Conference data transmission method, device, system, electronic equipment and readable medium

Abstract

The present disclosure provides a conference data transmission method, device, system, electronic equipment and readable medium, which belongs to the technical field of computers and can solve the problem of existing illegal device intrusion. The conference data transmission method of the present disclosure comprises: receiving unencrypted first conference data sent by a conference transmission device in the case that the identity authentication of a conference participant is passed; obtaining a conference key corresponding to the first conference data, encrypting the first conference data through the conference key to obtain encrypted second conference data; and sending the encrypted second conference data to the conference transmission device, so that the conference transmission device provides the encrypted second conference data to a conference client through a cloud platform. The present disclosure can improve the security of conference data transmission and avoid the problem of data transmission being cracked.

Description

Technical Field

[0001] This disclosure belongs to the field of computer technology, and specifically relates to a method, apparatus, system, electronic device, and readable medium for transmitting conference data. Background Technology

[0002] With the development of internet technology, more and more meetings are being held online. Participants in online meetings can access the internet using mobile phones, computers, and other devices, and communicate via data transmission. For example, many software programs with chat or online meeting functions can be used to initiate online meetings.

[0003] However, traditional online meetings typically transmit content in plaintext, making them vulnerable to attacks and prone to data leakage. Therefore, traditional meeting transmission equipment can only meet the needs of regular meetings and is unsuitable for more important meetings requiring higher security. Summary of the Invention

[0004] This disclosure aims to provide a method, apparatus, system, electronic device, and readable medium for transmitting conference data.

[0005] The first aspect of this disclosure provides a method for transmitting conference data, applied to a security enhancement module, comprising: Once the participant's identity is verified, the system receives the first unencrypted meeting data sent by the conference transmission device. Obtain the meeting key corresponding to the first meeting data, and encrypt the first meeting data using the meeting key to obtain the encrypted second meeting data; The encrypted second meeting data is sent to the meeting transmission device, so that the meeting transmission device can provide the encrypted second meeting data to the meeting client through the cloud platform.

[0006] In one optional implementation, obtaining the conference key corresponding to the first conference data and encrypting the first conference data using the conference key to obtain encrypted second conference data includes: Generate a meeting key corresponding to the first meeting data, and encrypt the first meeting data using the meeting key; The conference key is encrypted using a security key provided by the cloud platform to obtain a ciphertext key; The second meeting data is obtained based on the encrypted first meeting data and the ciphertext key.

[0007] In one optional implementation, the conference key is calculated by the security enhancement module based on module information; or, the conference key is determined by the security enhancement module based on the data type of the first conference data.

[0008] In one optional implementation, before encrypting the conference key using a security key provided by the cloud platform, the method further includes: The cloud platform receives the security key returned in response to the key negotiation request sent by the conference transmission device; wherein the security key is generated based on the device service type and / or device authentication type of the conference transmission device.

[0009] In one optional implementation, receiving the security key returned by the cloud platform in response to the key negotiation request sent by the conference transmission device includes: The system receives a first key obtained by encrypting the security key using the platform's private key; and decrypts the first key using the platform's public key obtained in advance to obtain the security key.

[0010] In one optional implementation, the authentication of the meeting participants includes: Receive identity verification data sent by the conference transmission device; The identity recognition data is matched with the security verification data pre-stored in the security enhancement module, and the identity recognition result corresponding to the identity recognition data is determined based on the matching result; The identity verification result is sent to the conference transmission device so that the conference transmission device can verify the identity of the participants based on the identity verification result.

[0011] In one optional implementation, before receiving the identity verification data sent by the conference transmission device, the method further includes: receiving and storing the security verification data from the host computer; wherein the security verification data from the host computer is in encrypted form. The step of matching the identity recognition data with the security verification data pre-stored in the security enhancement module includes: The encrypted security verification data is decrypted using a verification key to obtain plaintext security verification data; the identity verification data is then matched with the plaintext security verification data.

[0012] In one optional implementation, the identification data sent by the conference transmission device includes at least one of the following: device-collected data used to identify the participants; The security verification data includes: characteristic data of registered members and identification information of registered members; The identity recognition result corresponding to the identity recognition data includes: the identification information of the attendee; wherein, the data collected by the device includes at least one of the following: facial image data, iris image data, fingerprint data, and password data; the identification information includes: name, unique identifier, and brief introduction information.

