CN114531235A - End-to-end encrypted communication method and system - Google Patents

Abstract

The invention discloses an end-to-end encrypted communication method and system, and relates to the technical field of Internet information communication. The method includes: in a trusted environment, obtaining the public key key2 and authentication information of the second terminal; sending the first ciphertext information to the second terminal to obtain the access_token, symmetric key and corresponding symmetric encryption returned by the second terminal algorithm; send the access_token and the second ciphertext information to the second terminal to obtain the third ciphertext information returned by the second terminal; use the symmetric key and the corresponding symmetric encryption algorithm to decrypt the third ciphertext information to obtain The data response information. The invention realizes the safe transmission of data between the two parties based on the symmetric encryption algorithm in the transmission process, and presets the encryption scheme in the preparation stage, thereby eliminating the risk of the third party and the data transmission platform intercepting data packets from the middle layer to obtain user data, and the data is safe. Get double protection.

Description

End-to-end encrypted communication method and system

technical field

The present invention relates to the technical field of Internet information communication, in particular to an end-to-end encrypted communication method and system.

Background technique

In the Internet era, data information is the most important property of individuals, and the secure transmission of data is an important means to protect personal privacy. In order to protect the security of data transmission, encryption is usually required in the communication network. The data encryption transmission scheme provided in the prior art involves key information encryption, network layer encryption mechanism, application layer encryption mechanism and other encryption methods. These schemes still cannot well avoid the risk of third-party intervention to intercept and crack information, and data security has not been securely protected.

SUMMARY OF THE INVENTION

In view of the above problems, the present invention discloses an end-to-end encrypted communication method and system, so as to realize the safe transmission of data.

The technical scheme of the present invention includes:

An end-to-end encrypted communication method, applied to a first terminal, the steps of which include:

In a trusted environment, obtain the public key key2 and authentication information of the second terminal;

Send the first ciphertext information to the second terminal to obtain the access_token, the symmetric key and the corresponding symmetric encryption algorithm returned by the second terminal, wherein the first ciphertext information includes: all encrypted data encrypted by using the public key key2. Described authentication information, described access_token includes described symmetric key encrypted by public key key2;

Send the access_token and the second ciphertext information to the second terminal to obtain the third ciphertext information returned by the second terminal, wherein the second ciphertext information includes: data request information encrypted by using the symmetric key, so The third ciphertext information is obtained based on the second ciphertext information and the access_token including the symmetric key encrypted by the public key key2, and the third ciphertext information includes: encrypted data response information;

Decrypt the third ciphertext information by using the symmetric key and the corresponding symmetric encryption algorithm to obtain the data response information.

Further, the first terminal includes: a client terminal, a PC terminal or a Web terminal.

Further, when the first terminal is a client, the obtaining the public key key2 and authentication information of the second terminal includes:

Create a public-private key pair;

The public key key1 in the public-private key pair and the identity information of the first terminal are sent to the second client to obtain the public key key2 and authentication information of the second terminal.

Further, when the first terminal is a client, obtaining the access_token, symmetric key and corresponding symmetric encryption algorithm returned by the second terminal includes:

sending the first ciphertext information to the second terminal, where the first ciphertext information further includes: a unified unique identification code of the first terminal encrypted by using the public key key2;

Obtain access_token and fourth ciphertext information, where the fourth ciphertext information includes: a symmetric key encrypted with the public key key1 and a corresponding symmetric encryption algorithm;

Use the private key key A to decode the fourth ciphertext information to obtain a symmetric key and a corresponding symmetric encryption algorithm.

Further, when the first terminal is a PC terminal or a Web terminal, the obtaining the public key key2 and authentication information of the second terminal includes:

establishing a connection with a third client, wherein the third client has established a trust relationship with the second terminal;

Receive the authentication information sent by the third client, where the authentication information is an authorization code or an invitation code generated by the second terminal, and the authorization code or the invitation code includes the public key key2.

