A message forwarding control method, device, equipment and medium

Abstract

The present application discloses a message forwarding control method, apparatus, device and medium, wherein a forwarding server obtains an original message initiated for transmission by a source sender with a receiver as the target; encrypts the original message to form an encrypted message and provides it to the receiver; obtains a control credential provided by the source sender or the receiver for the forwarding requirement of the original message; if the control credential meets the set conditions, sends the signed decryption information to the receiver; wherein the decryption information is used to decrypt the encrypted message into the original message, thereby solving the problem of mistrust between the source device and the destination device during message forwarding, and proving the message forwarding by obtaining the control credential, thereby avoiding the problem of mutual mistrust between the forwarding server and the device in a zero-trust environment, and while realizing message forwarding, effectively and undeniably proves the forwarding and undeniably proves the erroneous forwarding, thereby avoiding the problem of a third party being unable to judge whether the message is forwarded or not and whether the message is forwarded incorrectly.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and in particular to a message forwarding control method, device, equipment and medium. Background Art

[0002] Data interaction is achieved by transmitting messages on the Internet. In the data communication forwarding link, it is often necessary to forward messages through intermediate devices, such as cross-network virtual private network (VPN) proxy servers, network address translation (NAT) forwarding proxy servers, etc., which require cross-network message forwarding between different networks.

[0003] However, in an extremely low-trust environment or an untrusted environment, there is a phenomenon of mutual distrust between the forwarding server and the forwarding and receiving devices it serves. Due to the particularity of data messages, it is difficult to find a cryptographic proof of message forwarding. Therefore, how to provide an irrefutable forwarding proof and complaint proof method between the service device and the served device that can be verified by a third party is a problem that needs to be solved in an extremely low-trust environment. Summary of the invention

[0004] The present invention provides a message forwarding control method, device, equipment and medium to solve the trust problem in the message forwarding control process.

[0005] According to one aspect of the present invention, a message forwarding control method is provided, which is executed by a forwarding server, and the method includes:

[0006] Obtain the original message that the source sender initiates transmission with the receiver as the target;

[0007] Encrypting the original message to form an encrypted message, and providing the encrypted message to the recipient;

[0008] Obtaining a control certificate provided by the source sender or the receiver in response to a forwarding requirement of the original message;

[0009] If the control credential meets the set conditions, the signed decryption information is sent to the recipient; wherein the decryption information is used to decrypt the encrypted message into the original message.

[0010] According to another aspect of the present invention, a message forwarding control method is provided, which is executed by a receiving terminal, and the method includes:

[0011] Obtain the encrypted message forwarded by the forwarding server;

[0012] providing control credentials to the forwarding server;

[0013] If the forwarding server confirms that the control credential meets the set conditions, then obtaining the signed decrypted information from the forwarding server;

[0014] The encrypted message is decrypted into an original message using the decryption information.

[0015] According to another aspect of the present invention, a message forwarding control device is provided, which is applied to a forwarding server, and the device includes:

[0016] The original message acquisition module is used to acquire the original message that the source sender initiates the transmission with the receiver as the target;

[0017] A message encryption module, used for encrypting the original message to form an encrypted message, and providing it to the recipient;

[0018] A control credential acquisition module, used to acquire the control credential provided by the source sender or the receiver in response to the forwarding requirement of the original message;

[0019] A decryption information sending module is used to send the signed decryption information to the recipient if the control credential meets the set conditions; wherein the decryption information is used to decrypt the encrypted message into the original message.

[0020] According to another aspect of the present invention, a message forwarding control device is provided, which is applied to a receiving terminal, and the device includes:

[0021] The encrypted message acquisition module is used to obtain the encrypted message forwarded by the forwarding server;

[0022] A control credential providing module, used for providing control credentials to the forwarding server;

[0023] A decryption information acquisition module, configured to acquire the signed decryption information from the forwarding server if the forwarding server confirms that the control credential meets the set conditions;

[0024] The message decryption module is used to decrypt the encrypted message into an original message using the decryption information.

[0025] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0026] at least one processor; and

[0027] a memory communicatively connected to the at least one processor; wherein,

[0028] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the message forwarding control method described in any embodiment of the present invention.

[0029] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the message forwarding control method described in any embodiment of the present invention when executed.

[0030] According to the technical solution of the embodiment of the present invention, the forwarding server obtains the original message initiated by the source sender for transmission with the receiver as the target; encrypts the original message to form an encrypted message and provides it to the receiver; obtains the control credential provided by the source sender or the receiver for the forwarding demand of the original message; if the control credential meets the set conditions, sends the signed decryption information to the receiver; wherein the decryption information is used to decrypt the encrypted message into the original message, thereby solving the problem of distrust between the source device and the destination device during message forwarding, encrypts the original message to form an encrypted message, provides the encrypted message to the receiver, and obtains the control credential provided by the source sender or the receiver at the same time, and proves the message forwarding through the control credential, thereby avoiding the problem of mutual distrust between the forwarding server and the device in a zero-trust environment, and while realizing message forwarding, effectively performs undeniable proof of forwarding and undeniable proof of erroneous forwarding, thereby avoiding the problem of third parties being unable to judge whether to forward or not and whether the forwarding is erroneous.

[0031] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 is a flow chart of a message forwarding control method provided according to Embodiment 1 of the present invention;

[0034] Figure 2 is a flow chart of a message forwarding control method provided according to Embodiment 2 of the present invention;

[0035] Figure 3is a flow chart of a message forwarding control method provided according to Embodiment 3 of the present invention;

[0036] Figure 4 is a flow chart of a message forwarding control method provided according to Embodiment 4 of the present invention;

[0037] Figure 5 This is an example diagram of an implementation of message sending provided according to Embodiment 4 of the present invention;

[0038] Figure 6 is another example diagram of implementing message sending according to Embodiment 4 of the present invention;

[0039] Figure 7 is a structural schematic diagram of a message forwarding control device provided according to Embodiment 5 of the present invention;

[0040] Figure 8 is a structural schematic diagram of a message forwarding control device provided according to Embodiment 6 of the present invention;

[0041] Fig. 9 It is a structural schematic diagram of an electronic device for implementing the message forwarding control method of an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0043] It should be noted that the terms "original", "encrypted", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0044] Embodiment 1

[0045] Figure 1A flow chart of a message forwarding control method is provided for the first embodiment of the present invention. This embodiment is applicable to the case where a message forwarding is effectively proved when a forwarding server forwards a message to a device. The method can be executed by a message forwarding control device. The message forwarding control device can be implemented in the form of hardware and / or software. The message forwarding control device can be configured in a forwarding server. Figure 1 As shown, the method includes:

[0046] S101: Acquire an original message that a source sender initiates transmission with a receiver as a target.

[0047] In this embodiment, the source sender is the message sender, and the original message may include information such as a message header, message content, source port, and destination port, wherein the message header may be any one of the following: an IP header, an Ethernet header, an IP plus UDP protocol header, and an IP plus TCP header. When the source sender needs to communicate with the receiver, the original message is first formed, and the original message includes at least the message content, and may also include information such as the address and port of the receiver, so as to determine the destination of the message forwarding. The original message can be forwarded using the VPN forwarding mode, that is, by adding a new IP header or UDP / TCP protocol header outside the original message to form a message and send it through a communication transmission tunnel, and the forwarding server receives the original message through the communication transmission tunnel. The tunnel between the source sender and the receiver includes a tunnel between the source sender and the forwarding server and a tunnel between the forwarding server and the receiver. When the original message is transmitted, the original message can be embedded in the tunnel message, that is, the original message is encapsulated by the tunnel message, so that the original message can be transmitted to the forwarding server through the tunnel. After receiving the tunnel message with the original message embedded therein, the forwarding server can obtain the original message by decapsulating the tunnel message.

[0048] S102: Encrypt the original message to form an encrypted message, and provide it to a receiver.