[0013] In one alternative implementation, prior to the authentication of the meeting participants, the following steps are also included: Receive and store the platform certificate generated by the cloud platform in response to the device registration request; In response to the authentication command sent by the conference transmission device, auxiliary verification data is added to the platform certificate to obtain a module certificate. The module certificate is then sent to the conference transmission device so that the conference transmission device can provide the module certificate to the cloud platform for device authentication. If the device authentication is successful, the identity verification of the participants is performed.

[0014] In one optional implementation, the security enhancement module communicates with the conference transmission device via a preset application programming interface (API); wherein the preset API is provided by a software development kit (SDK) corresponding to the security enhancement module.

[0015] A second aspect of this disclosure provides a method for transmitting conference data, applied to a conference transmission device, comprising: Once the participants' identities are verified, the unencrypted initial meeting data is sent to the security enhancement module. The security enhancement module receives encrypted second conference data obtained by encrypting the first conference data using the acquired conference key. The encrypted second meeting data is sent to the cloud platform so that the cloud platform can provide the second meeting data to the meeting client.

[0016] In one optional implementation, the conference key is generated by the security enhancement module, and the second conference data further includes: a ciphertext key obtained by encrypting the conference key with a security key provided by the cloud platform.

[0017] In one optional implementation, before receiving the encrypted second conference data obtained by the security enhancement module encrypting the first conference data using the acquired conference key, the method further includes: Send a key negotiation request to the cloud platform; Based on the results returned by the cloud platform, the security key from the cloud platform is provided to the security enhancement module; wherein the security key is generated according to the device service type and / or device authentication type of the conference transmission device.

[0018] In one alternative implementation, providing the security key from the cloud platform to the security enhancement module includes: The cloud platform encrypts the security key using its private key to obtain a first key, which is then sent to the security enhancement module. The security enhancement module then decrypts the first key using the pre-obtained platform public key to obtain the security key.

[0019] In one alternative implementation, before sending the unencrypted first meeting data to the security enhancement module, the method further includes: The acquired identity verification data is sent to the security enhancement module; Receive the identity recognition result returned by the security enhancement module after matching the identity recognition data with the pre-stored security verification data; The identity recognition result is matched with the personnel identity information contained in the participant configuration request received from the cloud platform, and the identity of the participant is verified based on the matching result.

[0020] In one alternative implementation, prior to the authentication of the meeting participants, the following steps are also included: Send a device registration request to the cloud platform so that the security enhancement module receives and stores the platform certificate generated by the cloud platform in response to the device registration request; Send an authentication command to the security enhancement module so that the security enhancement module can add auxiliary verification data to the platform certificate to obtain the module certificate; The received module certificate from the security enhancement module is sent to the cloud platform for device authentication.

[0021] In one optional implementation, the conference transmission device communicates with the cloud platform via a first communication protocol, and the conference transmission device communicates with the security enhancement module via a second communication protocol; wherein the first communication protocol includes the MQTT protocol, and the second communication protocol includes the USB protocol.

[0022] A third aspect of this disclosure provides a method for transmitting conference data, applied to a conference client, comprising: The system retrieves encrypted second conference data from the conference transmission device via a cloud platform; wherein the second conference data is obtained by encrypting the first conference data provided by the conference transmission device using a conference key by a security enhancement module. Obtain the conference key, and use the conference key to decrypt the second conference data to obtain the unencrypted first conference data.

[0023] In one optional implementation, obtaining the conference key includes: Obtain the ciphertext key contained in the second meeting data; wherein, the ciphertext key is obtained by encrypting the meeting key with the security key provided by the cloud platform; The conference key is obtained by decrypting the ciphertext key using the security key provided by the cloud platform.

[0024] A fourth aspect of this disclosure provides a conference data transmission apparatus, comprising: The receiving module is configured to receive unencrypted first conference data sent by the conference transmission device after the participant's authentication is successful; The encryption module is configured to acquire a conference key corresponding to the first conference data, and encrypt the first conference data using the conference key to obtain encrypted second conference data. The sending module is configured to send the encrypted second conference data to the conference transmission device, so that the conference transmission device can provide the encrypted second conference data to the conference client through the cloud platform.

