A method for implementing efficient encrypted instant messaging

Abstract

A method for implementing efficient encrypted instant messaging is to use a "vertical authentication" technical architecture to establish an encrypted instant messaging system, based on a symmetric cryptographic algorithm, to complete key exchange, signature and encryption functions. When a user establishes a user "group" in a "circle of friends", the encryption system at the instant messaging key management center end allocates a set of identical "key seed" table elements to the user client in each "group" in real time, and in the encryption chip of each user's client, encrypted instant messaging is implemented in a "one-to-one" or "one-to-many" user "group". The social information of users is transmitted to each other in real time "offline" encrypted manner, which can improve the operating efficiency of encrypted instant messaging. Various keys generated by the combined key generation algorithm are changed one at a time, solving the problem of symmetric key management. At the same time, the core parts of various protocols of encrypted instant messaging are completed in the chip, thereby establishing a "chip-level" encrypted instant messaging system.

Description

Technical field:

[0001] The present invention relates to the field of network communication security. Background technology:

[0002] At present, the instant messaging encrypted transmission systems at home and abroad all adopt the security architecture of PKI technology. PKI technology is to distribute the user's certificate including the public key in advance through the CA certification center to realize the "offline" data encryption transmission key exchange between users. Among them: offline data encryption transmission refers to: the ciphertext data transmission protocol between users, which does not require the CA certification center to exchange keys. However, the construction cost of the CA certification center is high, and the PKI technology adopts the public key system, which runs relatively slowly. In addition, the user certificates stored in the CA certification center's certificate database, if stored in plain text, are vulnerable to hacker attacks and have low security. If the user certificate is stored in ciphertext form, the operating efficiency of the CA certification center will be further reduced, causing the CA certification center to increase its equipment investment exponentially. At the same time, PKI technology cannot realize the "one-to-many" key exchange of instant messaging, that is, in a "group" established by the instant messaging system, an encrypted file submitted by a user in the "group", multiple users cannot realize the "offline" decryption of ciphertext data, that is, key exchange must be carried out through the CA certification center to realize the "one-to-many" key exchange of instant messaging, resulting in low efficiency of the instant messaging encryption system. In short, the existing instant messaging data encryption technology products cannot meet the market demand. Summary of the invention:

[0003] A method for implementing efficient encrypted instant messaging adopts a "vertical authentication" technical architecture to establish a real-time social information encryption transmission system, deploys smart card hardware devices on the user's client, and establishes a client encryption system in these smart card chips, that is, in the client encryption chip, write a symmetric cryptographic algorithm, a digest algorithm, a combined key generation algorithm, a "key seed" table element, a group of storage keys CK, and an encryption / decryption protocol, establish an instant messaging key management center in the instant messaging system, and establish an instant messaging key management center-side encryption system in the hardware device chip of the instant messaging key management center, that is, in the encryption chip of the instant messaging key management center, write a symmetric cryptographic algorithm, a digest algorithm, a combined key generation algorithm, an encryption / decryption protocol, a group of storage keys KC, or a set of "key seed" table C elements that generate a one-time storage key KCi, and in the "key seed" database of the instant messaging key management center, store the ciphertext of the "key seed" table ai elements of all users, wherein: the "key seed" table ai elements of all users are encrypted into ciphertexts in advance by a fixed storage key KC or a one-time storage key KCi;

[0004] Definition: A user "group" with only two users in the "friend circle" of instant messaging is a "one-to-one" user "group", and a user "group" with more than two users in the "friend circle" is a "one-to-many" user "group";

[0005] Definition: User Aj and user Ai communicate with each other in an instant, and a "one-to-one" user "group" is established. User Ai is the group owner of the "one-to-one" user "group". User Ai initiates and pulls multiple users into a "circle of friends" user "group" at the same time. User Ai is the group owner of the "one-to-many" user "group";

[0006] After user Ai and user Aj establish a "one-to-one" user "group", the encrypted instant messaging protocol between user Ai and user Aj is as follows:

[0007] The client encryption system of user Ai generates a set of timestamps Ti and random numbers Si in the encryption chip. According to the combined key generation algorithm, the elements of the "key seed" table ai in the smart card chip are selected by the timestamps Ti and random numbers Si, and the selected elements are merged into a set of encryption keys K1. The social information RL that user Ai intends to send to the "one-to-one" user "group" is encrypted into ciphertext RL1 using the key K1. The identifier of user Ai, the identifier of user Aj, a set of timestamps Ti and random numbers Si, and the ciphertext RL1 of the social information RL are sent to the instant messaging key management center together. The encryption system at the instant messaging key management center takes out the ciphertext of the element of the "key seed" table ai corresponding to the identifier of user Ai from the "key seed" database. In the encryption chip at the instant messaging key management center, the storage key KC or KCi is called to decrypt the ciphertext of the element of the "key seed" table ai to obtain the plaintext. The combined key generation algorithm composed of a set of timestamps Ti and random numbers Si generates the decryption key K2. The ciphertext RL1 of the social information RL is decrypted to obtain the plaintext of the social information RL. The encryption system at the instant messaging key management center takes out the element ciphertext of the "key seed" table aj corresponding to the user Aj from the "key seed" database. In the encryption chip at the instant messaging key management center, the storage key KC or KCi is called to decrypt the element ciphertext of the "key seed" table aj to obtain the plaintext, and a set of timestamps Tj and random numbers Sj are generated. According to the combined key generation algorithm, the encryption key K3 corresponding to the user Aj is generated to encrypt the social information RL to obtain the ciphertext RL2, and the user Aj identifier, timestamp Tj and random number Sj, and the ciphertext RL2 are sent to the client of the user Aj. In the encryption chip at the client of the user Aj, the elements of the key seed table aj are selected according to the combined key generation algorithm composed of the timestamp Tj and the random number Sj, and the selected elements are synthesized into the decryption key K4 to decrypt the ciphertext RL2 to obtain the plaintext of the social information RL, thereby realizing the encrypted instant messaging between the user Ai and the user Aj.

[0008] A method for implementing efficient encrypted instant messaging is to use a "vertical authentication" technical architecture to establish an encrypted instant messaging system, based on a symmetric cryptographic algorithm, to complete key exchange, signature and encryption functions. When a user establishes a user "group" of a "circle of friends", the encryption system at the instant messaging key management center allocates a set of identical "key seed" table elements to the user client in each "group" in real time. In the encryption chip of each user's client, encrypted instant messaging is implemented in a "one-to-one" or "one-to-many" user "group". The social information of users is mutually encrypted and transmitted in real time "offline", which can improve the operating efficiency of encrypted instant messaging, and the combined key generation algorithm The method generates various keys that are changed one at a time, solving the problem of symmetric key management. At the same time, the core parts of various protocols of encrypted instant messaging are completed in the chip, thereby establishing a "chip-level" encrypted instant messaging system; Among them: the definition of the "vertical authentication" technical architecture is that the keys are centrally generated, centrally filled, centrally distributed, and centrally destroyed; the combined key generation algorithm is a selection parameter composed of a set of timestamps and random numbers to select a set of elements in a "key seed" table, and the selected Y elements are synthesized into a set of encryption / decryption keys, signature and encryption keys, or signature verification and decryption keys, Y = 16 or 32. The technical characteristics of the method are:

[0009] Deploy smart card hardware devices on the client side of user Ai, and establish a client encryption system in the smart card chip, that is, write symmetric cryptographic algorithms, digest algorithms, combined key generation algorithms, encryption / decryption key protocols, signature and encryption protocols, signature verification / decryption protocols, a set of "key seed" table ai elements, a set of storage keys CKi, and establish Ri "friend circle" user "groups" on the client side of user Ai. Each "friend circle" user "group" corresponds to a set of "key seed" table C ie Element, "Key Seed" Table C ie The element is generated by the encryption system of the instant messaging key management center in the encryption device chip and sent to the client encryption chip. Then, a set of storage keys CKi of the client encryption system is used to store the "key seed" table C ie After the elements are encrypted into ciphertext, they are stored in the client "key seed" database of user Ai;

[0010] Deploy hardware equipment at the instant messaging key management center, and establish an encryption system at the instant messaging key management center in the chip of the hardware equipment, that is, write a symmetric cryptographic algorithm, a digest algorithm, a combined key generation algorithm, a key encryption / decryption protocol, a signature and encryption protocol, a signature verification / decryption protocol, a set of storage keys KC, or a set of "key seed" table C elements into the encryption chip at the instant messaging key management center. In the user "key seed" database at the instant messaging key management center, store the identifiers of all users Ai and a corresponding set of "key seed" table ai element ciphertexts, wherein: use the storage key KC, or a set of "key seed" table C elements, and use the one-time storage key KCi generated by the combined key generation algorithm to encrypt the elements of the user "key seed" table ai into ciphertext storage in advance;

