Communication systems, methods, apparatus, devices, and storage media

Abstract

The disclosure provides a communication system, method and device, relates to the technical field of computers and communication, and particularly relates to the field of information security and network communication technology. The specific implementation scheme is as follows: the third terminal is used for sending the first public key to the first terminal via the first channel and the second channel in sequence in response to receiving the secret communication request instruction from the first terminal, wherein the first public key is used for encrypting the first transmission data to generate the first transmission ciphertext, and the first transmission data is transmitted from the first terminal to the third terminal; the first channel is used for secret communication between the third terminal and the second terminal based on the first key pair, and the second channel is used for secret communication between the first terminal and the second terminal based on the second key pair; and via the third channel between the first terminal and the third terminal, the third terminal is used for secret communication with the first terminal based on the third key pair, and the third key pair comprises the first public key and the first private key, and the first private key is used for decrypting the first transmission ciphertext.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of computers and communication technologies, in particular to the field of information security and network communication technologies, and specifically to a communication system, method, device, equipment, storage medium and program product. BACKGROUND

[0002] With the development of computer technology and communication technology, how to protect information security in the communication process has become a technical problem to be solved.

[0003] There is a case that the communication between the client and the target server passes through the intermediate server, which makes the transmission data between the client and the target server possibly intercepted by the intermediate server via the intermediate server, causing information leakage. SUMMARY

[0004] The present disclosure provides a communication system, method, device, equipment, storage medium and program product.

[0005] According to an aspect of the present disclosure, a communication system is provided, comprising a first terminal, a second terminal and a third terminal; the third terminal is configured to, in response to receiving a secure communication request instruction from the first terminal, send a first public key to the first terminal via a first channel and a second channel in sequence, wherein the first public key is used to encrypt first transmission data to generate first transmission ciphertext, and the first transmission data is transmitted from the first terminal to the third terminal; the first channel is used for secure communication between the third terminal and the second terminal based on a first key pair, and the second channel is used for secure communication between the first terminal and the second terminal based on a second key pair; and via a third channel between the first terminal and the third terminal, the third terminal is configured to perform secure communication with the first terminal based on a third key pair, wherein the third key pair comprises the first public key and a first private key, and the first private key is used to decrypt the first transmission ciphertext.

[0006] According to another aspect of the present disclosure, a communication method is provided, comprising: in response to receiving a secure communication request instruction from a first terminal, sending a first public key to the first terminal via a first channel and a second channel in sequence, wherein the first public key is used to encrypt first transmission data to generate first transmission ciphertext, and the first transmission data is transmitted from the first terminal to the third terminal; the first channel is used for secure communication between the third terminal and the second terminal based on a first key pair, and the second channel is used for secure communication between the first terminal and the second terminal based on a second key pair; and via a third channel between the first terminal and the third terminal, performing secure communication between the first terminal and the third terminal based on a third key pair, wherein the third key pair comprises the first public key and a first private key, and the first private key is used to decrypt the first transmission ciphertext.

[0007] According to another aspect of the present disclosure, a communication method is provided, comprising: sending, via a second terminal, a secret communication request instruction to a third terminal; receiving, via a first channel and a second channel, a first public key from the third terminal, wherein the first public key is used to encrypt first transmission data to generate first transmission ciphertext, and the first transmission data is sent from a first terminal to the third terminal; the first channel is used for secret communication between the third terminal and the second terminal based on a first key pair, and the second channel is used for secret communication between the first terminal and the second terminal based on a second key pair; and performing, via a third channel between the first terminal and the third terminal, secret communication between the first terminal and the third terminal based on a third key pair, wherein the third key pair comprises the first public key and a first private key, and the first private key is used to decrypt the first transmission ciphertext.

[0008] According to another aspect of the present disclosure, a communication device is provided, comprising: a first sending module configured to send, in response to receiving a secret communication request instruction from a first terminal, a first public key to the first terminal via a first channel and a second channel in sequence, wherein the first public key is used to encrypt first transmission data to generate first transmission ciphertext, and the first transmission data is sent from the first terminal to a third terminal; the first channel is used for secret communication between the third terminal and the second terminal based on a first key pair, and the second channel is used for secret communication between the first terminal and the second terminal based on a second key pair; and a first communication module configured to perform, via a third channel between the first terminal and the third terminal, secret communication between the first terminal and the third terminal based on a third key pair, wherein the third key pair comprises the first public key and a first private key, and the first private key is used to decrypt the first transmission ciphertext.

[0009] According to another aspect of the present disclosure, a communication device is provided, comprising: a second sending module configured to send, via a second terminal, a secret communication request instruction to a third terminal; a second receiving module configured to receive, via a first channel and a second channel, a first public key from the third terminal, wherein the first public key is used to encrypt first transmission data to generate first transmission ciphertext, and the first transmission data is sent from a first terminal to the third terminal; the first channel is used for secret communication between the third terminal and the second terminal based on a first key pair, and the second channel is used for secret communication between the first terminal and the second terminal based on a second key pair; and a second communication module configured to perform, via a third channel between the first terminal and the third terminal, secret communication between the first terminal and the third terminal based on a third key pair, wherein the third key pair comprises the first public key and a first private key, and the first private key is used to decrypt the first transmission ciphertext.

[0010] According to another aspect of this disclosure, an electronic device is provided, comprising: at least one processor and a memory communicatively connected to the at least one processor. The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the methods of embodiments of this disclosure.

[0011] According to another aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions for causing a computer to perform the methods of embodiments of this disclosure.

[0012] According to another aspect of this disclosure, a computer program product is provided, including a computer program stored on at least one of a readable storage medium and an electronic device, wherein the computer program, when executed by a processor, implements the methods of embodiments of this disclosure.

[0013] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0014] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0015] Figure 1 A schematic diagram illustrating the system architecture of a communication system, communication method, and apparatus according to embodiments of the present disclosure is shown.

[0016] Figure 2 A schematic diagram of a communication system according to an embodiment of the present disclosure is shown.

[0017] Figure 3A A schematic diagram illustrating a first channel, a second channel, and a third channel of a communication system according to another embodiment of the present disclosure is shown.

