Secret communication method, terminal, equipment, platform, storage medium and product

Abstract

The invention discloses a secret communication method, a first terminal, first equipment, a first platform, a computer readable storage medium and a computer program product, and the method comprises the steps: the first terminal determines a first secret key and a second secret key, encrypts a first parameter based on the first secret key and the second secret key, and obtains a second parameter, sending a first request including the second parameter to the first device; the first device receives the first request and sends a second parameter to the first platform; the first platform receives the second parameter, determines a third key and a second key, decrypts the second parameter based on the third key and the second key to obtain a first parameter, retrieves based on the first parameter to obtain a second retrieval result, encrypts the second retrieval result based on the second key to obtain a first retrieval result, and sends the first retrieval result to the second platform; sending a first message including the first retrieval result to the first device; the first device receives and forwards the first message to the first terminal; and the first terminal receives the first message, and decrypts the first retrieval result based on the second key to obtain a second retrieval result.

Description

Technical Field

[0001] The present application relates to but is not limited to the field of communications, and in particular to a confidential communication method, a first terminal, a first device, a first platform, a computer-readable storage medium, and a computer program product. Background Art

[0002] In today's era, data governance and data sharing have been widely used in various fields. The data governance platform centrally manages the internal and external data assets of the enterprise. By providing standardized application program interface (API) interface services, it can open the cleaned and integrated data to various application systems and developers, which greatly promotes the full utilization of data resources. With the development of data classification and security protection, the open interface service functions for trusted data in related technologies are not sound and complete. For example, the transmission encryption method of the data open interface in related technologies considers that it is difficult for clients in untrusted environments to save key information, so some transmission encryption methods consider using symmetric encryption.

[0003] However, when symmetric encryption is used for encrypted transmission, once the symmetric key is leaked, all interface service data will be cracked. Summary of the invention

[0004] The embodiments of the present application disclose a confidential communication method, a first terminal, a first device, a first platform, a computer-readable storage medium, and a computer program product, which solve the problem in the related art that all interface service data may be cracked.

[0005] In a first aspect, the present application provides a secure communication method, which is applied to a first terminal and includes:

[0006] Determine a first key and a second key; wherein the second key is a dynamic key;

[0007] Encrypting a first parameter based on the first key and the second key to obtain a second parameter; wherein the first parameter includes keywords that support retrieval;

[0008] Sending a first request to a first device; wherein the first request includes a second parameter;

[0009] Receiving a first message sent by the first device; wherein the first message includes a first search result;

[0010] The first search result is decrypted based on the second key to obtain a second search result.

[0011] In a second aspect, an embodiment of the present application provides a secure communication method, which is applied to a first device, including:

[0012] receiving a first request sent by a first terminal; wherein the first request includes a second parameter; the second parameter is obtained by encrypting the first parameter by the first terminal based on a first key and a second key; the second key is a dynamic key; the first parameter includes a keyword that supports retrieval;

[0013] Sending a second parameter to the first platform;

[0014] Receive a first message sent by the first platform, and forward the first message to the first terminal; wherein the first message includes a first search result.

[0015] In a third aspect, an embodiment of the present application provides a confidential communication method, which is applied to a first platform and includes:

[0016] Receiving a second parameter sent by the first device; wherein the second parameter is obtained by encrypting the first parameter by the first terminal based on the first key and the second key;

[0017] Determine a third key and a second key; wherein the second key is a dynamic key; the first key and the third key are a set of symmetric keys;

[0018] decrypting the second parameter based on the third key and the second key to obtain the first parameter;

[0019] Perform a search based on the first parameter to obtain a second search result;

[0020] Encrypting the second search result based on the second key to obtain a first search result;

[0021] Send a first message to the first device; wherein the first message includes a first search result.

[0022] In a fourth aspect, an embodiment of the present application provides a first terminal, wherein the first terminal includes:

[0023] A first processing module, configured to determine a first key and a second key; wherein the second key is a dynamic key;

[0024] The first processing module is further used to encrypt the first parameter based on the first key and the second key to obtain the second parameter; wherein the first parameter includes keywords that support retrieval;

[0025] A first sending module, configured to send a first request to a first device; wherein the first request includes a second parameter;

[0026] A first receiving module, configured to receive a first message sent by the first device; wherein the first message includes a first search result;

[0027] The first processing module is further configured to decrypt the first search result based on the second key to obtain a second search result.

[0028] In a fifth aspect, an embodiment of the present application provides a first device, wherein the first device includes:

[0029] a second receiving module, configured to receive a first request sent by a first terminal; wherein the first request includes a second parameter; the second parameter is obtained by encrypting the first parameter by the first terminal based on a first key and a second key; the second key is a dynamic key; and the first parameter includes keywords that support retrieval;

[0030] A second sending module, used for sending a second parameter to the first platform;

[0031] The second receiving module is further used to receive a first message sent by the first platform and forward the first message to the first terminal; wherein the first message includes a first search result.

[0032] In a sixth aspect, an embodiment of the present application provides a first platform, wherein the first platform includes:

[0033] A third receiving module is used to receive a second parameter sent by the first device; wherein the second parameter is obtained by encrypting the first parameter by the first terminal based on the first key and the second key;

[0034] A third processing module, used to determine a third key and a second key; wherein the second key is a dynamic key; the first key and the third key are a group of symmetric keys;

[0035] The third processing module is further used to decrypt the second parameter based on the third key and the second key to obtain the first parameter;

[0036] The third processing module is further used to perform a search based on the first parameter to obtain a second search result;

[0037] The third processing module is further used to encrypt the second search result based on the second key to obtain the first search result;

[0038] The third sending module is used to send a first message to the first device; wherein the first message includes a first search result.

[0039] In a seventh aspect, an embodiment of the present application provides a first terminal, wherein the first terminal includes:

[0040] A first memory, used to store executable instructions;

[0041] The first processor is used to implement the above-mentioned confidential communication method when executing the executable instructions stored in the first memory.

[0042] In an eighth aspect, an embodiment of the present application provides a first device, wherein the first device includes:

[0043] A second memory, used for storing executable instructions;

[0044] The second processor is used to implement the above-mentioned confidential communication method when executing the executable instructions stored in the second memory.

[0045] In a ninth aspect, an embodiment of the present application provides a node in a first group, wherein the nodes in the first group include:

[0046] A third memory, used to store executable instructions;

[0047] The third processor is used to implement the above-mentioned confidential communication method when executing the executable instructions stored in the third memory.

[0048] In the tenth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned confidential communication method.

[0049] In an eleventh aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements the above-mentioned confidential communication method when executed by a processor.

[0050] In a twelfth aspect, an embodiment of the present application provides a computer program which, when executed on a computer, enables the computer to execute the above-mentioned confidential communication method.

[0051] This application protects the data query parameter, i.e., the first parameter, based on a two-layer encryption protection mechanism of the first key and the third key, i.e., RSA and the dynamic key, i.e., the second key, to achieve "one thing, one secret", avoid the leakage of trusted data, and improve the security protection and tamper-proof capabilities of the request body; at the same time, this application encrypts the return value fed back from the first platform to the first device, i.e., the second search result, based on the dynamic key, to achieve dynamic encryption of the return result, effectively prevent key leakage, and ensure the security of data transmission throughout the entire process. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A schematic diagram of a secure communication system according to an embodiment of the present application;

[0053] Figure 2A schematic diagram of a secure communication platform according to an embodiment of the present application;

[0054] Figure 3 Schematic diagram of the process of the secure communication method provided in the embodiment of the present application Figure 1 ;

[0055] Figure 4 This is an API interface service registration and application flow chart provided by this application;

[0056] Figure 5 This is a flowchart of calling the API interface service in the embodiment of the present application;

[0057] Figure 6 Schematic diagram of the process of the secure communication method provided in the embodiment of the present application Figure 2 ;

[0058] Figure 7 A schematic diagram of a HASH operation provided in an embodiment of the present application;

[0059] Figure 8 A schematic block diagram of a first terminal provided in an embodiment of the present application;

[0060] Fig. 9 A schematic block diagram of a first device provided in an embodiment of the present application;

[0061] Fig.10 A schematic block diagram of a first node provided in an embodiment of the present application;

[0062] Fig.11 A schematic block diagram of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0063] The following will describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0064] Figure 1 It is a schematic diagram of a secure communication system provided in an embodiment of the present application.

[0065] like Figure 1 As shown, the secure communication system 100 may include a terminal device 110, a network device 120 and a secure communication platform 130. The network device 120 may communicate with the terminal device 110 via an air interface. The terminal device 110 and the network device 120 support multi-service transmission.

[0066] The confidential communication platform 130 is a secure shared interface service platform for trusted data, which is used to ensure that data is protected during transmission and storage to prevent unauthorized access, tampering or leakage.