[0025] The fifth aspect of this disclosure provides a conference data transmission apparatus, comprising: The first sending module is configured to send unencrypted first meeting data to the security enhancement module after the participant's authentication is successful; The receiving module is configured to receive encrypted second conference data obtained by the security enhancement module after encrypting the first conference data with the obtained conference key; The second sending module is configured to send the encrypted second meeting data to the cloud platform, so that the cloud platform can provide the second meeting data to the meeting client.

[0026] The sixth aspect of this disclosure provides a conference client, which includes: The acquisition module is configured to acquire encrypted second conference data from the conference transmission device from the cloud platform; wherein the second conference data is obtained by the security enhancement module encrypting the first conference data provided by the conference transmission device using a conference key; The decryption module is configured to obtain the conference key and decrypt the second conference data using the conference key to obtain the unencrypted first conference data.

[0027] The seventh aspect of this disclosure provides a conference transmission system, comprising: The fifth aspect is the data transmission device, the sixth aspect is the data transmission device, the seventh aspect is the conference client and the cloud platform.

[0028] The eighth aspect of this disclosure provides an electronic device, comprising: One or more processors; A memory having stored one or more programs that, when executed by one or more processors, cause the one or more processors to perform the method described in any of the preceding descriptions; One or more I / O interfaces are connected between the processor and the memory and configured to enable information interaction between the processor and the memory.

[0029] The ninth aspect of this disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any of the preceding claims. Attached Figure Description

[0030] Figure 1 A flowchart illustrating a method for transmitting conference data applied to a security enhancement module, as provided in an embodiment of this disclosure; Figure 2 A flowchart illustrating a method for transmitting conference data in a conference transmission device, as provided in this embodiment of the disclosure; Figure 3 A flowchart illustrating a method for transmitting conference data in a conference client, as provided in an embodiment of this disclosure; Figure 4 A flowchart illustrating the device authentication process applied to a security enhancement module, a conference transmission device, and a cloud platform, as provided in this embodiment of the disclosure; Figure 5 This diagram illustrates the specific process of authentication and data transmission during the conference. Figure 6 A structural diagram of a conference transmission device provided in one embodiment of this disclosure; Figure 7 A structural diagram of a conference transmission device provided in another embodiment of this disclosure; Figure 8 A structural diagram of the meeting client provided in this embodiment of the disclosure; Figure 9 A structural diagram of a conference transmission system provided in an embodiment of this disclosure; Figure 10 This disclosure provides a schematic block diagram of an electronic device according to an embodiment. Detailed Implementation

[0031] To enable those skilled in the art to better understand the technical solutions of this disclosure, the disclosure will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0032] Unless otherwise defined, the technical or scientific terms used in this disclosure shall have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms “first,” “second,” and similar terms used in this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Similarly, the terms “an,” “a,” or “the,” and similar terms do not indicate a quantity limitation, but rather indicate the presence of at least one. The terms “including,” “comprising,” or “containing,” and similar terms mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. The terms “connected,” “linked,” or similar terms are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The terms “upper,” “lower,” “left,” and “right,” etc., are used only to indicate relative positional relationships, and these relative positional relationships may change accordingly when the absolute position of the described objects changes.

[0033] In a first aspect, the present disclosure provides a method for transmitting conference data, which improves the reliability of conference data transmission through a security enhancement module and avoids data leakage caused by attacks on conference transmission equipment.

[0034] like Figure 1 As shown, the conference data transmission method provided in this embodiment can be applied to a security enhancement module. The security enhancement module can be connected to the conference transmission device via a plug-in connection, and the conference transmission device communicates with the cloud platform. The method includes: Step S110: After the participant's authentication is successful, receive the unencrypted first meeting data sent by the conference transmission device.

[0035] In this embodiment, the execution entity can be a security enhancement module. This security enhancement module is capable of communicating with the conference transmission device.

[0036] To enhance security and prevent unauthorized access to the meeting, the identities of participants must be verified beforehand. The meeting should begin only after successful verification, and meeting data should be transmitted over the network. This disclosure does not limit the specific implementation of identity verification, as long as it ensures the legitimacy of the participants' identities.

[0037] The conference transmission device acquires unencrypted initial conference data after the conference starts. This unencrypted initial conference data is generated based on the conference content. The conference transmission device then sends this initial conference data to the security enhancement module. Correspondingly, the security enhancement module receives the unencrypted initial conference data sent by the conference transmission device.