[0011] When a user creates a user "group" of "friend circle", a set of random numbers is generated in the encryption chip of the instant messaging key management center as the user "group" of user Ai's "friend circle". The corresponding "key seed" table C ie Elements, in the chip of the hardware device, respectively generate the user "group" of user Ai's "circle of friends", corresponding to each user's signature and encryption key, and put the "key seed" table C ie After the elements are encrypted into ciphertexts, they are sent to the encryption chips of the corresponding user clients, decrypted into plaintexts in the encryption chips of the respective user clients, and integrity verification is performed respectively. If the integrity verification is passed, they are encrypted into ciphertexts by the storage keys of the respective clients and stored in the "key seed" database of the respective user clients. If the integrity verification is not passed, this protocol is rerun, where: the sum of the "key seed" database records of the user "groups" of the "friend circle" of all user Ai is: R1+R2+......+Rn, the number of user "groups" corresponding to the "friend circle" of each user Ai is Ri, e=1~Ri, Ri<n, j=1~n, i=1~n, i≠j, and n is the sum of all mobile phone users;

[0012] The user "group" of user Ai's "friend circle" and other users are stored in the corresponding records in the "key seed" database of each client - Table C ie Elements, real-time one-time keys are generated to encrypt the social information sent by oneself to the user "group" of "friend circle", and at the same time, decrypt the ciphertext of social information sent by other users to the user "group" of "friend circle", to achieve "one-to-one" encrypted instant messaging, or "one-to-many" encrypted instant messaging, thereby establishing an efficient encrypted instant messaging system, and implementing it by combining software and hardware. The specific method is as follows:

[0013] 1. Assume that the identifiers of all users are: A1, A2, ..., An. If the user's client is a mobile phone, the user's identifier can correspond to the user's mobile phone card number. The user identifiers are different from each other, where: i = 1 to n, n is the sum of all users.

[0014] 2. Definition: A user "group" in the "friend circle" of only two users in instant messaging is a "one-to-one" user "group"; a user "group" in the "friend circle" of more than two users is a "one-to-many" user "group";

[0015] Definition: User Aj and user Ai communicate with each other to establish a one-to-one user group. User Ai is the group leader of the one-to-one user group. User Ai initiates a user group and pulls multiple users into a circle of friends. User Ai is the group leader of the one-to-many user group, where i=1~n, and n is the total number of all users.

[0016] 3. Embed a smart card, such as U-shield, SIM card, SD card, TF card, on the user's client PC or mobile phone, or build a smart card in the PC or mobile phone, and establish a client encryption system in the CPU chip of the smart card, that is, write a single-key cryptographic algorithm, digest algorithm, combined key generation algorithm, encryption / decryption protocol, signature and encryption protocol, signature verification and decryption protocol, as well as user identification Ai, a set of storage keys CKi, and a set of "key seed" table ai elements in the client encryption chip. The user identification Ai, storage key CKi, and elements of the "key seed" table i in each client encryption chip are all different, i=1~n, n is the total number of blockchain users.

[0017] 4. Deploy hardware encryption equipment at the instant messaging key management center, and establish an encryption system at the instant messaging key management center in the chip of the encryption equipment, that is, write a symmetric cryptographic algorithm, a digest algorithm, a combined key generation algorithm, an encryption / decryption protocol, a signature and encryption protocol, a signature verification and decryption protocol, a set of storage keys KC, or a set of "key seed" table C elements into the encryption chip at the instant messaging key management center. In the user "key seed" database at the instant messaging key management center, store the user Ai identifications of all users and a set of "key seed" table ai element ciphertexts, wherein: use the storage key KC, or a set of "key seed" table C elements, according to the combined key generation algorithm, to generate a storage key KCi that changes once, and encrypt the elements of the user "key seed" table ai into ciphertext in advance and then store them.

[0018] 5. “Vertical authentication” technical definition: centralized key generation, centralized filling, centralized distribution, and centralized destruction;

[0019] The "vertical authentication" technology is an authentication architecture established based on a symmetric cryptographic algorithm. It uses a combined key generation algorithm to achieve real-time generation of authentication, signature, and encryption keys. The three keys are changed one at a time, solving the problem of key update management of symmetric cryptographic algorithms. Only symmetric cryptographic algorithms are used to achieve three functions: digital signature, key exchange, and data encryption. Compared with PKI technology, the "vertical authentication" technology has a simple authentication architecture and signature verification speed is 200 times faster than PKI.

[0020] 6. The timestamp consists of year, month, day, hour, minute and second, a total of 14 digits, such as: 2019-07-28-19-01-55. You can take a partial timestamp, year, month, day and time, such as: 2019-07-28-19. If the timestamp is: 14 digits, that is: "year" consists of 4 digits, that is: XXX0-XXX9, that is: "year" is 0-9, and "month" is composed of 2 digits. "Month" is 01-12, "day" is composed of 2 digits, that is, "day" is 01-31, "hour" is composed of 2 digits, that is, "hour" is 01-24, "minute" is composed of 2 digits, that is, "minute" is 01-60, "second" is composed of 2 digits, that is, "second" is 01-60, such as: 2019-07-28-19-01-55, which means 19:01:55 on July 28, 2019;

[0021] The random number is composed of Y=16, or 32 bits, binary numbers. When Y=16, each random number is a 4-bit binary number, that is, each random number occupies 4 bits, and 16 random numbers occupy a total of 64 bits. The value of the binary data of each random number is 0 to 15, such as: 0011, 1010, 0000, ..., 1111, 0110, then the value of its binary data is: 3, 10, 0, ..., 15, 6;

[0022] When Y=32, each random number occupies 5 bits, and 32 random numbers occupy a total of 160 bits. The binary value of each random number is: 0~31, such as: 00110, 10100, 00000, ..., 11111, 01100, then the binary data value is: 6, 20, 0, ..., 31, 12.

[0023] 7. The symmetric encryption algorithm uses SM1, SM4, RC4, RC5, 3DES, or AES algorithm, and the key length is 128, 210, or 256 bits, or the key length is defined according to the key length requirements of the symmetric encryption algorithm. my country stipulates that the key length is 128 bits;

[0024] The digest algorithm uses the SM3 algorithm and the SHA-2 algorithm. The length of the digest information is 256 bits. If the digest algorithm used has a relatively short length of digest information, the security level of the signature system will be reduced.

[0025] 8. The password management unit is responsible for the generation, filling, distribution and destruction of user keys;

[0026] (1) The key is centrally generated. The password management unit uses the random number generator in the CPU chip of the encryption device to generate a set of 128-bit random numbers, which are used as a set of "storage keys" CKi of the user Ai client or the "storage keys" KC of the instant messaging key management center;

[0027] The password management unit uses the random number generator in the CPU chip of the encryption device to generate a set of F2-byte random numbers, and uses this set of random numbers as a set of "key seeds". If the timestamp is 10 bits, that is, year, month, day and hour, then: take F2 = 1424 or 1680 bytes, and form a set of W×Y "key seeds" table D with the random numbers of F2 bytes.

[0028]

[0029] Among them: the elements of table D are D uv , u=0~w-1, v=0~y-1, D uv Occupies 0.5 bytes, or 1 byte, W = 89, or 105, Y = 16, or 32;

[0030] In short, the password management unit centrally generates the "storage key" CKi and the elements of the "key seed" table ai of the client, and centrally generates the "storage key" KC of the instant messaging key management center, or a set of "key seed" table C elements;

[0031] (2) Centralized key filling: the password management unit will fill the centrally generated "storage key" KC, or a set of "key seed" table C elements, into the encryption chips of all instant messaging key management center terminals in an offline environment;

[0032] Then, the elements of the centrally generated "key seed" table ai and the "storage key" CKi, together with the corresponding user identification Ai, are respectively loaded into the encryption chips of all user clients in an offline environment;

[0033] At the same time, in the encryption chip at the instant messaging key management center, the elements of the centrally generated "key seed" table ai are used with the "storage key" KC or a set of "key seed" table C elements to generate a "storage key" KCi that changes once, and the "key seed" table ai elements are encrypted into ciphertext respectively, and stored in the "key seed" database at the instant messaging key management center with the corresponding user Ai identification, thereby realizing the centralized filling of keys with encryption chips;

[0034] (3) Centralized key distribution: the cryptographic management unit distributes client encryption chips to users to distribute the user client's "key seed" ai and the client's "storage key" CKi;

[0035] The password management unit distributes the "storage key" KC of the instant messaging key management center, or a set of "key seed" table C elements that generate a one-time "storage key" KCi, to the instant messaging key management center through the encryption chip of the instant messaging key management center, thereby realizing the centralized distribution of the "storage key" KC or "key seed" table C elements using encryption hardware;

[0036] The password management unit sends the generated ciphertext records of the "key seed" database of the instant messaging key management center to the server of the instant messaging key management center, thereby realizing the centralized distribution of the records of the "key seed" database in ciphertext form;

[0037] (4) Centralized destruction of keys. If a user loses the client encryption chip, the system administrator of the instant messaging key management center will delete the record corresponding to the user ID in the "key seed" database of the instant messaging key management center, thereby realizing centralized destruction of user keys. At the same time, the encryption system of the instant messaging key management center will replace the relevant records in the original "key seed" database of the instant messaging key management center with the updated "key seed" database record, thereby realizing centralized update of user keys.