[0067] It should be understood that the embodiments of the present application are only exemplified by the secure communication system 100, but the embodiments of the present application are not limited thereto. That is to say, the technical solutions of the embodiments of the present application can be applied to various communication systems to encrypt and transmit service data in various communication systems; exemplarily, various communication systems include but are not limited to Long Term Evolution (LTE) system, LTE Time Division Duplex (TDD), Universal Mobile Telecommunication System (UMTS), Internet of Things (IoT) system, Narrow Band Internet of Things (NB-IoT) system, Enhanced Machine Type Communications (eMTC) system, 5th Generation Mobile Communication Technology (5G) communication system, also known as New Radio (NR) communication system, or future communication system.

[0068] exist Figure 1 In the illustrated secure communication system 100, the network device 120 may be an access network device that communicates with the terminal device 110. The access network device may provide communication coverage for a specific geographical area, and may communicate with the terminal device 110 located in the coverage area.

[0069] The network device 120 may be an evolved Node B (eNB or eNodeB) in a Long Term Evolution (LTE) system, or a Next Generation Radio Access Network (NG RAN) device, or a base station (gNB) in an NR system, or a wireless controller in a Cloud Radio Access Network (CRAN), or the network device 120 may be a relay station, an access point, a vehicle-mounted device, a wearable device, a hub, a switch, a bridge, a router, or a network device in a future evolved Public Land Mobile Network (PLMN), etc.

[0070] The terminal device 110 includes but is not limited to any terminal device connected to the network device 120 or other terminal devices by wire or wireless connection.

[0071] Exemplarily, the terminal device 110 may refer to an access terminal, a user equipment (UE), a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, a wireless communication device, a user agent or a user device. The access terminal may be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, an IoT device, a satellite handheld terminal, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), a handheld device with wireless communication function, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal device in a 5G network or a terminal device in a future evolution network, etc.

[0072] The terminal device 110 may be used for device-to-device (D2D) communication.

[0073] Figure 1 A base station, a platform and two terminals are shown by way of example. Optionally, the key communication system 100 may include multiple base stations and each base station may include another number of terminals within its management scope, which is not specifically limited in the embodiments of the present application.

[0074] It should be noted that Figure 1It is only to illustrate the system to which the present application is applicable in the form of an example. Of course, the method shown in the embodiment of the present application can also be applied to other systems. In addition, the terms "system" and "network" are often used interchangeably in this article. The term "and / or" in this article is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship. It should also be understood that the "indication" mentioned in the embodiment of the present application can be a direct indication, an indirect indication, or an indication of an association relationship. For example, A indicates B, which can mean that A directly indicates B, for example, B can be obtained through A; it can also mean that A indirectly indicates B, for example, A indicates C, B can be obtained through C; it can also mean that there is an association relationship between A and B. It should also be understood that the "correspondence" mentioned in the embodiment of the present application can mean that there is a direct or indirect correspondence relationship between the two, or it can mean that there is an association relationship between the two, or it can mean that there is an indication and being indicated, configuration and being configured, etc. It should also be understood that the "predefined" or "predefined rules" mentioned in the embodiments of the present application can be implemented by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in devices (for example, including terminal devices and network devices), and the present application does not limit its specific implementation method. For example, predefined may refer to the definition in the protocol. It should also be understood that in the embodiments of the present application, the "protocol" may refer to a standard protocol in the field of communications, such as LTE protocols, NR protocols, and related protocols used in future communication systems, and the present application does not limit this.

[0075] To facilitate understanding of the technical solutions of the embodiments of the present application, the relevant technologies of the embodiments of the present application are described below. The following related technologies can be arbitrarily combined with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application.

[0076] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0077] Figure 2 It is a schematic block diagram of the secure communication platform provided in an embodiment of the present application.

[0078] A secure sharing interface service platform for trusted data, namely the confidential communication platform 130. The confidential communication platform 130 ensures the security, reliability and integrity of data during the authentication, query, processing and transmission process through a trusted execution environment, multiple encryption methods and blockchain technology. It provides a strong guarantee for the open sharing of trusted data. The confidential communication platform 130 is mainly composed of the data layer, trusted execution environment, server and client components:

[0079] Data layer: responsible for receiving and storing data products input from different data sources of the data governance platform. The storage database forms include but are not limited to full-text search databases (such as ElasticSearch, ES), data warehouses (such as HIVE), and relational databases (such as MYSQL / ORACLE). All databases use authentication and authorization, enable audit logs, and enable Transport Layer Security (TLS) / Secure Sockets Layer (SSL) for secure data transmission.

[0080] Trusted Execution Environment: The core component of the secure shared interface service platform, which provides a secure and isolated execution space to ensure the confidentiality, integrity and availability of data during processing and transmission. In this environment, data operations (such as query, encryption, calculation, etc.) are subject to strict access control and audit; the trusted execution environment mainly includes request authentication module, asymmetric encryption algorithm (such as Rivest-Shamir-Adleman, RSA) key management module, dynamic key management module, data service bus module, and various database adapter modules (such as ES adapter, HIVE adapter, MYSQL adapter, ORACLE adapter). It should be noted that the trusted execution environment is responsible for managing the generation, storage, and dynamic key policies of RSA keys and dynamic keys, and supports the decryption of request parameters, authentication of the requester, and encryption of query results; on the other hand, it uniformly processes various query requests based on the data bus mechanism, and calls the database adapter according to the actual database request of the specific business. The database adapter connects to the database and queries through TLS / SSL secure transmission in a trusted environment.

[0081] Server: Responsible for processing requests from clients, interacting with the trusted execution environment, and obtaining data required by the data layer. It mainly includes user management, data auditing, data resource management, data mart, interface service approval, interface service management, data service forwarding, key lifecycle management module and blockchain evidence module. The server manages users and authorizations of the entire platform through the user management module. Data resource registration, data resource approval and data mart are responsible for publishing the data resources of the data provider to the data mart after approval for other users to browse and apply for interface services. Interface service approval is responsible for managing the application process of the data sharing interface. The interface service management module is responsible for managing the sharing parameters, usage scope and whether the data sharing interface is open. Data service forwarding is responsible for accepting data requests from clients and forwarding them to the trusted execution environment, as well as returning the results of the trusted execution environment to the client. Key lifecycle management is responsible for managing the key replacement cycle and the dynamic encryption strategy of dynamic keys to enhance the security of keys. At the same time, the blockchain evidence module records the request information, return information and interface permission information during the data interface access process. Under the premise of ensuring that the privacy of user data is not leaked, it provides evidence for subsequent data traceability and data auditing.

[0082] Client: The interface for users to interact with the secure shared interface service platform. It supports integration into user programs in the form of a software development kit (SDK), or deployment locally in the form of an independent client. It is responsible for sending requests and receiving data returned by the server. The client includes an API service module, a dynamic key generation module, a data encryption and decryption processing module, and a blockchain evidence storage module. The API service module is mainly responsible for providing a user-oriented Restful interface, and the data encryption and decryption processing module is responsible for encrypting and sending data and decrypting and receiving data based on the client's key information. The dynamic key generation module derives dynamic keys based on the parameters requested by the client. The encryption strategy of the client depends on the key life cycle management of the server. The key replacement mechanism is implemented through regular version updates, and the dynamic key module and RSA key are synchronized. The blockchain evidence storage module records the client's key generation records, interface usage records, query result records and other information, and provides data auditing and evidence traceability functions on the premise of ensuring the security of client data.

[0083] Figure 3 A flowchart of a secure communication method provided in an embodiment of the present application is shown in FIG. Figure 3 As shown, this method is applied to Figure 1 The secure communication system 100 shown, the method comprises:

[0084] Step 301: A first terminal determines a first key and a second key.

[0085] The second key is a dynamic key.

[0086] In some embodiments, the first terminal, namely Figure 1 The terminal device 110 receives the first device, that is, Figure 1 The first key is sent by the network device 120 in the first terminal, or the first key is obtained from the storage module of the first terminal.

[0087] In the embodiment of the present application, the first device sends the first key in the following ways: in-band, out-of-band, media, signaling, data, message, control plane, user plane, etc.

[0088] In the embodiment of the present application, the first key is the first terminal and the first platform, that is, Figure 1 The symmetric key is a symmetric key shared between the secure communication platforms in the first terminal or a symmetric key derived from the shared symmetric key. The symmetric key can be pre-set in the first terminal by offline filling for subsequent secure communication by the first terminal. The symmetric key can be a pair or multiple pairs. The symmetric key can be generated by a (quantum) random number generator.

[0089] In the embodiment of the present application, the second key is a dynamic key derived by the dynamic key generation module based on the request parameters of the first terminal.

[0090] In the embodiment of the present application, confidential communication includes querying sensitive information, transmitting encrypted emails, transmitting encrypted calls, transmitting encrypted short messages, transmitting encrypted instant messages, transmitting encrypted audio and video conferences, and transmitting encrypted 5G messages.

