A key agreement method, system, sending end and receiving end

Abstract

The embodiment of the application provides a key agreement method, system, sending end and receiving end. The scheme is as follows: a first request message including a first public key is sent to the receiving end; a first response message fed back by the receiving end for the first request message is received; the first response message contains a first encryption key and a second public key of the receiving end; the first encryption key is obtained by encrypting a first string by using a first master key, and the first master key is obtained by processing a second private key corresponding to the first public key and the second public key according to a preset key generation algorithm; a second master key is obtained; the second master key is obtained by processing a first private key corresponding to the second public key and the first public key according to the preset key generation algorithm; and the first encryption key is decrypted by using the second master key to obtain the first string. Through the technical scheme provided by the embodiment of the application, the security of key transmission is improved, and the data interaction cost is reduced.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a key negotiation method, system, sending end and receiving end. Background Technology

[0002] To ensure data security during transmission, encryption is often employed. For example, in audio and video data transmission, the device can use a random string as a key to encrypt the audio and video data, resulting in encrypted audio and video data, which is then sent to the client. The client uses the key, sent in plaintext by the device via a key transfer link, to decrypt the received encrypted audio and video data, thus obtaining the original audio and video data.

[0003] In the aforementioned key transmission process, since the key is transmitted in plaintext, the key transmission link must have high security to ensure the security of the key, which greatly increases the cost of data interaction. Summary of the Invention

[0004] The purpose of this application is to provide a key negotiation method, system, sender, and receiver to improve the security of key transmission and reduce data interaction costs. The specific technical solution is as follows:

[0005] This application provides a key negotiation method applied to a sending end, the method comprising:

[0006] Send a first request message, including its own first public key, to the receiving end;

[0007] The receiving end receives a first response message in response to the first request message; the first response message includes a first encryption key and a second public key of the receiving end; the first encryption key is obtained by encrypting a first string using a first master key, and the first master key is obtained by processing a second private key corresponding to the first public key and the second public key according to a preset key generation algorithm; the first string is the encryption key for the business data transmitted between the sending end and the receiving end.

[0008] Obtain the second master key; the second master key is obtained by processing the second public key and the first private key corresponding to the first public key according to the preset key generation algorithm;

[0009] The first encryption key is decrypted using the second master key to obtain the first string.

[0010] Optionally, when the first request message includes a data acquisition request for the business data, the first response message also includes encrypted data, which is obtained by the receiving end encrypting the business data using the first string;

[0011] After decrypting the first encryption key using the second master key to obtain the first string, the method further includes:

[0012] The encrypted data is decrypted using the first string to obtain the business data.

[0013] Optionally, the step of obtaining the second master key includes:

[0014] Check if a master key corresponding to the second public key exists in the local cache;

[0015] If so, retrieve the master key corresponding to the second public key from the local cache and use it as the second master key;

[0016] If not, then a second master key is generated using the preset key generation algorithm based on the second public key and the first private key corresponding to the first public key.

[0017] Optionally, before sending a first request message including its own first public key to the receiving end, the method further includes:

[0018] Obtain the second string and the third public key of the forwarding server;

[0019] Obtain a third master key, which is obtained by processing the third public key and the first private key according to the preset key generation algorithm;

[0020] The first request to be encrypted is encrypted using the second string to obtain the first encrypted request;

[0021] The second string is encrypted using the third master key to obtain the second encryption key;

[0022] A second request message is sent to the forwarding server. The second request message contains the first encryption request, the second encryption key, and the first public key, so that the forwarding server can obtain the fourth master key. The second encryption key is decrypted using the fourth master key to obtain the second string. The first encryption request is decrypted using the second string to obtain the first request to be encrypted. A first request response to the first request to be encrypted is generated. The first request response is encrypted using the second string to obtain the second response message. The second response message is sent to the sending end. The fourth master key is obtained by processing the first public key and the third private key corresponding to the third public key according to the preset key generation algorithm.

[0023] Receive the second response message;

[0024] The second string is used to decrypt the second response message to obtain the first request response;

[0025] The step of sending a first request message including its own first public key to the receiving end includes:

[0026] Send a first request message including its own first public key to the forwarding server, so that the forwarding server forwards the received first request message to the receiving end;

[0027] The step of receiving the first response message from the receiving end in response to the first request message includes:

[0028] The receiver receives a first response message forwarded by the forwarding server, wherein the first response message is a response sent by the receiver to the forwarding server in response to the first request message.

[0029] This application also provides a key negotiation method applied to a receiving end, the method comprising:

[0030] Receive a first request message sent by the sender, which includes the sender's first public key;

[0031] Obtain the first master key, which is obtained by processing the first public key and the second private key of the receiving end according to a preset key generation algorithm;

[0032] Obtain the first string; the first string is the encryption key for the business data transmitted between the sending end and the receiving end.

[0033] The first string is encrypted using the first master key to obtain the first encryption key;

[0034] A first response message is sent to the sending end, the first response message containing the first encryption key and the second public key corresponding to the second private key.

[0035] Optionally, if the first request message includes a data retrieval request for the business data, then after obtaining the first string, the method further includes:

[0036] Based on the first request message, obtain the business data;

[0037] The business data is encrypted using the first string to obtain encrypted data;

[0038] The step of sending the first response message to the sending end includes:

[0039] Send a first response message including the encrypted data to the sending end.

[0040] Optionally, the step of obtaining the first master key includes:

[0041] Check if a master key corresponding to the first public key exists in the local cache;

[0042] If so, retrieve the master key corresponding to the first public key from the local cache and use it as the first master key;

[0043] If not, then the first master key is generated according to the first public key and the second private key of the receiving end, based on the preset key generation algorithm.

[0044] Optionally, before receiving the first request message including the first public key of the sender sent by the sender, the method further includes:

[0045] Obtain the third string and the third public key of the forwarding server;

[0046] Obtain the fifth master key, which is obtained by processing the third public key and the second private key according to the preset key generation algorithm;

[0047] The second request to be encrypted is encrypted using the third string to obtain the second encrypted request;

[0048] The third string is encrypted using the fifth master key to obtain the third encryption key;

[0049] A third request message is sent to the forwarding server. The third request message contains the second encryption request, the third encryption key, and the second public key, so that the forwarding server can obtain the sixth master key. The sixth master key is used to decrypt the third encryption key to obtain the third string. The third string is used to decrypt the second encryption request to obtain the second request to be encrypted. A second request response to the second request to be encrypted is generated. The third string is used to encrypt the second request response to obtain the third response message. The third response message is sent to the sending end. The sixth master key is obtained by processing the third private key corresponding to the second public key and the third public key according to the preset key generation algorithm.

[0050] Receive the third response message;

[0051] The third string is used to decrypt the third response message to obtain the second request response;

[0052] The step of receiving a first request message including the first public key of the sender sent by the sender includes:

[0053] Receive a first request message sent by the forwarding server, which includes the first public key of the sending end, wherein the first request message is sent by the sending end to the forwarding server;

[0054] The step of sending the first response message to the sending end includes:

[0055] The first response message is sent to the forwarding server so that the forwarding server forwards the first response message to the sending end.

[0056] This application also provides a key negotiation system, which includes a sender and a receiver;

[0057] The sending end is used to send a first request message including its own first public key to the receiving end;

[0058] The receiving end is configured to: receive the first request message; obtain a first master key, which is obtained by processing the first public key and the second private key of the receiving end according to a preset key generation algorithm; obtain a first string, which is the encryption key for business data transmitted between the sending end and the receiving end; encrypt the first string using the first master key to obtain a first encryption key; and send a first response message to the sending end, which contains the first encryption key and the second public key corresponding to the second private key.

[0059] The sending end is further configured to receive the first response message; obtain a second master key; the second master key is obtained by processing the second public key and the first private key corresponding to the first public key according to the preset key generation algorithm; and decrypt the first encryption key using the second master key to obtain the first string.

[0060] Optionally, the receiving end is further configured to, after processing the first public key and the second private key of the receiving end according to a preset key generation algorithm to obtain the first master key, cache the first master key in a local cache according to the relationship between the first public key and the first master key;

[0061] The sending end is further configured to, after processing the second public key and the first private key corresponding to the first public key according to the preset key generation algorithm to obtain the second master key, cache the second master key in a local cache according to the correspondence between the second public key and the second master key.

