by the data delivery unit may be a media stream or another key to better ensure data security.

Referring to FIG. 7 , it is a structural diagram of a key issuing device according to Embodiment 6 of the present invention. In order to ensure data security, a key chain generation unit 71 can be set in the above key issuing device to pass a root key and a one-way function to generate the keychain.

Through the key generation unit 71, the number of keys in the key chain generated within a certain period of time can be determined according to specific conditions. For example: set a root key as k1 and a key chain generated by f as the one-way function, then the keys in the key chain generated by k1 and f are k1, k2, k3, ... Among them, k2=f(k1), k3=f(k2), k3=f ² (k1),  …

On the basis of Embodiment 6, in order to ensure data security, a parameter update unit can be further set. Referring to FIG. 8 , it is a structural diagram of a key distribution device in Embodiment 7 of the present invention. On the basis of the key distribution device shown, a parameter update unit 81 is further added, which is used to update the root key and/or one-way function in the key chain generation unit according to the set frequency.

In the key delivery device described in the above embodiments, a key encryption unit may also be included, which is used to encrypt the key obtained by the key acquisition unit, and then the key is issued after encryption. Unit 64 distributes the encrypted key, so as to ensure the security of data transmission.

In order for the UE to quickly use an appropriate key to decrypt data such as media streams, the key issuing device may further include an identification adding unit, configured to add an identification to the key obtained by the key obtaining unit 63 .

The identifier can specifically be an index number or a time stamp.

For multicast and broadcast technologies in the field of mobile communications, from the perspective of service data, multicast broadcast charges users, while from the perspective of bearer, multicast charges users and content providers, and broadcast only charges content providers. merchant charges. In the prior art, charging is mainly based on the user's contract status, such as a monthly subscription service. However, the method of charging according to the user's subscription status cannot meet the user's needs. For example, the user only wants to enjoy MBMS in a certain period of time, but does not need it in other periods of time. Or, a user tries to watch a program for a few minutes first, and then decides whether to continue watching, then the existing charging mode based on the user's subscription cannot meet the needs of these users.

Embodiment 8. On the basis of the above embodiments and implementations, the key delivery device may further include a fee management unit for implementing time-sharing charging for users. Referring to FIG. The structure diagram of the key issuing device, the key issuing device further includes a fee management unit 91, which is used to perform charging management according to the time-related information and the set fee within the unit duration. For example, the fee corresponding to the time-related information may be calculated and deducted according to the time-related information and the set fee per unit duration.

In the key distribution device mentioned in the above embodiments, the time-related information is at least one of the duration requested by the user, the time period requested by the user, and the service program requested by the user.

The device for delivering the key may be implemented by a BM-SC in MBMS.

Those of ordinary skill in the art can understand that all or part of the steps in the method of the above-mentioned embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the program can be executed during execution , including the following steps:

Receive a key request carrying time-related information;

According to the current specific time and the set key change frequency, at least one key corresponding to the time-related information is obtained from the set key chain, and the key is issued.

The storage medium, such as: ROM/RAM, magnetic disk, optical disk, etc.

As can be seen from the above embodiments, the present invention has the following beneficial effects:

Since the key corresponding to the time-related information can be obtained from the set key chain according to the current specific time and the set key change frequency, and the key is issued at one time, there is no need to The key is issued once every time the key is changed, thereby reducing the number of times of key issuance, thereby reducing resource consumption of network devices and saving network transmission resources.

Especially in order to ensure the reliability of the message in the UDP transmission mode, reduce the number of key delivery times, and also reduce the number of confirmation messages, especially when there is a lot of user data, it can save a lot of network equipment and network transmission resources.

By encrypting the delivered key, the security of the delivered key is enhanced.

By adding an identifier to the generated key, it is convenient for the UE to quickly select the correct key for decryption when needed.

In addition, by calculating and deducting the fee corresponding to the time-related information according to the time-related information in the key request and the fee per unit duration, it is possible to realize charging by time intervals and meet user needs.

The method and device for issuing a key provided by the present invention have been described in detail above through the embodiments, and the descriptions of the above embodiments are only used to help understand the method and the idea of the present invention; at the same time, for those of ordinary skill in the art , according to the idea of the present invention, there will be changes in the specific implementation and scope of application. In summary, the contents of this specification should not be construed as limiting the present invention.

Claims (14)

1. A key delivery method, characterized in that, comprising: Receive a key request carrying time-related information; According to the current specific time and the set key change frequency, at least one key corresponding to the time-related information is obtained from the set key chain, and the key is issued. 2. The key delivery method according to claim 1, further comprising: According to the current specific time and the set frequency of changing the key, the key corresponding to the time period acquired from the key chain is used to encrypt the data within a determined time period and deliver it. 3. The key distribution method according to claim 1 or 2, wherein the key chain is generated by a root key and a one-way function. 4. The key delivery method according to claim 3, further comprising: At least one of the root key and the one-way function is replaced according to a set frequency. 5. The key delivery method according to claim 2, further comprising: before delivering the key: Add an identifier to the key. 6. The key distribution method according to claim 5, wherein the identification is an index number or a time stamp. 7. The key delivery method according to claim 1, further comprising: According to the time-related information and the set fee per unit duration, corresponding billing processing is performed. 8. The key delivery method according to claim 1 or 7, wherein the time-related information is specifically at least one of the duration requested by the user, the time period requested by the user, and the service program requested by the user. 9. A key delivery device, characterized in that it comprises: a receiving unit, configured to receive a key request carrying time-related information; The storage unit is used to store the set key change frequency and the set key chain; A key acquisition unit, configured to acquire at least one key corresponding to the time-related information from the key chain stored in the storage unit according to the current specific time and the set key change frequency stored in the storage unit. key; A key delivery unit, configured to deliver the key obtained from the key acquisition unit. 10. The key issuing device according to claim 9, further comprising: An encryption unit, configured to encrypt data within a determined time period using the key corresponding to the time period obtained from the key chain according to the current specific time and the key change frequency; The data delivery unit is configured to deliver the data encrypted by the encryption unit. 11. The key issuing device according to claim 9, further comprising: a key chain generating unit, configured to generate the key chain by using a root key and a one-way function. 12. The key distribution device according to claim 11, further comprising: a parameter update unit, configured to update the root key and/or one-way key in the key chain generation unit according to a set frequency function. 13. The key delivery device according to any one of claims 9 to 12, further comprising: an identification adding unit, configured to add an identification to the key acquired by the key acquisition unit. 14. The key issuing device according to claim 9, further comprising: a fee management unit, configured to perform corresponding billing processing according to the time-related information and the set fee per unit duration .

Images