[0038] 9. The combined key generation algorithm selects a set of elements of a "key seed" table through a selection parameter composed of a set of timestamps and random numbers, selects the "row" elements of the "key seed" table with the timestamp, selects the sub-table of the "key seed" table with Y rows and Y columns, and then selects the "column" elements of the "key seed" table with Y rows and Y columns according to the random number, selects Y elements, and synthesizes a set of "storage keys", encryption / decryption keys, signatures and encryptions, or signature verification and decryption keys, where: Y = 16 or 32;

[0039] The specific implementation method of the combined key generation algorithm is as follows:

[0040] Take Table D as an example to illustrate the specific implementation method of the combined key generation algorithm. When the elements of Table D are selected as 89 rows and 16 columns, that is, 89×16=1424 elements, each element occupies 1 byte, and a total of 1424 bytes are occupied. When the elements of Table D are selected as 105 rows and 32 columns, that is, 105×32=3360 elements, each element occupies 0.5 bytes, and a total of 1680 bytes are occupied.

[0041] (1) The "year" of the timestamp corresponds to rows 1 to 10 in Table D, a total of 10 rows, the "month" corresponds to rows 11 to 22 in Table D, a total of 12 rows, the "day" corresponds to rows 23 to 53 in Table D, a total of 31 rows, and the "hour" corresponds to rows 54 to 77 in Table D, a total of 24 rows. When the elements of Table D are selected as 89 rows and 16 columns, there are still 12 rows of elements in Table D that do not correspond to the timestamp; when the elements of Table D are selected as 105 rows and 32 columns, there are still 28 rows of elements in Table D that do not correspond to the timestamp;

[0042] First select 4 rows from the elements of table D according to the timestamp. The method is: select 1 row from the 10 rows in table D, that is, use the value of the single digit of the timestamp "year" as the row number corresponding to the "year" in table D. For example, if the timestamp is: 2013XXXXXX, then: select the 4th row in table D, and select 1 row from the 12 rows in table D, that is, use the value of the timestamp "month" as the "row" corresponding to the "month" in table D. For example, if the timestamp is: 20XX11XXXX, then: select the 21st row in table D, and select the 31 rows in table D, that is, use the value of the timestamp "month" as the "row" corresponding to the "month" in table D. Take 1 row, that is, use the numerical value of the timestamp "day" as the "row" corresponding to "day" in table D. For example, if the timestamp is 20XXXX30XX, then take the 52nd row in table D. Take 1 row from the 54th to 77th rows of table D, that is, use the numerical value of the timestamp "hour" as the "row" corresponding to "hour" in table D. For example, if the timestamp is 20XXXXXX21, then take the 74th row in table D. Then select the 78th to Wth rows of table D, a total of W-78+1 rows. A total of Y rows are selected, where Y = 16 or 32 rows, forming a sub-table D1 of Y×Y table D.

[0043]

[0044] Among them: The elements of table D1 are: D vv , v = 0 ~ Y-1, D vv Occupies 0.5 or 1 byte, Y = 16 or 32; the elements from row 5 to row Y in table D1 are exactly the same as the elements from row 78 to row W in table D;

[0045] (2) Assume that the random numbers are Q1, Q2, ..., QY, and the corresponding values ​​are L1, L2, ..., LY. When Y = 16, the value corresponding to the 16-bit random number is between 0 and 15. Use L1, L2, ..., L16 to select the columns of table D1, that is, use the value L1 of the first random number Q1 to select the element in the L1+1th column of the first row of table D1, use the value L2 of the second random number Q2 to select the element in the L2+1th column of the second row of table D1, ..., use the value L16 of the 16th random number Q16 to select the element in the L16+1th column of the 16th row of table D1, and select a total of 16 elements;

[0046] When Y=32, the value of the 32-bit random number is: 0-31, and the columns of table D1 are selected using: L1, L2, ..., L32, that is, the value L1 of the first random number Q1 is used to select the element of the L1+1th column of the first row of table D1, the value L2 of the second random number Q2 is used to select the element of the L2+1th column of the second row of table D1, ..., the value L32 of the 32nd random number Q32 is used to select the element of the L32+1th column of the 32nd row of table D1, and a total of 32 elements are selected;

[0047] Since the state stipulates that the key length of the single-key cryptographic algorithm is 128 bits, assume that the storage key, encryption / decryption key, signature and encryption key, and verification and decryption key are all 128 bits. Combine the Y groups of elements selected from Table D into a group of keys. If the elements of Table D are 8 bits, Y=16, then the key formed by combining the 16 groups of elements selected from Table D is 128 bits. If the elements of Table D are 4 bits, Y=32, then the key formed by combining the 32 groups of elements selected from Table D is also 128 bits.

[0048] 10. According to the combined key generation algorithm, the key can be generated in real time, changing once. If the timestamp is 10 bits, namely: year, month, day and hour, the "key seed" table is 89×16, and the random number is a 16-bit binary number, where: each random number occupies 4 bits, and there are 16 changes in total, then the key change amount is: 2 64 / hour; if the timestamp is 10 bits, namely: year, month, day and hour, the "key seed" table is 105×32, and the random number is a 32-bit binary number, where: each random number occupies 5 bits, and there are 32 changes in total, then the change amount of the key is: 2 160 / Hour.

[0049] 11. In each user's client, the user "group" identifier of the user's "circle of friends" is stored, and each user "group" corresponding to each "circle of friends" of each user corresponds to a set of ciphertext of the "key seed" table element.

[0050] For example, user A1 has a total of R1 user "group" identifiers corresponding to the "friend circle", namely: "group" identifier B 11 Corresponding to "Key Seed" Table C 11 The ciphertext of the element, the "group" identifier B 12 Corresponding to "Key Seed" Table C 12 The ciphertext of the element, ..., the "group" identifier B 1R1 Corresponding to "Key Seed" Table C 1R1 The ciphertext of the element;

[0051] User A2 has R2 IDs for the user "group" in the "friend circle", namely: "group" ID B 21 Corresponding to "Key Seed" Table C 21 The ciphertext of the element, the "group" identifier B 22 Corresponding to "Key Seed" Table C 22 The ciphertext of the element, ..., the "group" identifier B 2R2 Corresponding to "Key Seed" Table C 2R2 The ciphertext of the element;

[0052] ……;

[0053] There are a total of Rn identifiers for user An's "friend circle" user "group", namely: "group" identifier B n1 Corresponding to "Key Seed" Table C n1 The ciphertext of the element, the "group" identifier B n2 Corresponding to "Key Seed" Table C n2 The ciphertext of the element, ..., the "group" identifier B nRn Corresponding to "Key Seed" Table C nRn The ciphertext of the element.

[0054] 12. The protocol for establishing a "key seed" database on the client side. Each user client encryption system, in the process of establishing a user "group" of the "friend circle", uses the storage key CKi in the client encryption chip to identify the user "group" of the corresponding "friend circle" B ie The "key seed" table C ie The element is encrypted into ciphertext and stored in the client's "key seed" database. Each record of the "key seed" database of the user client corresponds to a user "group" in the "circle of friends". The structure and records of the user client "key seed" database are as follows:

[0055] (1) The structure and records of the "key seed" database of user A1's client are as follows:

[0056] Field 1 Field 2 Field 3 ID Number "Group" logo "Key Seed" Table 1 <![CDATA["Group" identifier B 11 > <![CDATA["Key Seed" Table C 11 Ciphertext of the element]]> 2 <![CDATA["Group" identifier B 12 > <![CDATA["Key Seed" Table C 12 Ciphertext of the element]]> …… …… …… R1 <![CDATA["Group" identifier B 1R1 > <![CDATA["Ciphertext of the "Key Seed" table C 1R1 ciphertext of the element]]>

[0057] (2) The structure and records of the "key seed" database of user A2's client are as follows:

[0058] Field 1 Field 2 Field 3 ID Number "Group" logo "Key Seed" Table 1 <![CDATA["Group" identifier B 21 > <![CDATA["Ciphertext of the "Key Seed" table C 21 ciphertext of the element]]> 2 <![CDATA["Group" identification B 22 > <![CDATA["Key seed" table C 22 Ciphertext of the element]]> …… …… …… R2 <![CDATA["Group" identifier B 2R2 > <![CDATA["Key Seed" Table C 2R2 Ciphertext of the element]]>

[0059] ...,

[0060] (n) The structure and records of the "key seed" database of the user An client are as follows:

[0061] Field 1 Field 2 Field 3 ID Number "Group" logo "Key Seed" Table 1 <![CDATA["Group" identifier B n1 > <![CDATA["Ciphertext of the "Key Seed" table C n1 ciphertext of the element]]> 2 <![CDATA["Group" identifier B n2 > <![CDATA["Key Seed" Table C n2 Ciphertext of the element]]> …… …… …… R <![CDATA["Group" identifier B nRn > <![CDATA["Key seed" Table C nRn Ciphertext of the element]]>

[0062] Among them: the sum of records of the "key seed" database corresponding to the user "group" of the "friend circle" of all instant messaging users is: R1+R2+......+Rn, the number of user "groups" corresponding to the "friend circle" of each user Ai is Ri, e=1~Ri, Ri<n, i=1~n, n is the sum of all mobile phone users;

[0063] The records in the user client's "key seed" database are generated in real time in the encryption chip at the instant messaging key management center, and are encrypted into ciphertext and sent to the client. In the client's encryption chip, they are decrypted into plaintext, and then encrypted into ciphertext by the client's storage key and stored in the client's "key seed" database. This ensures the transmission and storage security of the records in the user client's "key seed" database.