[0049] In this embodiment, the encrypted message can be encrypted by a preset encryption algorithm, which can be a symmetric encryption algorithm, such as a DES algorithm, an AES algorithm, or an asymmetric encryption algorithm, such as an RSA algorithm, a DSA algorithm, or the like.

[0050] An encryption algorithm can be pre-set. After obtaining the original message, the original message is encrypted using the pre-set algorithm to form an encrypted message and forwarded to the recipient. Multiple encryption algorithms can also be pre-set. When encrypting, an encryption algorithm is randomly selected to encrypt the original message, or a suitable encryption algorithm is selected to encrypt the original message according to the size and importance of the message. When the forwarding server sends the encrypted message to the recipient, it can be sent directly or forwarded in pieces, that is, if the size of the encrypted message exceeds the maximum transmission unit limit of the tunnel protocol between the forwarding server and the recipient, the encrypted message is forwarded in pieces. When the encrypted message is large, the larger encrypted message can be converted into multiple smaller messages by fragmentation for transmission. If the encrypted message provided to the recipient by the forwarding server is segmented, the restoration information of the restored message can be carried while sending the encrypted message, or the restoration information can be sent to the recipient separately so that the recipient can restore the fragmented message according to the restoration information.

[0051] When the source sender provides the original message to the forwarding server, it can also serialize the original message. Each message carries a serial number. The forwarding server encrypts and forwards according to the serial number of the original message, and indicates the serial number of the original message corresponding to the received encrypted message to the receiver through the recovery information. The receiver can determine which part of the message fragment corresponds to which sequence number of the original message through the recovery information, and further restore the message.

[0052] When forwarding a message, the embodiment of the present application can also forward the message through the NAT forwarding mode, that is, the message forwarding is realized by modifying the message header, that is, the source and destination addresses, ports, protocols, etc. of the original message are modified, and the message content in the original message remains unchanged, and the original message content is encrypted and forwarded to the receiver. When forwarding in this way, if the original message is fragmented, the forwarding server needs to send the corresponding relationship between the content of the original message and the forwarded encrypted message to the receiver so that the receiver can restore the message.

[0053] It should be noted that when the forwarding server in the embodiment of the present application obtains the original message and forwards it to the recipient after encryption, if the forwarding is performed using a VPN, a message sequence number is usually added to each message. The present application can utilize the sequence number of the original outer tunnel protocol according to the outer tunnel protocol. For example, if the outer tunnel is TCP transmission, the outer TCP sequence number is directly used as the sequence number of each encrypted message.

[0054] S103: Obtain control credentials provided by the source sender or receiver for forwarding requirements of the original message.

[0055] In this embodiment, the control credential can be specifically understood as a kind of information proving that a message is forwarded between the forwarding server and the device. The control credential can be used to control the message forwarding process. For example, the source sender provides the control credential to the forwarding server, and the forwarding server can use the control credential to determine whether to send decryption information to the receiver, or when to send the decryption information to the receiver, so that the receiver can decrypt according to the decryption information and complete the complete process of message forwarding. The control credential can also be used to pay during the message forwarding process. For example, the source sender or the receiver pays the forwarding server, and the payment information for the forwarding demand is carried by the control credential to achieve the purpose of paid forwarding.

[0056] The source sender or receiver may provide control credentials for the forwarding server to forward the original message each time the message is forwarded. For example, the source sender generates and actively sends the control credentials each time the original message is sent to the forwarding server, or the forwarding server actively obtains the control credentials from the source sender through a communication request after receiving the original message. When the receiver provides the control credentials, it may be generated and sent after receiving the encrypted message, or it may be actively obtained by the forwarding server. The source sender or receiver may provide control credentials for the forwarding server to forward the original message in batches, without providing different control credentials each time the message is forwarded. For example, the control credentials may be provided according to the message forwarding volume, for example, one control credential may be shared by every 100 original messages, or the control credentials may be provided according to the duration, for example, one control credential may be shared by original messages within 1 hour, or one control credential may be shared by all original messages in the same session. When multiple messages share a control credential, the control credential can be saved by the forwarding server. For example, the forwarding server saves the control credential and counts the original forwarded messages. When the number reaches 100, it records that the control credential has expired, obtains a new control credential from the source sender or receiver, and updates it. When multiple messages share a control credential, the source sender or receiver can also provide feedback each time. The source sender or receiver can provide feedback on the same control credential.

[0057] S104. If the control credential meets the set conditions, the signed decryption information is sent to the recipient; wherein the decryption information is used to decrypt the encrypted message into the original message.

[0058] In this embodiment, the setting condition is related to the type of control credential. When the function of the control credential is to realize payment, the setting condition may be payment qualification; when the function of the control credential is to control message forwarding, the setting condition may be confirmation of forwarding instruction, or the current time meets the time condition, etc. The decryption information may be a decryption key, a decryption method, etc. The decryption information is determined according to the encryption method, and the decryption information corresponding to different encryption algorithms may be different. It is judged whether the control credential meets the setting condition. If the setting condition is met, the decryption information is signed, and the signed decryption information is sent to the recipient, so that the recipient can decrypt the encrypted message according to the decryption information to obtain the original message. The decryption information is signed with the private key of the forwarding server to indicate that the subject identity sending the decryption information is the forwarding server.

[0059] The embodiment of the present invention provides a message forwarding control method, wherein a forwarding server obtains an original message initiated by a source sender for transmission with a receiver as a target; encrypts the original message to form an encrypted message and provides it to the receiver; obtains a control credential provided by the source sender or the receiver for the forwarding requirement of the original message; if the control credential meets the set conditions, sends the signed decryption information to the receiver; wherein the decryption information is used to decrypt the encrypted message into the original message, thereby solving the problem of distrust between the source device and the destination device during message forwarding, encrypts the original message to form an encrypted message, provides the encrypted message to the receiver, and obtains the control credential provided by the source sender or the receiver at the same time, and proves the message forwarding through the control credential, thereby avoiding the problem of mutual distrust between the forwarding server and the device in a zero-trust environment, and while realizing message forwarding, effectively performs undeniable proof of forwarding and undeniable proof of erroneous forwarding, thereby avoiding the problem of a third party being unable to judge whether to forward or not and whether to forward erroneously.

[0060] Embodiment 2

[0061] Figure 2 This is a flow chart of a message forwarding control method provided in Embodiment 2 of the present invention. This embodiment is refined on the basis of the above embodiment. Figure 2 As shown, the method includes:

[0062] S201: Acquire an original message that a source sender initiates transmission with a receiver as a target.

[0063] When transmitting a message, the source determines the destination of the message, that is, the receiver, and forms an original message, which carries data information. The forwarding server obtains the original message and forwards the original message to the receiver as a communication transfer platform.

[0064] S202: Encrypt the original message to form an encrypted message, and provide it to a receiver.

[0065] The forwarding server encrypts the original message using a preset encryption algorithm, obtains the encrypted message and provides it to the recipient.

[0066] S203. Generate an encrypted message feature certificate according to the encrypted message, and sign the encrypted message feature certificate; wherein the encrypted message feature certificate is used to uniquely represent the content of the encrypted message.

[0067] In this embodiment, the encrypted message feature certificate can be specifically understood as an encrypted message signed by the forwarding server for verifying the encrypted message received by the subsequent entity. The encrypted message feature certificate in the embodiment of the present application can be used to uniquely characterize the content of the encrypted message. The encrypted message feature certificate may include the entire content of the encrypted message, and may also include partial content, size and other information of the encrypted message. The encrypted message is processed according to pre-set rules, algorithms, etc., to generate an encrypted message feature certificate, and the encrypted message feature certificate is digitally signed by a signature algorithm to determine the authenticity and non-repudiation of the information of the message certificate feature and the identity of the signer, avoid identity forgery, and solve the problem of distrust between the forwarding server and the recipient and the source sender.