[0091] Step 302: The first terminal encrypts the first parameter based on the first key and the second key to obtain the second parameter.

[0092] The first parameter includes keywords that support retrieval.

[0093] In the embodiment of the present application, the first parameter is a parameter related to the request.

[0094] In some embodiments, the first terminal receives a dynamic encryption policy number sent by the first device, or obtains the dynamic encryption policy number from the storage module of the first terminal; determines a dynamic key encryption and decryption method based on the dynamic encryption policy number; encrypts the first parameter according to the dynamic key encryption and decryption method based on the second key to obtain an encrypted first parameter; signs the first parameter based on the second key to obtain a signature string; encrypts the signature string, the encrypted first parameter, user authorization authentication information, the application interface service identifier, the session identifier and the salt value based on the first key to obtain a second parameter.

[0095] Here, the dynamic key encryption and decryption method is used to characterize the algorithm used by the dynamic key to encrypt the request parameters, and the algorithm includes but is not limited to symmetric encryption algorithms such as AES algorithm and SM4 algorithm.

[0096] In the embodiment of the present application, the first terminal inputs the second key and the first parameter into a message authentication code (MAC) algorithm to obtain a first message authentication code, i.e., a signature string, wherein the first message authentication code can at least be used to verify the authenticity and integrity of the first information.

[0097] Here, MAC is a technology that ensures integrity and performs authentication. The input of a message authentication code is a message of any length and a key shared between the sender and the receiver. It can output fixed-length data, which is called MAC, sometimes also called Auth Tag.

[0098] It should be noted that the dynamic key management module in the first platform and the client jointly preset multiple types of dynamic key encryption and decryption methods in advance and unify the numbers. The first terminal can obtain the multiple types of dynamic key encryption and decryption methods that have been jointly preset and numbered in advance by logging into the client.

[0099] Step 303: The first terminal sends a first request including a second parameter to the first device.

[0100] Step 304: The first device receives a first request including a second parameter.

[0101] Step 305: The first device sends the second parameter to the first platform.

[0102] It should be noted that in order to protect the privacy of user query information and prevent the leakage of returned result data, the user query link needs to be encrypted, and the key management and encryption and decryption processing need to be performed in the trusted execution environment of the first platform to ensure the security, integrity and reliability of data transmission from query to database return. Therefore, the first device sends the relevant parameters to the first platform.

[0103] Step 306: The first platform receives the second parameter.

[0104] In the embodiment of the present application, after the first platform receives the second parameter, the first platform verifies whether the identifier of the device requested for retrieval is compliant. If not, the retrieval is rejected or the request is not responded to.

[0105] In the embodiment of the present application, after the first platform receives the second parameter, the first platform verifies whether the application program interface service corresponds to the identifier of the application program interface service. If not, the retrieval is rejected or the request is not responded to.

[0106] Step 307: The first platform determines the third key and the second key.

[0107] The first key and the third key are a set of symmetric keys.

[0108] In some embodiments, the first platform obtains the third key locally.

[0109] In some embodiments, after the first platform obtains the signature string, the first platform verifies the signature string.

[0110] Step 308: The first platform decrypts the second parameter based on the third key and the second key to obtain the first parameter.

[0111] In some embodiments, the first platform obtains the dynamic encryption policy number from the local; determines the dynamic key encryption and decryption method based on the dynamic encryption policy number; decrypts the encrypted first parameter based on the second key according to the dynamic key encryption and decryption method to obtain the first parameter. It should be noted that the algorithm used for decryption is also consistent with the pre-configuration of the server and the client during version synchronization, including but not limited to symmetric encryption algorithms such as AES algorithm and SM4 algorithm.

[0112] Step 309: The first platform performs a search based on the first parameter to obtain a second search result.

[0113] In the embodiment of the present application, the first platform first determines the corresponding database based on the keywords that support the search, and then searches from the corresponding database based on the keywords.

[0114] Step 310: The first platform encrypts the second search result based on the second key to obtain the first search result.

[0115] Here, the second key encrypts the search result, and still uses the dynamic key encryption and decryption method determined based on the dynamic encryption policy number to encrypt, so that it is more convenient for the first terminal to decrypt.

[0116] Step 311: The first platform sends a first message including a first search result to the first device.

[0117] It should be noted that the open interface service provided by the data platform of the relevant technology focuses on the identity authentication of the user and ignores the security encryption of data communication. A mature solution has not yet been provided for the sharing service of trusted data. In addition, from the perspective of the applicability of the interface service, many application scenarios involve non-system users who need to access or call the authorized data API without logging in. This also requires new security protection measures to ensure the secure opening of trusted data, especially the query parameters of the access process, the secure storage of the data provider's data, the encryption of the communication process, etc., which all require a system architecture based on a trusted environment and a communication confidentiality mechanism to implement; and the present application constructs a data API service device based on the first platform, that is, a trusted execution environment, a server and a client, to protect the user's query data request and the return result in the transmission link. The secure encryption, while facilitating the user to call the authorization authentication more conveniently and reliably.

[0118] Step 312: The first device receives a first message including a first search result.

[0119] Step 313: The first device forwards a first message including a first search result to the first terminal.

[0120] Step 314: The first terminal receives the first message.

[0121] Step 315: The first terminal decrypts the first search result based on the second key to obtain a second search result.

[0122] Here, the second key encrypts the search result, and the decryption is performed using a dynamic key encryption and decryption method determined based on the dynamic encryption policy number, so that the first terminal can decrypt more quickly.

[0123] An embodiment of the present application provides a confidential communication method, the method comprising: a first terminal determines a first key and a second key, wherein the second key is a dynamic key; the first terminal encrypts a first parameter based on the first key and the second key to obtain a second parameter, wherein the first parameter includes a keyword supported for retrieval; the first terminal sends a first request including the second parameter to a first device; the first device receives the first request including the second parameter; the first device sends the second parameter to a first platform; the first platform receives the second parameter; the first platform determines a third key and a second key, wherein the first key and the third key are a set of symmetric keys; the first platform decrypts the second parameter based on the third key and the second key to obtain the first parameter; the first platform retrieves based on the first parameter to obtain a second retrieval result; the first platform encrypts the second retrieval result based on the second key to obtain the first retrieval result; the first platform sends a first message including the first retrieval result to the first device; the first device receives the first message including the first retrieval result; the first device forwards the first message including the first retrieval result to the first terminal; the first terminal receives the first message; the first terminal decrypts the first retrieval result based on the second key to obtain the second retrieval result. That is to say, this application protects the data query parameter, i.e., the first parameter, based on a two-layer encryption protection mechanism of the first key and the third key, i.e., RSA and the dynamic key, i.e., the second key, to achieve "one thing, one secret", avoid the leakage of trusted data, and improve the security protection and anti-tampering capabilities of the request body; at the same time, this application encrypts the return value fed back from the first platform to the first device, i.e., the second search result, based on the dynamic key, to achieve dynamic encryption of the return result, effectively prevent key leakage, and ensure the security of data transmission throughout the entire process.

[0124] It should be noted that this application adopts a four-layer architecture based on the client, server, trusted execution environment and data layer to form a secure shared interface service platform for trusted data, namely the first platform. The blockchain-based evidence traceability and auditing ensures the security, reliability and integrity of data during the process of requesting authentication, querying, processing and transmission, providing a strong guarantee for the open sharing environment of trusted data.

[0125] In some embodiments, the method provided in the embodiments of the present application includes the following contents:

[0126] Step A1: The first terminal sends a second request to the first device.

[0127] Among them, the second request is used to register and apply for data resources; the data resources include one or more of the following: field categories that can be opened, field categories that are allowed to be searched, whether to perform anonymization, and the scope of user permissions that are opened.

[0128] Step A2: The first device receives the second request.

[0129] Step A3: review the second request and publish the relevant information of the data resource to the data mart of the first device.

[0130] Among them, relevant information includes data resource cataloging and data summary information.

[0131] Step A4: The first terminal sends a third request to the first device.

[0132] Among them, the third request is used to apply for application program interface open service.

[0133] Step A5: The first device receives the third request.

[0134] Step A6: The first device reviews the third request and sends an API key (APIKey) and an interface protocol including user authorization authentication information to the first terminal.

[0135] Among them, the user authorization authentication information is generated by the first platform based on the user name, password, application interface service identifier, request data table name, device whitelist list, and creation time information.

[0136] The interface protocol, or the calling protocol, includes the routing information of the first terminal, user authorization authentication information, the identification of the application program interface service, the search keyword information and the format of the query result.

[0137] Step A7: The first terminal receives the APIKey and the interface protocol.

[0138] It should be noted that steps A1 to A7 are the transaction process of interface service registration and application business mainly for data resources. This process enables the data provider to open data resources to data demanders. The data resources here are shared data synchronized to the data layer through the operation of the data governance platform. The shared data can be original data resources, standard data after data processing, or desensitized data.