[0064] 13. A protocol for establishing a "key seed" database at the instant messaging key management center. The encryption system at the instant messaging key management center stores the ciphertext of the "key seed" table ai element of all users together with the identifier of the user Ai in the "key seed" database of the instant messaging key management center, ensuring the storage security of the "key seed" table ai element of all users at the instant messaging key management center;

[0065] The structure and records of the "key seed" database at the instant messaging key management center are as follows:

[0066] (1) Method 1: Use the storage key KC to encrypt the "key seed" table ai elements respectively. The "key seed" database structure and records are as follows:

[0067] Field 1 Field 2 Field 3 ID Number UserAi Ciphertext of the "KeySeed" table element 1 User A1 The ciphertext of element a1 in the "key seed" table 2 User A2 The ciphertext of element a2 in the "key seed" table …… …… …… n User An "Key seed" represents the ciphertext of an element

[0068] (2) Method 2: Use the "key seed" table C element, generate a one-time storage key KCi according to the combined key generation algorithm, and use KCi to encrypt the "key seed" table ai elements respectively. The "key seed" database structure and record are as follows:

[0069] Field 1 Field 2 Field 3 Field 4 ID Number UserAi Ciphertext of the "KeySeed" table element Generate the encryption key timestamp i and random number i 1 User A1 The ciphertext of element a1 in the "key seed" table Timestamp 1 and random number 1 2 User A2 The ciphertext of element a2 in the "key seed" table Timestamp 2 and random number 2 …… …… …… …… n UserAn "Key seed" represents the ciphertext of an element Timestamp n and random number n

[0070] Wherein: the content of field 4 is combined with the "key seed" table C to generate a storage key KCi that changes once, and is used to encrypt the "key seed" table ai elements in the corresponding records, which can greatly improve the storage security and operation security of the "key seed" database records at the instant messaging key management center end, i = 1 to n, n is the sum of all instant messaging users;

[0071] The records in the "key seed" database of the instant messaging key management center - the "key seed" table ai element, are stored in ciphertext form, and in the encryption chip of the instant messaging key management center, the ciphertext of the "key seed" table ai element is decrypted with the "storage key", and the plaintext of the "key seed" table ai element is used to generate a one-time signature and encryption key, as well as a verification and decryption key according to the combined key generation algorithm, thereby ensuring the storage and operation security of the records in the "key seed" database of the instant messaging key management center.

[0072] 14. Establishing a user "group" of "friend circle" in the instant messaging system Protocol 1: When user Ai wants to establish a "one-to-one" user "group" with user Aj, user Ai sends the user Ai ID and user Aj ID to the instant messaging key management center. The encryption system at the instant messaging key management center first generates a set of random numbers in the chip of the encryption device, and uses the set of random numbers as a set of "key seeds" Table C ie Elements and "Key Seed" Table C jg element, then the "key seed" table C ie Elements and "Key Seed" Table C jg The elements are the same. After that, the "key seed" table ai element ciphertext of the corresponding user Ai is called. In the chip of the encryption device, the storage key KC or KCi is used to decrypt it, and then a set of timestamps TL and random numbers TS are generated. According to the combined key generation algorithm, a set of signature and encryption keys TK1 is generated. ie Elements are signed and encrypted, and the "key seed" table C ie The signature and ciphertext of the element, the timestamp TL and the random number TS are sent to the client encryption chip of user Ai. The client encryption system of user Ai selects the elements of the "key seed" table ai according to the combined key generation algorithm based on the timestamp TL and the random number TS, and combines the selected elements into the signature verification and decryption key TK2 to decrypt the "key seed" table C ie The element ciphertext is then verified for integrity. If the integrity verification is passed, the "key seed" table C distributed by the instant messaging key management center received by the user Ai client ie The elements are real and credible. The client encryption system of user Ai uses the storage key CKi to store the "key seed" table C ieAfter the element is encrypted into ciphertext, it is stored in the record of the "key seed" database of the client of user Ai. If it fails the integrity verification, the protocol is rerun;

[0073] At the same time, the encryption system at the instant messaging key management center calls the ciphertext of the element aj in the "key seed" table corresponding to the user Aj, and uses the storage key KC or KCi to decrypt it in the chip of the encryption device. According to the combined key generation algorithm, the elements of the "key seed" table aj are selected by the timestamp TL and the random number TS, and the selected elements are combined into a set of signature and encryption keys TK3, and the "key seed" table C is decrypted. jg Elements are signed and encrypted, and the "key seed" table C jg The signature and ciphertext of the element, the timestamp TL and the random number TS are sent to the client encryption chip of user Aj. The client encryption system of user Aj selects the elements of the "key seed" table aj according to the combined key generation algorithm based on the timestamp TL and the random number TS, and combines the selected elements into a set of signature verification and decryption keys TK4 to decrypt the "key seed" table C jg Element ciphertext, and perform integrity verification. If the integrity verification is passed, the user Aj client receives the "key seed" table C distributed by the instant messaging key management center. ig The elements are real and credible. The client encryption system of user Aj uses the storage key CKj to store the "key seed" table C jg After the element is encrypted into ciphertext, it is stored in the record of the "key seed" database of the client of user Aj. If it fails the integrity verification, the protocol is rerun to establish a "one-to-one" user "group" and realize the secure distribution of the "key seed" of the "one-to-one" user "group". Among them: the stored key KCi changes once and is generated by a set of "key seed" table C elements in the encryption chip at the instant messaging key management center end according to the combined key generation algorithm, e=1~Ri, g=1~Rj, e≠g, i=1~n, j=1~n, i≠j, n is the sum of all instant messaging users.

[0074] 15. Protocol 2 for establishing a user "group" of "friend circle" in the instant messaging system: When user Ai wants to establish a "one-to-many" user "group" with multiple users, user Ai, as the "group" owner, pulls multiple users into the "group", that is, user Ai sends his own ID and the IDs of multiple users to the instant messaging key management center. The encryption system at the instant messaging key management center generates a set of random numbers in the chip of the encryption device as a set of "key seed" table elements, and uses the "key seed" table elements as the user "group" of the "friend circle" of user Ai's client, and the corresponding "key seed" table C ieElement, at the same time, it is also used as the user "group" of the "friend circle" of other multiple user clients, and the corresponding "key seed" table element. The encryption system at the instant messaging key management center end calls the "key seed" database, the corresponding user Ai "key seed" table ai element ciphertext, and the ciphertext of the "key seed" table element of multiple other users, and uses the storage key KC or KCi in the chip of the encryption device to decrypt them respectively. After that, a set of timestamp TL1 and random number TS1 are generated, and according to the combined key generation algorithm, the signature and encryption key of the corresponding user Ai, as well as the signature and encryption key of multiple other users are generated respectively;

[0075] Use the signature and encryption key corresponding to user Ai to encrypt the "key seed" table C ie The element is signed and encrypted. At the same time, the signature and encryption keys corresponding to multiple other users are used to encrypt the "key seed" table C ie The element is signed and encrypted, and the "key seed" corresponding to user Ai is listed in Table C ie Element signature and ciphertext, as well as "key seeds" corresponding to multiple other users Table C ie The signature and ciphertext of the element are sent to the client of user Ai and the clients of other users respectively. In the encryption chips of the client of user Ai and the clients of other users, according to the combined key generation algorithm, a set of timestamps TL1 and random numbers TS1, the elements of the "key seed" table ai of user Ai, and the elements of the "key seed" table corresponding to other users are used to generate the signature verification and decryption keys corresponding to user Ai and the signature verification and decryption keys corresponding to other users respectively, and decrypt the "key seed" table C of the client of user Ai respectively. ie Element ciphertext, and "key seed" table C of multiple other user clients ie The element ciphertext is then verified for integrity. If the integrity verification is passed, the storage key CKi of user Ai and the storage keys in the encryption chips of multiple other user clients are called, and the "key seed" table C is respectively ie After the element is encrypted into ciphertext, it is stored in the "key seed" database record of user Ai and multiple other user clients. If the integrity verification fails, the protocol is rerun to complete the secure distribution of the "key seed" for the "one-to-many" user "group", where: the stored key KCi changes each time and is generated by a set of "key seed" table C elements in the encryption chip at the instant messaging key management center end according to the combined key generation algorithm, e=1~Ri, i=1~n, n is the sum of all instant messaging users.