[0068] As an optional embodiment of the present embodiment, the present optional embodiment further optimizes the generation of encrypted message characteristic credentials based on the encrypted message as follows: performing hash calculation on the encrypted message to obtain a characteristic value of the encrypted message as the encrypted message characteristic credentials.

[0069] The encrypted message is hashed by a hash algorithm, and the encrypted message is transformed into a message digest of a fixed length by the hash algorithm. The obtained hash value is the characteristic value of the encrypted message, and this characteristic value is used as the encrypted message characteristic credential. By obtaining the encrypted message characteristic credential through hash calculation, the uniqueness and non-tamperability of the characteristic credential can be achieved, thereby improving the credibility of the forwarding server. Alternatively, the encrypted message characteristic credential can be determined by calculating the encrypted message through other one-way functions. As an optional embodiment of the present embodiment, the present optional embodiment further optimizes the signing of the encrypted message characteristic credential as follows: using the private key of the forwarding server to sign the encrypted message characteristic credential;

[0070] Among them, the private key of the forwarding server is the private key of the blockchain account of the forwarding server;

[0071] Or, the private key of the forwarding server dynamically updates the private key, and the public key signature is provided together with the encrypted message feature certificate. The public key signature is formed by the forwarding server using the blockchain account private key to sign the public key corresponding to the forwarding server private key.

[0072] In the embodiment of the present application, when signing the encrypted message feature certificate, in order to ensure the uniqueness of the signature, the private key of the forwarding server is used to sign the encrypted message feature certificate. The private key of the forwarding server can be the blockchain account private key of the forwarding server. Using the blockchain account private key as the private key can ensure credibility. Alternatively, the private key of the forwarding server can be updated in real time by dynamically updating. When the private key is dynamically updated, the public key corresponding to the private key is signed. The forwarding server uses the blockchain account private key to sign the public key corresponding to the private key of the forwarding server to form a public key signature, ensure the reliability of the public key, and avoid tampering with the public key. The public key signature is provided to the recipient together with the encrypted message feature certificate, and can also be provided to the source sender. The embodiment of the present application takes the provision to the recipient as an example. The recipient verifies the public key signature and confirms the dynamically updated public key, and then the message certification certificate can be verified by dynamically updating the public key.

[0073] The private key described in this application should be understood according to the context as follows: the private key used to sign the signed information, and the corresponding public key is the public key or its derived public key corresponding to the account that can be identified and verified by the blockchain (smart contract). For example, the blockchain account private key can be used for signing, and the blockchain can use the blockchain account public key of this account to verify the signature information to determine whether the signature comes from the account, or the public key or derived public key registered for this forwarding purpose by the account publicized on the blockchain. For example, account A publicizes the public key K1 for forwarding control on the blockchain. When A signs the information X with its corresponding private key S1, the information and X are called sign together. K1 and sign are submitted to the blockchain (smart contract), and the blockchain (smart contract) can identify whether the signature comes from A based on this public key K1 and sign. For another example, account A publicly publishes the public key K1 used for forwarding control on the blockchain. When A uses its corresponding private key S1 to sign the derived public key K2, the information plus K2 is called Sign1 and sent to B. Then A uses the private key S2 corresponding to K2 to sign Y, and the information plus Y is called sign2. Then B can provide K1, K2, and sign2 to the blockchain smart contract, and the smart contract can identify that the signature comes from A based on this information.

[0074] S204: Send the encrypted message feature certificate to the recipient.

[0075] In the embodiment of the present application, the forwarding server generates and sends an encrypted message feature certificate after forming an encrypted message. The encrypted message feature certificate can be generated before or after obtaining the control certificate. This application does not limit this. This embodiment takes the generation before obtaining the control certificate as an example. The encrypted message feature certificate can be sent to the recipient together with the encrypted message, or it can be sent out-of-band, that is, it is sent separately from the encrypted message. As an optional embodiment of the present embodiment, this optional embodiment is further optimized to include the original message carrying the message feature certificate generated and signed by the source sender, which is recorded as the source message feature certificate.

[0076] In this embodiment, the source message feature certificate can be specifically understood as the certificate information used to prove the original message sent by the source sender. The source sender generates the source message feature certificate based on the original message and signs it. The generation of the source message feature certificate can also be obtained through hash calculation. The signature of the message feature certificate can also be signed by the private key of the source server. The private key can be the blockchain account private key of the source sender or a dynamically updated private key. The implementation principle is the same as the principle of the forwarding server generating the encrypted message feature certificate and signing it, and this application will not repeat it here.

[0077] The source sender generates a message feature certificate and signs it, which is recorded as the source message feature certificate, and carries it in the original message to send it to the forwarding server. The forwarding server can verify the identity by verifying the signature of the source message feature certificate, thereby obtaining the original message feature value, that is, the feature value of the original message provided by the source sender, and then detects the feature value obtained by hash calculation of this execution device to avoid forwarding the wrong original message.

[0078] The source message feature certificate can also be sent to the receiver by the forwarding server, either in-band or out-band. When sent out-band, the forwarding server re-signs the source message feature certificate, so the source message feature certificate has the signature of the source sender and the signature of the forwarding server; when sent in-band, since the forwarding server signs the features of the encrypted message, it indirectly signs the source message feature certificate contained therein. The forwarding server signs the feature certificate of the original message.

[0079] As an optional embodiment of the present embodiment, the present optional embodiment is further optimized to include obtaining the original message initiated by the source sender for transmission with the receiver as the target, and then checking the characteristic value calculated by hash according to the characteristic value of the original message provided by the source sender. If the characteristic value matches, the message forwarding operation is allowed to be executed, otherwise the source sender is notified or the original message is discarded.

[0080] After obtaining the characteristic value of the original message, the forwarding server can also verify the original message to avoid the situation where the original message is forwarded with an error when an error occurs in the original message, causing a waste of resources. The forwarding server obtains the characteristic value of the original message provided by the source sender, and the acquisition method can be active acquisition, for example, by sending a communication request to the source sender to request the characteristic value of the original message, and the source sender feedbacks the characteristic value of the original message to the forwarding server after receiving this request; or the source sender actively sends the characteristic value of the original message to the forwarding server, for example, the characteristic value of the original message is carried in the original message, and the characteristic value of the original message can be the characteristic certificate of the source message. The forwarding server can perform hash calculation based on the original message sent by the source sender to obtain the characteristic value, and compare the characteristic value of the original message provided by the source sender with the characteristic value calculated by the local machine. If they are consistent, it is determined that the received original message is correct and the message forwarding operation is allowed. Otherwise, the original message is wrong, and the source sender is notified of the message error. The source sender can determine whether to resend the original message, or directly discard the original message after the original message error.

[0081] S205: Obtain control credentials provided by the source sender or receiver in response to the forwarding requirements of the original message.

[0082] As an optional embodiment of the present embodiment, the present optional embodiment further optimizes obtaining the control credentials provided by the receiver for the forwarding requirement of the original message to: obtaining the confirmation credentials sent by the receiver after receiving the encrypted message.

[0083] In this embodiment, the receipt certificate can be specifically understood as the certificate information confirming that the encrypted message has been received. The receipt certificate can be a piece of information including that the recipient has received the encrypted message, or it can be the payment information of the recipient, indicating that the recipient has paid the forwarding server for forwarding the message. After receiving the encrypted message, the recipient generates a receipt certificate and feeds it back to the forwarding server. The receipt certificate in this application can be generated immediately after receiving the encrypted message, or after receiving the encrypted message, a feature value is generated according to the encrypted message, and the feature value is compared with the encrypted message feature certificate. If they match, a receipt certificate is generated.

[0084] As an optional embodiment of the present embodiment, the optional embodiment is further optimized to include a control credential that is signed by the recipient using the recipient's private key.