Further, when the first terminal is a PC terminal or a Web terminal, obtaining the access_token, symmetric key and corresponding symmetric encryption algorithm returned by the second terminal includes:

generate a set of ephemeral symmetric keys;

In a trusted environment, the first ciphertext information is sent to the third client, so that the second terminal generates an access_token based on the first ciphertext information sent by the third client and the identification information of the first terminal , and send the access_token, the symmetric key and the corresponding symmetric encryption algorithm to the first terminal, wherein the first ciphertext information further includes: the temporary symmetric key encrypted with the public key key2.

Further, the third ciphertext information is obtained based on the second ciphertext information and the access_token containing the symmetric key encrypted by the public key key2:

Verify the first terminal identity information in the access_token;

For the access_token passing the verification, use the corresponding private key keyB of the public key key2 to decrypt the symmetric key encrypted by the public key key2 in the access_token;

decrypting the second ciphertext information using the symmetric key to obtain the data request information;

Based on the data request information, obtain data response information;

The data response information is encrypted using the symmetric key and the corresponding symmetric encryption algorithm to generate third ciphertext information.

A storage medium in which a computer program is stored, wherein the computer program is configured to execute any one of the above methods when running.

A terminal is characterized by comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute any one of the above methods.

An end-to-end encrypted communication system includes a first terminal and a second terminal,

The first terminal is used to obtain the public key key2 and authentication information of the second terminal in a trusted environment; send the first ciphertext information to the second terminal to obtain the access_token, symmetric key and corresponding Symmetric encryption algorithm, the first ciphertext information includes: the authentication information encrypted by using the public key key2, the access_token contains the symmetric key encrypted by the public key key2; the access_token and the second ciphertext The information is sent to the second terminal to obtain third ciphertext information returned by the second terminal, where the second ciphertext information includes: data request information encrypted by using the symmetric key; using the symmetric key and corresponding symmetric key An encryption algorithm decrypts the third ciphertext information to obtain the data response information;

The second terminal is used to generate a public-private key pair; according to the first ciphertext information, the access_token, the symmetric key and the corresponding symmetric encryption algorithm are obtained; based on the second ciphertext information and the access_token, the access_token contains the data encrypted by the public key key2 The symmetric key is used to obtain the third ciphertext information.

Compared with the prior art, the present invention has at least the following advantages:

1. The present invention presets an encryption scheme in the preparation stage of data transmission, thereby ensuring that the data is in a relatively safe environment before starting transmission;

2. In the transmission process of the present invention, the symmetric encryption algorithm is used to realize the safe transmission of data between the two parties, thereby eliminating the risk of the third party and the data transmission platform intercepting data packets from the middle layer to obtain user data, and data security is double protected.

Description of drawings

Fig. 1 is a system diagram of the present invention.

Fig. 2 is a flow chart of the method of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only specific embodiments of the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

The present invention provides an end-to-end encrypted communication system, as shown in FIG. 1 , including a first terminal and a second terminal, and the opposite terminal that establishes a communication connection between the first terminal and the second terminal includes but is not limited to a client , PC terminal or Web terminal; the second terminal is the opposite terminal that establishes a communication connection with the first terminal, which is a service that can be stored and run in the operating system, including but not limited to a service with a processor and a Memory An electronic device or a computer-readable storage medium.

The encrypted communication method provided by the present invention, as shown in Figure 2, includes:

Step 110: In a trusted environment, obtain the public key key2 and authentication information of the second terminal.

In an example, when the first terminal is a client, the initialized first terminal is paired and connected with the second terminal in a trusted environment. Optionally, the trusted environment may be implemented based on Bluetooth function or U disk transmission.

After the two ends are connected, the first terminal creates keys key1 (public key), key A (private key), and the second terminal creates keys key2 (public key) and key B (private key).

At this time, in a trusted environment, the first terminal sends its public key key1 and identity information to the second terminal, and the second terminal sends the public key key2 and authentication information to the first terminal after receiving it.

In another example, when the first terminal is in the form of a terminal other than a client, such as a PC terminal or a web terminal, since the first terminal does not have the Bluetooth function, the above-mentioned trusted environment can also be based on a third client Finish. That is, first select a third client that establishes a trust relationship with the second terminal based on the trusted environment.