[0018] Figure 3B A schematic diagram illustrating the creation of a third channel according to an embodiment of the present disclosure is shown.

[0019] Figure 3C A schematic diagram illustrating the creation of a third channel according to another embodiment of this disclosure is shown;

[0020] Figure 3D This schematic diagram illustrates the interaction between the first terminal and the third terminal via a third channel.

[0021] Figure 4 A flowchart illustrating a communication method according to an embodiment of the present disclosure is shown, the communication method being performed by a third terminal;

[0022] Figure 5 A flowchart illustrating a communication method according to yet another embodiment of the present disclosure is shown, the communication method being performed by a first terminal;

[0023] Figure 6 The block diagram schematically illustrates a communication device according to another embodiment of the present disclosure, which may be disposed on a third terminal;

[0024] Figure 7 A block diagram schematically illustrates a communication device according to yet another embodiment of the present disclosure, which may be disposed in a first terminal; and

[0025] Figure 8 A block diagram of an electronic device that can implement the communication method of embodiments of the present disclosure is shown schematically. Detailed Implementation

[0026] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0027] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0028] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0029] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0030] With the development of computer and communication technologies, ensuring information security during communication has become an urgent technical problem to be solved.

[0031] There is a situation where communication between the client and the target server goes through an intermediate server. This could lead to the data being intercepted by the intermediate server, resulting in information leakage.

[0032] For example, a client issues a task execution command to a target server. This command is transmitted to the target server via an intermediate server, which can provide services other than task execution, such as client management. Upon receiving the command, the target server executes the task. This client-to-intermediate-server, intermediate-server-to-target-server communication method is more efficient for task execution. However, the operation execution data related to the task is still transmitted between the client and the target server via the intermediate server, which may be intercepted by the intermediate server, resulting in lower security.

[0033] Figure 1 The illustration schematically depicts the system architecture of a communication system, communication method, and apparatus according to an embodiment of the present disclosure. It should be noted that... Figure 1 The examples shown are merely examples of system architectures that can be applied to the embodiments of this disclosure, in order to help those skilled in the art understand the technical content of this disclosure, but do not mean that the embodiments of this disclosure cannot be used in other devices, systems, environments or scenarios.

[0034] like Figure 1 As shown, the system architecture 100 according to this embodiment may include a first terminal 101, a second terminal 102, a third terminal 103, and a network 104. The network 104 is used as a medium to provide a communication link between clients 101, 102, 103 and server 105. The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0035] The first terminal 101 may include a client, such as various electronic devices with a display screen and web browsing support, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0036] The second terminal 102 and the third terminal 103 can be servers that provide various services, for example. The server can also be a cloud server, that is, a server with cloud computing capabilities.

[0037] It should be understood that Figure 1 The number of first terminals, second terminals, third terminals, and networks shown is merely illustrative. Depending on implementation needs, any number of first terminals, second terminals, third terminals, and networks can be included.

[0038] It should be noted that the collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0039] In the technical solution disclosed herein, the user's authorization or consent is obtained before acquiring or collecting the user's personal information.

[0040] Figure 2 A schematic diagram of a communication system according to an embodiment of the present disclosure is shown. The communication system according to an embodiment of the present disclosure may include, for example, a first terminal 201, a second terminal 202, and a third terminal 203.

[0041] The third terminal is used to respond to a confidential communication request instruction received from the first terminal by sending the first public key to the first terminal sequentially via the first channel and the second channel.

[0042] The first public key is used to encrypt the first transmitted data to generate the first transmitted ciphertext, the first transmitted data being sent from the first terminal to the third terminal; the first channel is used for secure communication between the third terminal and the second terminal based on the first key pair, and the second channel is used for secure communication between the first terminal and the second terminal based on the second key pair.

[0043] like Figure 2 As shown, for example, the first terminal 201 can send the confidential communication request instruction for the third terminal 203 sequentially along path a and path b to the third terminal 203.

[0044] like Figure 2 As shown, for example, the third terminal 203 may, in response to receiving a confidential communication request instruction from the first terminal 201, send the first public key to the first terminal 201 sequentially along path c and path d.

[0045] A channel can be understood as a data signal transmission path using wireless signals as the transmission carrier; it is the transmission medium between the transmitting end and the receiving end. The channels in this embodiment include a first channel, a second channel, and a third channel.

[0046] Taking the example of a first terminal sending a data signal to a third terminal via a second terminal, the first terminal may include a client, the second terminal may include an intermediate server, and the third terminal may include a target server.

[0047] The third terminal uses a third channel between the first terminal and the third terminal to conduct secure communication with the first terminal based on a third key.

[0048] The third key pair includes a first public key and a first private key, the first private key being used to decrypt the first transmitted ciphertext.

[0049] like Figure 2 As shown, for example, secure communication between the first terminal 201 and the third terminal 203 can be conducted via a third channel between the first terminal 201 and the third terminal 203 based on a third key pair, and the relevant data of the secure communication can be transmitted, for example, along path e and path f.

[0050] For example, Figure 2 The paths shown, a and d, can correspond to the second channel, b and c, for example, the first channel, and e and f, for example, the third channel.

[0051] It should be noted that, according to the communication method of this disclosure, for example, non-confidential communication data between any two terminals can be transmitted via... Figure 1 The corresponding terminals transmit data via network 104.

[0052] For example, the first terminal may also send a confidential communication request instruction for the third terminal to the third terminal via network 104.

[0053] For example, the first public key and the first private key may be generated at a third terminal. The third terminal may retain the first private key and send the first public key to the first terminal in sequence via the first channel and the second channel.

[0054] The first public key and the first private key are asymmetric keys for the third channel. This allows the third terminal to decrypt the first transmitted data sent from the first terminal to the third terminal using the first private key after the first public key encrypts it. The first transmitted data sent from the first terminal to the third terminal does not pass through the second terminal, so the second terminal cannot obtain the first transmitted data. Furthermore, the first transmitted data encrypted with the first public key can only be decrypted by the first private key, and only the third terminal has the first private key. This ensures the communication security of the first transmitted data from the first terminal to the third terminal.