[0085] When the recipient generates a control certificate, the recipient signs the control certificate with the recipient's private key to ensure that the control certificate is not tampered with.

[0086] As an optional embodiment of the present embodiment, the optional embodiment is further optimized to include the recipient's private key as the recipient's blockchain account private key.

[0087] Using the recipient's blockchain account private key as the recipient's private key can ensure the reliability of the private key.

[0088] As an optional embodiment of the present embodiment, the optional embodiment is further optimized to include that the recipient's private key is a private key dynamically updated by the recipient, and the corresponding signature public key is provided together with the control certificate signed by the recipient's private key; wherein the signature public key is formed after being signed by the blockchain account private key.

[0089] The recipient's private key can be updated dynamically, and its corresponding signature public key is provided to the forwarding server together with the control certificate. The signature public key is obtained by the recipient using the blockchain account private key to sign the public key corresponding to the recipient's private key. The forwarding server can obtain the public key by decrypting the signature public key, and then use the public key to decrypt the control certificate provided by the recipient.

[0090] S206. If the control credential meets the set conditions, the signed decryption information is sent to the recipient; wherein the decryption information is used to decrypt the encrypted message into the original message.

[0091] S207: If the control certificate does not meet the set conditions, the decryption information is refused to be sent to the recipient.

[0092] Determine whether the control credential meets the set conditions. If so, send decryption information to the recipient, and the recipient can decrypt the encrypted message based on the decryption information. If not, refuse to send decryption information to the recipient. At this time, the recipient cannot decrypt the encrypted message. In this case, the recipient can resend the control credential to obtain the decryption information.

[0093] The control vouchers, encrypted message feature vouchers, source message feature vouchers, feature vouchers of the original message signed by the forwarding server, etc. generated by the embodiment of the present application can all be chained on the blockchain. Since the vouchers are the signatures of the blockchain account private key or its derived private key, they have the properties of non-repudiation and tampering. These vouchers can be verified by third-party roles on the blockchain, such as smart contracts. By submitting these vouchers, especially the control vouchers on the chain, the historical status of the forwarded message can be recorded to provide forwarding historical evidence. When chaining the blockchain, you can choose to chain at a fixed time, or you can chain in real time. You can chain each voucher, or you can choose to chain some vouchers. For example, for the encrypted message feature voucher, sample 1000 encrypted message feature vouchers and select 100 to chain, or select the last encrypted message feature voucher for chaining every 100 encrypted message feature vouchers generated. Each voucher in the embodiment of the present application can be used for review and verification when message forwarding is abnormal. Since each voucher is signed, it is non-tamperable, which ensures the reliability of message forwarding, and the forwarding server and the device it serves do not have to trust each other. The review verification can be initiated by any party among the forwarding server, the source sender and the receiver, and the blockchain processing logic is used for arbitration to determine the review result and ensure the fairness of data forwarding. For example, smart contracts can be used for processing. When the receiver denies the forwarded message, the service server can provide the third party with the control certificate signed by the receiver. The control certificate represents that the receiver has received the encrypted message forwarded by the forwarding server.

[0094] The embodiment of the present invention provides a message forwarding control method, which solves the problem of distrust between the source device and the destination device during the message forwarding process. The original message is encrypted by the forwarding server to form an encrypted message, and the encrypted message is provided to the receiver. At the same time, the control certificate provided by the source sender or the receiver is obtained. The control certificate is a control certificate signed by the receiver using the receiver's private key, which ensures the reliability and non-tamperability of the data. By generating an encrypted message feature certificate and signing it, message forwarding errors are avoided, and before forwarding the message, the feature value obtained by hash calculation is checked according to the feature value of the original message provided by the source sender, effectively avoiding the forwarding of the original message with errors. In a zero-trust environment, the problem of mutual distrust between the forwarding server and the device is avoided. While realizing message forwarding, the forwarding is effectively proved, reducing the losses caused by message forwarding errors or non-forwarding of messages.

[0095] Embodiment 3

[0096] Figure 3This is a flowchart of a message forwarding control method provided in Embodiment 3 of the present invention. This embodiment is applicable to the case where a receiving party receives and verifies a message forwarded by a forwarding server. This method can be executed by a message forwarding control device. The message forwarding control device can be implemented in the form of hardware and / or software. The message forwarding control device can be configured in a receiving terminal. Figure 3 As shown, the method includes:

[0097] S301. Obtain an encrypted message forwarded by a forwarding server.

[0098] The receiver communicates with the forwarding server to obtain the encrypted message sent by the forwarding server, and the receiver transmits the message with the source sender through the forwarding server.

[0099] S302: Provide control credentials to the forwarding server.

[0100] After receiving the encrypted message, the receiver generates a control credential. The control credential can be generated after verifying that the encrypted message has not been modified during the transmission process through the encrypted message feature credential. The control credential can generate a corresponding control credential each time an encrypted message is received, or a control credential can be shared for multiple encrypted messages. For example, 1,000 encrypted messages share a control credential. When the first encrypted message is received, the control credential is generated and sent to the forwarding server, and the control credential is saved at the same time, and the encrypted messages are counted cumulatively. When the 2nd to 1,000th encrypted messages are received, the saved control credential is obtained and provided to the forwarding server. When the 1,001st encrypted message is received, a new control credential is regenerated. Alternatively, the encrypted messages received within a period of time use the same control credential. For example, the encrypted messages received within 1 hour use the same control credential. After the control credential is generated, the generation time of the control credential is recorded and updated every hour. After receiving the encrypted message, the current control credential is obtained and provided to the forwarding server. The control credential may include information that the recipient has received the encrypted message, confirming that the forwarding server has forwarded the encrypted message, and may also be the recipient's payment information, by carrying proof of confirmation of forwarding in the payment information.

[0101] S303: If the forwarding server confirms that the control certificate meets the set conditions, the signed decrypted information is obtained from the forwarding server.

[0102] The receiver provides the control certificate to the forwarding server, and the forwarding server confirms whether the control certificate meets the set conditions. If the set conditions are met, the receiver will receive the decrypted information signed by the service provider. The receiver receives the decrypted information fed back by the forwarding server when the control certificate meets the set conditions.

[0103] S304: Decrypt the encrypted message into the original message using the decryption information.

[0104] The decryption information may include a decryption key, a decryption method, etc. After receiving the decryption information, the encrypted message is decrypted according to the decryption information to obtain the original message.

[0105] The embodiment of the present invention provides a message forwarding control method, wherein a receiving terminal obtains an encrypted message forwarded by a forwarding server; a control credential is provided to the forwarding server; if the forwarding server confirms that the control credential satisfies a set condition, decryption information is obtained from the forwarding server; the encrypted message is decrypted into the original message using the decryption information, thereby solving the problem of mistrust between a source device and a destination device during message forwarding. The receiving party proves the message forwarding by providing the control credential to the forwarding server, thereby avoiding the problem of mutual mistrust between the forwarding server and the device in a zero-trust environment. While realizing message forwarding, the forwarding is effectively proved, thereby reducing the loss caused by message forwarding errors or non-forwarding of messages.

[0106] Embodiment 4

[0107] Figure 4 This is a flow chart of a message forwarding control method provided by Embodiment 4 of the present invention. This embodiment is refined on the basis of the above embodiment. Figure 4 As shown, the method includes:

[0108] S401. Obtain an encrypted message forwarded by a forwarding server.

[0109] S402. Obtain an encrypted message feature certificate from a forwarding server; wherein the encrypted message feature certificate is used to uniquely characterize the content of the encrypted message.

[0110] The receiver obtains the encrypted message feature certificate from the forwarding server. The encrypted message feature certificate can uniquely represent the content of the encrypted message, so the received encrypted message can be verified through the encrypted message certification certificate. The encrypted message feature certificate can be obtained from the forwarding server by the receiver actively sending a request, or by the forwarding server actively sending it to the receiver.