[0139] Figure 4 This is a flowchart of API interface service registration and application provided by this application; the steps corresponding to API interface service registration and application are as follows Figure 4 As shown:

[0140] Step 401: The user requests to register a data resource.

[0141] Step 402: Server administrator review.

[0142] Step 403: The server publishes to the data mart; here, data summary information can be viewed on the data mart.

[0143] Step 404: The user applies for data API open service.

[0144] Step 405: Server administrator review.

[0145] Step 406: Generate an API open service, and send the APIKey and calling protocol of the API interface to the applicant.

[0146] Furthermore, the request initiated by the applicant based on APIKey and calling protocol does not require login authentication; that is, the applicant user logs in to the server page, mounts the data resources to be opened in the corresponding position of the data resource directory (if the required directory does not exist, apply for a new directory first) and submits a registration application. The application content covers the field categories that can be opened, the field categories allowed to be searched, whether to desensitize, and the scope of user permissions to be opened. After passing the review of the service administrator, it can be officially released and put on the shelves. The data resources on the shelves can be viewed centrally in the data mart, providing data resource cataloging and data summary information display. After that, the applicant logs in to the server page, browses the data items visible within the authorization scope in the data mart, and applies for API open services for the required data resources (one table corresponds to one API service). Here, the applicant needs to specify the IP whitelist of the device to be used, the number of uses, and the time limit for use. After the review is passed, the APIKey and calling protocol of the specific open API interface will be returned to the applicant. Among them, the APIKey is handed over to the applicant for safekeeping. When calling the API interface, the applicant initiates a request according to the calling protocol, and no longer needs to log in and authenticate, but completes the authentication based on the APIKey and IP information in the request interface.

[0147] Furthermore, APIKey needs to include the user's authorization and authentication information. At the same time, in order to prevent APIKey from being forged or cracked, its complexity needs to be increased. Therefore, the generation method of APIKey is based on the applicant's username, password, API service identifier (ID) (serverid), request data table name (tablename), device IP whitelist list (iplist), and creation time (createtime). It is generated in a trusted execution environment using an encryption algorithm such as the HMAC-SHA256 algorithm and provided to the server for use. The basic steps of HMAC-SHA256 encryption based on user registration interface information can be expressed as follows: the first platform, that is, the trusted execution environment obtains the fourth key, that is, the private key SK, username, password, serverid, tablename, iplist, and createtime in the current environment; based on username, password, serverid, tablename, iplist, and createtime, a first string M is generated; based on SK and M, user authorization and authentication information is generated.

[0148] Here, you can use the RSA management tool to obtain the private key SK in the current environment.

[0149] Here, M, i.e., the plain text information of APIKey, is constructed based on formula (1) by using special characters to connect the required information string.

[0150] M=concat(username||password||serverid||tablename||iplist||createtime) (1)

[0151] Here, based on SK and M, the user authorization authentication information generated includes:

[0152] According to the HMAC-SHA256 algorithm, APIKey is obtained based on SK, M and formula (2).

[0153] HMAC (SK,M)=SHA256(SK⊕opad,SHA256(SK⊕ipad,M)) (2)

[0154] Where: ⊕ represents an XOR operation, opad and ipad are two specific constant vectors, usually ipad is padded to 64 bytes with 0x36, opad is padded to 64 bytes with 0x5C, and SHA256 represents a secure hash function that outputs 256 bits.

[0155] In some embodiments, the first terminal and the first platform of the present application may determine the second key by the following steps:

[0156] Step B1: Obtain a session identifier, user authorization authentication information, an API service identifier, and an identifier of a first terminal.

[0157] Here, the first terminal directly obtains the session identifier, user authorization authentication information, the API service identifier, and the first terminal identifier. It should be noted that the user authorization authentication information may be sent to the first terminal by the first platform through the first device.

[0158] Here, the first platform decrypts the second parameter based on the third key to obtain user authorization authentication information, the identifier of the application interface service, the session identifier and the salt value. It should be noted that the identifier of the first terminal can be sent in advance to the first platform by the first terminal through the first device; or the first platform obtains it in the message corresponding to the second parameter, or the first platform obtains it through detection.

[0159] In the embodiment of the present application, the identification information of the first terminal includes but is not limited to a mobile station international Integrated Services Digital Network number (MSISDN), an international mobile subscriber identity (IMSI), an international mobile equipment identity (IMEI), a service identifier (such as the domain name of the terminal, etc.), and a service number of a user's application (such as a user identifier of a chat software, communication software, or other software installed on the terminal).

[0160] Step B2: Generate a multi-factor password for dynamic encryption based on the session identifier, user authorization authentication information, the identifier of the application program interface service and the identifier of the first terminal.

[0161] Step B3: Determine the second key based on the multi-factor password.

[0162] In the embodiment of the present application, step D3, based on the multi-factor password, determining the second key includes the following steps: determining a pseudo-random function; obtaining a specified number of iterations, a required output key length, and a randomly generated salt value; deriving a second key based on the multi-factor password, the specified number of iterations, the length, the salt value, and the pseudo-random function. Obviously, a derived key with high complexity, good security, and strong anti-cracking ability is generated based on multiple request parameters, and the encryption process performance is optimized, which can effectively improve the efficiency of generating derived keys, and realize the construction of a dynamic encryption method based on session parameters and interface business parameters based on the request parameters shared between the first terminal and the first platform.

[0163] This application builds a multi-factor derived key based on the request parameters, and performs key generation and dynamic encryption and decryption operations on both ends, avoiding insecure dynamic key storage and reducing the risk of key transmission. It solves the problem of insufficient security protection and low reliability when users query trusted data through the client, implements "one secret for one transaction", ensures that each session has a unique key, and achieves a higher level of security protection.

[0164] In some embodiments, the method provided in the embodiments of the present application includes the following contents:

[0165] Step C1: The first terminal sends a fourth request to the first platform.

[0166] The fourth request is used to update / initialize key information.

[0167] In an embodiment of the present application, the first platform may be a device that provides keys or key management services for at least two terminals performing confidential communication in a confidential communication system; the first platform includes but is not limited to a key management center (Key Management Center, KMC), a key management system (Key Management System, KMS), a key service center, a security service center, a key management platform / facilities that provide services for a specific business, etc.

[0168] Step C2: The first platform receives the fourth request.

[0169] Step C3: The first platform generates an updated / initialized first key and an updated / initialized third key.

[0170] Step C4: The first platform uniformly numbers and the first terminal jointly preset multiple types of dynamic key encryption and decryption methods in advance to generate an updated / initialized dynamic key policy number.

[0171] Step C5: The first platform sends the updated / initialized first key and the updated / initialized dynamic key policy number to the first device.

[0172] Step C6: The first device receives the updated / initialized first key and the updated / initialized dynamic key policy number.

[0173] Step C7: The first device sends a notification message to the first terminal.

[0174] The notification message is used to notify the first terminal to update the stored first key and dynamic key policy number.

[0175] Step C8: The first terminal receives the notification message.

[0176] In the embodiment of the present application, steps C1 to C8 are the entire service platform periodically initializing (updating the key) the keys used. The server initiates a request to initialize the key according to the timing strategy provided by the key lifecycle management, generates the latest version of the key in a trusted execution environment, and discards the previous version of the key; and shares the latest version of the key.

[0177] under, Figure 5 The following will describe an exemplary application of a method of calling an API interface service provided by an embodiment of the present application in a practical application scenario. The steps of calling an API interface service are as follows: Figure 5 As shown:

[0178] Step 501, the client initiates a data query request, that is, the authorized user of the client, according to the calling protocol, brings the APIKey, serverid and original query parameters into the client's API service interface on the machine specified in the open API interface whitelist and initiates a data query request.

[0179] Step 502: The client encrypts the query parameters using the dynamic key generated by the dynamic key policy and the public key of the trusted execution environment to obtain the encrypted parameters and the query signature, and then encrypts the query signature and the encrypted parameters to obtain an encrypted query body and sends it to the server.

[0180] Step 503: The server receives the encrypted query body and forwards the encrypted query body to the trusted execution environment for processing.

[0181] Step 504: In a trusted execution environment, the encrypted query body is decrypted using the private key and the dynamic key, and the requested IP is verified to be compliant, the service corresponds to the APIKey, and the query signature is verified to be consistent. If the request does not comply with the rules, step 505 is executed directly; if the request complies with the rules, step 506 is executed.

[0182] Step 505: Feedback that the request is not compliant is sent to the server, and then execute step 508.

[0183] Step 506: query the corresponding database, that is, the data service bus selects the corresponding database adapter according to the decrypted relevant information, and then performs a security query on the matching database to obtain the query result.

[0184] Step 507 , dynamically encrypt the query result to obtain an encrypted result, that is, after obtaining the query result, use the dynamic key generated by the dynamic encryption module to encrypt the query result to obtain an encrypted result; then execute step 508 .