[0055] According to the communication system of this disclosure, the data transmission between the first terminal and the third terminal is handled via a second terminal. However, the second terminal may intercept the transmitted data, threatening communication security. The third terminal, in response to a secure communication request instruction received from the first terminal, sends a first public key to the first terminal sequentially via a first channel and a second channel. Since the first channel is used for secure communication between the third terminal and the second terminal based on a first key pair, and the second channel is used for secure communication between the first terminal and the second terminal based on a second key pair, the first public key is used to encrypt the first transmitted data to generate first transmitted ciphertext. This ensures that the first public key is securely transmitted to the first terminal via the first and second channels. The first terminal can then encrypt the first transmitted data sent to the third terminal using the received first public key to obtain the first transmitted ciphertext. The third terminal can then decrypt the first transmitted ciphertext using its first private key to obtain the first transmitted plaintext. Therefore, secure communication between the first terminal and the third terminal can be achieved using the third channel.

[0056] Furthermore, the communication system of this embodiment, including the first terminal 201, the second terminal 202, and the third terminal 203, can achieve secure communication between any two terminals among the first, second, and third terminals within the system via the first channel, the second channel, and the third channel. That is, the terminal other than the two communicating ends will not obtain the communication data. Moreover, data such as the first public key transmitted via the first, second, and third channels will not be obtained by terminals outside the system, further ensuring communication security.

[0057] For example, the third key pair may also include a second public key and a second private key, wherein the second public key is used to encrypt the second transmitted data to generate a second transmitted ciphertext, the second transmitted data being sent from the third terminal to the first terminal, and the second private key is used to decrypt the second transmitted ciphertext.

[0058] For example, the second public key and the second private key may be generated at the first terminal, and the first terminal may retain the second private key and send the second public key to the third terminal via the third channel.

[0059] According to embodiments of this disclosure, the second public key can be securely transmitted to a third terminal via a third channel. The third terminal can encrypt the second transmitted data sent to the first terminal using the received second public key to obtain the second transmitted ciphertext. The first terminal can decrypt the second transmitted ciphertext using the second private key to obtain the second transmitted plaintext. Thus, secure communication between the third terminal and the first terminal can be achieved using the third channel.

[0060] According to another embodiment of the communication system disclosed herein, a first terminal is configured to send a target task execution instruction to a third terminal. The third terminal, in response to receiving the target task execution instruction from the first terminal, associates a first private key with the target task. The third terminal is also configured to execute the target task.

[0061] The operational data of the target task is transmitted securely between the third terminal and the first terminal via a third channel and based on a third key pair.

[0062] For example, the target task may be a task that requires the confidentiality of relevant operational data.

[0063] For example, the first terminal may be used to transmit target task execution instructions for the third terminal via... Figure 1 The network 104 shown can be sent to the third terminal, and can also be sent to the third terminal via the second channel and the first channel in sequence, and can also be sent to the third terminal via the third channel.

[0064] In some cases, the second terminal acts as an intermediary, providing services such as access for multiple first terminals. The execution instructions for the target task on the first terminal are actually directed to the third terminal; for example, the execution of the target task is completed on the third terminal. In distributed systems or cloud computing scenarios, each first terminal can use the third terminal to execute the target task. The second terminal can provide services such as managing the first terminals, thereby efficiently executing the target task and managing multiple first terminals.

[0065] According to the communication system of this disclosure, a first terminal sends a target task execution instruction to a third terminal, and the third terminal, in response to receiving the target task execution instruction from the first terminal, associates a first private key with the target task, so that the execution of the target task is contingent upon the first private key. Since only the third terminal possesses the first private key, the execution of the target task is limited to the third terminal, ensuring the security of the target task's execution.

[0066] For example, when the third terminal is used to associate the first private key with the target task, the third terminal can also be used to start the second terminal answering service. For example, when the first terminal can be used to send the target task execution instruction for the third terminal to the third terminal via the second channel and the first channel in sequence, the answering service can be used to receive access data for the third terminal from the first terminal using the second terminal.

[0067] For example, in a communication system according to another embodiment of this disclosure, the target task includes creating an isolated environment task. A third terminal is used to use a first private key as a startup parameter for creating the isolated environment task, so that the third terminal associates the first private key with the target task.

[0068] The Create Isolation Environment task is used to create the target isolation environment.

[0069] An isolated environment can be understood as an independent operating environment. In some cases, servers in a production environment need to deploy multiple different operating environments. By using isolated environments that are "isolated" from each other, issues such as incompatibility between different operating environments can be resolved.

[0070] According to the communication system of this disclosure embodiment, for the specific target task of creating an isolated environment, a third terminal is used to use the first private key as the start parameter for creating the isolated environment task, so that the third terminal associates the first private key with the target task. This means that when the task of creating the isolated environment is executed, the first private key is required as a prerequisite for starting and executing the task. Since only the third terminal has the first private key, the execution of the above-mentioned task of creating the isolated environment is limited to the third terminal, which can improve the execution security of the task of creating the isolated environment.

[0071] By way of example, in another embodiment of the communication system according to this disclosure, the first terminal is further configured to create a second channel according to a secure communication request instruction for a second terminal. The second terminal is further configured to create a first channel according to a secure communication request instruction for a third terminal. The first terminal is further configured to create a third channel according to a secure communication request instruction for a third terminal.

[0072] According to the communication method of this disclosure, when any terminal issues a secure communication request instruction to a terminal with which it interacts, a corresponding channel can be created, enabling the two interacting terminals to conduct secure communication through the corresponding channel, thereby improving communication security.

[0073] Figure 3A The diagram schematically illustrates the first channel (Channel-1), the second channel (Channel-2), and the third channel (Channel-3).

[0074] For example, a second channel, a first channel, and a third channel can be created sequentially.

[0075] Figure 3B A schematic diagram illustrating the creation of a third channel according to an embodiment of the present disclosure is shown. Figure 3C A schematic diagram illustrating the creation of a third channel according to another embodiment of this disclosure is shown.

[0076] like Figure 3A and Figure 3B As shown, a specific example of creating a third channel can be implemented using the following embodiments.

[0077] For example, the third terminal can pre-generate a first public key pub key-1 and a first private key pri key-1. The first terminal can pre-generate a second public key pub key-2 and a second private key pri key-2.