[0111] This step can also be performed before providing control credentials, and there is no strict execution order with other steps.

[0112] S403: Verify the content of the received encrypted message according to the encrypted message feature certificate.

[0113] After receiving the encrypted message, the receiver generates a corresponding feature value according to the encrypted message, and compares the feature value corresponding to the encrypted message with the encrypted message feature certificate provided by the forwarding server. If they match, the verification is successful. If they do not match, the verification fails. At this time, the message sent by the forwarding server may be wrong. When the encrypted message feature certificate is a feature value obtained by hash calculation, the encrypted message is hashed to obtain the feature value, and the two feature values ​​are compared to determine whether the verification is successful. And execute S404 when the verification is successful.

[0114] S404: Provide control credentials to the forwarding server.

[0115] As an optional embodiment of the present embodiment, the present optional embodiment further optimizes providing the control credential to the forwarding server as follows: after confirming receipt of the encrypted message, providing the forwarding server with a confirmation credential as the control credential.

[0116] After receiving the encrypted message, the receiver generates a confirmation certificate and sends the confirmation certificate as a control certificate to the forwarding server so that the forwarding server can determine that the receiver has received the encrypted message. The confirmation certificate can contain information such as the message reception time and message size so that the forwarding server can determine the receiver's reception of the encrypted message; it can also only contain information indicating that the encrypted message has been received. When the forwarding server receives the confirmation certificate, it can only determine that the receiver has received the encrypted message.

[0117] As an optional embodiment of the present embodiment, the optional embodiment is further optimized to include a control credential that is signed by the recipient using the recipient's private key.

[0118] As an optional embodiment of the present embodiment, the optional embodiment is further optimized to include the recipient's private key as the recipient's blockchain account private key.

[0119] As an optional embodiment of the present embodiment, the present optional embodiment is further optimized to include that the recipient's private key is a private key dynamically updated by the recipient, and the signature public key is provided together with the control certificate signed by the recipient's private key; wherein the signature public key is formed after being signed by the blockchain account private key.

[0120] The embodiment of the present application further refines the signature of the control certificate and the key used for signing. The implementation process has been described in detail in the previous embodiment. Please refer to the content described in the previous embodiment, and this embodiment will not be repeated here.

[0121] As an optional embodiment of the present embodiment, the present optional embodiment further optimizes the provision of control credentials to the forwarding server as follows: the receiver, in response to the forwarding requirements of the original message, uses the local confirmation information and signature generated by the blockchain deployment program as control credentials, and provides the control credentials to the forwarding server.

[0122] In this embodiment, the blockchain deployment program can be understood as an application that can implement corresponding functions on the blockchain, and the blockchain deployment program can be deployed on the terminal device where the recipient is located. The local confirmation information can be specifically understood as the information that the recipient confirms that the machine has received the encrypted message. The local confirmation information can also only include information indicating that the encrypted message has been received, and can also include information such as the message reception time and message size. After receiving the encrypted message, the recipient generates local confirmation information through the blockchain deployment program and signs the local confirmation information to prevent data tampering. The signed local confirmation information is provided to the forwarding server as a control credential. This application generates local confirmation information and signs it through the blockchain deployment program, without the need to develop additional applications, and the local confirmation information and signature are directly provided to the forwarding server as control credentials, without the need to chain the blockchain, and without the need for nodes on the blockchain to process, which will not increase the workload.

[0123] S405: If the forwarding server confirms that the control certificate meets the set conditions, decryption information is obtained from the forwarding server.

[0124] S406: Decrypt the encrypted message into the original message using the decryption information.

[0125] S407. Obtain a source message feature certificate generated by the source sender based on the original message, wherein the source message feature certificate includes a hash calculation feature value of the original message.

[0126] The source message feature certificate is generated by the source sender according to the original message, and the source message feature certificate can be signed by the source sender. The source message feature certificate is the unique content of the original message generated by the source sender. The source message feature of the embodiment of the present application can be hashed by the original message through a hash algorithm, and the obtained feature value is used as the source message feature certificate. The source message feature certificate can also carry other information, such as message size, sending time, source address, etc.

[0127] As an optional embodiment of this embodiment, this optional embodiment is further optimized to include: obtaining the source message feature certificate generated by the source sender based on the original message includes at least one of the following operations:

[0128] Obtain the source message feature certificate directly from the source.

[0129] Obtain source message feature credentials from the message encrypted by the forwarding server.

[0130] This embodiment provides a variety of ways for the receiver to obtain the source message feature certificate. The receiver can obtain it directly from the source sender. The source sender can also carry the source message feature certificate in the original message, encrypt it through the forwarding server and forward it to the receiver. The receiver obtains the original message by decrypting the encrypted message, and further parses the original message to obtain the source message feature certificate. The source message feature certificate can also be stored in the blockchain, and the receiver can query the blockchain to obtain the source message feature certificate stored on the chain by the source sender.

[0131] S408. Compare the received encrypted message and the decrypted message according to the source message feature certificate and the encrypted message feature certificate provided by the forwarding server to verify the content of the original message.

[0132] When the source message feature certificate and the message feature certificate provided by the forwarding server are both signed, the signatures of the source message feature certificate and the message feature certificate provided by the forwarding server are first verified to confirm the identity.

[0133] By verifying the signature of the encrypted message feature certificate provided by the forwarding server and confirming the identity, the encrypted message is decrypted to obtain the corresponding feature value, and the encrypted message is hashed to obtain the feature value. This feature value is compared with the feature value corresponding to the encrypted message feature certificate of the encrypted message provided by the forwarding server. If they are consistent, it is determined that the encrypted message is forwarded correctly. Otherwise, the encrypted message is forwarded incorrectly. The reason may be that the forwarding server data is forged or the line failure message is tampered with. If the message is forwarded correctly, the decrypted message is further hashed to obtain the feature value, and compared with the feature value in the source message feature certificate. If they are consistent, it is determined that the original message is forwarded correctly. When verifying the encrypted message and the decrypted message, if the source message feature certificate or the encrypted message certificate also includes other types of information, the corresponding information of the decrypted message or the corresponding information of the encrypted message is obtained for comparison to determine whether they are consistent. If they are consistent, the message is forwarded correctly.

[0134] S409. If the content verification fails, a message content verification transaction request is initiated to the blockchain to request the blockchain node to perform a message content verification review process; wherein the message content verification transaction request includes the message received by the receiver, decryption information, the source message feature certificate provided by the source sender, and the message feature certificate provided by the forwarding server.

[0135] In this embodiment, the message content verification transaction request can be specifically understood as a request for the blockchain to verify the message forwarding process of the forwarding server. If the content verification fails, the message forwarded by the forwarding server is wrong. The receiver forms a message content verification transaction request based on the message received by the receiver, the decryption information, the source message feature certificate provided by the source sender, and the encrypted message feature certificate provided by the forwarding server and sends it to the blockchain, and the message content is verified and reviewed by the blockchain node. Through the verification and review of the blockchain node, the cause of the abnormal message forwarding can be determined, for example, whether the forwarding server correctly forwards the message, or whether the receiver correctly decrypts the message. The information sent by the source sender and the forwarding server can be determined through the source message feature certificate, the encrypted message feature certificate provided by the forwarding server, etc. Since the source sender and the forwarding server have signed each certificate, the data cannot be tampered with, which improves the data reliability, so that the blockchain node can review and determine the cause of the abnormal message forwarding.

[0136] It is important to know that when any of the forwarding server, receiver, and source sender detects an abnormal message forwarding, they can also request the blockchain to review the message forwarding content, and form a verification request based on the original message, encrypted message, source message feature certificate provided by the source sender, and control certificate of the receiver or source sender. By initiating a verification request to the blockchain, the blockchain node is requested to perform a verification review. In addition, when the source sender, forwarding server, and receiver in this application send any information or message to the outside, they can sign it to effectively prove the data. When any party makes a complaint, the signed data can be used to prove the data forwarding.