After that, the second terminal creates keys key2 (public key) and key B (private key), and sends an authentication information (eg, authorization code or invitation code) carrying the public key key2 to the third client.

The first terminal obtains the public key key2 through the authentication information obtained from the third client.

Step 120: Send the first ciphertext information to the second terminal to obtain the access_token, symmetric key and corresponding symmetric encryption algorithm returned by the second terminal.

In an example, when the first terminal is a client, the first terminal uses the RSA asymmetric encryption algorithm, encrypts the authentication information (for example, auth_key) and the client-UUID (terminal unified unique identification code) with the public key key2, and obtains the first ciphertext information, and send the first ciphertext information to the second terminal.

After receiving the first ciphertext information, the second terminal generates an access_token, wherein the access_token contains the symmetric key encrypted by the public key key2, and returns the access credential access_token, the symmetric key encrypted by the public key key1, and AES (Advanced Encryption Standard) symmetric encryption algorithm information, according to which the two ends establish a mutual connection and access trust relationship.

In another example, when the first terminal is in the form of a terminal other than a client, the first terminal will generate a set of temporary symmetric keys, and use the public key key2 to encrypt the set of temporary symmetric keys and the authorization code/invitation code to the second terminal.

The second terminal generates an access credential access_token after verifying its identity, wherein the access_token contains the symmetric key encrypted by the public key key2, and returns the access_token, symmetric key and symmetric encryption algorithm information to the first terminal in a trusted environment The terminal, according to which the two ends establish a mutual connection and access trust relationship.

In the above two examples, the symmetric encryption algorithm information is used for the algorithm information used when the first terminal decrypts the subsequent data transmission, including basic content such as formula information of the algorithm; optionally, the symmetric algorithm information may be AES ( Advanced Encryption Standard), DES (Data Encryption Standard), etc.

Step 130: Send the access_token and the second ciphertext information to the second terminal to obtain the third ciphertext information returned by the second terminal.

After steps 110-120, the first terminal and the second terminal have established a mutual trust relationship. At this time, the first terminal can perform data transmission with the corresponding second terminal by virtue of the obtained access_token, which specifically includes:

Step 1301: the first terminal uses the data request information encrypted by the symmetric key to obtain the second ciphertext information, and sends the access_token and the second ciphertext information to the second terminal;

Step 1302: After receiving the access_token and the second ciphertext information, the second terminal verifies the access_token and the identity information of the first terminal contained in the access_token to determine the identity of the first terminal;

Step 1303: After the verification is passed, use the private key keyB to decrypt the access_token to obtain the symmetric key;

Step 1304: Decrypt the first ciphertext information using the symmetric key to obtain data request information;

Step 1305: Generate data response information of the data request information;

Step 1306: Use the symmetric key to encrypt the data response information, and generate third ciphertext information to the first terminal.

Step 140: Decrypt the third ciphertext information using the symmetric key and the corresponding symmetric encryption algorithm to obtain data response information.

After receiving the third ciphertext, the first terminal decrypts the third ciphertext information by using the symmetric key and the corresponding symmetric encryption algorithm, thereby obtaining the corresponding information of the data generated by the second terminal.

The above description is only a preferred embodiment of the present invention, and is not intended to limit the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the present invention. within the scope of protection.

Claims (10)

1. A communication method of end-to-end encryption is applied to a first terminal, and the steps comprise:

under a trusted environment, acquiring a public key2 and authentication information of the second terminal;

sending the first ciphertext information to the second terminal to obtain an access _ token, a symmetric key and a corresponding symmetric encryption algorithm returned by the second terminal, wherein the first ciphertext information comprises: the authentication information encrypted using the public key2, the access token having the symmetric key therein encrypted by a public key 2;

sending the access _ token and the second ciphertext information to the second terminal to obtain third ciphertext information returned by the second terminal, wherein the second ciphertext information comprises: data request information encrypted by using the symmetric key, wherein the third ciphertext information is obtained based on the second ciphertext information and the symmetric key included in the access _ token and encrypted by using the public key2, and the third ciphertext information comprises: encrypted data response information;

and decrypting the third ciphertext information by using the symmetric key and a corresponding symmetric encryption algorithm to obtain the data response information.