[0062] This application embodiment also provides a transmitting end, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0063] Memory, used to store computer programs;

[0064] When a processor executes a program stored in memory, it implements any of the key negotiation method steps described above.

[0065] This application embodiment also provides a receiving end, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0066] Memory, used to store computer programs;

[0067] When a processor executes a program stored in memory, it implements any of the key negotiation method steps described above.

[0068] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the key negotiation method steps described above.

[0069] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to execute any of the key negotiation methods described above.

[0070] Beneficial effects of the embodiments in this application:

[0071] The technical solution provided in this application embodiment involves the receiving end, upon receiving a first request message including a first public key from the sending end, generating a first master key based on the first public key and its own second private key. The receiving end then uses this first master key to encrypt a first string; that is, it uses the first master key to encrypt the encryption key of the business data transmitted between the sending and receiving ends, obtaining a first encryption key. The receiving end then sends a first response message containing the first encryption key and its own second public key to the sending end. Upon receiving this first response message, the sending end, based on its second public key, obtains a second master key identical to the first master key, and uses this second key to decrypt the first encryption key, obtaining the first string.

[0072] Compared to related technologies, in the key negotiation process, the first response message sent by the receiving end to the sending end includes the first encryption key, which is the encrypted first string, instead of directly sending the first string as the encryption key. This effectively improves the security of the first string, thereby improving the security of key transmission and reducing data interaction costs.

[0073] Furthermore, the first response message from the receiving end includes not only the first encryption key but also the receiving end's own second public key. This allows the sending end to accurately obtain the second master key, which is the same as the first master key, based on the second public key. This allows the sending end to decrypt the first encryption key and obtain the first string. While ensuring that the sending end can accurately obtain the first string, the security of the first string is improved, thereby enhancing the security of key transmission and reducing data interaction costs.

[0074] Of course, implementing any product or method of this application does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0075] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0076] Figure 1 A schematic diagram of the first type of key negotiation method provided in the embodiments of this application;

[0077] Figure 2 This is a schematic diagram of a topology for a data interaction process;

[0078] Figure 3 A second flowchart illustrating the key negotiation method provided in the embodiments of this application;

[0079] Figure 4 A third flowchart illustrating the key negotiation method provided in the embodiments of this application;

[0080] Figure 5 A fourth flowchart illustrating the key negotiation method provided in the embodiments of this application;

[0081] Figure 6 A fifth flowchart illustrating the key negotiation method provided in the embodiments of this application;

[0082] Figure 7 A sixth flowchart illustrating the key negotiation method provided in this application embodiment;

[0083] Figure 8 A seventh flowchart illustrating the key negotiation method provided in this application embodiment;

[0084] Figure 9 An eighth flowchart illustrating the key negotiation method provided in this application embodiment;

[0085] Figure 10-a This is a first signaling diagram of the audio and video data playback process provided in the embodiments of this application;

[0086] Figure 10-b This is a second signaling diagram of the audio and video data playback process provided in the embodiments of this application;

[0087] Figure 10-c A signaling diagram for the connection establishment process provided in an embodiment of this application;

[0088] Figure 11 A first structural schematic diagram of the key negotiation device provided in the embodiments of this application;

[0089] Figure 12 A second structural schematic diagram of the key negotiation device provided in the embodiments of this application;

[0090] Figure 13 A schematic diagram of the key negotiation system provided in the embodiments of this application;

[0091] Figure 14 A schematic diagram of the structure of a transmitting end provided in an embodiment of this application;

[0092] Figure 15 This is a schematic diagram of a receiving end provided in an embodiment of this application. Detailed Implementation

[0093] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of this application.

[0094] In related technologies, the sending end and the receiving end can ensure the security of data transmission during the data transmission process through transmission link encryption and data encryption. During transmission link encryption, standard encryption schemes such as Transport Layer Security Protocol (TLS) or Datagram Transport Layer Security (DTLS) can be used. However, this encryption process is complex and not suitable for end-to-end encryption. During data content encryption, the encryption key is transmitted in plaintext through the key transmission link, which increases the cost of data transmission while requiring high security for the key transmission link.

[0095] To address the problems in related technologies, embodiments of this application provide a key negotiation method. For example... Figure 1 As shown, Figure 1 This is a schematic diagram of a first-order key negotiation method provided in an embodiment of this application. The method is applied to a request sending end (hereinafter referred to as the sending end) and specifically includes the following steps.

[0096] Step S101: Send a first request message including its own first public key to the receiving end.

[0097] Step S102: Receive the first response message from the receiving end in response to the first request message; the first response message includes a first encryption key and the receiving end's second public key; the first encryption key is obtained by encrypting the first string using the first master key, and the first master key is obtained by processing the second private key corresponding to the first public key and the second public key according to a preset key generation algorithm; the first string is the encryption key for the business data transmitted between the sending end and the receiving end.

[0098] Step S103: Obtain the second master key; the second master key is obtained by processing the second public key and the first private key corresponding to the first public key according to a preset key generation algorithm.

[0099] Step S104: Decrypt the first encryption key using the second master key to obtain the first string.

[0100] pass Figure 1The method shown involves the receiving end, upon receiving a first request message containing a first public key from the sending end, generating a first master key based on the first public key and its own second private key. This first master key is then used to encrypt the first string; in other words, the first master key is used to encrypt the encryption key of the business data transmitted between the sending and receiving ends, yielding a first encryption key. The receiving end then sends a first response message containing the first encryption key and its own second public key to the sending end. Upon receiving this first response message, the sending end, based on its second public key, obtains a second master key identical to the first master key, and uses this second key to decrypt the first encryption key, obtaining the first string.

[0101] Compared to related technologies, in the key negotiation process, the first response message sent by the receiving end to the sending end includes the first encryption key, which is the encrypted first string, instead of directly sending the first string as the encryption key. This effectively improves the security of the first string, thereby improving the security of key transmission and reducing data interaction costs.

[0102] Furthermore, the first response message from the receiving end includes not only the first encryption key but also the receiving end's own second public key. This allows the sending end to accurately obtain the second master key, which is the same as the first master key, based on the second public key. This allows the sending end to decrypt the first encryption key and obtain the first string. While ensuring that the sending end can accurately obtain the first string, the security of the first string is improved, thereby enhancing the security of key transmission and reducing data interaction costs.

[0103] For step S101 above, a first request message including its own first public key is sent to the receiving end.

[0104] During data interaction, data can be transmitted through the communication link between the sender and receiver (i.e., the requesting receiver), or through a forwarding server between the sender and receiver. For ease of understanding, let's combine... Figure 2 Let's take an example to illustrate. Figure 2 This is a schematic diagram of a topological structure for a data interaction process.

[0105] exist Figure 2 In the topology shown, the transmitter and receiver can be configured as follows: Figure 2 The peer-to-peer (P2P) link communication connection shown can also be as follows: Figure 2 The diagram shows a communication connection established via a forwarding link with a forwarding server.

[0106] In this embodiment, during data interaction between the sending end and the receiving end, the sending end sends a request message to the receiving end, and the receiving end responds with a corresponding response message based on the received request message. For example, in the audio and video data interaction process, the client can be the sending end, and the device can be the receiving end. The client can send a data acquisition request for audio and video data to the device. After receiving the data acquisition request, the device can acquire the corresponding audio and video data and send the acquired audio and video data back to the client.

[0107] In this embodiment, the sending end and receiving end are determined based on the sending and receiving of the request; that is, the sending end is the sender of the request, and the receiving end is the receiver of the request. Alternatively, they can be determined based on the sending and receiving of data. For example, if the sender of the audio / video data is the device and the receiver is the client, then the device can be designated as the sending end, and the client as the receiving end. No specific limitations are imposed on the sending end and receiving end here.

[0108] Furthermore, depending on the specific application scenario, the aforementioned sending end, receiving end, and forwarding server can be different electronic devices. Taking the audio and video data transmission process as an example, the sending end (i.e., the client) can be a user's mobile phone, computer, tablet, etc., the receiving end (i.e., the device end) can be a video capture device or video storage device, etc., and the forwarding server can be a streaming media server or cloud server, etc. Here, no specific limitations are made on the device types corresponding to the aforementioned sending end, receiving end, and forwarding server. For ease of understanding, the following explanation only uses the encrypted transmission process of audio and video data as an example and does not constitute any limitation.