[0076] 16. In the user "group" of the "friend circle" of the instant messaging system, when user Ai, as the group owner, wants to add one or more users to a "friend circle" user "group", that is, user Ai, as the "group" owner, pulls one or more users into this "group", the group owner needs to enter the "key seed" table C corresponding to this group. ie The element is forwarded to the client of one or more users to be added to the group through the instant messaging key management center. The specific protocol is as follows:

[0077] User Ai maps the user "group" of "friend circle" to the "key seed" table C ie The ciphertext of the element is decrypted in the client encryption chip with the storage key CKi, and then the "key seed" table ai element is called to generate a set of timestamps TL2 and random numbers TS2. According to the combined key generation algorithm, a set of signature and encryption keys TK5 is generated to encrypt the "key seed" table C ie The element is signed and encrypted, and the user Ai, the identity of one or more users, and the "key seed" table C ie The signature and ciphertext of the element, as well as a set of timestamp TL2 and random number TS2, are sent to the instant messaging key management center. The encryption system of the instant messaging key management center takes out the ciphertext of the element of the "key seed" table ai corresponding to the user Ai identity from the "key seed" database, and uses the storage key KC or KCi in the chip of the encryption device to decrypt the ciphertext of the element of the "key seed" table ai. According to the combined key generation algorithm, the elements of the "key seed" table ai are selected by the timestamp TL2 and the random number TS2, and the selected elements are synthesized into a set of decryption keys TK6 to decrypt the "key seed" table C ie The ciphertext of the element is read and integrity verified. If the integrity verification is passed, the ciphertext of the "key seed" table element corresponding to one or more user identifiers is called in the "key seed" database, and the storage key KC or KCi is used to decrypt it in the chip of the encryption device. After that, a set of timestamps TL3 and random numbers TS3 are generated. According to the combined key generation algorithm, the signature and encryption key corresponding to one or more users are generated respectively, and then the "key seed" table C is decrypted respectively. ie The element is signed and encrypted, and the "key seed" corresponding to one or more users is listed in Table C ie The signature and ciphertext of the element, as well as the timestamp TL3 and the random number TS3, are sent to the corresponding user client together with one or more user identifiers. In the client encryption chip of one or more users, one or more signature verification and decryption keys are generated respectively by the timestamp TL3 and the random number TS3, and the "key seed" table elements corresponding to one or more user identifiers according to the combined key generation algorithm, and the "key seed" table C corresponding to one or more users is decrypted respectively. ieThe ciphertext of the element is then verified for integrity. If the integrity verification is passed, the "key seed" table C is stored in one or more user client encryption chips using their respective storage keys. ie The elements are encrypted into ciphertext and stored in the "key seed" database records corresponding to each user client. If the integrity verification fails, the protocol is rerun to complete a "group" of users in a "circle of friends" and add one or more users to the "group" to distribute the "key seed". The storage key KCi changes each time and is generated by a set of "key seed" table C elements in the encryption chip at the instant messaging key management center end according to the combined key generation algorithm, e=1~Ri, i=1~n, and n is the sum of all instant messaging users.

[0078] 17. Encrypted Instant Messaging Protocol 1: In a one-to-one "friend circle" user "group" of user Ai, there are only two users: user Ai and user Aj. The ID of user Ai's corresponding "friend circle" user "group" is B ie When user Ai intends to send encrypted social information RL in a one-to-one "friend circle" user "group", the user Ai client encryption system first calls the storage key CKi in the encryption chip to decrypt the corresponding record of the user Ai client "key seed" database - "key seed" table C ie The element ciphertext is generated, and a set of timestamps TLL and random numbers TSS are generated. According to the combined key generation algorithm, a set of encryption keys KK1 is generated, and the ciphertext of RL is encrypted to generate the social information RL, and the user Ai is corresponding to the user "group" identification B of the "friend circle" ie , a set of timestamps TLL and random numbers TSS, as well as the ciphertext of social information RL, are sent to the user Ai's "one-to-one" "circle of friends" user "group". In the encryption chip of the user Aj client, the storage key CKj is called to decrypt the corresponding "key seed" database record - "key seed" table C ig Element ciphertext, and generate decryption key KK2 according to the combined key generation algorithm composed of timestamp TLL and random number TSS, decrypt the social information RL ciphertext sent by user Ai to the "one-to-one" user "group", and user Aj can read the plain text of social information RL, thereby completing the encrypted transmission process of instant messaging in a "one-to-one" "circle of friends" user "group" of user Ai, where: e=1~Ri, g=1~Rj, e≠g, i=1~n, j=1~n, i≠j, n is the sum of all instant messaging users;

[0079] The combined key generation algorithm using the "vertical authentication" technical architecture can solve the problem of one-to-one instant messaging user "groups" requiring the key for encrypting user social information to change each time, thereby improving the security level of encrypted instant messaging. At the same time, in one-to-one instant messaging user groups, users' encrypted instant messaging uses "offline" encrypted transmission, which can greatly improve the operating efficiency of encrypted instant messaging.

[0080] 18. Encrypted Instant Messaging Protocol 2: In a one-to-many "friend circle" user "group" of user Ai, there are a total of Z users, and the ID of the "friend circle" user "group" corresponding to user Ai is B ie When user Ai intends to send encrypted social information RL in a one-to-many user "group", the user Ai client encryption system first calls the storage key CKi in the encryption chip to decrypt the corresponding record of the user Ai client "key seed" database - "key seed" table C ie Element ciphertext, and then generate a set of timestamps TLL1 and random numbers TSS1, generate a set of encryption keys KKL1 according to the combined key generation algorithm, encrypt the social information RL to generate the ciphertext of RL, and correspond the user Ai to the "friend circle" user "group" identifier B ie , a set of timestamp TLL1 and random number TSS1, as well as the ciphertext of the social information RL, are sent together to Ai's "one-to-many" "circle of friends" user "group". The client encryption systems of multiple other users respectively call the records in the client "key seed" database of the corresponding "circle of friends" user "group" from their respective client "key seed" databases, and decrypt them in their respective client encryption chips using their respective client storage keys. Based on the combined key generation algorithm composed of the timestamp TLL1 and the random number TSS1, they respectively generate their own decryption keys to decrypt the ciphertext of the encrypted social information RL sent by user Ai to the "one-to-many" user "group". Multiple other users can read the plaintext of the social information RL, thereby completing the encrypted transmission process of instant messaging in a "one-to-many" "circle of friends" user "group" of user Ai, where: e=1~Ri, i=1~n, and n is the sum of all instant messaging users;

[0081] The combined key generation algorithm using "vertical authentication" technology can solve the global problem of the one-to-many user "group" in instant messaging, where the key for encrypting user social information changes each time. This can improve the security level of encrypted instant messaging. At the same time, in the "one-to-many" user "group", users' encrypted instant messaging uses "offline" encrypted transmission, which can greatly improve the operating efficiency of encrypted instant messaging.