[0078] like Figure 3A As shown, the third terminal 303 can, for example, pre-send the first public key pub key-1 to the first terminal 301 via the first channel channel-1 and the second channel channel-2, so that the first terminal 301 can pre-obtain the first public key generated by the third terminal 303 for secure communication between the first terminal 301 and the third terminal 303. The first terminal 301 can, for example, pre-send the second public key pub key-2 to the third terminal 303. At this time, the first terminal has the first public key pub key-1 and the second private key pri key-2, and the third terminal has the first private key pri key-1 and the second public key pub key-2.

[0079] like Figure 3B As shown, in operation S341, the first terminal 301 uses the first public key pub key-1 to encrypt the verification data d1 and the second public key pub key-2 to obtain the verification ciphertext ci-1.

[0080] For example, operation S341 may further encrypt the verification data d1, the second public key pub key-2, and the signature sig-1 using the first public key pub key-1 at the first terminal 301 to obtain the verification ciphertext ci-1. The signature sig-1 may be obtained by encrypting the digest using the first public key pub key-1, and the digest may be obtained based on the verification data d1 and the second public key pub key-2. The digest may include the verification data d1 and the second public key pub key-2.

[0081] The ciphertext ci-1 can be sent to the third terminal 303.

[0082] In operation S342, the third terminal 303 uses the first private key pri key-1 to decrypt the verification ciphertext ci-1, obtaining the verification plaintext pla-1. This verification plaintext pla-1 includes the second public key pub key-2.

[0083] In operation S343, the third terminal 303 uses the first public key pub key-1 to perform security verification on the plaintext pla-1 and obtains the security verification result sr-1.

[0084] In operation S344, if the security verification result sr-1 indicates that the plaintext pla-1 is secure, the first terminal 301 determines the third channel Channel-3 based on the first private key pri key-1 and the first public key pub key-1.

[0085] The above operations can synchronously encrypt the verification data d1 sent to the third terminal 303 along with the encrypted verification data d1. The third terminal 303 can decrypt and perform security verification on the verification ciphertext ci-1 to determine whether the verification data d1 has been tampered with during the transmission from the first terminal 301 to the third terminal 303 (whether it has been tampered with is characterized by the security verification result sr-1), thus establishing a secure third channel.

[0086] Figure 3C The illustration shows a schematic diagram of creating a third channel according to another embodiment. Figure 3C The illustrated embodiment for creating a third channel also includes the aforementioned operations S341-S343. Figure 3B The illustrated embodiment uses a third terminal to decrypt and securely verify the verification ciphertext ci-1 sent from the first terminal to determine the third channel. Figure 3B The illustrated embodiment for creating a third channel differs from that shown. Figure 3C The illustrated embodiment for creating a third channel further includes a first terminal decrypting and securely verifying a verification ciphertext ci-2 sent from a third terminal to determine the third channel.

[0087] like Figure 3C As shown, the creation of a third channel according to another embodiment of this disclosure may also include the following operations.

[0088] In operation S345, if the security verification result sr-1 indicates that the plaintext pla-1 is secure, the third terminal 303 stores the second public key pub key-2 obtained from the first terminal 301. The second public key pub key-2 is obtained from the plaintext pla-1.

[0089] In operation S346, the third terminal 303 uses the second public key pub key-2 to encrypt the verification data d2, obtaining the verification ciphertext ci-2.

[0090] For example, operation S345 may also encrypt the verification data d2 and the signature sig-2 using the second public key pub key-2 at the third terminal 303 to obtain the verification ciphertext ci-2. The signature sig-2 may be obtained by encrypting the digest using the second public key pub key-1, and the digest may be obtained based on the verification data d2. The digest may include the verification data d2.

[0091] The ciphertext ci-2 can be sent to the first terminal 301.

[0092] During operation S347, the first terminal 301 uses the second private key prikey-2 to decrypt the verification ciphertext ci-2 to obtain the verification plaintext pla-2.

[0093] In operation S348, the first terminal 301 uses the second public key pub key-2 to perform security verification on the plaintext pla-2 and obtains the security verification result sr-2.

[0094] In operation S349, if the security verification result sr-2 indicates that the plaintext pla-2 is secure, the first terminal 301 determines the third channel Channel-3 based on the second private key pri key-2 and the second public key pub key-2.

[0095] like Figure 3D As shown, based on the first private key and the first public key, the determined third channel can be used to: encrypt the message data mes1 sent by the first terminal using the first public key at the first terminal, resulting in ciphertext mci-1, which can then be sent to the third terminal. The third terminal then decrypts the ciphertext mci-1 using the first private key to obtain the plaintext message mpla-1. This enables secure communication between the first and third terminals via the third channel. Alternatively, the ciphertext mci-1 can be obtained by encrypting the message data mes1 and the signature sig-3 using the first public key. The signature sig-3 may, for example, include the first public key. In this case, the third terminal uses the first public key to perform secure verification of the plaintext message mpla-1.

[0096] like Figure 3D As shown, the third channel can also be used to: encrypt the message data meg2 sent by the third terminal using the second public key at the third terminal, resulting in ciphertext mci-2, which can then be sent to the third terminal. The third terminal can then decrypt the ciphertext mci-2 using the second private key to obtain the plaintext message mpla-2. This enables secure communication from the third terminal to the first terminal via the third channel. The ciphertext mci-2 can also be obtained by encrypting the message data mes2 and the signature sig-4 using the second public key. The signature sig-4 may, for example, include the second public key. In this case, the first terminal uses the second public key to perform secure verification of the plaintext message mpla-2.

[0097] Similar to creating a third channel, it is possible to utilize... Figure 3BThe second and first channels are created in the same way as the third channel. When creating the second channel, the second terminal can pre-generate a third public key and a third private key. The first terminal can pre-generate a fourth public key and a fourth private key. When creating the first channel, the third terminal can pre-generate a fifth public key and a fifth private key, and the second terminal can pre-generate a sixth public key and a sixth private key.