[0109] After the sending end and the receiving end establish a communication connection, in order to ensure the security of data transmission, the sending end and the receiving end can negotiate a key. At this time, the sending end can read the public key (denoted as the first public key) from its stored public key and private key pair, and send a request message (denoted as the first request message) to the receiving end based on the first public key. That is, it sends a first request message including the first public key to the receiving end.

[0110] In an optional embodiment, when the sending end and the receiving end are directly connected in communication, such as... Figure 2 The sender and receiver are connected via a P2P link, and the sender can directly send the first request message to the receiver.

[0111] In another optional embodiment, when the sender and receiver communicate via a forwarding server, such as Figure 2The sending end and receiving end are connected via a forwarding link. The sending end can send the first request message to the forwarding server, and the forwarding server will forward the received first request message to the receiving end.

[0112] Depending on the different connection methods of the communication connection between the sending end and the receiving end, the method of sending the first request message will also vary. Here, no specific limitation is made on the method of sending the first request message.

[0113] The aforementioned first request message can be a key negotiation request message or a data acquisition request message, such as a data acquisition request message for audio and video data at the receiving end. No specific limitations are imposed on the aforementioned first request message.

[0114] In this embodiment of the application, the sending end, receiving end, and forwarding server all store corresponding public key and private key pairs.

[0115] In an optional embodiment, the public and private key pair described above can be generated using an Elliptic Curve Digital Signature Algorithm (ECDSA). This involves randomly generating a random number as the private key, then performing an elliptic curve transformation on that private key to obtain the corresponding public key, thus obtaining the public and private key pair.

[0116] In an optional embodiment, the content of the first request message may be encrypted or unencrypted; that is, the content of the data acquisition request message may be encrypted or unencrypted. Here, the method of encrypting the content of the first request message is not specifically limited.

[0117] In step S102 above, the receiving end sends a first response message in response to the first request message; the first response message includes a first encryption key and the receiving end's second public key; the first encryption key is obtained by encrypting the first string using the first master key, and the first master key is obtained by processing the second private key corresponding to the first public key and the second public key according to a preset key generation algorithm; the first string is the encryption key for the business data transmitted between the sending end and the receiving end.

[0118] In this step, after receiving the first request message, the receiving end will respond to the first request message and send a response message (denoted as the first response message) back to the sending end. The first response message contains a first encryption key and the public key (denoted as the second public key) of its own public-private key pair stored at the receiving end. The process of the receiving end responding to the first request message is described below and will not be elaborated upon here.

[0119] In an optional embodiment, when the sending end and the receiving end are directly connected, the receiving end can directly send the first response message to the sending end.

[0120] In another optional embodiment, when the sending end and the receiving end are connected through a forwarding server, the receiving end can send the first response message to the forwarding server, and the forwarding server will forward the received first response message to the sending end.

[0121] Depending on the different connection methods of the communication connection between the sending end and the receiving end, the method of sending the first response message will also vary. Here, no specific limitation is made on the method of sending the first response message.

[0122] Depending on the specific first request message, the first response message will also vary. For example, when the first request message is a data acquisition request message, the first response message will be the corresponding response message. No specific limitations are imposed on the first response message here.

[0123] The first encryption key mentioned above is obtained by the receiving end encrypting the first string using the first master key. The first master key is generated by the receiving end using a preset key generation algorithm based on the first public key in the first request message and the private key (i.e., the second private key) in the public key and private key pair stored by the receiving end.

[0124] In an optional embodiment, the aforementioned preset key generation algorithm can be an Elliptic Curve Diffie–Hellman key exchange (ECDH) key negotiation algorithm. For example, when calculating the first master key, the receiving end can multiply the first public key by the second private key to obtain the first master key. Here, the specific method for generating the first master key is not limited.

[0125] Regarding step S103 above, namely obtaining the second master key; the second master key is obtained by processing the second public key and the first private key corresponding to the first public key according to a preset key generation algorithm.

[0126] In an optional embodiment, after receiving the first response message, the sending end can generate a second master key using the preset key generation algorithm based on the second public key in the first response message and the private key (denoted as the first private key) in its stored public key and private key pair.

[0127] In another optional embodiment, the sender's local cache stores the public keys of other devices and their corresponding master keys. The sender can retrieve a second master key from its local cache. Details on retrieving the second master key are provided below and will not be elaborated upon here.

[0128] The generation method of the second master key is the same as that of the first master key. For example, if the first master target is obtained by multiplying the first public key and the second private key, then the second master key can also be obtained by multiplying the second public key and the first private key. Here, no specific limitation is made on the generation method of the second master target.

[0129] In this embodiment, since the public and private key pairs stored in the sending and receiving ends are obtained by transforming the public key using the private key, the first master key generated based on the first public key and the second private key is the same as the second master key generated based on the second public key and the first private key. That is, the first master key and the second master key are the same key.

[0130] For ease of understanding, let's take the example of the sender's public key being A1 and private key being B1, the receiver's public key being A2 and private key being B2, and the master key being the product of the public and private keys. Since the public key is derived from the private key, such as A = B * G, that is, A1 = B1 * G, A2 = B2 * G.

[0131] The first master key C1 can be represented as: C1 = A1 * B2, and the second master key C2 can be represented as: C2 = A2 * B1. Therefore, C1 = A1 * B2 = (B1 * G) * B2 = B1 * (G * B2) = B1 * A2 = C2, that is, C1 = C2.

[0132] Regarding step S104 above, that is, using the second master key to decrypt the first encryption key to obtain the first string.

[0133] In this step, since the first master key and the second master key are the same, and the first encryption key is obtained by encrypting the first string using the first master target, the sending end can use the second master key to decrypt the first encryption key after obtaining the second master key, and obtain the first string.

[0134] In an optional embodiment, according to the above... Figure 1 The method shown in this application embodiment also provides a key negotiation method. For example... Figure 3 As shown, Figure 3 This is a schematic diagram of a second flowchart illustrating the key negotiation method provided in an embodiment of this application. Figure 3 In the method shown, step S103 is further refined into the following steps, namely step S1031-step S1033.

[0135] Step S1031: Check if a master key corresponding to the second public key exists in the local cache. If yes, proceed to step S1032; otherwise, proceed to step S1033.

[0136] In this embodiment, after generating a master key based on the public key of another device and its own private key, the sending end can store the public key and master key accordingly. When the sending end receives the first response message, it can search for the master key corresponding to the second public key in its local cache based on the public key (i.e., the second public key) included in the first response message. If found, it is determined that the master key corresponding to the second public key exists in the local cache. If not found, it is determined that the master key corresponding to the second public key does not exist in the local cache.

[0137] Step S1032: Obtain the master key corresponding to the second public key from the local cache, and use it as the second master key.

[0138] In this step, when the sending end determines that a master key corresponding to the second public key exists in its local cache, it can identify that master key as the aforementioned second master key.

[0139] Step S1033: Generate a second master key using a preset key generation algorithm based on the second public key and the first private key corresponding to the first public key.

[0140] In this step, after determining that the master key corresponding to the second public key does not exist in the local cache, the sending end can generate the second master key using the second public key and the first private key, employing a preset key generation algorithm. The method for generating the second master key is described above and will not be elaborated upon here.

[0141] In an optional embodiment, after the sending end performs step S1033 (i.e., after generating the second master key), it can cache the correspondence between the second public key and the second master key in a local cache. That is, the correspondence between the second public key and the second master key is cached in the local cache.

[0142] In an optional embodiment, for each public key and its corresponding master key cached in the local cache, the master key has a corresponding validity period to ensure its validity. When the storage period of a master key in the local cache, such as the second master key mentioned above, exceeds the validity period of the second master key, the sender can discard the second public key and the second master key in the local cache.

[0143] In this embodiment, in addition to caching the public key, the corresponding master key, and the validity period of the master key, the local cache may also cache other information, such as version information and cache quantity. Here, no specific limitations are made on the information cached in the local cache.

[0144] In this embodiment of the application, considering the consumption of device resources by the master key and the time spent generating the master key, by caching the correspondence between the public key and the master key, the frequency of generating the master key corresponding to the same public key can be effectively reduced, thereby avoiding the consumption of device resources for master key generation, shortening the time required to obtain the master key, and improving the efficiency of master key acquisition.

[0145] In an optional embodiment, when the first request message includes a data acquisition request for business data, the first response message also includes encrypted data, which is obtained by the receiving end encrypting the business data using a first string.