[0082] 19. User Collection Social Information Protocol: The encryption system of user Ai's client calls the "key seed" ai in the encryption chip, generates a one-time encryption key according to the combined key generation algorithm, encrypts the social information that user Ai intends to collect into ciphertext, and stores the ciphertext of the social information to be collected in the cloud of the instant messaging system, that is, the ciphertext of the social information that all user Ai intends to collect is stored in the "social information" database collected by users in the cloud of the instant messaging system. The structure and records of the "social information" database collected by users are as follows:

[0083] (1) The database structure and records of "social information" collected by user A1 are as follows:

[0084] Field 1 Field 2 Field 3 Field 4 ID Number User ID sending social messages User A1's favorite social information ciphertext Generate timestamp and random number for encryption key 1 User ID sending social message 1 Social information ciphertext 1 Timestamp 1 and random number 1 2 User ID sending social message 2 Social Information Encryption 2 Timestamp 2 and random number 2 …… …… …… f1 The user ID that sends the social message f1 Social information ciphertext f1 Timestamp f1 and random number f1

[0085] (2) The database structure and records of "social information" collected by user A2 are as follows:

[0086] Field 1 Field 2 Field 3 Field 4 ID Number User ID sending social messages User A2's favorite social information ciphertext Generate timestamp and random number for encryption key 1 User ID sending social message 1 Social information ciphertext 1 Timestamp 1 and random number 1 2 User ID sending social message 2 Social Information Encryption 2 Timestamp 2 and random number 2 …… …… …… f2 The user ID that sends the social message f2 Social information ciphertext f2 Timestamp f2 and random number f2

[0087] ...,

[0088] (n) The database structure and records of "social information" collected by user An are as follows:

[0089] Field 1 Field 2 Field 3 Field 4 ID Number User ID sending social messages Social information ciphertext collected by user An Generate timestamp and random number for encryption key 1 User ID sending social message 1 Social information ciphertext 1 Timestamp 1 and random number 1 2 User ID sending social message 2 Social Information Encryption 2 Timestamp 2 and random number 2 …… …… …… fn User ID that sends social message fn Social information ciphertextfn Timestamp fn and random number fn

[0090] Where: f1 is the total amount of social information collected by user A1, f2 is the total amount of information collected by user A2, ..., fn is the total amount of social information collected by user An, n = 1 ~ n, n is the total number of all instant messaging users;

[0091] In a "one-to-one" or "one-to-many" user "group", each user can collect his or her own social information or that sent by other users. Therefore, the user's social information is stored and transmitted in encrypted form on the cloud server of the instant messaging system, thereby ensuring the storage and transmission security of social information between users.

[0092] 20. Encryption chips are deployed on the user client of the encrypted instant messaging system, and encryption chips are also deployed on the instant messaging key management center. The core parts of various protocols of the encrypted instant messaging system, such as real-time generated encryption / decryption keys, signature and encryption keys, and verification and decryption keys, are all generated in the chip, and various keys do not leave the chip. In addition, the social information encryption / decryption process, the "key seed" table element signature and encryption process, and the "key seed" table element ciphertext decryption and integrity verification process are also completed in the encryption chip, realizing the "chip" to "chip" encryption / decryption protocol, signature and encryption protocol, and verification and decryption protocol. At the same time, a combined key generation algorithm is used to generate various keys that change one by one and are not repeated. Especially in the "one-to-many" user "group", the key used to encrypt social information also changes one by one, solving this global problem. In addition, in the user "group" of the same "circle of friends" in the encrypted instant messaging system, the social information between users in the "group" adopts the "offline" encrypted transmission method, which can greatly improve the operating efficiency of encrypted instant messaging.

Claims

1. A method for implementing efficient encrypted instant messaging is to establish an encrypted instant messaging system using a "vertical authentication" technical architecture, and to complete key exchange, signature and encryption functions based on a symmetric cryptographic algorithm. When a user establishes a user "group" of a "circle of friends", the encryption system at the instant messaging key management center allocates a set of identical "key seed" table elements to the user client in each "group" in real time. In the encryption chip of each user's client, encrypted instant messaging is implemented in a "one-to-one" or "one-to-many" user "group". The social information of users is mutually encrypted and transmitted in real time "offline", which can improve the operating efficiency of encrypted instant messaging. Various keys generated by the combined key generation algorithm are changed one at a time, solving the problem of symmetric key management. At the same time, the core parts of various protocols of encrypted instant messaging are completed in the chip, thereby establishing a "chip-level" encrypted instant messaging system; wherein: The definition of "vertical authentication" technical architecture is that keys are centrally generated, centrally filled, centrally distributed, and centrally destroyed; The combined key generation algorithm is to select a set of elements of a "key seed" table by using a set of selection parameters consisting of a timestamp and a random number, and synthesize the selected Y elements into a set of encryption / decryption keys, signature and encryption keys, or signature verification and decryption keys, where Y = 16 or 32. The technical features of the method are: Deploy smart card hardware devices on the client side of user Ai, and establish a client encryption system in the smart card chip, that is, write symmetric cryptographic algorithms, digest algorithms, combined key generation algorithms, encryption / decryption key protocols, signature and encryption protocols, signature verification / decryption protocols, a set of "key seed" table ai elements, a set of storage keys CKi, and establish Ri "friend circle" user "groups" on the client side of user Ai. Each "friend circle" user "group" corresponds to a set of "key seed" table C ie Element, "Key Seed" Table C ie The element is generated by the encryption system of the instant messaging key management center in the encryption device chip and sent to the client encryption chip. Then, a set of storage keys CKi of the client encryption system is used to store the "key seed" table C ie After the elements are encrypted into ciphertext, they are stored in the client "key seed" database of user Ai; Deploy hardware equipment at the instant messaging key management center, and establish an encryption system at the instant messaging key management center in the chip of the hardware equipment, that is, write a symmetric cryptographic algorithm, a digest algorithm, a combined key generation algorithm, a key encryption / decryption protocol, a signature and encryption protocol, a signature verification / decryption protocol, a set of storage keys KC, or a set of "key seed" table C elements into the encryption chip at the instant messaging key management center. In the user "key seed" database at the instant messaging key management center, store the identifiers of all users Ai and a corresponding set of "key seed" table ai element ciphertexts, wherein: use the storage key KC, or a set of "key seed" table C elements, according to the combined key generation algorithm, to generate a one-time storage key KCi to encrypt the elements of the user "key seed" table ai into ciphertext storage in advance; When a user creates a user "group" of "friend circle", a set of random numbers is generated in the encryption chip of the instant messaging key management center as the user "group" of user Ai's "friend circle". The corresponding "key seed" table C ie Elements, in the chip of the hardware device, respectively generate the signature and encryption key of each user in the user "group" of the user Ai's "circle of friends", and put the "key seed" table C ie After the elements are encrypted into ciphertexts, they are sent to the encryption chips of the corresponding user clients, decrypted into plaintexts in the encryption chips of the respective user clients, and integrity verification is performed respectively. If the integrity verification is passed, they are encrypted into ciphertexts by the storage keys of the respective clients and stored in the "key seed" database of the respective user clients. If the integrity verification is not passed, this protocol is rerun, where: the sum of the "key seed" database records of the user "groups" of the "friend circle" of all user Ai is: R1+R2+......+Rn, the number of user "groups" of the "friend circle" corresponding to each user Ai is Ri, e=1~Ri, Ri<n, j=1~n, i=1~n, i≠j, and n is the sum of all mobile phone users; User Ai's "friend circle" of users "group" other users, through the corresponding records stored in the "key seed" database of each client - Table C ie Elements, real-time one-time encryption key is generated to encrypt the social information sent by oneself to the user "group" of "friend circle". At the same time, it decrypts the ciphertext of social information sent by other users to the user "group" of "friend circle", realizing "one-to-one" encrypted instant messaging, or "one-to-many" encrypted instant messaging, thereby establishing an efficient encrypted instant messaging system.

2. The method according to claim 1, characterized in that: (1) The key is centrally generated. The password management unit uses the random number generator in the CPU chip of the encryption device to generate a set of 128-bit random numbers, which are used as a set of "storage keys" CKi of the user Ai client or the "storage keys" KC of the instant messaging key management center; The password management unit uses the random number generator in the CPU chip of the encryption device to generate a set of F2-byte random numbers, and uses this set of random numbers as a set of "key seeds". If the timestamp is 10 bits, that is, year, month, day and hour, then: take F2 = 1424 or 1680 bytes, and form a set of W×Y "key seeds" table D with the random numbers of F2 bytes. Among them: the elements of table D are D uv , u=0~w-1, v=0~y-1, D uv Occupies 0.5 bytes, or 1 byte, W = 89, or 105, Y = 16, or 32; In short, the password management unit centrally generates the "storage key" CKi and the elements of the "key seed" table ai of the client, and centrally generates the "storage key" KC of the instant messaging key management center, or a set of "key seed" table C elements; (2) Centralized key filling: the password management unit will fill the centrally generated "storage key" KC, or a set of "key seed" table C elements, into the encryption chips of all instant messaging key management center terminals in an offline environment; Then, the elements of the centrally generated "key seed" table ai and the "storage key" CKi, together with the corresponding user identification Ai, are respectively loaded into the encryption chips of all user clients in an offline environment; At the same time, in the encryption chip at the instant messaging key management center, the elements of the centrally generated "key seed" table ai are used with the "storage key" KC or a set of "key seed" table C elements to generate a "storage key" KCi that changes once, and the "key seed" table ai elements are encrypted into ciphertext respectively, and stored in the "key seed" database at the instant messaging key management center with the corresponding user Ai identification, thereby realizing the centralized filling of keys with encryption chips; (3) Centralized key distribution: the cryptographic management unit distributes client encryption chips to users to distribute the user's client "key seed" ai and the client's "storage key" CKi; The password management unit distributes the "storage key" KC of the instant messaging key management center, or a set of "key seed" table C elements that generate a one-time "storage key" KCi, to the instant messaging key management center through the encryption chip of the instant messaging key management center, thereby realizing the centralized distribution of the "storage key" KC or "key seed" table C elements using encryption hardware; The password management unit sends the generated ciphertext records of the "key seed" database of the instant messaging key management center to the server of the instant messaging key management center, thereby realizing the centralized distribution of the records of the "key seed" database in ciphertext form; (4) Centralized destruction of keys. If a user loses the client encryption chip, the system administrator of the instant messaging key management center will delete the record corresponding to the user ID in the "key seed" database of the instant messaging key management center, thereby realizing centralized destruction of user keys. At the same time, the encryption system of the instant messaging key management center will replace the relevant records in the original "key seed" database of the instant messaging key management center with the updated "key seed" database record, thereby realizing centralized update of user keys.