[0185] Step 508: The server forwards relevant data to the client's request interface. The relevant data here includes the request non-compliant data or encryption results;

[0186] Step 509: The client decrypts the encryption result to obtain a plaintext query result, that is, the client decrypts the encryption result and verifies the signature information. After the verification is passed, the plaintext query result is returned to the caller through the API interface.

[0187] It should be noted that during the entire API interface communication process, only the client where the authorized user is located can view the plaintext query parameters and query results, and the data is encrypted during the transmission process from the client to the server and from the server to the trusted execution environment to protect information security, which can effectively prevent unauthorized interface access, third-party packet capture to steal data or tampering with data, and abnormal interface calls in different locations.

[0188] In the embodiment of the present application, under the open interface service architecture for trusted data, it is assumed that the client is an open and uncontrollable environment, and there are various security risks of cracking or tampering. Therefore, it is necessary to build a trusted execution environment outside the client and server, put the key management in the trusted execution environment, and perform trusted operations such as authentication, encryption, and decryption on the data communication between the client and the server to ensure the integrity and confidentiality of the data. Therefore, based on the trusted data security sharing API interface service, the embodiment of the present application provides a confidential communication method, the overall process is as follows Figure 6 As shown:

[0189] First, the entire service platform periodically initializes (updates) the keys used, i.e.

[0190] Step 601: The server initiates a key initialization request to the trusted execution environment according to the timing policy provided by the key lifecycle management;

[0191] Step 602: Generate a public key and a private key in a trusted execution environment, and obtain the current dynamic key policy number;

[0192] Step 603: The trusted execution environment returns the public key and dynamic key policy number to the server.

[0193] Step 604, the server notifies the client to update the stored public key and / or dynamic key policy number; that is, generate the latest version of the key in the trusted execution environment and discard the previous version of the key; then, in the data open interface encryption process, RSA public key encryption and dynamic key encryption are mainly used, wherein the RSA management module generates the required public key and private key, the dynamic key management module and the client jointly preset multiple types of dynamic key encryption and decryption methods in advance and unify the numbering, and provide the required encryption policy number when generating the dynamic key policy, and then send the latest public key and dynamic key policy number generated by the trusted execution environment to the server, the server writes the latest public key and encryption policy in a hard-coded form into the new version of the client software / SDK package (obfuscated coding package), and notifies the client to update the version. If the client uses an expired key or an invalid key to communicate, the server returns a prompt to update the version information. In this way, the service platform regularly completes the initialization / update of the keys used.

[0194] Secondly, the entire service platform uses keys for encrypted communication, that is,

[0195] Step 605, the user calls the API interface through the client / SDK to initiate a data query request based on encrypted communication to the server; the data query request includes the original query parameters; the data query request needs to prepare in advance the interface protocol provided when registering the interface service and the API key (APIKey) of the user authorization authentication information; the interface protocol includes the requested client routing information, query parameters (APIKey, serverid, keywords) and the return value format results; when registering the service, the data provider decides which fields are allowed to be searched as keywords, and the data provider also determines the public field range and corresponding desensitized fields of results when registering the service.

[0196] Step 606: The client encrypts the original query parameters based on the dynamic key valid for this session and generates a signature; that is, the client generates a unique sessionid based on this session, generates a dynamic key, and uses the dynamic key to dynamically encrypt the original query parameters keywords to obtain dynamically encrypted query parameters; and generates a dynamic signature at the same time.

[0197] Step 607: The client uses the public key to re-encrypt the dynamic signature, dynamically encrypted query parameters, APIKey, serverid, and sessionid to obtain a re-encrypted query structure.

[0198] Step 608: The client sends the twice-encrypted query structure to the server.

[0199] Step 609: After receiving the client request, the server adds the server IP that sent the request to the request header and then forwards it to the trusted execution environment for processing.

[0200] Step 610: Decrypt the double-encrypted query structure using the locally managed private key in the trusted execution environment to obtain the dynamic signature, dynamically encrypted query parameters, APIKey, serverid, and sessionid.

[0201] Step 611: Generate a dynamic key in a trusted execution environment through a dynamic key policy; dynamically decrypt the dynamically encrypted query parameters based on the dynamic key to obtain the original query parameters keywords.

[0202] Step 612: Check whether the request is compliant in the trusted execution environment, that is, whether the APIKey is consistent with the serverid and whether the IP is in the whitelist of the service. If it meets the requirements, execute step 613. Otherwise, feedback the request non-compliant to the client through the server.

[0203] Step 613, query the result through the data service bus and use dynamic key encryption, that is, obtain the query configuration information through serverid, select the corresponding database adapter to query, and continue to use the dynamic key encryption generated in step 611 after obtaining the result to obtain the dynamically encrypted query result.

[0204] Step 614: Send the dynamic encryption query result to the server.

[0205] Step 615: The server returns the dynamic encrypted query result to the client through the session.

[0206] Step 616: The client decrypts the dynamically encrypted query result according to the dynamic key generated at the beginning of this session, i.e., step 607, and obtains a plaintext result and returns it to the calling user, so that the user can obtain the plaintext query result.

[0207] It should be noted that this application can use a multi-factor derived dynamic key combined with RSA encrypted communication. The request parameter encryption and decryption process is as follows:

[0208] The dynamic encryption method of this system framework is to pass the encryption factor, and then the server and client calculate the derived dynamic key locally respectively, and then encrypt and decrypt based on the pre-shared symmetric encryption algorithm, so it is necessary to improve the complexity and security of the dynamic key. Referring to the algorithm idea of ​​the password derivation function (such as Password-Based Key Derivation Function 2, PBKDF2), the original password is constructed based on the existing encryption factor, and the dynamic key is generated through a complex key derivation function, that is, a multi-factor key derivation function (such as Mutlti-Factors Key Derivation Function, MFKDF). The output key length can be specified according to the encryption strategy, and the encryption execution efficiency can be guaranteed. When the dynamic key is initialized, multiple types of symmetric encryption algorithm strategies are preset, requiring the sessionid, APIKey, serverid, IP, etc. in the request parameters to be extracted as dynamic keys through the HASH algorithm, and the Advanced Encryption Standard (Advanced Encryption Standard, AES) / SM4 and other algorithms are selected for encryption. At the same time, the public key is also generated by the server based on the trusted execution environment. The client needs to regularly update and obtain the dynamic encryption strategy and public key.

[0209] When the client initiates a session, it first generates a unique number sessionid for this session based on the timestamp, and then constructs a multi-factor password (MFP) for dynamic encryption based on the APIKey, serverid in the request parameters, the IP contained in the request header, and formula (3).

[0210] MFP=hash(sessionid||APIKey||serverid||IP) (3)

[0211] Then, the pseudo-random function (PRF) is selected as HMAC-SHA256, the random function is used to generate the salt value salt, the number of iterations c is specified, the required output key length dklen (for example, the AES algorithm requires 256 bits, and the SM4 algorithm requires 128 bits) and formula (4) can be used to derive and calculate the dynamic key AK of this session as follows:

[0212] AK client =MFKDF-HMAC-SHA256(MFP,salt,c,dklen) (4)

[0213] The specified number of iterations c and the key length dklen can be preset in the client code in advance through version synchronization, and only the salt value salt needs to be passed each time communication is performed.

[0214] Afterwards, the query parameter keywords in the request parameters are encrypted using the dynamic encryption method and formula (5) to obtain the dynamic encrypted query parameter Params AK :

[0215] Params AK =AK_Encrypt(AK,keywords) (5)

[0216] In the formula, the AK_Encrypt function determines the use of symmetric encryption algorithms including but not limited to the AES algorithm and the SM4 algorithm according to the dynamic encryption strategy. At the same time, the HMACSHA256 algorithm and formula (6) are used to calculate the digital signature of the query parameter keywords:

[0217] sign keywords =HMACSHA256(AK,keywords) (6)

[0218] After calculation, the current public key PK is used to encrypt all request information, signature and formula (7) to obtain the secondary encrypted request body EncryptRequestBody PK , and send it to the server:

[0219]

[0220] After the server forwards the request to the trusted execution environment, it first uses the local private key SK to EncryptRequestBody PK Decryption can get APIKey, serverid, signkeywords ,sessionid,Params AK , salt, and then the requester IP can be obtained through the request header. Therefore, in the trusted execution environment, the same strategy as the client can be used to generate a dynamic key; then decryption is performed to obtain the query parameters. The algorithm used for decryption is also consistent with the pre-configuration of the server and the client during version synchronization, including but not limited to symmetric encryption algorithms such as AES algorithm and SM4 algorithm, as shown in formula (8) and formula (9):

[0221] AK server =MFKDF-HMAC-SHA256(MFP,salt,c,dklen) (8)

[0222] keywords=AK_Decrypt(AK server ,Params AK ) (9)

[0223] After getting the keywords, the HMACSHA256 algorithm can be used to calculate the digest signature. keywords Verify the consistency of query parameters.