[0146] In an optional embodiment, when the first response message further includes the encrypted data, according to Figure 1 The method shown in this application embodiment also provides a key negotiation method. For example... Figure 4 As shown, Figure 4 This is a schematic diagram of a third key negotiation method provided in an embodiment of this application. The method includes the following steps.

[0147] Step S401: Send a first request message including its own first public key to the receiving end.

[0148] The above step S401 is the same as the above step S101.

[0149] Step S402: Receive a first response message from the receiving end in response to the first request message; the first response message includes encrypted data, a first encryption key, and the receiving end's second public key; the encrypted data is obtained by encrypting business data using a first string; the first encryption key is obtained by encrypting the first string using a first master key, and the first master key is obtained by processing the second private key corresponding to the first public key and the second public key according to a preset key generation algorithm; the first string is the encryption key for the business data transmitted between the sending end and the receiving end.

[0150] In addition to the first encryption key and the second public key, the first response message may also include the encrypted data.

[0151] Step S403: Obtain the second master key; the second master key is obtained by processing the second public key and the first private key corresponding to the first public key according to a preset key generation algorithm.

[0152] Step S404: Decrypt the first encryption key using the second master key to obtain the first string.

[0153] Steps S403-S404 above are the same as steps S103-S104 above.

[0154] Step S405: Use the first string to decrypt the encrypted data to obtain the business data.

[0155] In this step, since the encrypted data is obtained by encrypting the business data using the first string, the sending end can use the first string obtained by decryption in step S404 to decrypt the encrypted data and obtain the business data.

[0156] Compared to related technologies where the key negotiation process and the data encryption transmission process need to be performed separately, in this embodiment, the key negotiation process and the encrypted transmission process of business data are performed simultaneously, which reduces the interaction frequency between the sending end and the receiving end, reduces the number of key negotiations, and improves the efficiency of data interaction.

[0157] In an optional embodiment, according to the above... Figure 1 The method shown in this application embodiment also provides a key negotiation method. For example... Figure 5 As shown, Figure 5 This is a schematic diagram of a fourth key negotiation method provided in an embodiment of this application. The method is applied to the aforementioned sending end and includes the following steps.

[0158] Step S501: Obtain the second string and the third public key of the forwarding server.

[0159] In an optional embodiment, the sending end can randomly generate a random string as the second string. This second string may include letters, numbers, etc. No specific limitation is made here.

[0160] In an optional embodiment, the forwarding server may disclose its own public key (denoted as the third public key) in relation to the public and private key pair in the forwarding server. That is, both the sending and receiving ends can determine the third public key of the forwarding server. After determining the third public key, the sending end can cache it. When the client interacts with the forwarding server, the sending end can retrieve the cached third public key.

[0161] Step S502: Obtain the third master key. The third master key is obtained by processing the third public key and the first private key according to a preset key generation algorithm.

[0162] The method for obtaining the third master key is the same as the method for obtaining the first master key, and will not be explained in detail here.

[0163] Step S503: Encrypt the first request to be encrypted using the second string to obtain the first encrypted request.

[0164] In an optional embodiment, the sending end can encrypt the first request to be encrypted using the aforementioned second string, based on encryption algorithms such as the Advanced Encryption Standard (AES) and the ChaCha20-Poly1305, to obtain the first encrypted request. Here, the encryption method for the first request to be encrypted is not specifically limited. ChaCha20-Poly1305 is a novel encryption algorithm used by Google.

[0165] In an optional embodiment, the first request to be encrypted may be a connection request between the sender and the forwarding server.

[0166] Step S504: Encrypt the second string using the third master key to obtain the second encryption key.

[0167] In this step, the sending end can use the third master key obtained in step S502 above to encrypt the second string to obtain the second encryption key.

[0168] In an optional embodiment, the sending end can encrypt the second string using the aforementioned third master key, based on algorithms such as AES and ChaCha20-Poly1305, to obtain the second encryption key. The encryption method for the second string is not specifically limited here.

[0169] Step S505: Send a second request message to the forwarding server. The second request message contains a first encryption request, a second encryption key, and a first public key, so that the forwarding server can obtain a fourth master key. Use the fourth master key to decrypt the second encryption key to obtain a second string. Use the second string to decrypt the first encryption request to obtain a first request to be encrypted. Generate a first request response for the first request to be encrypted. Use the second string to encrypt the first request response to obtain a second response message. Send the second response message to the sending end. The fourth master key is obtained by processing the third private key corresponding to the first public key and the third public key according to a preset key generation algorithm.

[0170] In this step, the sending end can send a second request message to the forwarding server. This second request message contains the aforementioned first encryption request, second encryption key, and first public key. Upon receiving the second request message, the forwarding server can obtain a fourth master key and use it to decrypt the second encryption key to obtain a second string. The forwarding server then uses the second string to decrypt the first encryption request to obtain a first request to be encrypted. The forwarding server generates a first request response corresponding to this first request to be encrypted. The forwarding server encrypts this first request response using the second string to obtain a second response message and sends this second response message to the sending end.

[0171] In an optional embodiment, when the forwarding server sends the second response message to the sender, it may also send the second encryption key and the third public key from its own public and private key pair stored in the forwarding server to the sender.

[0172] In an optional embodiment, the second encryption key and the third public key may be included in the second response message.

[0173] In an optional embodiment, when the first request to be encrypted is the connection request, the first request response can be the connection response corresponding to the connection request.

[0174] In an optional embodiment, in order to improve the security of the second response message, when encrypting the first request response, the forwarding server may use a string other than the second string to encrypt the first request response to obtain the first request response.

[0175] Step S506: Receive the second response message.

[0176] In an optional embodiment, when the forwarding server sends the second encryption key and the third public key together with the second response message to the sender, the sender will also obtain the second encryption key and the third public key at the same time as receiving the second response message.

[0177] Step S507: Use the second string to decrypt the second response message to obtain the first request response.

[0178] In an optional embodiment, the sender can directly use the second string obtained in step S501 above to decrypt the second response message and obtain the first request response.

[0179] In another optional embodiment, when the forwarding server sends the second encryption key and the third public key together with the second response message to the sender, the sender can obtain the third master key based on the received third public key, and use the third master key to decrypt the second encryption key to obtain the second string, thereby using the decrypted second string to decrypt the second response message to obtain the first request response.

[0180] Through the above steps S501-S507, the encrypted transmission process of requests and responses between the sending end and the forwarding server can be realized, effectively improving the security of data interaction between the sending end and the forwarding server.

[0181] Step S508: Send a first request message including its own first public key to the forwarding server so that the forwarding server forwards the received first request message to the receiving end.

[0182] In this step, when the sending end sends the first request message to the receiving end, the first request message is forwarded to the forwarding server. After receiving the first request message sent by the sending end, the forwarding server forwards the first request message to the receiving end.

[0183] Step S509: Receive the first response message forwarded by the forwarding server. The first response message is the response sent by the receiving end to the forwarding server in response to the first request message.

[0184] In this step, after receiving the first request message, the receiving end will send a first response message to the sending end in response to the first request message. At this time, the receiving end sends the first response message to the forwarding server. The forwarding server then sends the received first response message back to the sending end.

[0185] Step S510: Obtain the second master key; the second master key is obtained by processing the second public key and the first private key corresponding to the first public key according to a preset key generation algorithm.

[0186] Step S511: Decrypt the first encryption key using the second master key to obtain the first string.

[0187] Steps S510-S511 are the same as steps S103-S104.

[0188] Based on the same inventive concept, and according to the key negotiation method provided in the above embodiments of this application, this application also provides a key negotiation method. For example... Figure 6 As shown, Figure 6 This is a fifth flowchart illustrating the key negotiation method provided in this application embodiment. The method is applied to the receiving end and includes the following steps.

[0189] Step S601: Receive a first request message sent by the sender, which includes the sender's first public key.

[0190] In this step, after the sending end sends a first request message to the receiving end, the receiving end receives the first request message. The first request message includes the first public key from the public key and private key pair stored by the sending end.

[0191] In an optional embodiment, when the sending end and the receiving end are directly connected, the receiving end can directly receive the first request message sent by the sending end.

[0192] In another optional embodiment, when the sending end and the receiving end are connected through a forwarding server, since the sending end sends the first request message to the forwarding server, the receiving end receives the first request message forwarded by the forwarding server.

[0193] Depending on the connection method of the communication between the sending and receiving ends, the sending method of the first request message will also vary. Here, no specific limitation is made on the receiving method of the first request message.