3. The method according to claim 1, characterized in that: (1) A protocol for establishing a "key seed" database on the client side. Each user client encryption system uses the storage key CKi in the client encryption chip to identify the user "group" of the corresponding "friend circle" B in the process of establishing the user "group" of the "friend circle". ie The "key seed" table C ie The element is encrypted into ciphertext and stored in the client's "key seed" database. Each record of the "key seed" database of the user client corresponds to a user "group" of the "friend circle". The structure and records of the user client "key seed" database are as follows: (1) The structure and records of the "key seed" database of user A1's client are as follows: (2) The structure and records of the "key seed" database of user A2's client are as follows: ……， (n) The structure and records of the "key seed" database of the user An client are as follows: Among them: the sum of records of the "key seed" database corresponding to the "group" of all instant messaging users' "friend circle" is: R1+R2+......+Rn, the number of user "groups" corresponding to each user Ai's "friend circle" is Ri, e=1~Ri, Ri<n, i=1~n, n is the sum of all mobile phone users; The records in the "key seed" database of the user client are generated in real time in the encryption chip of the instant messaging key management center, and are encrypted into ciphertext and sent to the client. In the encryption chip of the client, they are decrypted into plaintext, and then encrypted into ciphertext by the client's storage key, and stored in the records of the "key seed" database of the client, thereby ensuring the transmission and storage security of the records in the "key seed" database of the user client; (2) A protocol for establishing a "key seed" database at the instant messaging key management center. The encryption system at the instant messaging key management center stores the ciphertext of the "key seed" table ai elements of all users together with the identifier of the user Ai in the "key seed" database at the instant messaging key management center, thereby ensuring the storage security of the "key seed" table ai elements of all users at the instant messaging key management center; The "key seed" database structure and records of the instant messaging key management center are as follows: Method 1: Use the storage key KC to encrypt the "key seed" table ai elements respectively. The "key seed" database structure and records are as follows: Method 2: Use the "key seed" table C element, and generate a one-time storage key KCi according to the combined key generation algorithm. Use KCi to encrypt the "key seed" table ai elements respectively. The "key seed" database structure and records are as follows: Wherein: the content of field 4 is combined with the "key seed" table C to generate a storage key KCi that changes once, and is used to encrypt the "key seed" table ai elements in the corresponding records, which can greatly improve the storage security and operation security of the "key seed" database records at the instant messaging key management center end, i = 1 to n, n is the sum of all instant messaging users; The records in the "key seed" database of the instant messaging key management center - the "key seed" table ai element, are stored in ciphertext form, and in the encryption chip of the instant messaging key management center, the "storage key" is used to decrypt the ciphertext of the "key seed" table ai element, and the plaintext of the "key seed" table ai element is used to generate a one-time signature and encryption key, as well as a verification and decryption key according to the combined key generation algorithm, thereby ensuring the storage and operation security of the records in the "key seed" database of the instant messaging key management center.

4. The method according to claim 1, characterized in that: (1) Establishing a user "group" of "friend circle" in the instant messaging system Protocol 1: When user Ai wants to establish a "one-to-one" user "group" with user Aj, user Ai sends the user Ai ID and user Aj ID to the instant messaging key management center. The encryption system at the instant messaging key management center first generates a set of random numbers in the chip of the encryption device, and uses the set of random numbers as a set of "key seeds" in Table C. ie Elements and "Key Seed" Table C jg element, then the "key seed" table C ie Elements and "Key Seed" Table C jg The elements are the same. After that, the "key seed" table ai element ciphertext of the corresponding user Ai is called. In the chip of the encryption device, the storage key KC or KCi is used to decrypt it, and then a set of timestamps TL and random numbers TS are generated. According to the combined key generation algorithm, a set of signature and encryption keys TK1 is generated. The "key seed" table C ie Elements are signed and encrypted, and the "key seed" table C ie The signature and ciphertext of the element, the timestamp TL and the random number TS are sent to the client encryption chip of user Ai. The client encryption system of user Ai selects the elements of the "key seed" table ai according to the combined key generation algorithm, based on the timestamp TL and the random number TS, and combines the selected elements into the signature verification and decryption key TK2, decrypting the "key seed" table C ie The element ciphertext is then verified for integrity. If the integrity verification is passed, the "key seed" table C distributed by the instant messaging key management center received by the user Ai client ie The elements are real and credible. The client encryption system of user Ai uses the storage key CKi to store the "key seed" table C ie After the element is encrypted into ciphertext, it is stored in the record of the "key seed" database of the user Ai's client. If it fails the integrity verification, the protocol is rerun; At the same time, the encryption system at the instant messaging key management center calls the ciphertext of the element aj in the "key seed" table corresponding to the user Aj, and uses the storage key KC or KCi to decrypt it in the chip of the encryption device. According to the combined key generation algorithm, the elements of the "key seed" table aj are selected by the timestamp TL and the random number TS, and the selected elements are combined into a set of signature and encryption keys TK3, and the "key seed" table C is decrypted. jg Elements are signed and encrypted, and the "key seed" table C jg The signature and ciphertext of the element, the timestamp TL and the random number TS are sent to the client encryption chip of user Aj. The client encryption system of user Aj selects the elements of the "key seed" table aj based on the timestamp TL and the random number TS according to the combined key generation algorithm, and combines the selected elements into a set of signature verification and decryption keys TK4 to decrypt the "key seed" table C jg Element ciphertext, and perform integrity verification. If the integrity verification is passed, the user Aj client receives the "key seed" table C distributed by the instant messaging key management center. ig The elements are real and credible. The client encryption system of user Aj uses the storage key CKj to store the "key seed" table C jg After the element is encrypted into ciphertext, it is stored in the record of the "key seed" database of the client of user Aj. If it fails the integrity verification, the protocol is re-run, thereby establishing a "one-to-one" user "group" and realizing the secure distribution of the "key seed" of the "one-to-one" user "group". Among them: the storage key KCi changes once, and is generated by a set of "key seed" table C elements in the encryption chip at the instant messaging key management center end according to the combined key generation algorithm, e = 1 ~ Ri, g = 1 ~ Rj, e ≠ g, i = 1 ~ n, j = 1 ~ n, i ≠ j, n is the sum of all instant messaging users; (2) Establishing a User "Group" of "Friends Circle" in the Instant Messaging System Protocol 2: When user Ai wants to establish a "one-to-many" user "group" with multiple users, user Ai, as the "group" owner, pulls multiple users into the "group", that is, user Ai sends his own ID and the IDs of multiple users to the instant messaging key management center. The encryption system at the instant messaging key management center generates a set of random numbers in the chip of the encryption device as a set of "key seed" table elements, and uses the "key seed" table elements as the user "group" of the "friend circle" of user Ai's client. The corresponding "key seed" table C ie Element, at the same time, it is also used as the user "group" of the "friend circle" of other multiple user clients, and the corresponding "key seed" table element. The encryption system at the instant messaging key management center end calls the "key seed" database, the corresponding user Ai "key seed" table ai element ciphertext, and the ciphertext of the "key seed" table element of multiple other users, and uses the storage key KC or KCi in the chip of the encryption device to decrypt them respectively. After that, a set of timestamp TL1 and random number TS1 are generated, and according to the combined key generation algorithm, the signature and encryption key of the corresponding user Ai, as well as the signature and encryption key of multiple other users are generated respectively; Use the signature and encryption key corresponding to user Ai to encrypt the "key seed" table C ie The element is signed and encrypted. At the same time, the signature and encryption keys corresponding to multiple other users are used to respectively ie The element is signed and encrypted, and the "key seed" corresponding to user Ai is listed in Table C ie Element signature and ciphertext, as well as "key seeds" corresponding to multiple other users Table C ie The signature and ciphertext of the element are sent to the client of user Ai and the clients of other users respectively. In the encryption chips of the client of user Ai and the clients of other users, according to the combined key generation algorithm, a set of timestamps TL1 and random numbers TS1, the elements of the "key seed" table ai of user Ai, and the elements of the "key seed" table corresponding to other users are used to generate the signature verification and decryption keys corresponding to user Ai and the signature verification and decryption keys corresponding to other users respectively, and decrypt the "key seed" table C of the client of user Ai respectively. ie Element ciphertext, and "key seed" table C of multiple other user clients ie The element ciphertext is then verified for integrity. If the integrity verification is passed, the storage key CKi of user Ai and the storage keys in the encryption chips of multiple other user clients are called, and the "key seed" table C is used to store the key seed. ie After the element is encrypted into ciphertext, it is stored in the "key seed" database record of user Ai and multiple other user clients. If the integrity verification fails, the protocol is re-run, thereby completing the establishment of a "one-to-many" user "group" of "key seed" security distribution, where: the storage key KCi changes once, and is generated by a set of "key seed" table C elements in the encryption chip of the instant messaging key management center, according to the combined key generation algorithm, e = 1 ~ Ri, i = 1 ~ n, n is the sum of all instant messaging users; (3) In the user "group" of the "friend circle" of the instant messaging system, when user Ai, as the group owner, wants to add one or more users to a "friend circle" user "group", that is, user Ai, as the "group" owner, adds one or more users to this "group". The group owner needs to enter the "key seed" table C corresponding to this group. ie The element is forwarded to the client of one or more users to be added to the group through the instant messaging key management center. The specific protocol is as follows: User Ai maps the user "group" of "friend circle" to the "key seed" table C ie The ciphertext of the element is decrypted with the storage key CKi in the client encryption chip, and then the "key seed" table ai element is called to generate a set of timestamps TL2 and random numbers TS2. According to the combined key generation algorithm, a set of signature and encryption keys TK5 is generated to encrypt the "key seed" table C ie The element is signed and encrypted, and the user Ai, the identity of one or more users, and the "key seed" table C ie The signature and ciphertext of the element, as well as a set of timestamp TL2 and random number TS2, are sent to the instant messaging key management center. The encryption system of the instant messaging key management center takes out the ciphertext of the element of the "key seed" table ai corresponding to the user Ai identity from the "key seed" database, and uses the storage key KC or KCi in the chip of the encryption device to decrypt the ciphertext of the element of the "key seed" table ai. According to the combined key generation algorithm, the elements of the "key seed" table ai are selected by the timestamp TL2 and the random number TS2, and the selected elements are synthesized into a set of decryption keys TK6 to decrypt the "key seed" table C ie The ciphertext of the element is read and integrity verified. If the integrity verification is passed, the ciphertext of the "key seed" table element corresponding to one or more user identifiers is called in the "key seed" database. In the chip of the encryption device, the storage key KC or KCi is used to decrypt it respectively. After that, a set of timestamps TL3 and random numbers TS3 are generated. According to the combined key generation algorithm, the signature and encryption key corresponding to one or more users are generated respectively. Then, the "key seed" table C is decrypted respectively. ie The element is signed and encrypted, and the "key seed" corresponding to one or more users is listed in Table C ie The signature and ciphertext of the element, as well as the timestamp TL3 and the random number TS3, are sent to the corresponding user client together with one or more user identifiers. In the client encryption chip of one or more users, according to the combined key generation algorithm, one or more signature verification and decryption keys are generated by the timestamp TL3 and the random number TS3, as well as the "key seed" table elements corresponding to one or more user identifiers, respectively, to decrypt the "key seed" table C corresponding to one or more users. ie The ciphertext of the element is then verified for integrity. If the integrity verification is passed, the "key seed" table C is stored in one or more user client encryption chips using their respective storage keys. ie The elements are encrypted into ciphertext and stored in the "key seed" database records corresponding to each user client. If the integrity verification fails, the protocol is rerun to complete a "group" of users in a "circle of friends" and add one or more users to the "group" to distribute the "key seed". The storage key KCi changes each time and is generated by a set of "key seed" table C elements in the encryption chip at the instant messaging key management center end according to the combined key generation algorithm, e = 1 ~ Ri, i = 1 ~ n, n is the sum of all instant messaging users.