[0098] like Figure 3A As shown, the second terminal 302 can, for example, send its third public key (pub key-3) to the first terminal 301 in advance, so that the first terminal 301 can obtain the third public key generated by the second terminal 302 for secure communication between the first terminal 301 and the second terminal 302. The first terminal 301 can, for example, send its fourth public key (pub key-4) to the second terminal 302 in advance. At this time, the first terminal has the third public key (pub key-3) and the fourth private key (pri key-4), and the second terminal has the third private key (pri key-3) and the fourth public key (pub key-4).

[0099] like Figure 3A As shown, the second key pair may include a third public key, a third private key, a fourth public key, and a fourth private key. The first key pair may include a fifth public key, a fifth private key, a sixth public key, and a sixth private key.

[0100] For example, referring to the embodiment of creating a third channel, a second channel and a first channel can be created using the same method as creating a third channel. The operations for creating a first channel and a second channel will not be described in detail here.

[0101] The communication method according to an embodiment of this disclosure may, for example, be derived by... Figure 1 The third terminal 103 shown is executed.

[0102] Figure 4 A flowchart illustrating a communication method according to an embodiment of the present disclosure is shown schematically.

[0103] like Figure 4 As shown, the communication method 400 of this embodiment may include, for example, operations S410 to S420.

[0104] In operation S410, in response to receiving a secure communication request instruction from the first terminal, the first public key is sent to the first terminal sequentially via the first channel and the second channel.

[0105] The first public key is used to encrypt the first transmitted data to generate the first transmitted ciphertext, which is sent from the first terminal to the third terminal. The first channel is used for secure communication between the third terminal and the second terminal based on the first key pair, and the second channel is used for secure communication between the first terminal and the second terminal based on the second key pair.

[0106] In operation S420, secure communication is conducted between the first terminal and the third terminal via a third channel based on a third key pair.

[0107] The third key pair includes a first public key and a first private key, the first private key being used to decrypt the first transmitted ciphertext.

[0108] For example, the third key pair also includes a second public key and a second private key.

[0109] The second public key is used to encrypt the second transmitted data to generate the second transmitted ciphertext, which is sent from the third terminal to the first terminal. The second private key is used to decrypt the second transmitted ciphertext.

[0110] It should be noted that the communication method according to the embodiments of this disclosure is executed by a third terminal. In the above embodiments of the communication system including a first terminal, a second terminal and a third terminal, the operation performed by the third terminal has been described in detail. The related technical principles and technical effects are the same as those in the above embodiments and will not be repeated here.

[0111] Exemplarily, the communication method according to another embodiment of this disclosure further includes: in response to receiving a target task execution instruction from a first terminal, associating a first private key with a target task; and executing the target task.

[0112] The operational data of the target task is transmitted securely between the third terminal and the first terminal via a third channel and based on a third key pair.

[0113] For example, in another embodiment of the communication method according to this disclosure, the target task includes creating an isolated environment task; for example, the following embodiment can be used to implement a specific example of associating a first private key with the target task: using the first private key as a startup parameter for creating an isolated environment task.

[0114] The Create Isolation Environment task is used to create the target isolation environment.

[0115] The communication method according to an embodiment of this disclosure may, for example, be derived by... Figure 1 The first terminal 101 shown is executed.

[0116] Figure 5 A flowchart illustrating a communication method according to an embodiment of the present disclosure is shown schematically.

[0117] like Figure 5 As shown, the communication method 500 of this embodiment may include, for example, operations S510 to S530.

[0118] When operating S510, a secure communication request command is sent from the second terminal to the third terminal.

[0119] During operation of S520, the first public key is received from the third terminal via the first channel and the second channel.

[0120] The first public key is used to encrypt the first transmitted data to generate the first transmitted ciphertext, the first transmitted data being sent from the first terminal to the third terminal; the first channel is used for secure communication between the third terminal and the second terminal based on the first key pair, and the second channel is used for secure communication between the first terminal and the second terminal based on the second key pair.

[0121] During operation S530, secure communication is conducted between the first terminal and the third terminal via a third channel based on a third key pair.

[0122] The third key pair includes a first public key and a first private key, the first private key being used to decrypt the first transmitted ciphertext.

[0123] It should be noted that the communication method according to the embodiments of this disclosure is executed by the first terminal. In the above embodiments executed by a communication system including the first terminal, the second terminal and the third terminal, the operation executed by the first terminal has been described in detail. The related technical principles and technical effects are the same as those in the above embodiments, and will not be repeated here.

[0124] For example, the communication method according to another embodiment of the present disclosure may further include: creating a target channel in response to receiving a confidential communication request instruction from a target terminal.

[0125] The target channel includes at least one of a second channel and a third channel. The target key pair includes at least one of a second key pair corresponding to the second channel and a third key pair corresponding to the third channel. A third terminal associated with the target channel and the target terminal conduct bidirectional secure communication based on the target key pair; the target terminal includes a second terminal corresponding to the second channel and a third terminal corresponding to the third channel.

[0126] It should be noted that creating a target channel includes creating at least one of a third channel and a second channel. The specific operations for creating a third channel have been described in detail in the above embodiments and will not be repeated here. The specific operations for creating a second channel can also refer to the embodiments for creating a third channel.

[0127] According to another embodiment of the communication method of this disclosure, a specific example of creating a target channel can be implemented using the following embodiment: Encrypting the interaction public key and first verification data using the target public key from the target terminal to obtain a first verification ciphertext. If the first security verification result indicates that the first verification plaintext is secure, a target channel based on the target public key and the target private key is determined.

[0128] The target key pair includes a target public key and a target private key. The target private key is used by the target terminal to decrypt and perform security verification on the received first verification ciphertext to obtain the first verification plaintext.

[0129] If the first verification data also includes a signature determined by the target public key, the target public key can also perform security verification (signature verification) on the first verification plaintext to obtain the first security verification result.

[0130] If the target channel includes a second channel, the second key pair includes an interactive public key and an interactive private key. If the target channel includes a third channel, the third key pair includes an interactive public key and an interactive private key.

[0131] It should be noted that when the target channel includes a third channel, the target public key is the first public key, the target private key is the first private key, the exchange public key is the second public key, and the exchange private key is the second private key. When the target channel includes a second channel, the target public key is the third public key, the target private key is the third public key, the exchange public key is the fourth public key, and the exchange private key is the fourth private key.