[0194] Step S602: Obtain the first master key. The first master key is obtained by processing the first public key and the second private key of the receiving end according to a preset key generation algorithm.

[0195] In an optional embodiment, after receiving the first request message, the receiving end can generate a first master key using a preset key generation algorithm based on the first public key in the first request message and the second private key in its stored public key and private key pair.

[0196] In another optional embodiment, the receiving end caches the public key of other devices and the corresponding master key in its local cache. The receiving end can retrieve the first master key from its local cache. The retrieval of the first master key is described below and will not be elaborated upon here.

[0197] Step S603: Obtain the first string; the first string is the encryption key for the business data transmitted between the sender and receiver.

[0198] The method for obtaining the first string can be the same as the method for obtaining the second string. Here, the method for obtaining the first string will not be explained in detail.

[0199] Step S604: Encrypt the first string using the first master key to obtain the first encryption key.

[0200] The encryption method for the first string mentioned above can be referred to the encryption method for the second string mentioned above, and will not be explained in detail here.

[0201] Step S605: Send a first response message to the sender. The first response message contains the second public key corresponding to the first encryption key and the second private key.

[0202] In an optional embodiment, when the sending end and the receiving end are directly connected, the receiving end can directly send the first response message to the sending end.

[0203] In another optional embodiment, when the sending end and the receiving end are connected through a forwarding server, the receiving end can send the first response message to the forwarding server, and then the forwarding server will forward the received first response message to the sending end.

[0204] Depending on the different connection methods of the communication connection between the sending end and the receiving end, the method of sending the first response message will also vary. Here, no specific limitation is made on the method of sending the first response message.

[0205] pass Figure 6 The method shown involves the receiving end, upon receiving a first request message containing a first public key from the sending end, generating a first master key based on the first public key and its own second private key. This first master key is then used to encrypt the first string; in other words, the first master key is used to encrypt the encryption key of the business data transmitted between the sending and receiving ends, yielding a first encryption key. The receiving end then sends a first response message containing the first encryption key and its own second public key to the sending end. Upon receiving this first response message, the sending end, based on its second public key, obtains a second master key identical to the first master key, and uses this second key to decrypt the first encryption key, obtaining the first string.

[0206] Compared to related technologies, in the key negotiation process, the first response message sent by the receiving end to the sending end includes the first encryption key, which is the encrypted first string, instead of directly sending the first string as the encryption key. This effectively improves the security of the first string, thereby improving the security of key transmission and reducing data interaction costs.

[0207] Furthermore, the first response message from the receiving end includes not only the first encryption key but also the receiving end's own second public key. This allows the sending end to accurately obtain the second master key, which is the same as the first master key, based on the second public key. This allows the sending end to decrypt the first encryption key and obtain the first string. While ensuring that the sending end can accurately obtain the first string, the security of the first string is improved, thereby enhancing the security of key transmission and reducing data interaction costs.

[0208] In an optional embodiment, according to Figure 6The method shown in this application embodiment also provides a key negotiation method, such as... Figure 7 As shown, Figure 7 This is a sixth flowchart illustrating the key negotiation method provided in an embodiment of this application. Figure 7 In the method shown, step S602 is further refined into the following steps, namely steps S6021-S6023.

[0209] Step S6021: Check if a master key corresponding to the first public key exists in the local cache. If yes, proceed to step S6022; otherwise, proceed to step S6023.

[0210] Step S6022: Obtain the master key corresponding to the first public key from the local cache, and use it as the first master key.

[0211] Step S6023: Generate a first master key based on the first public key and the second private key of the receiving end, according to a preset key generation algorithm.

[0212] The execution methods of steps S6021-S6023 can be referred to the execution methods of steps S1031-S1033, and will not be described in detail here.

[0213] In an optional embodiment, after performing step S6023 (i.e., after generating the first master key), the receiving end can cache the first public key and the first master key in a local cache. That is, the correspondence between the first public key and the first master key is cached in the local cache.

[0214] In an optional embodiment, for each public key and its corresponding master key cached in the local cache, the master key has a corresponding validity period to ensure its validity. When the storage period of a master key in the local cache, such as the first master key mentioned above, exceeds the validity period of the first master key, the sending end can discard the first public key and the first master key in the local cache.

[0215] In this embodiment, in addition to caching the public key, the corresponding master key, and the validity period of the master key, the local cache may also cache other information, such as version information and cache quantity. Here, no specific limitations are made on the information cached in the local cache.

[0216] In this embodiment of the application, considering the consumption of device resources by the master key and the time spent generating the master key, by caching the correspondence between the public key and the master key, the frequency of generating the master key corresponding to the same public key can be effectively reduced, thereby avoiding the consumption of device resources for master key generation, shortening the time required to obtain the master key, and improving the efficiency of master key acquisition.

[0217] In an optional embodiment, when the first request message includes a data acquisition request for business data, according to the above... Figure 6 The method shown in this application embodiment also provides a key negotiation method. For example... Figure 8 As shown, Figure 8 This is a seventh flowchart illustrating the key negotiation method provided in this application embodiment. The method includes the following steps.

[0218] Step S801: Receive a first request message sent by the sender, which includes the sender's first public key.

[0219] Step S802: Obtain the first master key. The first master key is obtained by processing the first public key and the second private key of the receiving end according to a preset key generation algorithm.

[0220] Step S803: Obtain the first string; the first string is the encryption key for the business data transmitted between the sender and receiver.

[0221] Steps S801-S803 are the same as steps S601-S603.

[0222] Step S804: Obtain business data based on the first request message.

[0223] For ease of understanding, taking a data acquisition request for audio and video data as an example, after receiving the data acquisition request, the receiving end will acquire the audio and video data corresponding to the data acquisition request as business data.

[0224] Depending on the different data interaction scenarios described above, the business data will also vary. Therefore, no specific limitations are imposed on the aforementioned business data.

[0225] Step S805: Use the first string to encrypt the business data to obtain encrypted data.

[0226] The encryption method for the aforementioned business data can refer to the encryption method for the first request to be encrypted mentioned above, and will not be specifically explained here.

[0227] Step S806: Encrypt the first string using the first master key to obtain the first encryption key.

[0228] The above step S806 is the same as the above step S604.

[0229] Step S807: Send a first response message containing encrypted data to the sending end.

[0230] Compared to related technologies where the key negotiation process and the data encryption transmission process need to be performed separately, in this embodiment, the key negotiation process and the encrypted transmission process of business data are performed simultaneously, which reduces the interaction frequency between the sending end and the receiving end, reduces the number of key negotiations, and improves the efficiency of data interaction.

[0231] In an optional embodiment, according to the above... Figure 6 The method shown in this application embodiment also provides a key negotiation method. For example... Figure 9 As shown, Figure 9 This is an eighth flowchart illustrating the key negotiation method provided in this application embodiment. The method is applied to the receiving end and includes the following steps.

[0232] Step S901: Obtain the third string and the third public key of the forwarding server.

[0233] Step S902: Obtain the fifth master key. The fifth master key is obtained by processing the third public key and the second private key according to a preset key generation algorithm.

[0234] Step S903: Encrypt the second request to be encrypted using the third string to obtain the second encrypted request.

[0235] Step S904: Encrypt the third string using the fifth master key to obtain the third encryption key.

[0236] Step S905: A third request message is sent to the forwarding server. The third request message contains a second encryption request, a third encryption key, and a second public key, so that the forwarding server can obtain a sixth master key. The sixth master key is used to decrypt the third encryption key to obtain a third string. The third string is used to decrypt the second encryption request to obtain a second request to be encrypted. A second request response to the second request to be encrypted is generated. The third string is used to encrypt the second request response to obtain a third response message. The third response message is sent to the sending end. The sixth master key is obtained by processing the third private key corresponding to the second public key and the third public key according to a preset key generation algorithm.

[0237] Step S906: Receive the third response message.

[0238] Step S907: Use the third string to decrypt the third response message to obtain the second request response.

[0239] The execution methods of steps S901-S907 are similar to those of steps S501-S507, and will not be described in detail here.

[0240] Through the above steps S901-S907, the encrypted transmission process of requests and responses between the sending end and the forwarding server can be realized, effectively improving the security of data interaction between the sending end and the forwarding server.

[0241] Step S908: Receive a first request message sent by the forwarding server, which includes the first public key of the sender. The first request message is sent by the sender to the forwarding server.