[0224] It should be noted that a dynamic key derivation algorithm of MFKDF-HMAC-SHA256 is proposed, which uses multi-parameter factors as initialization parameters to calculate complex and reliable dynamic keys, and refines and disassembles the HMAC-SHA256 encryption process. By optimizing intermediate variables to improve calculation efficiency, it can effectively improve the encryption calculation efficiency of dynamic key derivation, and can achieve an efficiency optimization effect of nearly 1 times, which is helpful to quickly generate dynamic keys when calling open interfaces.

[0225] Further, the following is a detailed introduction to the encryption and decryption methods of the query results:

[0226] After obtaining the plaintext query condition keywords in the trusted execution environment, the corresponding database adapter is searched according to the serverid for query. After obtaining the query results, the dynamic key needs to be used again for encryption. Here, the dynamic key continues to use the AK generated above. server , according to formula (10), the results are dynamically encrypted to obtain EncryptR AK :

[0227] EncryptR AK =AK_Encrypt(AK server ,results) (10)

[0228] Among them, EncryptR AKThe server returns the request to the client, and the client uses formula (11) to generate the AK based on this session. client Decryption is performed, so that the client obtains the plaintext query result.

[0229] results = AK_Decrypt(AK client ,EncryptR AK ) (11)

[0230] It should be noted that in order to improve the security and complexity of dynamic keys, this paper introduces multiple API session parameters (APIKey, sessionid, serverid, IP), extracts its multi-factor password MFP to replace the original password password in the original algorithm. And selects the PRF pseudo-random function as HMAC-SHA256 to enhance the complexity of iterative encryption while ensuring that the calculation efficiency can run stably in the client environment. Table 1 is the basic process of the MFPKDF-HMAC-SHA256 algorithm:

[0231]

[0232] The INT function converts an integer i into a 4-byte (32-bit) big-endian representation; the FirstBytes function intercepts U j The first r bytes of ; “||” represents the concatenation operator; “⊕” represents the exclusive OR operator.

[0233] In order to ensure the security of the derivative function result, the number of iterations c usually needs to reach more than 1000 times. Therefore, the amount of calculation in the MFPKDF-HMAC-SHA256 algorithm increases with the number of iterations, and is mainly concentrated in the calculation of HMAC-SHA256. Here, for formula (4), the MFPKDF input parameters are substituted, and it can be seen that one encryption calculation includes 4 operations, such as Figure 7 As shown. Figure 7 From the analysis, we can see that the MFP parameters do not change during each loop, ipad and opad are constants, so MFP⊕ipad and MFP⊕opad do not actually change in each loop. Therefore, the calculation results of MFP⊕ipad and MFP⊕opad can be cached in the first loop, and the cache variables can be directly read in the subsequent (c-1) iteration loops to avoid repeated calculations. After this optimization operation, the time complexity of the encryption operation can be reduced from 4c to (2c+1), which nearly doubles the calculation efficiency in encryption scenarios with a large c.

[0234] The embodiment of the present application provides a first terminal, which can be used to implement Figure 3A corresponding embodiment provides a confidential communication method, referring to Figure 8 As shown, the first terminal 800 includes:

[0235] The first processing module 801 is used to determine a first key and a second key; wherein the second key is a dynamic key;

[0236] The first processing module 801 is used to encrypt the first parameter based on the first key and the second key to obtain the second parameter; wherein the first parameter includes keywords that support retrieval;

[0237] A first sending module 802 is configured to send a first request to a first device; wherein the first request includes a second parameter;

[0238] A first receiving module 803 is configured to receive a first message sent by a first device; wherein the first message includes a first search result;

[0239] The first processing module 801 is used to decrypt the first search result based on the second key to obtain the second search result.

[0240] In other embodiments of the present application, the first receiving module 803 is used to receive a first key sent by the first device, or obtain the first key from the storage module of the first terminal;

[0241] A first acquisition module 804 is used to acquire a session identifier, user authorization authentication information, an API service identifier, and an identifier of a first terminal;

[0242] A first processing module 801, configured to generate a multi-factor password for dynamic encryption based on a session identifier, user authorization authentication information, an identifier of an application program interface service, and an identifier of a first terminal;

[0243] The first processing module 801 is used to determine a second key based on the multi-factor password.

[0244] In other embodiments of the present application, the first processing module 801 is used to determine a pseudo-random function;

[0245] A first acquisition module 804 is used to obtain a specified number of iteration rounds, a required output key length, and a randomly generated salt value;

[0246] The first processing module 801 is used to derive a second key based on a multi-factor password, a specified number of iterations, a length, a salt value, and a pseudo-random function.

[0247] In other embodiments of the present application, the first receiving module 803 is used to receive a dynamic encryption policy number sent by the first device, or obtain it from the storage module of the first terminal;

[0248] The first processing module 801 is used to determine the dynamic key encryption and decryption method based on the dynamic encryption policy number;

[0249] The first processing module 801 is used to encrypt the first parameter based on the second key in a dynamic key encryption and decryption manner to obtain the encrypted first parameter;

[0250] The first processing module 801 is used to sign the first parameter based on the second key to obtain a signature string;

[0251] The first processing module 801 is used to encrypt the signature string, the encrypted first parameter, the user authorization authentication information, the application program interface service identifier, the session identifier and the salt value based on the first key to obtain the second parameter.

[0252] In other embodiments of the present application, the first sending module 802 is configured to send a second request to the first device;

[0253] Among them, the second request is used to register and apply for data resources; the data resources include one or more of the following: field categories that can be opened, field categories that are allowed to be searched, whether to perform anonymization, and the scope of user permissions that are opened.

[0254] In other embodiments of the present application, the first sending module 802 is used to send a third request to the first device; wherein the third request is used to apply for an application program interface open service;

[0255] The first receiving module 803 is used to receive user authorization authentication information and interface protocols sent by the first device; wherein the user authorization authentication information is generated by the first platform based on the user name, password, application interface service identifier, request data table name, device whitelist list, and creation time information; the interface protocol includes the routing information of the first terminal, user authorization authentication information, application interface service identifier, retrieval keyword information, and the format of the query result.

[0256] In other embodiments of the present application, the first receiving module 803 is used to receive a notification message sent by the first device; wherein the notification message is used to notify the first terminal to update the stored first key and dynamic key policy number; the notification message includes the updated / initialized first key and the updated / initialized dynamic key policy number.

[0257] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0258] It should be noted that in the embodiments of the present application, if the above-mentioned confidential communication method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or partly reflected in the form of a software product that contributes to the relevant technology. The computer software product is stored in a storage medium, including several instructions for a terminal device to execute all or part of the methods of each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a disk or an optical disk. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

[0259] The embodiment of the present application provides a first device, which can be used to implement Figure 3 A corresponding embodiment provides a confidential communication method, referring to Fig. 9 As shown, the first device 900 includes:

[0260] The second receiving module 901 is used to receive a first request sent by a first terminal; wherein the first request includes a second parameter; the second parameter is obtained by encrypting the first parameter by the first terminal based on the first key and the second key; the second key is a dynamic key; the first parameter includes a keyword that supports retrieval;

[0261] The second sending module 902 is used to send the second parameter to the first platform;

[0262] The second receiving module 901 is used to receive a first message sent by the first platform and forward the first message to the first terminal; wherein the first message includes a first search result.

[0263] In other embodiments of the present application, the second receiving module 901 is used to receive a second request sent by the first terminal; wherein the second request is used to register and apply for data resources; the data resources include one or more of the following: the field category that can be opened, the field category that is allowed to be searched, whether to perform desensitization processing, and the scope of user authority that is opened;

[0264] The second processing module 903 is used to review the second request and publish the relevant information of the data resource to the data mart of the first device; wherein the relevant information includes the data resource catalog and data summary information.

[0265] In other embodiments of the present application, the second receiving module 901 is used to receive a third request sent by the first terminal; the third request is used to apply for an application program interface open service;

[0266] The second processing module 903 is used to review the third request and send user authorization authentication information and interface protocol to the first terminal; wherein the user authorization authentication information is generated by the first platform based on the applicant's user name, password, application interface service identifier, request data table name, device whitelist list, and creation time information; the interface protocol includes the routing information of the first terminal, user authorization authentication information, application interface service identifier, retrieval keyword information, and the format of the query result.

[0267] In other embodiments of the present application, the second sending module 902 is used to send a fourth request to the first platform; wherein the fourth request is used to update / initialize key information;

[0268] The second receiving module 901 is used to receive the updated / initialized first key and the updated / initialized dynamic key policy number sent by the first platform;

[0269] The second sending module 902 is used to send a notification message to the first terminal; wherein the notification message is used to notify the first terminal to update the stored first key and dynamic key policy number.