[0132] For example, according to another embodiment of the communication method of this disclosure, creating a target channel may further include: in response to receiving a second verification ciphertext from a target terminal, decrypting the second verification ciphertext using an interactive private key to obtain a second verification plaintext. In response to the target terminal's second security verification result for the second verification plaintext being secure, determining a target channel based on the interactive public key and the interactive private key.

[0133] The second verification ciphertext is obtained by the target terminal encrypting the second verification data using the shared public key.

[0134] The second security verification result is obtained by the target terminal using the interactive public key to verify the second verification plaintext.

[0135] For example, the second security verification result may be obtained by performing security verification (signature verification) on the second verification plaintext using the interaction public key, in the case where the second verification data also includes a signature determined by the interaction public key.

[0136] Figure 6 A block diagram of a communication device according to an embodiment of the present disclosure is shown schematically. This communication device can be located on a third terminal.

[0137] like Figure 6 As shown, the communication device 600 of this embodiment includes, for example, a first transmitting module 610 and a first communication module 620.

[0138] The first sending module 610 is configured to, in response to receiving a secure communication request instruction from the first terminal, send a first public key sequentially to the first terminal via a first channel and a second channel. The first public key is used to encrypt first transmitted data to generate first transmitted ciphertext, the first transmitted data being sent from the first terminal to the third terminal; the first channel is used for secure communication between the third terminal and the second terminal based on a first key pair, and the second channel is used for secure communication between the first terminal and the second terminal based on a second key pair.

[0139] The first communication module 620 is used to conduct secure communication between the first terminal and the third terminal via a third channel based on a third key pair. The third key pair includes a first public key and a first private key, the first private key being used to decrypt the first transmitted ciphertext.

[0140] For example, the communication device further includes: a first private key association module, which associates a first private key with a target task in response to receiving a target task execution instruction from a first terminal; and a target task execution module, which executes the target task, wherein the operation data of the target task is securely communicated between the third terminal and the first terminal through a third channel based on a third key pair.

[0141] For example, the target task includes a task to create an isolated environment; the first private key association module includes a first private key association submodule, which is used to use the first private key as a startup parameter for the task to create an isolated environment, wherein the task to create an isolated environment is used to create the target isolated environment.

[0142] For example, the third key pair also includes a second public key and a second private key, wherein the second public key is used to encrypt the second transmitted data to generate a second transmitted ciphertext, the second transmitted data being sent from the third terminal to the first terminal, and the second private key is used to decrypt the second transmitted ciphertext.

[0143] Figure 7 A block diagram of a communication device according to an embodiment of the present disclosure is shown schematically. This communication device may be located at a first terminal.

[0144] like Figure 7 As shown, the communication device 700 of this embodiment includes, for example, a second transmitting module 710, a second receiving module 720, and a second communication module 730.

[0145] The second sending module 710 is used to send a secure communication request instruction to the third terminal via the second terminal.

[0146] The second receiving module 720 is used to receive a first public key from a third terminal via a first channel and a second channel. The first public key is used to encrypt first transmitted data to generate a first transmitted ciphertext, the first transmitted data being sent from the first terminal to the third terminal; the first channel is used for secure communication between the third terminal and the second terminal based on a first key pair, and the second channel is used for secure communication between the first terminal and the second terminal based on a second key pair.

[0147] The second communication module 730 is used to conduct secure communication between the first terminal and the third terminal via a third channel based on a third key pair. The third key pair includes a first public key and a first private key, the first private key being used to decrypt the first transmitted ciphertext.

[0148] For example, the communication device further includes: a target channel creation module, configured to create a target channel in response to receiving a secure communication request instruction from a target terminal, wherein the target channel includes at least one of a second channel and a third channel; the target key pair includes at least one of a second key pair corresponding to the second channel and a third key pair corresponding to the third channel; and a third terminal associated with the target channel and the target terminal perform bidirectional secure communication based on the target key pair, wherein the target terminal includes a second terminal corresponding to the second channel and a third terminal corresponding to the third channel.

[0149] For example, the target channel creation module includes: a first verification ciphertext determination submodule and a target channel first determination submodule.

[0150] The first verification ciphertext determination submodule is used to encrypt the interactive public key and the first verification data using the target public key from the target terminal to obtain the first verification ciphertext. The target key pair includes a target public key and a target private key. The target private key is used by the target terminal to decrypt the received first verification ciphertext to obtain the first verification plaintext. The target public key is used by the target terminal to perform security verification on the first verification plaintext to obtain the first security verification result. If the target channel includes a second channel, the second key pair includes an interactive public key and an interactive private key. If the target channel includes a third channel, the third key pair includes an interactive public key and an interactive private key.

[0151] The first target channel determination submodule is used to determine the target channel based on the target public key and the target private key when the first security verification result indicates that the first verification plaintext is secure.

[0152] For example, the target channel creation module further includes: a second verification plaintext determination submodule and a target channel second determination submodule.

[0153] The second verification plaintext determination submodule is used to respond to receiving the second verification ciphertext from the target terminal, and to decrypt the second verification ciphertext using the interactive private key to obtain the second verification plaintext. The second verification ciphertext is obtained by the target terminal encrypting the second verification data using the interactive public key.

[0154] The second target channel determination submodule is used to determine the target channel based on the interactive public key and interactive private key in response to the target terminal's second security verification result for the second verification plaintext being secure. The second security verification result is obtained by the target terminal using the interactive public key to verify the second verification plaintext.

[0155] It should be understood that the embodiments of the apparatus portion of this disclosure correspond to the same or similar embodiments of the method portion of this disclosure, and the technical problems solved and the technical effects achieved are also the same or similar. This disclosure will not repeat them here.

[0156] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0157] Figure 8 A schematic block diagram of an example electronic device 800 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0158] like Figure 8 As shown, device 800 includes a computing unit 801, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 802 or a computer program loaded from storage unit 808 into random access memory (RAM) 803. RAM 803 may also store various programs and data required for the operation of device 800. The computing unit 801, ROM 802, and RAM 803 are interconnected via bus 804. Input / output (I / O) interface 805 is also connected to bus 804.