[0242] Step S909: Obtain the first master key. The first master key is obtained by processing the first public key and the second private key of the receiving end according to a preset key generation algorithm.

[0243] Step S910: Obtain the first string; the first string is the encryption key for the business data transmitted between the sender and receiver.

[0244] Step S911: Encrypt the first string using the first master key to obtain the first encryption key.

[0245] The steps S909-S911 described above are the same as the steps S602-S604 described above.

[0246] Step S912: Send the first response message to the forwarding server so that the forwarding server forwards the first response message to the sender.

[0247] To facilitate understanding, the following will be combined with Figure 10-a , Figure 10-b and Figure 10-c Let's take an example to illustrate.

[0248] exist Figure 10-a middle, Figure 10-a This is a first signaling diagram for the audio / video data playback process provided in an embodiment of this application. When the client and device are connected via a P2P link, the user can trigger a playback operation for a certain audio / video data in the client. At this time, the client will send a request message to the device to play the audio / video data. The request message includes the client's public key, i.e., public key 1.

[0249] Upon receiving the request message, the device generates a master key 1 based on the public key 1 in the request message and its own private key 2. The device randomly obtains string 1 and retrieves the corresponding audio / video data according to the request message. The device encrypts the audio / video data using string 1 to obtain encrypted data, and then encrypts string 1 again using the master key 1 to obtain encryption key 1. The device then sends a response message to the client, which includes the encrypted data, encryption key 1, and the device's public key 2.

[0250] After receiving the response message, the client generates a master key 2 based on the public key 2 in the response message and its own private key 1. The client uses the master key 2 to decrypt the encryption key 1, obtaining string 1. String 1 is then used to decrypt the encrypted data, yielding the audio and video data. The client can then play this audio and video data.

[0251] exist Figure 10-b middle, Figure 10-b This is a second signaling diagram for the audio / video data playback process provided in an embodiment of this application. When the client and device are connected via a forwarding server, the audio / video playback process is... Figure 10-a The difference between the audio and video playback processes shown is that the transmission of request and response messages requires forwarding processing by a forwarding server.

[0252] exist Figure 10-c middle, Figure 10-c This is a signaling diagram illustrating the connection establishment process provided in an embodiment of this application. After obtaining string 2 and the forwarding server's public key 3, the client generates a master key 3 based on its private key 1 and public key 3. It then encrypts the connection request using string 2 to obtain an encrypted request, and further encrypts string 2 using the master key 3 to obtain an encryption key 2. The client sends a request message to the forwarding server, which includes the encryption request, encryption key 2, and public key 1.

[0253] After receiving the request message, the forwarding server generates a master key 4 based on its private key 3 and public key 1. It then uses the master key 4 to decrypt the encryption key 2, obtaining string 2. This string 2 is then used to decrypt the encrypted request, resulting in a connection request. The forwarding server responds to the connection request, receiving a connection response. It then encrypts the connection response using string 2, obtaining an encrypted response. Finally, it encrypts string 2 again using its master key 4, obtaining an encryption key 3. The forwarding server sends a response message to the client, which includes the encrypted response, encryption key 3, and public key 3.

[0254] After receiving the response message, the client generates a master key 3 based on private key 1 and public key 3. It then uses the master key 3 to decrypt the encryption key 3, obtaining string 2. This string 2 is then used to decrypt the encrypted response, resulting in a connection response. At this point, the client confirms the establishment of a communication connection with the forwarding server.

[0255] exist Figure 10-c In the illustrated embodiment, the forwarding server encrypts the connection response using string 2. Alternatively, the forwarding server can randomly generate a string, such as string 4, and use that string 4 to encrypt the connection response. Furthermore, Figure 10-cThis only shows the process of establishing a communication connection between the client and the forwarding server. For the process of establishing a communication connection between the device and the forwarding server, please refer to [reference needed]. Figure 10-c The process shown is carried out without further explanation.

[0256] In the above Figure 10-a , Figure 10-b and Figure 10-c The master key is generated using both the public and private keys. In addition, it can also be retrieved from the local cache, which will not be explained in detail here.

[0257] Based on the same inventive concept, and according to the key negotiation method provided in the above embodiments of this application, this application also provides a key negotiation device. For example... Figure 11 As shown, Figure 11 This is a schematic diagram of a first structure of a key negotiation device provided in an embodiment of this application. The device is applied to the aforementioned sending end and specifically includes the following modules.

[0258] The first sending module 1101 is used to send a first request message including its own first public key to the receiving end;

[0259] The first receiving module 1102 is used to receive a first response message from the receiving end in response to the first request message; the first response message includes a first encryption key and a second public key of the receiving end; the first encryption key is obtained by encrypting a first string using a first master key, and the first master key is obtained by processing a second private key corresponding to the first public key and the second public key according to a preset key generation algorithm; the first string is the encryption key for the business data transmitted between the sending end and the receiving end;

[0260] The first acquisition module 1103 is used to acquire the second master key; the second master key is obtained by processing the second public key and the first private key corresponding to the first public key according to a preset key generation algorithm;

[0261] The first decryption module 1104 is used to decrypt the first encryption key using the second master key to obtain the first string.

[0262] Optionally, when the first request message includes a data acquisition request for business data, the first response message also includes encrypted data, which is obtained by the receiving end encrypting the business data using the first string;

[0263] The aforementioned key negotiation device may further include:

[0264] The second decryption module is used to decrypt the first encryption key using the second master key to obtain the first string, and then use the first string to decrypt the encrypted data to obtain the business data.

[0265] Optionally, the first acquisition module 1103 described above can be used to query whether there is a master key corresponding to the second public key in the local cache; if so, the master key corresponding to the second public key is obtained from the local cache and used as the second master key; if not, the second master key is generated using a preset key generation algorithm based on the second public key and the first private key corresponding to the first public key.

[0266] Optionally, the above-mentioned key negotiation device may further include:

[0267] The second acquisition module is used to acquire a second string and the third public key of the forwarding server before sending a first request message including its own first public key to the receiving end.

[0268] The third acquisition module is used to acquire the third master key, which is obtained by processing the third public key and the first private key according to a preset key generation algorithm.

[0269] The first encryption module is used to encrypt the first request to be encrypted using the second string to obtain the first encrypted request;

[0270] The second encryption module is used to encrypt the second string using the third master key to obtain the second encryption key;

[0271] The second sending module is used to send a second request message to the forwarding server. The second request message contains a first encryption request, a second encryption key, and a first public key, so that the forwarding server can obtain a fourth master key, use the fourth master key to decrypt the second encryption key to obtain a second string, use the second string to decrypt the first encryption request to obtain a first request to be encrypted, generate a first request response to the first request to be encrypted, use the second string to encrypt the first request response to obtain a second response message, and send the second response message to the sending end. The fourth master key is obtained by processing the third private key corresponding to the first public key and the third public key according to a preset key generation algorithm.

[0272] The second receiving module is used to receive the second response message;

[0273] The third decryption module is used to decrypt the second response message using the second string to obtain the first request response;

[0274] The aforementioned first sending module 1101 can be specifically used to send a first request message including its own first public key to the forwarding server, so that the forwarding server forwards the received first request message to the receiving end;

[0275] The aforementioned first receiving module 1102 can be specifically used to receive the first response message forwarded by the forwarding server. The first response message is the feedback from the receiving end to the forwarding server in response to the first request message.

[0276] Based on the same inventive concept, and according to the key negotiation method provided in the above embodiments of this application, this application also provides a key negotiation device. For example... Figure 12 As shown, Figure 12 This is a second schematic diagram of a key negotiation device provided in an embodiment of this application. The device is applied to the aforementioned receiving end and specifically includes the following modules.

[0277] The third receiving module 1201 is used to receive a first request message sent by the sending end, which includes the first public key of the sending end;

[0278] The fourth acquisition module 1202 acquires the first master key, which is obtained by processing the first public key and the second private key of the receiving end according to a preset key generation algorithm;

[0279] The fifth acquisition module 1203 is used to acquire the first string; the first string is the encryption key for the business data transmitted between the sender and receiver.

[0280] The third encryption module 1204 is used to encrypt the first string using the first master key to obtain the first encryption key;

[0281] The third sending module 1205 is used to send a first response message to the sending end. The first response message contains a second public key corresponding to the first encryption key and the second private key.