2. The method of claim 1, wherein the first terminal comprises: client, PC end or Web end.

3. The method as claimed in claim 2, wherein when the first terminal is a client, the obtaining 2 the public key and the authentication information of the second terminal includes:

creating a public and private key pair;

and sending the public key1 in the public and private key pair and the identity information of the first terminal to the second client so as to obtain a public key2 and authentication information of the second terminal.

4. The method of claim 3, wherein when the first terminal is a client, the obtaining of the access _ token, the symmetric key and the corresponding symmetric encryption algorithm returned by the second terminal comprises:

sending the first ciphertext information to a second terminal, where the first ciphertext information further includes: the first terminal uniform unique identification code encrypted by using the public key 2;

obtaining access _ token and fourth ciphertext information, wherein the fourth ciphertext information comprises: a symmetric key and corresponding symmetric encryption algorithm encrypted using public key 1;

and decoding the fourth ciphertext information by using the private key A to obtain a symmetric key and a corresponding symmetric encryption algorithm.

5. The method as claimed in claim 2, wherein when the first terminal is a PC terminal or a Web terminal, the obtaining the public key2 and the authentication information of the second terminal includes:

establishing connection with a third client, wherein the third client and the second terminal establish a trust relationship;

and receiving authentication information sent by the third client, wherein the authentication information is an authorization code or an invitation code generated by the second terminal, and the authorization code or the invitation code includes the public key 2.

6. The method of claim 5, wherein when the first terminal is a PC terminal or a Web terminal, the obtaining of the access _ token, the symmetric key and the corresponding symmetric encryption algorithm returned by the second terminal comprises:

generating a set of temporary symmetric keys;

under the trusted environment, the first ciphertext information is sent to the third client, so that the second terminal generates an access _ token based on the first ciphertext information sent by the third client and the identification information of the first terminal, and sends the access _ token, the symmetric key and the corresponding symmetric encryption algorithm to the first terminal, wherein the first ciphertext information further comprises: the temporary symmetric key encrypted using the public key 2.

7. The method of claim 1, wherein the third ciphertext information is derived based on the second ciphertext information and the symmetric key included in the access token that is encrypted by a public key 2:

verifying the first terminal identity information in the access _ token;

decrypting the symmetric key encrypted by the public key2 in the authenticated access _ token by using a private key keyB corresponding to the public key 2;

decrypting the second ciphertext information using the symmetric key to obtain the data request information;

obtaining data response information based on the data request information;

and encrypting the data response information by using the symmetric key and the corresponding symmetric encryption algorithm to generate third ciphertext information.

8. A storage medium having a computer program stored thereon, wherein the computer program is arranged to, when executed, perform the method of any of claims 1-6.

9. A terminal, characterized in that it comprises a memory in which a computer program is stored and a processor arranged to run the computer program to perform the method according to any of claims 1-6.

10. A communication system for end-to-end encryption comprises a first terminal and a second terminal,

the first terminal is used for acquiring a public key2 and authentication information of the second terminal in a trusted environment; sending the first ciphertext information to the second terminal to obtain an access _ token, a symmetric key and a corresponding symmetric encryption algorithm returned by the second terminal, wherein the first ciphertext information comprises: the authentication information encrypted using the public key2, the access token having the symmetric key therein encrypted by a public key 2; sending the access _ token and the second ciphertext information to the second terminal to obtain third ciphertext information returned by the second terminal, wherein the second ciphertext information comprises: data request information encrypted using the symmetric key; decrypting the third ciphertext information using the symmetric key and a corresponding symmetric encryption algorithm to obtain the data response information;

the second terminal is used for generating a public and private key pair; obtaining an access _ token, a symmetric key and a corresponding symmetric encryption algorithm according to the first ciphertext information; and obtaining the third ciphertext information based on the second ciphertext information and the symmetric key encrypted by the public key2 contained in the access _ token.

Images