[0270] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0271] It should be noted that in the embodiments of the present application, if the above-mentioned confidential communication method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or partly reflected in the form of a software product that contributes to the relevant technology. The computer software product is stored in a storage medium, including several instructions for a network device to execute all or part of the methods of each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a magnetic disk or an optical disk. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

[0272] The embodiment of the present application provides a first platform, which can implement Figure 3 A corresponding embodiment provides a confidential communication method, referring to Fig.10 As shown, the first platform 1000 includes:

[0273] The third receiving module 1001 is used to receive a second parameter sent by the first device; wherein the second parameter is obtained by encrypting the first parameter by the first terminal based on the first key and the second key;

[0274] The third processing module 1002 is used to determine a third key and a second key; wherein the second key is a dynamic key; and the first key and the third key are a set of symmetric keys;

[0275] The third processing module 1002 is used to decrypt the second parameter based on the third key and the second key to obtain the first parameter;

[0276] The third processing module 1002 is used to perform a search based on the first parameter to obtain a second search result;

[0277] The third processing module 1002 is used to encrypt the second search result based on the second key to obtain the first search result;

[0278] The third sending module 1003 is used to send a first message to the first device; wherein the first message includes a first search result.

[0279] In other embodiments of the present application, the third acquisition module 1004 is used to obtain the third key locally;

[0280] The third processing module 1002 is used to decrypt the second parameter based on the third key to obtain the signature string, the encrypted first parameter, the user authorization authentication information, the application program interface service identifier, the session identifier and the salt value;

[0281] The third processing module 1002 is used to generate a multi-factor password for dynamic encryption based on the session identifier, the user authorization authentication information, the identifier of the application program interface service and the identifier of the first terminal;

[0282] The third processing module 1002 is used to determine a second key based on the multi-factor password.

[0283] In other embodiments of the present application, the third processing module 1002 is used to determine a pseudo-random function;

[0284] The third acquisition module 1004 is used to obtain the specified number of iteration rounds, the required output key length and the salt value;

[0285] The third processing module 1002 is used to derive a second key based on the multi-factor password, a specified number of iterations, a length, a salt value, and a pseudo-random function.

[0286] In other embodiments of the present application, the third acquisition module 1004 is used to obtain the dynamic encryption policy number from the local;

[0287] The third processing module 1002 is used to determine the dynamic key encryption and decryption method based on the dynamic encryption policy number;

[0288] The third processing module 1002 is used to decrypt the encrypted first parameter based on the second key and in a dynamic key encryption and decryption manner to obtain the first parameter.

[0289] In other embodiments of the present application, the third processing module 1002 is used to verify whether the identification of the device requested to be retrieved is compliant;

[0290] The third processing module 1002 is used to verify whether the API service and the API service identifier correspond to each other;

[0291] The third processing module 1002 is used to verify the signature string.

[0292] In other embodiments of the present application, the third receiving module 1001 is used to receive a fourth request sent by the first device; wherein the fourth request is used to update / initialize key information;

[0293] A third processing module 1002, configured to generate an updated / initialized first key and an updated / initialized third key;

[0294] The third processing module 1002 is used to unify the numbering and pre-set multiple types of dynamic key encryption and decryption methods with the first terminal in advance to generate an updated / initialized dynamic key policy number;

[0295] The third sending module 1003 is configured to send the updated / initialized first key and the updated / initialized dynamic key policy number to the first device.

[0296] In other embodiments of the present application, the third acquisition module 1004 is used to obtain the fourth key, user name, password, application program interface service identifier, request data table name, device whitelist list, and creation time information;

[0297] The third processing module 1002 is used to generate a first character string based on the user name, password, API service identifier, request data table name, device whitelist list, and creation time information;

[0298] The third processing module 1002 is used to generate user authorization authentication information based on the fourth key and the first character string.

[0299] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0300] It should be noted that in the embodiments of the present application, if the above-mentioned confidential communication method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or partly reflected in the form of a software product that contributes to the relevant technology. The computer software product is stored in a storage medium, including several instructions for a network device to execute all or part of the methods of each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a magnetic disk or an optical disk. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

[0301] Fig.11 1 is a schematic structural diagram of a communication device 1100 provided in an embodiment of the present application. The communication device may be a first terminal, a first device, or a first platform. Fig.11 The communication device 1100 shown includes a processor 1110, and the processor 1110 can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0302] Alternatively, if Fig.11 As shown, the communication device 1100 may further include a memory 1120. The processor 1110 may call and run a computer program from the memory 1120 to implement the method in the embodiment of the present application.

[0303] The memory 1120 may be a separate device independent of the processor 1110 , or may be integrated into the processor 1110 .

[0304] Alternatively, if Fig.11 As shown, the communication device 1100 may further include a transceiver 1130, and the processor 1110 may control the transceiver 1130 to communicate with other devices, specifically, may send information or data to other devices, or receive information or data sent by other devices.

[0305] The transceiver 1130 may include a transmitter and a receiver. The transceiver 1130 may further include an antenna, and the number of the antennas may be one or more.

[0306] Optionally, the communication device 1100 may specifically be the first terminal / first platform / first device of an embodiment of the present application, and the communication device 1100 may implement the corresponding processes implemented by the first terminal / first platform / first device in each method of the embodiment of the present application, which will not be described again here for the sake of brevity.

[0307] Exemplarily, an embodiment of the present application further provides a computer program product, including a computer program, and the computer program can be executed by the processor 1110 of the communication device 1100 to complete the steps of any of the aforementioned methods.

[0308] It should be understood that the processor of the embodiment of the present application may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method embodiment can be completed by the hardware integrated logic circuit or software instructions in the processor. The above processor can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor are combined and performed. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, and other mature storage media in the art. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0309] As an embodiment, the processor may include one or more general-purpose central processing units (CPUs). Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer execution instructions).

[0310] It can be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a ROM, a programmable read-only memory (Programmable ROM, PROM), an erasable programmable read-only memory (Erasable PROM, EPROM), an electrically erasable programmable read-only memory (Electrically EPROM, EEPROM) or a flash memory. The volatile memory can be a random access memory (Random Access Memory, RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus random access memory (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0311] An embodiment of the present application also provides a computer-readable storage medium for storing a computer program.

[0312] The computer-readable storage medium can be applied to the first terminal / first platform / first device in the embodiments of the present application, and the computer program enables the computer to execute the corresponding processes implemented by the first terminal / first platform / first device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0313] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0314] The computer program product includes one or more computer instructions. When loading and executing the computer program instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instruction can be stored in a computer-readable storage medium, or transmitted from a computer-readable storage medium to another computer-readable storage medium. For example, the computer instruction can be transmitted from a website site, a computer, a server, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server, or data center. The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a server, a data center, etc. that includes one or more available media integration. Available media can be magnetic media, (e.g., floppy disk, hard disk, tape), optical media (e.g., DVD), or semiconductor media (e.g., solid-state hard disk (SSD)), etc.

[0315] The above is a detailed introduction to the confidential communication method, the first terminal, the first device, the first platform, the computer-readable storage medium and the computer program product provided in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the ideas of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

[0316] It should be understood that the "one embodiment" or "an embodiment" or "an embodiment of the present application" or "the aforementioned embodiment" or "some implementations" or "some embodiments" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" or "an embodiment of the present application" or "the aforementioned embodiment" or "some implementations" or "some embodiments" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The above-mentioned sequence numbers of the embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments.

[0317] Unless otherwise specified, the first terminal / first device / first platform performs any step in the embodiments of the present application, and the processor of the first terminal / first device / first platform may perform the step. Unless otherwise specified, the embodiments of the present application do not limit the order in which the first terminal / first device / first platform performs the following steps. In addition, the methods used to process data in different embodiments may be the same method or different methods.

[0318] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0319] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0320] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0321] The methods disclosed in the several method embodiments provided in this application can be arbitrarily combined without conflict to obtain a new method embodiment. The features disclosed in the several product embodiments provided in this application can be arbitrarily combined without conflict to obtain a new product embodiment. The features disclosed in the several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain a new method embodiment or device embodiment.

[0322] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, magnetic disks or optical disks.

[0323] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer storage medium. Based on such an understanding, the technical solution of the embodiment of the present application can be essentially or partly embodied in the form of a software product that contributes to the relevant technology. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0324] As used in the embodiments of the present application and the appended claims, the singular forms "a," "an," "said," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0325] It should be noted that in each embodiment involved in the present application, all steps may be executed or part of the steps may be executed as long as a complete technical solution can be formed.

[0326] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A confidential communication method, characterized in that: Applied to a first terminal, the method includes: Determine a first key and a second key; wherein the second key is a dynamic key; Encrypting a first parameter based on the first key and the second key to obtain a second parameter; wherein the first parameter includes keywords that support retrieval; Sending a first request to a first device; wherein the first request includes a second parameter; Receiving a first message sent by the first device; wherein the first message includes a first search result; The first search result is decrypted based on the second key to obtain a second search result.