[0282] Optionally, the above-mentioned key negotiation device may further include:

[0283] The sixth acquisition module is used to acquire business data based on the first request message after acquiring the first string if the first request message includes a data acquisition request for business data.

[0284] The fourth encryption module is used to encrypt business data using the first string to obtain encrypted data;

[0285] The aforementioned third sending module 1205 can be specifically used to send a first response message containing encrypted data to the sending end.

[0286] Optionally, the fourth acquisition module 1202 mentioned above can be used to query whether there is a master key corresponding to the first public key in the local cache; if so, the master key corresponding to the first public key is obtained from the local cache and used as the first master key; if not, the first master key is generated according to the first public key and the second private key of the receiving end, according to a preset key generation algorithm.

[0287] Optionally, the above-mentioned key negotiation device may further include:

[0288] The seventh acquisition module is used to acquire the third string and the third public key of the forwarding server before receiving the first request message sent by the sending end, which includes the first public key of the sending end;

[0289] The eighth acquisition module is used to acquire the fifth master key, which is obtained by processing the third public key and the second private key according to a preset key generation algorithm;

[0290] The fifth encryption module is used to encrypt the second request to be encrypted using the third string, thereby obtaining the second encrypted request;

[0291] The sixth encryption module is used to encrypt the third string using the fifth master key to obtain the third encryption key;

[0292] The fourth sending module is used to send a third request message to the forwarding server. The third request message contains a second encryption request, a third encryption key, and a second public key, so that the forwarding server can obtain a sixth master key, use the sixth master key to decrypt the third encryption key to obtain a third string, use the third string to decrypt the second encryption request to obtain a second request to be encrypted, generate a second request response to the second request to be encrypted, use the third string to encrypt the second request response to obtain a third response message, and send the third response message to the sending end. The sixth master key is obtained by processing the third private key corresponding to the second public key and the third public key according to a preset key generation algorithm.

[0293] The fourth receiving module is used to receive the third response message;

[0294] The fourth decryption module is used to decrypt the third response message using the third string to obtain the second request response;

[0295] The aforementioned third receiving module 1201 can be specifically used to receive a first request message sent by the forwarding server, which includes the first public key of the sending end. The first request message is sent by the sending end to the forwarding server.

[0296] The aforementioned third sending module 1205 can be used to send the first response message to the forwarding server, so that the forwarding server forwards the first response message to the sending end.

[0297] The apparatus provided in this application embodiment allows the receiving end to generate a first master key based on the first public key and its own second private key after receiving a first request message including a first public key from the sending end. The receiving end then uses the first master key to encrypt a first string, that is, to encrypt the encryption key of the business data transmitted between the sending and receiving ends using the first master key, thus obtaining a first encryption key. The receiving end then sends a first response message containing the first encryption key and its own second public key to the sending end. Upon receiving the first response message, the sending end obtains a second master key identical to the first master key based on its second public key, and uses the second key to decrypt the first encryption key, obtaining the first string.

[0298] Compared to related technologies, in the key negotiation process, the first response message sent by the receiving end to the sending end includes the first encryption key, which is the encrypted first string, instead of directly sending the first string as the encryption key. This effectively improves the security of the first string, thereby improving the security of key transmission and reducing data interaction costs.

[0299] Furthermore, the first response message from the receiving end includes not only the first encryption key but also the receiving end's own second public key. This allows the sending end to accurately obtain the second master key, which is the same as the first master key, based on the second public key. This allows the sending end to decrypt the first encryption key and obtain the first string. While ensuring that the sending end can accurately obtain the first string, the security of the first string is improved, thereby enhancing the security of key transmission and reducing data interaction costs.

[0300] Based on the same inventive concept, and according to the key negotiation method provided in the above embodiments of this application, this application also provides a key negotiation system. For example... Figure 13 As shown, Figure 13 This is a schematic diagram of a key negotiation system provided in an embodiment of this application. The system includes a transmitter 1301 and a receiver 1302;

[0301] The aforementioned sending end 1301 is used to send a first request message including its own first public key to the receiving end 1302;

[0302] The aforementioned receiver 1302 is used to receive a first request message; obtain a first master key, which is obtained by processing a first public key and a second private key of the receiver 1302 according to a preset key generation algorithm; obtain a first string, which is the encryption key for the business data transmitted between the sender 1301 and the receiver 1302; encrypt the first string using the first master key to obtain a first encryption key; and send a first response message to the sender 1301, which contains a second public key corresponding to the first encryption key and the second private key.

[0303] The aforementioned sender 1301 can also be used to receive a first response message; obtain a second master key; the second master key is obtained by processing the second public key and the first private key corresponding to the first public key according to a preset key generation algorithm; and decrypt the first encryption key using the second master key to obtain a first string.

[0304] Optionally, the aforementioned receiver 1302 is further configured to, after processing the first public key and the second private key of the receiver 1302 according to the preset key generation algorithm to obtain the first master key, cache the first master key in the local cache according to the relationship between the first public key and the first master key;

[0305] The aforementioned sending end 1301 is also used to cache the second master key in a local cache according to the correspondence between the second public key and the first private key corresponding to the first public key after processing the second public key and the first private key corresponding to the first public key according to the preset key generation algorithm to obtain the second master key.

[0306] In the system provided by this application embodiment, after receiving a first request message including a first public key sent by the sender, the receiving end generates a first master key based on the first public key and its own second private key. The receiving end then uses the first master key to encrypt a first string, that is, it uses the first master key to encrypt the encryption key of the business data transmitted between the sender and the receiving end, obtaining a first encryption key. The receiving end sends a first response message containing the first encryption key and its own second public key to the sender. Upon receiving the first response message, the sender obtains a second master key identical to the first master key based on the second public key, and then uses the second key to decrypt the first encryption key, obtaining the first string.

[0307] Compared to related technologies, in the key negotiation process, the first response message sent by the receiving end to the sending end includes the first encryption key, which is the encrypted first string, instead of directly sending the first string as the encryption key. This effectively improves the security of the first string, thereby improving the security of key transmission and reducing data interaction costs.

[0308] Furthermore, the first response message from the receiving end includes not only the first encryption key but also the receiving end's own second public key. This allows the sending end to accurately obtain the second master key, which is the same as the first master key, based on the second public key. This allows the sending end to decrypt the first encryption key and obtain the first string. While ensuring that the sending end can accurately obtain the first string, the security of the first string is improved, thereby enhancing the security of key transmission and reducing data interaction costs.

[0309] Based on the same inventive concept, and according to the key negotiation method provided in the above embodiments of this application, this application also provides a sending end, such as... Figure 14 As shown, it includes a processor 1401, a communication interface 1402, a memory 1403, and a communication bus 1404, wherein the processor 1401, the communication interface 1402, and the memory 1403 communicate with each other through the communication bus 1404.

[0310] Memory 1403 is used to store computer programs;

[0311] When processor 1401 executes a program stored in memory 1403, it performs the following steps:

[0312] Send a first request message, including its own first public key, to the receiving end;

[0313] The receiving end sends a first response message in response to the first request message; the first response message contains a first encryption key and the receiving end's second public key; the first encryption key is obtained by encrypting the first string using the first master key, and the first master key is obtained by processing the second private key corresponding to the first public key and the second public key according to a preset key generation algorithm; the first string is the encryption key for the business data transmitted between the sending end and the receiving end.

[0314] Obtain the second master key; the second master key is obtained by processing the second public key and the first private key corresponding to the first public key according to a preset key generation algorithm;

[0315] The first encryption key is decrypted using the second master key to obtain the first string.

[0316] Based on the same inventive concept, and according to the key negotiation method provided in the above embodiments of this application, this application also provides a receiving end, such as... Figure 15 As shown, it includes a processor 1501, a communication interface 1502, a memory 1503, and a communication bus 1504. The processor 1501, communication interface 1502, and memory 1503 communicate with each other via the communication bus 1504.

[0317] Memory 1503 is used to store computer programs;

[0318] When processor 1501 executes the program stored in memory 1503, it performs the following steps:

[0319] Receive a first request message sent by the sender, which includes the sender's first public key;

[0320] Obtain the first master key, which is obtained by processing the first public key and the second private key of the receiving end according to a preset key generation algorithm;

[0321] Obtain the first string; the first string is the encryption key for the business data transmitted between the sender and receiver.

[0322] The first string is encrypted using the first master key to obtain the first encryption key;

[0323] Send a first response message to the sender. The first response message contains the second public key corresponding to the first encryption key and the second private key.