[0159] Multiple components in device 800 are connected to I / O interface 805, including: input unit 806, such as keyboard, mouse, etc.; output unit 807, such as various types of monitors, speakers, etc.; storage unit 808, such as disk, optical disk, etc.; and communication unit 809, such as network card, modem, wireless transceiver, etc. Communication unit 809 allows device 800 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0160] The computing unit 801 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as communication methods. For example, in some embodiments, the communication method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on device 800 via ROM 802 and / or communication unit 809. When the computer program is loaded into RAM 803 and executed by the computing unit 801, one or more steps of the communication method described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to perform the communication method by any other suitable means (e.g., by means of firmware).

[0161] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0162] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0163] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0164] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0165] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0166] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other.

[0167] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0168] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A communication system, comprising: First terminal, second terminal, and third terminal; The third terminal is used to respond to a secure communication request instruction received from the first terminal by sending a first public key to the first terminal sequentially via a first channel and a second channel. The first public key is used to encrypt first transmitted data to generate a first transmitted ciphertext, and the first transmitted data is sent from the first terminal to the third terminal. The first channel is used for secure communication between the third terminal and the second terminal based on a first key pair, and the second channel is used for secure communication between the first terminal and the second terminal based on a second key pair. The third terminal is further configured to decrypt and perform security verification on the verification ciphertext sent from the first terminal to determine a third channel between the first terminal and the third terminal, wherein the transmission of the verification ciphertext does not pass through the second terminal. The third terminal is also used to conduct secure communication with the first terminal via a third channel between the first terminal and the third terminal, based on a third key pair, wherein the third key pair includes the first public key and the first private key, and the first private key is used to decrypt the first transmitted ciphertext. The first terminal is used to send the target task execution instruction for the third terminal to the third terminal; The third terminal is further configured to, in response to receiving a target task execution instruction from the first terminal, associate the first private key with the target task and execute the target task, wherein the operation data of the target task is securely communicated between the third terminal and the first terminal through the third channel based on the third key pair.

2. The system according to claim 1, wherein, The target task includes creating an isolation environment task; the third terminal is used to use the first private key as the start parameter of the creating isolation environment task, so that the third terminal associates the first private key with the target task, wherein the creating isolation environment task is used to create a target isolation environment.

3. The system according to claim 1 or 2, wherein, The third key pair further includes a second public key and a second private key, wherein the second public key is used to encrypt the second transmitted data to generate a second transmitted ciphertext, the second transmitted data being sent from the third terminal to the first terminal, and the second private key is used to decrypt the second transmitted ciphertext.

4. The system according to claim 1 or 2, wherein, The first terminal is further configured to create the second channel according to a secure communication request instruction for the second terminal; The second terminal is further configured to create the first channel according to a secure communication request instruction for the third terminal; The first terminal is further configured to create the third channel according to a confidential communication request instruction for the third terminal.

5. A communication method, comprising: In response to receiving a secure communication request instruction from a first terminal, a first public key is sequentially sent to the first terminal via a first channel and a second channel. The first public key is used to encrypt first transmitted data to generate a first transmitted ciphertext. The first transmitted data is sent from the first terminal to a third terminal. The first channel is used for secure communication between the third terminal and the second terminal based on a first key pair, and the second channel is used for secure communication between the first terminal and the second terminal based on a second key pair. The verification ciphertext sent from the first terminal is decrypted and securely verified to determine a third channel between the first terminal and the third terminal, wherein the transmission of the verification ciphertext does not pass through the second terminal; Secure communication is conducted between the first terminal and the third terminal via a third channel and based on a third key pair, wherein the third key pair includes a first public key and a first private key, and the first private key is used to decrypt the first transmitted ciphertext. In response to receiving a target task execution instruction from the first terminal, the first private key is associated with the target task; The target task is executed, wherein the operation data of the target task is securely communicated between the third terminal and the first terminal via the third channel based on the third key pair.

6. The method according to claim 5, wherein, The target task includes creating an isolated environment; associating the first private key with the target task includes: The first private key is used as the startup parameter for the task of creating an isolated environment, wherein the task of creating an isolated environment is used to create the target isolated environment.

7. The method according to claim 5 or 6, wherein, The third key pair further includes a second public key and a second private key, wherein the second public key is used to encrypt the second transmitted data to generate a second transmitted ciphertext, the second transmitted data being sent from the third terminal to the first terminal, and the second private key is used to decrypt the second transmitted ciphertext.

8. A communication method, comprising: Send a secure communication request command to the third terminal via the second terminal; The system receives a first public key from the third terminal via a first channel and a second channel. The first public key is used to encrypt first transmitted data to generate a first transmitted ciphertext. The first transmitted data is sent from the first terminal to the third terminal. The first channel is used for secure communication between the third terminal and the second terminal based on a first key pair. The second channel is used for secure communication between the first terminal and the second terminal based on a second key pair. The verification ciphertext is sent to the third terminal, and a third channel between the first terminal and the third terminal is determined based on the decryption and security verification results of the verification ciphertext by the third terminal, wherein the transmission of the verification ciphertext does not pass through the second terminal. Secure communication is conducted between the first terminal and the third terminal via a third channel and based on a third key pair, wherein the third key pair includes a first public key and a first private key, and the first private key is used to decrypt the first transmitted ciphertext. The task execution instruction for the third terminal is sent to the third terminal so that the third terminal associates the first private key with the target task and executes the target task. The operation data of the target task is communicated securely between the third terminal and the first terminal through the third channel based on the third key pair.

9. The method according to claim 8, further comprising: In response to receiving a secure communication request instruction from a target terminal, a target channel is created, wherein the target channel includes at least one of the second channel and the third channel; a target key pair includes at least one of the second key pair corresponding to the second channel and the third key pair corresponding to the third channel; a third terminal associated with the target channel and the target terminal perform bidirectional secure communication based on the target key pair, wherein the target terminal includes the second terminal corresponding to the second channel and the third terminal corresponding to the third channel.