5. The method according to claim 1, characterized in that: (1) Encrypted Instant Messaging Protocol 1: In a one-to-one "friend circle" user "group" of user Ai, there are only two users: user Ai and user Aj. The identifier of user Ai's corresponding "friend circle" user "group" is B ie When user Ai intends to send encrypted social information RL in a one-to-one "friend circle" user "group", user Ai's client encryption system first calls the storage key CKi in the encryption chip to decrypt the corresponding record of user Ai's client "key seed" database - "key seed" table C ie The element ciphertext is generated, and a set of timestamps TLL and random numbers TSS are generated. According to the combined key generation algorithm, a set of encryption keys KK1 is generated, and the ciphertext of RL is encrypted to generate the social information RL, and the user Ai is corresponding to the user "group" identification B of the "friend circle" ie , a set of timestamps TLL and random numbers TSS, as well as the ciphertext of social information RL, are sent to the user Ai's "one-to-one" "circle of friends" user "group". In the encryption chip of the user Aj client, the storage key CKj is called to decrypt the corresponding "key seed" database record - "key seed" table C ig Element ciphertext, and generate decryption key KK2 according to the combined key generation algorithm composed of timestamp TLL and random number TSS, decrypt the social information RL ciphertext sent by user Ai to the "one-to-one" user "group", and user Aj can read the plain text of social information RL, thus completing the encrypted transmission process of instant messaging in a "one-to-one" "circle of friends" user "group" of user Ai, where: e=1~Ri, g=1~Rj, e≠g, i=1~n, j=1~n, i≠j, n is the sum of all instant messaging users; The combined key generation algorithm using the "vertical authentication" technical architecture can solve the problem of changing the key for encrypting user social information in a "one-to-one" user "group" of instant messaging, which can improve the security level of encrypted instant messaging; at the same time, in a "one-to-one" user "group", the encrypted instant messaging of users adopts "offline" encrypted transmission, which can greatly improve the operating efficiency of encrypted instant messaging; (2) Encrypted Instant Messaging Protocol 2: In a "one-to-many" "friend circle" user "group" of user Ai, there are a total of Z users, and the identifier of the "friend circle" user "group" corresponding to user Ai is B ie When user Ai intends to send encrypted social information RL in a "one-to-many" user "group", the user Ai client encryption system first calls the storage key CKi in the encryption chip to decrypt the corresponding record of the user Ai client "key seed" database - "key seed" table C ie Element ciphertext, and then generate a set of timestamps TLL1 and random numbers TSS1, generate a set of encryption keys KKL1 according to the combined key generation algorithm, encrypt the social information RL to generate the ciphertext of RL, and correspond the user Ai to the "friend circle" user "group" identifier B ie , a set of timestamp TLL1 and random number TSS1, as well as the ciphertext of the social information RL, are sent together to Ai's "one-to-many" "circle of friends" user "group". The client encryption systems of multiple other users call the records in the client "key seed" database of the corresponding "circle of friends" user "group" from their respective client "key seed" databases, and decrypt them in their respective client encryption chips using their respective client storage keys. Based on the combined key generation algorithm composed of the timestamp TLL1 and the random number TSS1, they generate their respective decryption keys to decrypt the ciphertext of the encrypted social information RL sent by user Ai to the "one-to-many" user "group". Multiple other users can read the plaintext of the social information RL, thereby completing the encrypted transmission process of instant messaging in a "one-to-many" "circle of friends" user "group" of user Ai, where: e=1~Ri, i=1~n, and n is the sum of all instant messaging users; The combined key generation algorithm using "vertical authentication" technology can solve the global problem of changing the key for encrypting user social information one-by-one in a "one-to-many" user "group". This can improve the security level of encrypted instant messaging. At the same time, in a "one-to-many" user "group", users' encrypted instant messaging uses "offline" encrypted transmission, which can greatly improve the operating efficiency of encrypted instant messaging.

6. The method according to claim 1, characterized in that: User collection social information protocol: The encryption system of user Ai's client calls the "key seed" ai in the encryption chip, generates a one-time encryption key according to the combined key generation algorithm, encrypts the social information that user Ai intends to collect into ciphertext, and stores the ciphertext of the social information to be collected in the cloud of the instant messaging system, that is, the ciphertext of the social information that all user Ai intends to collect is stored in the "social information" database collected by users in the cloud of the instant messaging system. The structure and records of the "social information" database collected by users are as follows: (1) The database structure and records of "social information" collected by user A1 are as follows: (2) The database structure and records of "social information" collected by user A2 are as follows: ……， (n) The database structure and records of "social information" collected by user An are as follows: Where: f1 is the total amount of social information collected by user A1, f2 is the total amount of information collected by user A2, ..., fn is the total amount of social information collected by user An, n = 1 ~ n, n is the total number of all instant messaging users; In a "one-to-one" or "one-to-many" user "group", each user can collect his or her own social information or that sent by other users. Therefore, the user's social information is stored and transmitted in encrypted form on the cloud server of the instant messaging system, thereby ensuring the storage and transmission security of social information between users.

Images