[0324] The sending and receiving ends provided in this application embodiment, after receiving a first request message including a first public key from the sending end, the receiving end generates a first master key based on the first public key and its own second private key. The receiving end then uses the first master key to encrypt the first string, that is, it uses the first master key to encrypt the encryption key of the business data transmitted between the sending and receiving ends, obtaining a first encryption key. The receiving end sends a first response message containing the first encryption key and its own second public key to the sending end. Upon receiving the first response message, the sending end obtains a second master key, identical to the first master key, based on its second public key. The receiving end then uses the second master key to decrypt the first encryption key, obtaining the first string.

[0325] Compared to related technologies, in the key negotiation process, the first response message sent by the receiving end to the sending end includes the first encryption key, which is the encrypted first string, instead of directly sending the first string as the encryption key. This effectively improves the security of the first string, thereby improving the security of key transmission and reducing data interaction costs.

[0326] Furthermore, the first response message from the receiving end includes not only the first encryption key but also the receiving end's own second public key. This allows the sending end to accurately obtain the second master key, which is the same as the first master key, based on the second public key. This allows the sending end to decrypt the first encryption key and obtain the first string. While ensuring that the sending end can accurately obtain the first string, the security of the first string is improved, thereby enhancing the security of key transmission and reducing data interaction costs.

[0327] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not indicate that there is only one bus or one type of bus.

[0328] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0329] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0330] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0331] Based on the same inventive concept, and according to the key negotiation method provided in the above embodiments of this application, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the above key negotiation methods.

[0332] Based on the same inventive concept, and according to the key negotiation method provided in the above embodiments of this application, this application also provides a computer program product containing instructions, which, when run on a computer, causes the computer to execute any of the key negotiation methods in the above embodiments.

[0333] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0334] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0335] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, embodiments such as apparatus, systems, transmitters, receivers, computer-readable storage media, and computer program products are basically similar to the method embodiments, and therefore the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0336] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A key negotiation method, characterized in that, Applied to the sending end, the method includes: Send a first request message, including its own first public key, to the receiving end; the first request message includes a data acquisition request for business data. The receiving end receives a first response message in response to the first request message; the first response message includes a first encryption key, a second public key of the receiving end, and encrypted data; the first encryption key is obtained by encrypting a first string using a first master key, and the first master key is obtained by processing a second private key corresponding to the first public key and the second public key according to a preset key generation algorithm; the first string is the encryption key for service data transmitted between the sending end and the receiving end; the first string is used to encrypt the service data; the service data is video data; the encrypted data is obtained by the receiving end encrypting the video data using the first string. The system checks if a master key corresponding to the second public key exists in the local cache. If it does, the system retrieves the master key corresponding to the second public key from the local cache and uses it as the second master key. If not, the system generates the second master key using the preset key generation algorithm based on the second public key and the first private key corresponding to the first public key. The second master key is obtained by processing the second public key and the first private key corresponding to the first public key using the preset key generation algorithm. The first encryption key is decrypted using the second master key to obtain the first string; The encrypted data is decrypted using the first string to obtain the business data.

2. The method according to claim 1, characterized in that, Before sending a first request message including its own first public key to the receiving end, the method further includes: Obtain the second string and the third public key of the forwarding server; Obtain a third master key, which is obtained by processing the third public key and the first private key according to the preset key generation algorithm; The first request to be encrypted is encrypted using the second string to obtain the first encrypted request; The second string is encrypted using the third master key to obtain the second encryption key; A second request message is sent to the forwarding server. The second request message contains the first encryption request, the second encryption key, and the first public key, so that the forwarding server can obtain the fourth master key. The second encryption key is decrypted using the fourth master key to obtain the second string. The first encryption request is decrypted using the second string to obtain the first request to be encrypted. A first request response to the first request to be encrypted is generated. The first request response is encrypted using the second string to obtain the second response message. The second response message is sent to the sending end. The fourth master key is obtained by processing the first public key and the third private key corresponding to the third public key according to the preset key generation algorithm. Receive the second response message; The second string is used to decrypt the second response message to obtain the first request response; The step of sending a first request message including its own first public key to the receiving end includes: Send a first request message including its own first public key to the forwarding server, so that the forwarding server forwards the received first request message to the receiving end; The step of receiving the first response message from the receiving end in response to the first request message includes: The receiver receives a first response message forwarded by the forwarding server, wherein the first response message is a response sent by the receiver to the forwarding server in response to the first request message.

3. A key negotiation method, characterized in that, Applied to the receiving end, the method includes: The receiver receives a first request message sent by the sender, which includes the sender's first public key; the first request message includes a data acquisition request for business data. Check if a master key corresponding to the first public key exists in the local cache; if so, retrieve the master key corresponding to the first public key from the local cache and use it as the first master key; if not, generate the first master key according to the first public key and the second private key of the receiving end, based on a preset key generation algorithm. Obtain a first string; the first string is the encryption key for the service data transmitted between the sending end and the receiving end; the service data is video data. The first string is encrypted using the first master key to obtain the first encryption key; the first string is used to encrypt the business data. Based on the first request message, obtain the business data; The business data is encrypted using the first string to obtain encrypted data; A first response message is sent to the sending end. The first response message includes the first encryption key, the second public key corresponding to the second private key, and the encrypted data.

4. The method according to claim 3, characterized in that, Before receiving the first request message including the first public key of the sender sent by the sender, the method further includes: Obtain the third string and the third public key of the forwarding server; Obtain the fifth master key, which is obtained by processing the third public key and the second private key according to the preset key generation algorithm; The second request to be encrypted is encrypted using the third string to obtain the second encrypted request; The third string is encrypted using the fifth master key to obtain the third encryption key; A third request message is sent to the forwarding server. The third request message contains the second encryption request, the third encryption key, and the second public key, so that the forwarding server can obtain the sixth master key. The sixth master key is used to decrypt the third encryption key to obtain the third string. The third string is used to decrypt the second encryption request to obtain the second request to be encrypted. A second request response to the second request to be encrypted is generated. The third string is used to encrypt the second request response to obtain the third response message. The third response message is sent to the sending end. The sixth master key is obtained by processing the third private key corresponding to the second public key and the third public key according to the preset key generation algorithm. Receive the third response message; The third string is used to decrypt the third response message to obtain the second request response; The step of receiving a first request message including the first public key of the sender sent by the sender includes: Receive a first request message sent by the forwarding server, which includes the first public key of the sending end, wherein the first request message is sent by the sending end to the forwarding server; The step of sending the first response message to the sending end includes: The first response message is sent to the forwarding server so that the forwarding server forwards the first response message to the sending end.

5. A key negotiation system, characterized in that, The system includes a transmitter and a receiver; The sending end is configured to send a first request message including its own first public key to the receiving end; the first request message includes a data acquisition request for business data. The receiving end is used to receive the first request message; The system checks if a master key corresponding to the first public key exists in the local cache. If it does, it retrieves the master key corresponding to the first public key from the local cache and uses it as the first master key. If not, it generates the first master key based on the first public key and the second private key of the receiving end, according to a preset key generation algorithm. The system then retrieves a first string, which is the encryption key for the business data transmitted between the sending end and the receiving end; the business data is video data. The first string is encrypted using the first master key to obtain the first encryption key; Based on the first request message, the service data is obtained; the service data is encrypted using the first string to obtain encrypted data; a first response message is sent to the sending end, the first response message containing the first encryption key, the second public key corresponding to the second private key, and the encrypted data; the first string is used to encrypt the service data; the service data is video data; The sending end is also used to receive the first response message; Obtain the second master key; the second master key is obtained by processing the second public key and the first private key corresponding to the first public key according to the preset key generation algorithm; The first encryption key is decrypted using the second master key to obtain the first string; the encrypted data is then decrypted using the first string to obtain the business data. The receiving end is further configured to, after processing the first public key and the second private key of the receiving end according to the preset key generation algorithm to obtain the first master key, cache the first master key in the local cache according to the relationship between the first public key and the first master key; The sending end is further configured to, after processing the second public key and the first private key corresponding to the first public key according to the preset key generation algorithm to obtain the second master key, cache the second master key in a local cache according to the correspondence between the second public key and the second master key.

6. A transmitter, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the steps of the method described in any one of claims 1-2.

7. A receiving end, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the steps of the method described in any one of claims 3-4.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-2 or 3-4.

Images