2. The method according to claim 1, characterized in that The determining of the first key and the second key comprises: receiving the first key sent by the first device, or obtaining the first key from a storage module of the first terminal; Obtaining a session identifier, user authorization authentication information, an API service identifier, and an identifier of the first terminal; Generate a multi-factor password for dynamic encryption based on the session identifier, user authorization authentication information, an identifier of the application program interface service, and an identifier of the first terminal; Based on the multi-factor password, the second key is determined.

3. The method according to claim 2, characterized in that The determining the second key based on the multi-factor password includes: Determine the pseudo-random function; Get the specified number of iterations, the required output key length, and the randomly generated salt value; The second key is derived based on the multi-factor password, the specified number of iterations, the length, the salt value, and the pseudo-random function.

4. The method according to claim 3, characterized in that The step of encrypting the first parameter based on the first key and the second key to obtain the second parameter includes: Receiving the dynamic encryption policy number sent by the first device, or obtaining it from the storage module of the first terminal; Determine the dynamic key encryption and decryption method based on the dynamic encryption policy number; Based on the second key, encrypt the first parameter according to the dynamic key encryption and decryption method to obtain the encrypted first parameter; Signing the first parameter based on the second key to obtain a signature string; Based on the first key, the signature string, the encrypted first parameter, the user authorization authentication information, the application program interface service identifier, the session identifier and the salt value are encrypted to obtain a second parameter.

5. The method according to claim 1, characterized in that The method further comprises: sending a second request to the first device; Among them, the second request is used to register and apply for data resources; the data resources include one or more of the following: field categories that can be opened, field categories that are allowed to be searched, whether to perform anonymization, and the scope of user permissions that are opened.

6. The method according to claim 1, characterized in that The method further comprises: Sending a third request to the first device; wherein the third request is used to apply for an application program interface open service; Receiving user authorization authentication information and interface protocol sent by the first device; Among them, the user authorization authentication information is generated by the first platform based on the user name, password, application interface service identifier, request data table name, device whitelist list, and creation time information; the interface protocol includes the routing information of the first terminal, user authorization authentication information, application interface service identifier, retrieval keyword information and the format of the query result.

7. The method according to claim 1, characterized in that The method further comprises: Receiving a notification message sent by the first device; The notification message is used to notify the first terminal to update the stored first key and dynamic key policy number; the notification message includes the updated / initialized first key and the updated / initialized dynamic key policy number.

8. A confidential communication method, characterized in that: Applied to a first device, the method includes: receiving a first request sent by a first terminal; wherein the first request includes a second parameter; the second parameter is obtained by encrypting the first parameter by the first terminal based on a first key and a second key; the second key is a dynamic key; the first parameter includes a keyword that supports retrieval; Sending a second parameter to the first platform; Receive a first message sent by the first platform, and forward the first message to the first terminal; wherein the first message includes a first search result.

9. The method according to claim 8, characterized in that The method further comprises: Receive a second request sent by the first terminal; wherein the second request is used to register and apply for data resources; the data resources include one or more of the following: field categories that can be opened, field categories that are allowed to be searched, whether to perform desensitization processing, and the scope of user permissions that are opened; Review the second request and publish the relevant information of the data resource to the data mart of the first device; wherein the relevant information includes data resource catalog and data summary information.

10. The method according to claim 8, characterized in that The method further comprises: receiving a third request sent by the first terminal; the third request is used to apply for an application program interface open service; Reviewing the third request, and sending user authorization authentication information and interface protocol to the first terminal; Among them, the user authorization authentication information is generated by the first platform based on the applicant's user name, password, application interface service identifier, request data table name, device whitelist list, and creation time information; the interface protocol includes the routing information of the first terminal, user authorization authentication information, application interface service identifier, retrieval keyword information and the format of the query result.

11. The method according to claim 8, characterized in that The method further comprises: Sending a fourth request to the first platform; wherein the fourth request is used to update / initialize key information; Receiving an updated / initialized first key and an updated / initialized dynamic key policy number sent by the first platform; Send a notification message to the first terminal; wherein the notification message is used to notify the first terminal to update the stored first key and dynamic key policy number.

12. A confidential communication method, characterized in that: Applied to the first platform, the method comprises: Receiving a second parameter sent by the first device; wherein the second parameter is obtained by encrypting the first parameter by the first terminal based on the first key and the second key; Determine a third key and a second key; wherein the second key is a dynamic key; the first key and the third key are a set of symmetric keys; decrypting the second parameter based on the third key and the second key to obtain the first parameter; Perform a search based on the first parameter to obtain a second search result; Encrypting the second search result based on the second key to obtain a first search result; Send a first message to the first device; wherein the first message includes a first search result.

13. The method according to claim 12, characterized in that Determining the third key and the second key comprises: Acquire the third key locally; Based on the third key, decrypt the second parameter to obtain the signature string, the encrypted first parameter, user authorization authentication information, the application program interface service identifier, the session identifier and the salt value; Generate a multi-factor password for dynamic encryption based on the session identifier, user authorization authentication information, an identifier of the application program interface service, and an identifier of the first terminal; Based on the multi-factor password, the second key is determined.

14. The method according to claim 13, characterized in that The determining the second key based on the multi-factor password includes: Determine the pseudo-random function; Obtaining a specified number of iteration rounds, a required output key length, and the salt value; The second key is derived based on the multi-factor password, the specified number of iterations, the length, the salt value, and the pseudo-random function.

15. The method according to claim 13, characterized in that The decrypting the second parameter based on the third key and the second key to obtain the first parameter includes: Get the dynamic encryption policy number from the local computer. Determine the dynamic key encryption and decryption method based on the dynamic encryption policy number; Based on the second key, the encrypted first parameter is decrypted according to the dynamic key encryption and decryption method to obtain the first parameter.

16. The method according to claim 12, characterized in that The method further comprises: Verify that the identification of the device requested for retrieval is compliant; or; Verify whether the API service and the API service identifier correspond to each other; or, Verify the signature string.

17. The method according to claim 12, characterized in that The method further comprises: receiving a fourth request sent by the first device; wherein the fourth request is used to update / initialize key information; generating an updated / initialized first key and an updated / initialized third key; The unified number and the first terminal jointly preset multiple types of dynamic key encryption and decryption methods in advance to generate an updated / initialized dynamic key policy number; An updated / initialized first key and an updated / initialized dynamic key policy number are sent to the first device.

18. The method according to claim 12, characterized in that The method further comprises: Obtain the fourth key, user name, password, API service identifier, request data table name, device whitelist, and creation time information; Generate a first character string based on the user name, password, API service identifier, request data table name, device whitelist, and creation time information; User authorization authentication information is generated based on the fourth key and the first character string.

19. A first terminal, characterized in that: The first terminal includes: A first processing module, configured to determine a first key and a second key; wherein the second key is a dynamic key; The first processing module is further used to encrypt the first parameter based on the first key and the second key to obtain the second parameter; wherein the first parameter includes keywords that support retrieval; A first sending module, configured to send a first request to a first device; wherein the first request includes a second parameter; A first receiving module, configured to receive a first message sent by the first device; wherein the first message includes a first search result; The first processing module is further configured to decrypt the first search result based on the second key to obtain a second search result.

20. A first device, characterized in that: The first device comprises: a second receiving module, configured to receive a first request sent by a first terminal; wherein the first request includes a second parameter; the second parameter is obtained by encrypting the first parameter by the first terminal based on a first key and a second key; the second key is a dynamic key; and the first parameter includes keywords that support retrieval; A second sending module, used for sending a second parameter to the first platform; The second receiving module is further used to receive a first message sent by the first platform and forward the first message to the first terminal; wherein the first message includes a first search result.

21. A first platform, characterized in that: The first platform includes: A third receiving module is used to receive a second parameter sent by the first device; wherein the second parameter is obtained by encrypting the first parameter by the first terminal based on the first key and the second key; A third processing module, used to determine a third key and a second key; wherein the second key is a dynamic key; the first key and the third key are a group of symmetric keys; The third processing module is further used to decrypt the second parameter based on the third key and the second key to obtain the first parameter; The third processing module is further used to perform a search based on the first parameter to obtain a second search result; The third processing module is further used to encrypt the second search result based on the second key to obtain the first search result; The third sending module is used to send a first message to the first device; wherein the first message includes a first search result.

22. A communication device, characterized in that: The communication device comprises: A memory for storing executable instructions; A processor, used to implement the confidential communication method described in any one of claims 1 to 7, or the confidential communication method described in any one of claims 8 to 11, or the confidential communication method described in any one of claims 12 to 18 when executing the executable instructions stored in the memory.

23. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the confidential communication method described in any one of claims 1 to 7, or the confidential communication method described in any one of claims 8 to 11, or the confidential communication method described in any one of claims 12 to 18.

24. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, it implements the confidential communication method according to any one of claims 1 to 7, or implements the confidential communication method according to any one of claims 8 to 11, or implements the confidential communication method according to any one of claims 12 to 18.

Images