[0137] The embodiment of the present invention provides a message forwarding control method. The receiving terminal provides a control certificate to the forwarding server, and then obtains the decryption information to decrypt the encrypted message into the original message, which solves the problem of distrust between the source device and the destination device in the message forwarding process. The receiving party provides the control certificate to the forwarding server to characterize the message forwarding, avoiding the problem of mutual distrust between the forwarding server and the device in the zero-trust environment. While realizing the message forwarding, the forwarding is effectively characterized to reduce the loss caused by the message forwarding error or the message not forwarded. In addition, the receiving terminal can verify the message through the message feature certificate provided by the forwarding server and the source message feature certificate, which improves the reliability and security of the message. When the verification fails, the blockchain can also be used for review, which ensures the reliability of the message forwarding and avoids the problem of distrust.

[0138] For example, Figure 5 A sample diagram of message sending is provided. Figure 5Take the example of in-band transmission of each message feature certificate. The source determines the original message to be sent. The original message includes a header and content. The original message can be sent by a provable forwarding network card. The provable forwarding network card processes and forwards the original message. When the original message needs to insert a sequence number, the sequence number is inserted into the header and content. The figure takes the original message including the sequence number as an example. By calculating the feature value of the original message, determining the source message feature value, and signing it, the source message feature certificate is obtained, and the source message feature certificate is written into the original message, and a new header 1 is added and sent to the forwarding server.

[0139] After receiving the message containing the original message, the forwarding server removes the newly added header 1 to obtain the original message, and verifies the received original message to verify whether the received message is correct. If it is correct, the original message is encrypted to form an encrypted message; if it is wrong, the message is discarded or the source sender is informed of the message error. The characteristic value of the encrypted message is calculated to obtain the encrypted message characteristic value, and it is signed to obtain the encrypted message characteristic certificate. The encrypted message characteristic certificate is packaged with the encrypted message at the same time, and a new header 2 is added and sent to the recipient.

[0140] The receiver processes the received message, but removes the newly added header 2 to obtain the encrypted message feature certificate and the encrypted message. The receiver verifies the received message to see if it is correct. If it is correct, it signs it, generates a control certificate, and sends it to the forwarding server. If it is wrong, it discards it or informs the forwarding server of the message error.

[0141] The forwarding server receives the control certificate and verifies whether the control certificate meets the set conditions. If so, it generates the signed decrypted information and sends it to the recipient.

[0142] After receiving the decryption information after the signature, the receiver decrypts the encrypted message and obtains the message data including the source message feature certificate, header, sequence number and content. The receiver verifies the decrypted message according to the source message feature certificate. If it is correct, it can enter the next cycle. If it is incorrect, it will enter the appeal.

[0143] For example, Figure 6 Another example diagram of message sending is provided. Figure 6 Take the out-of-band transmission of each message feature certificate as an example. The source determines the source message feature certificate based on the original message and sends it to the forwarding server. The forwarding server re-signs the source message feature certificate and sends it to the receiver. The source server forms a message including a new header 1, message, sequence number and content and sends it to the forwarding server. Among them, the generation principle of the source message feature certificate is the same as Figure 5 The principle of generating characteristic credentials of the source message is the same and will not be repeated here.

[0144] After receiving the message containing the original message, the forwarding server removes the newly added header 1 to obtain the original message, and verifies the received original message to verify whether the received message is correct. If it is correct, the original message is encrypted to form an encrypted message; if it is wrong, the message is discarded or the source sender is informed of the message error. Figure 6 It is not shown in the figure, and those skilled in the art can know it. Calculate the characteristic value for the encrypted message, obtain the encrypted message characteristic value, and sign it to obtain the encrypted message characteristic certificate. Send the encrypted message characteristic certificate and the encrypted message to the recipient respectively.

[0145] The receiver processes the received message, but removes the newly added header 2 to obtain the encrypted message. The receiver verifies the received message to see if it is correct. If it is correct, it signs it, generates a control certificate, and sends it to the forwarding server. If it is wrong, it can use special methods to process, discard, or inform the forwarding server of the message error.

[0146] The forwarding server receives the control certificate and verifies whether the control certificate meets the set conditions. If so, it generates the signed decrypted information and sends it to the recipient.

[0147] After receiving the decryption information after the signature, the receiver decrypts the encrypted message and obtains the message data including the source message feature certificate, header, sequence number and content. The receiver verifies the decrypted message according to the source message feature certificate. If it is correct, it can enter the next cycle. If it is incorrect, it will enter the appeal.

[0148] Depend on Figure 6 It can be seen that when the source sender, the forwarding server and the receiver send the message feature certificate to each message, they can send the message feature certificate separately from the message.

[0149] In the technical solutions provided by the embodiments of the present invention, when the source sender, forwarding server, and receiver need to send information to other parties, they can preferably sign the sent information to indicate their own identity so that the other party can verify their identity based on the signature.

[0150] Embodiment 5

[0151] Figure 7 This is a schematic diagram of the structure of a message forwarding control device provided in Embodiment 5 of the present invention, which is applied to a forwarding server. Figure 7 As shown, the device includes: an original message acquisition module 51, a message encryption module 52, a control credential acquisition module 53 and a decryption information sending module 54.

[0152] The original message acquisition module 51 is used to acquire the original message that the source sender initiates the transmission with the receiver as the target;

[0153] A message encryption module 52, used to encrypt the original message to form an encrypted message, and provide it to the recipient;

[0154] A control credential acquisition module 53, used to acquire a control credential provided by the source sender or the receiver in response to a forwarding requirement of the original message;

[0155] The decryption information sending module 54 is used to send the signed decryption information to the recipient if the control certificate meets the set conditions; wherein the decryption information is used to decrypt the encrypted message into the original message.

[0156] An embodiment of the present invention provides a message forwarding control device, which solves the problem of distrust between a source device and a destination device during message forwarding. The device encrypts the original message to form an encrypted message, provides the encrypted message to a receiver, and obtains control credentials provided by the source sender or the receiver at the same time. The message forwarding is proved by the control credentials, thereby avoiding the problem of mutual distrust between a forwarding server and a device in a zero-trust environment. While realizing message forwarding, the forwarding is effectively proved, thereby reducing the loss caused by message forwarding errors or non-forwarding of messages.

[0157] Optionally, the control credential acquisition module 53 is specifically used to obtain a receipt credential sent by the recipient after receiving the encrypted message.

[0158] Optionally, the control certificate is a control certificate signed by the recipient using the recipient's private key.

[0159] Optionally, the recipient's private key is the recipient's blockchain account private key.

[0160] Optionally, the recipient's private key is a private key dynamically updated by the recipient, and the corresponding signature public key is provided together with the control certificate signed by the recipient's private key; wherein, the signature public key is formed after signing with the blockchain account private key.

[0161] Optionally, the device further comprises:

[0162] A certificate signing module, used for generating an encrypted message characteristic certificate according to the encrypted message after encrypting the original message to form an encrypted message, and signing the encrypted message characteristic certificate; wherein the encrypted message characteristic certificate is used to uniquely characterize the content of the encrypted message;

[0163] The certificate sending module is used to send the encrypted message feature certificate to the recipient.

[0164] Optionally, a certificate signature module is specifically used to perform hash calculation on the encrypted message to obtain a characteristic value of the encrypted message as the encrypted message characteristic certificate.

[0165] Optionally, the original message carries a message feature certificate generated and signed by the source sender, which is recorded as the source message feature certificate.

[0166] Optionally, a certificate signing module is specifically used to use the private key of the forwarding server to sign the encrypted message feature certificate;

[0167] The private key of the forwarding server is the private key of the blockchain account of the forwarding server;

[0168] Or, the private key of the forwarding server dynamically updates the private key, and the public key signature is provided together with the encrypted message feature certificate, and the public key signature is formed by the forwarding server using the blockchain account private key to sign the public key corresponding to the forwarding server private key.