10. The method according to claim 9, wherein, The creation of the target channel includes: The target public key from the target terminal is used to encrypt the interactive public key and the first verification data to obtain the first verification ciphertext. The target key pair includes the target public key and the target private key. The target private key is used by the target terminal to decrypt the received first verification ciphertext to obtain the first verification plaintext. The target public key is used by the target terminal to perform security verification on the first verification plaintext to obtain the first security verification result. Where the target channel includes the second channel, the second key pair includes the interactive public key and the interactive private key; where the target channel includes the third channel, the third key pair includes the interactive public key and the interactive private key. If the first security verification result indicates that the first verification plaintext is secure, the target channel is determined based on the target public key and the target private key.

11. The method according to claim 10, wherein, The creation of the target channel also includes: In response to receiving a second verification ciphertext from the target terminal, the second verification ciphertext is decrypted using the interactive private key to obtain a second verification plaintext, wherein the second verification ciphertext is obtained by the target terminal encrypting the second verification data using the interactive public key; and In response to the target terminal's second security verification result for the second verification plaintext being secure, the target channel based on the interactive public key and the interactive private key is determined, wherein the second security verification result is obtained by the target terminal using the interactive public key to verify the second verification plaintext.

12. A communication device, comprising: A first sending module is configured to, in response to receiving a secure communication request instruction from a first terminal, send a first public key sequentially to the first terminal via a first channel and a second channel, wherein the first public key is used to encrypt first transmitted data to generate a first transmitted ciphertext, and the first transmitted data is sent from the first terminal to a third terminal; the first channel is used for secure communication between the third terminal and the second terminal based on a first key pair, and the second channel is used for secure communication between the first terminal and the second terminal based on a second key pair. A channel determination module is used to decrypt and perform security verification on the verification ciphertext sent from the first terminal to determine a third channel between the first terminal and the third terminal, wherein the transmission of the verification ciphertext does not pass through the second terminal; A first communication module is configured to conduct secure communication between the first terminal and the third terminal via a third channel between the first terminal and the third terminal based on a third key pair, wherein the third key pair includes a first public key and a first private key, and the first private key is used to decrypt the first transmitted ciphertext. The first private key association module, in response to receiving a target task execution instruction from the first terminal, associates the first private key with the target task; and The target task execution module executes the target task, wherein the operation data of the target task is securely communicated between the third terminal and the first terminal through the third channel based on the third key pair.

13. The apparatus according to claim 12, wherein, The target task includes creating an isolated environment; the first private key association module includes: The first private key association submodule is used to use the first private key as the startup parameter of the task to create an isolated environment, wherein the task to create an isolated environment is used to create a target isolated environment.

14. The apparatus according to claim 12 or 13, wherein, The third key pair further includes a second public key and a second private key, wherein the second public key is used to encrypt the second transmitted data to generate a second transmitted ciphertext, the second transmitted data being sent from the third terminal to the first terminal, and the second private key is used to decrypt the second transmitted ciphertext.

15. A communication device, comprising: The second sending module is used to send a secure communication request instruction to the third terminal via the second terminal; The second receiving module is used to receive a first public key from the third terminal via a first channel and a second channel, wherein the first public key is used to encrypt the first transmitted data to generate a first transmitted ciphertext, and the first transmitted data is sent from the first terminal to the third terminal; the first channel is used for secure communication between the third terminal and the second terminal based on a first key pair, and the second channel is used for secure communication between the first terminal and the second terminal based on a second key pair. The target channel creation module is used to send the verification ciphertext to the third terminal and determine the third channel between the first terminal and the third terminal based on the decryption and security verification results of the verification ciphertext by the third terminal, wherein the transmission of the verification ciphertext does not pass through the second terminal. The second communication module is used to conduct secure communication between the first terminal and the third terminal via a third channel between the first terminal and the third terminal based on a third key pair, wherein the third key pair includes a first public key and a first private key, and the first private key is used to decrypt the first transmitted ciphertext. The task instruction sending module is used to send a task execution instruction for a third terminal to the third terminal, so that the third terminal associates the first private key with the target task and executes the target task, wherein the operation data of the target task is securely communicated between the third terminal and the first terminal through the third channel based on the third key pair.

16. The apparatus according to claim 15, The target channel creation module is also used to create a target channel in response to a confidential communication request instruction received from the target terminal, wherein... The target channel includes at least one of the second channel and the third channel; the target key pair includes at least one of the second key pair corresponding to the second channel and the third key pair corresponding to the third channel; the third terminal associated with the target channel and the target terminal perform bidirectional secure communication based on the target key pair, and the target terminal includes the second terminal corresponding to the second channel and the third terminal corresponding to the third channel.

17. The apparatus according to claim 16, wherein, The target channel creation module includes: The first verification ciphertext determination submodule is used to encrypt the interaction public key and the first verification data using the target public key from the target terminal to obtain the first verification ciphertext. The target key pair includes the target public key and the target private key. The target private key is used by the target terminal to decrypt the received first verification ciphertext to obtain the first verification plaintext. The target public key is used by the target terminal to perform security verification on the first verification plaintext to obtain a first security verification result. Where the target channel includes the second channel, the second key pair includes the interaction public key and the interaction private key; where the target channel includes the third channel, the third key pair includes the interaction public key and the interaction private key. The first target channel determination submodule is used to determine the target channel based on the target public key and the target private key, provided that the first security verification result indicates that the first verification plaintext is secure.

18. The apparatus according to claim 17, wherein, The target channel creation module also includes: The second verification plaintext determination submodule is configured to, in response to receiving a second verification ciphertext from the target terminal, decrypt the second verification ciphertext using the interactive private key to obtain the second verification plaintext, wherein the second verification ciphertext is obtained by the target terminal encrypting the second verification data using the interactive public key; and The second target channel determination submodule is configured to determine the target channel based on the interaction public key and the interaction private key in response to the second security verification result of the target terminal for the second verification plaintext being secure, wherein the second security verification result is obtained by the target terminal using the interaction public key to verify the second verification plaintext.

19. An electronic device comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the method of any one of claims 5-7 or 8-11.

20. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 5-7 or 8-11.

21. A computer program product comprising a computer program stored on at least one of a readable storage medium and an electronic device, wherein the computer program, when executed by a processor, implements the method according to any one of claims 5-7 or 8-11.

Images