[0169] Optionally, the device further comprises:

[0170] The message checking module is used to check the characteristic value calculated by hash according to the characteristic value of the original message provided by the source after obtaining the original message initiated by the source with the receiver as the target. If the characteristic value matches, the message forwarding operation is allowed to be executed; otherwise, the source is notified or the original message is discarded.

[0171] Optionally, the decryption information sending module 54 is further configured to refuse to send the decryption information to the recipient if the control credential does not satisfy a set condition.

[0172] The message forwarding control device provided in the embodiment of the present invention can execute the message forwarding control method provided in the first or second embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0173] Embodiment 6

[0174] Figure 8 This is a schematic diagram of the structure of a message forwarding control device provided in Embodiment 6 of the present invention, which is applied to a receiving terminal. Figure 8 As shown, the device includes: a decrypted message acquisition module 61, a control credential providing module 62, a decrypted information acquisition module 63 and a message decryption module 64.

[0175] The encrypted message acquisition module 61 is used to acquire the encrypted message forwarded by the forwarding server;

[0176] A control credential providing module 62, configured to provide control credentials to the forwarding server;

[0177] A decryption information acquisition module 63, configured to acquire the signed decryption information from the forwarding server if the forwarding server confirms that the control credential meets the set conditions;

[0178] The message decryption module 64 is used to decrypt the encrypted message into an original message using the decryption information.

[0179] An embodiment of the present invention provides a message forwarding control device, which solves the problem of distrust between the source device and the destination device during the message forwarding process. The receiver proves the message forwarding by providing control credentials to the forwarding server, thereby avoiding the problem of mutual distrust between the forwarding server and the device in a zero-trust environment. While realizing message forwarding, the forwarding is effectively proved, reducing the losses caused by message forwarding errors or non-forwarding of messages.

[0180] Optionally, the control credential providing module 62 is specifically used to provide a receipt credential to the forwarding server as the control credential after confirming receipt of the encrypted message.

[0181] Optionally, the control certificate is a control certificate signed by the recipient using the recipient's private key.

[0182] Optionally, the recipient's private key is the recipient's blockchain account private key.

[0183] Optionally, the recipient's private key is a private key dynamically updated by the recipient, and the signature public key is provided together with the control certificate signed by the recipient's private key; wherein, the signature public key is formed after signing with the blockchain account private key.

[0184] Optionally, the control credential providing module 62 is specifically used for: the recipient, in response to the forwarding requirements of the original message, uses the local confirmation information and signature generated by the blockchain deployment program as the control credential, and provides the control credential to the forwarding server.

[0185] Optionally, the device further comprises:

[0186] A feature credential acquisition module, used to acquire an encrypted message feature credential from the forwarding server; wherein the encrypted message feature credential is used to uniquely characterize the content of the encrypted message;

[0187] The first message verification module is used to verify the content of the received encrypted message based on the encrypted message feature certificate.

[0188] Optionally, the device further comprises:

[0189] A source credential acquisition module, used to obtain a source message feature credential generated by the source sender based on the original message, wherein the source message feature credential includes a hash calculation feature value of the original message;

[0190] The second message verification module is used to compare the received encrypted message and the decrypted message according to the source message feature certificate and the message feature certificate provided by the forwarding server to verify the content of the original message.

[0191] Optionally, the device further comprises:

[0192] The verification request sending module is used to initiate a message content verification transaction request to the blockchain after the content verification of the original message is performed, if the content verification fails, so as to request the blockchain node to perform a message content verification review process; wherein the message content verification transaction request includes the message received by the receiving party, the decryption information, the source message feature certificate provided by the source sender, and the encrypted message feature certificate provided by the forwarding server.

[0193] Optionally, obtaining the source message feature certificate generated by the source sender based on the original message includes at least one of the following operations:

[0194] Directly obtain the source message feature certificate from the source sender;

[0195] The source message feature certificate is obtained from the message encrypted by the forwarding server.

[0196] The message forwarding control device provided in the embodiment of the present invention can execute the message forwarding control method provided in the third or fourth embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0197] Embodiment 7

[0198] Fig. 9 A schematic diagram of an electronic device 70 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0199] like Fig. 9As shown, the electronic device 70 includes at least one processor 71, and a memory connected to the at least one processor 71, such as a read-only memory (ROM) 72, a random access memory (RAM) 73, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 71 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 72 or the computer program loaded from the storage unit 78 to the random access memory (RAM) 73. In the RAM 73, various programs and data required for the operation of the electronic device 70 can also be stored. The processor 71, the ROM 72, and the RAM 73 are connected to each other via a bus 74. An input / output (I / O) interface 75 is also connected to the bus 74.

[0200] A number of components in the electronic device 70 are connected to the I / O interface 75, including: an input unit 76, such as a keyboard, a mouse, etc.; an output unit 77, such as various types of displays, speakers, etc.; a storage unit 78, such as a disk, an optical disk, etc.; and a communication unit 79, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 79 allows the electronic device 70 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0201] The processor 71 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 71 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 71 executes the various methods and processes described above, such as a message forwarding control method.

[0202] In some embodiments, the message forwarding control method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 78. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 70 via the ROM 72 and / or the communication unit 79. When the computer program is loaded into the RAM 73 and executed by the processor 71, one or more steps of the message forwarding control method described above may be performed. Alternatively, in other embodiments, the processor 71 may be configured to execute the message forwarding control method in any other appropriate manner (e.g., by means of firmware).

[0203] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0204] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0205] In the case where the electronic device is a forwarding server, the device provided above can be configured to execute the message forwarding control method applied to the forwarding server provided in any of the above embodiments, and have corresponding functions and effects.

[0206] In the case where the electronic device is a receiving terminal, the device provided above can be configured to execute the message forwarding control method applied to the receiving terminal provided in any of the above embodiments, and have corresponding functions and effects.

[0207] The storage medium containing computer instructions provided in an embodiment of the present application is used to execute a message forwarding control method applied to a forwarding server when the computer instructions are executed by a computer processor, the method comprising: obtaining an original message initiated by a source sender for transmission with a receiver as a target; encrypting the original message to form an encrypted message, and providing it to the receiver; obtaining a control credential provided by the source sender or the receiver in response to the forwarding requirement of the original message; if the control credential meets the set conditions, sending decryption information to the receiver; wherein the decryption information is used to decrypt the encrypted message into the original message.

[0208] The storage medium containing computer instructions provided in an embodiment of the present application is used to execute a message forwarding control method applied to a receiving terminal when the computer instructions are executed by a computer processor. The method includes: obtaining an encrypted message forwarded by a forwarding server; providing control credentials to the forwarding server; if the forwarding server confirms that the control credentials meet the set conditions, obtaining decryption information from the forwarding server; and using the decryption information to decrypt the encrypted message into the original message.

[0209] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0210] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0211] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0212] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0213] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0214] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A message forwarding control method, characterized in that: Executed by a forwarding server, the method includes: Obtaining an original message transmitted by a source sender with the recipient as the target, wherein the original message carries a message feature certificate generated and signed by the source sender, which is recorded as the source message feature certificate; Encrypting the original message to form an encrypted message, and providing the encrypted message to the recipient; Obtaining the control credential provided by the source sender or the receiver in response to the forwarding demand of the original message, where the control credential is provided by the source sender and is a control credential signed by the source sender; and where the control credential is provided by the receiver and is a control credential signed by the receiver using the receiver's private key, and the control credential includes a receipt credential so that the forwarding server can determine that the receiver has received the encrypted message; If the control credential meets the set conditions, the signed decryption information is sent to the recipient; wherein the decryption information is used to decrypt the encrypted message into the original message, and the decryption information is signed with the private key of the forwarding server; After encrypting the original message to form an encrypted message, the method further includes: Generate an encrypted message feature certificate according to the encrypted message, and sign the encrypted message feature certificate; wherein the encrypted message feature certificate is used to uniquely characterize the content of the encrypted message; Sending the encrypted message feature certificate to the recipient; The receipt certificate is generated after the recipient generates a characteristic value based on the encrypted message and determines that the characteristic value matches the encrypted message characteristic certificate.

2. The method according to claim 1, characterized in that Obtaining the control credentials provided by the receiver for the forwarding requirement of the original message includes: Obtain a receipt certificate sent by the recipient after receiving the encrypted message.

3. The method according to claim 1, characterized in that The recipient's private key is the recipient's blockchain account private key.

4. The method according to claim 1, characterized in that: The recipient's private key is a private key dynamically updated by the recipient, and the corresponding signature public key is provided together with the control certificate signed by the recipient's private key; wherein, the signature public key is formed after being signed with the blockchain account private key.

5. The method according to claim 1, characterized in that Generating an encrypted message characteristic certificate according to the encrypted message includes: A hash calculation is performed on the encrypted message to obtain a characteristic value of the encrypted message as the encrypted message characteristic credential.

6. The method according to claim 1, characterized in that Signing the encrypted message feature certificate includes: Using the private key of the forwarding server to sign the encrypted message feature certificate; The private key of the forwarding server is the private key of the blockchain account of the forwarding server; Or, the private key of the forwarding server dynamically updates the private key, and the public key signature is provided together with the encrypted message feature certificate, and the public key signature is formed by the forwarding server using the blockchain account private key to sign the public key corresponding to the forwarding server private key.

7. The method according to claim 1, characterized in that After obtaining the original message initiated by the source to transmit to the receiver, the method further includes: According to the characteristic value of the original message provided by the source sender, the characteristic value calculated by the hash is checked. If the characteristic value matches, the message forwarding operation is allowed to be executed; otherwise, the source sender is notified or the original message is discarded.

8. The method according to claim 1, characterized in that Also includes: If the control certificate does not meet the set conditions, the decryption information is refused to be sent to the recipient.

9. The method according to claim 1, characterized in that: Also includes: When the receiver or the source denies having forwarded the message, it is submitted to a third party for review.

10. A message forwarding control method, characterized in that: Executed by the receiving party, the method includes: Obtaining an encrypted message forwarded by the forwarding server, wherein the encrypted message is formed by encrypting the original message, and the original message carries a message feature certificate generated and signed by the source sender, which is recorded as the source message feature certificate; Providing a control credential to the forwarding server, wherein the control credential is a control credential signed by the recipient using the recipient's private key, and the control credential includes a receipt credential, so that the forwarding server determines that the recipient has received the encrypted message; If the forwarding server confirms that the control credential meets the set conditions, the signed decrypted information is obtained from the forwarding server, where the decrypted information is signed using the private key of the forwarding server; Decrypting the encrypted message into an original message using the decryption information; The method further comprises: Obtaining an encrypted message feature certificate from the forwarding server; wherein the encrypted message feature certificate is used to uniquely characterize the content of the encrypted message; Verifying the content of the received encrypted message according to the encrypted message feature certificate; The receipt certificate is generated after the recipient generates a characteristic value based on the encrypted message and determines that the characteristic value matches the encrypted message characteristic certificate.

11. The method according to claim 10, characterized in that Providing control credentials to the forwarding server includes: After confirming receipt of the encrypted message, a receipt certificate is provided to the forwarding server as the control certificate.

12. The method according to claim 10, characterized in that The recipient's private key is the recipient's blockchain account private key.

13. The method according to claim 10, characterized in that The recipient's private key is a private key dynamically updated by the recipient, and the signature public key is provided together with the control certificate signed by the recipient's private key; wherein, the signature public key is formed after being signed with the blockchain account private key.

14. The method according to claim 10 or 11, characterized in that: Providing control credentials to the forwarding server includes: The receiver, in response to the forwarding requirement of the original message, uses the local confirmation information and signature generated by the blockchain deployment program as the control credential, and provides the control credential to the forwarding server.

15. The method according to claim 10, characterized in that Also includes: Obtaining a source message feature certificate generated by the source sender based on the original message, wherein the source message feature certificate includes a hash calculation feature value of the original message; The received encrypted message and the decrypted message are compared based on the source message feature certificate and the encrypted message feature certificate provided by the forwarding server to verify the content of the original message.

16. The method according to claim 10 or 15, characterized in that After verifying the content of the original message, the method further includes: If the content verification fails, a message content verification transaction request is initiated to the blockchain to request the blockchain node to perform a message content verification review process; wherein the message content verification transaction request includes the message received by the recipient, decryption information, the source message feature certificate provided by the source, and the encrypted message feature certificate provided by the forwarding server.

17. The method according to claim 15, characterized in that Acquiring the source message feature certificate generated by the source sender based on the original message includes at least one of the following operations: Directly obtain the source message feature certificate from the source sender; The source message feature certificate is obtained from the message encrypted by the forwarding server.

18. A message forwarding control device, characterized in that: Applied on a forwarding server, the device comprises: The original message acquisition module is used to acquire the original message initiated by the source sender for transmission with the receiver as the target, wherein the original message carries the message feature certificate generated and signed by the source sender, which is recorded as the source message feature certificate; A message encryption module, used for encrypting the original message to form an encrypted message, and providing it to the recipient; A control credential acquisition module, used to acquire the control credential provided by the source sender or the receiver in response to the forwarding demand of the original message. When the control credential is provided by the source sender, the control credential is a control credential signed by the source sender; when the control credential is provided by the receiver, the control credential is a control credential signed by the receiver using the receiver's private key. The control credential includes a receipt credential so that the forwarding server can determine that the receiver has received the encrypted message; A decryption information sending module, used to send the signed decryption information to the recipient if the control credential meets the set conditions; wherein the decryption information is used to decrypt the encrypted message into the original message, and the decryption information is signed with the private key of the forwarding server; The device also includes: A certificate signing module, used for generating an encrypted message characteristic certificate according to the encrypted message after encrypting the original message to form an encrypted message, and signing the encrypted message characteristic certificate; wherein the encrypted message characteristic certificate is used to uniquely characterize the content of the encrypted message; A certificate sending module, used to send the encrypted message feature certificate to the recipient; The receipt certificate is generated after the recipient generates a characteristic value based on the encrypted message and determines that the characteristic value matches the encrypted message characteristic certificate.

19. A message forwarding control device, characterized in that: Applied on a receiving side, the device comprises: The encrypted message acquisition module is used to acquire the encrypted message forwarded by the forwarding server, wherein the encrypted message is formed by encrypting the original message, and the original message carries the message feature certificate generated and signed by the source sender, which is recorded as the source message feature certificate; A control credential providing module, used to provide a control credential to the forwarding server, wherein the control credential is a control credential signed by the recipient using the recipient's private key, and the control credential includes a receipt credential, so that the forwarding server can determine that the recipient has received the encrypted message; A decryption information acquisition module, configured to acquire the signed decryption information from the forwarding server if the forwarding server confirms that the control credential meets the set conditions, wherein the decryption information is signed using the private key of the forwarding server; A message decryption module, used to decrypt the encrypted message into an original message using the decryption information; The device also includes: A feature credential acquisition module, used to acquire an encrypted message feature credential from the forwarding server; wherein the encrypted message feature credential is used to uniquely characterize the content of the encrypted message; A first message verification module, used to perform content verification on the received encrypted message according to the encrypted message feature certificate; The receipt certificate is generated after the recipient generates a characteristic value based on the encrypted message and determines that the characteristic value matches the encrypted message characteristic certificate.

20. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the message forwarding control method according to any one of claims 1 to 17.

21. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the message forwarding control method according to any one of claims 1 to 17 when executed.

Images