[0038] Step S120: Obtain the meeting key corresponding to the first meeting data, and encrypt the first meeting data using the meeting key to obtain the encrypted second meeting data.

[0039] To enhance security, plaintext data is not transmitted directly during transmission; instead, encrypted ciphertext data is transmitted. The conference key can be obtained in various ways. For example, it can be pre-obtained from a cloud platform. Alternatively, the conference key can be generated by the security enhancement module and provided to the cloud platform. In short, regardless of the generation method, the core of this disclosure is that the conference key is stored internally within the security enhancement module and cannot be accessed by external conference transmission devices, thus improving security.

[0040] Step S130: Send the encrypted second meeting data to the meeting transmission device so that the meeting transmission device can provide the encrypted second meeting data to the meeting client through the cloud platform.

[0041] The security enhancement module sends the encrypted second meeting data to the meeting transmission device, which then provides the second meeting data to the cloud platform, and the cloud platform provides it to the meeting client.

[0042] This demonstrates that the security enhancement module can encrypt meeting data. Since the encryption and decryption processes are completed within the security enhancement module, security is improved and the risk of data leakage is avoided.

[0043] like Figure 2 As shown, the conference data transmission method provided in this disclosure can be applied to conference transmission equipment. The method includes: Step S210: After the participants have been successfully authenticated, send the unencrypted first meeting data to the security enhancement module.

[0044] In this embodiment, the executing entity can be a conference transmission device. After the conference starts, the conference transmission device acquires unencrypted first conference data. This unencrypted first conference data is generated based on the conference content. Furthermore, the conference transmission device sends the first conference data to the security enhancement module.

[0045] Step S220: Receive the encrypted second conference data obtained by the security enhancement module after encrypting the first conference data using the acquired conference key.

[0046] Step S230: Send the encrypted second meeting data to the cloud platform so that the cloud platform can provide the second meeting data to the meeting client.

[0047] The cloud platform is used to provide the received second meeting data to the meeting client for download.

[0048] This method enhances data transmission security through multi-terminal interaction involving security enhancement modules, conference transmission equipment, cloud platforms, and conference clients.

[0049] like Figure 3 As shown, the conference data transmission method provided in this disclosure can be applied to a conference client. The method includes: Step S310: Obtain encrypted second conference data from the conference transmission device from the cloud platform; wherein the second conference data is obtained by the security enhancement module encrypting the first conference data provided by the conference transmission device using the conference key.

[0050] In this embodiment, the executing entity can be a conference client. The conference client can be various types of communication terminals such as mobile terminals and tablets. The conference client can obtain second conference data through various methods such as download links and shared QR codes; this disclosure does not limit the specific method of obtaining the second conference data.

[0051] Step S320: Obtain the conference key, and use the conference key to decrypt the second conference data to obtain the unencrypted first conference data.

[0052] The conference key can be obtained in various ways, such as by a cloud platform. Correspondingly, the conference key can be used to decrypt the second conference data to obtain the original first conference data.

[0053] This method uses encryption and decryption processing by a security enhancement module to enable the conference client to directly download the second conference data in encrypted form, avoiding the risk of malicious interception or tampering during data transmission. Furthermore, the conference client can convert the encrypted conference data into plaintext format based on the conference key, enabling the sharing of conference content.

[0054] like Figure 4 As shown in the embodiments of this disclosure, the method for transmitting conference data is used to realize data interaction between a cloud platform, a conference transmission device, a security enhancement module, and a conference client. Figure 4 The purpose is to illustrate the authentication interaction process between multiple devices.

[0055] The conference transmission equipment is used to acquire conference data and upload it to the cloud. Typically, this equipment is located within the conference venue to facilitate real-time capture of conference images and other data. Since conference transmission equipment is an external device relative to the cloud platform, there are numerous models and diverse sources of these devices. Therefore, performing security checks on each individual device would be extremely time-consuming and prone to security vulnerabilities due to missed checks. Thus, in this embodiment, conference transmission equipment is characterized by its wide range of sources and the difficulty of security checks. To facilitate convenient, quick, secure, and efficient security verification of conference transmission equipment, a security enhancement module is included in this embodiment. This module implements the encryption and decryption process for sensitive data, ensuring that sensitive data is not leaked and improving communication security in scenarios where the conference transmission equipment is untrusted.

[0056] This security enhancement module can communicate with the conference transmission device in various ways. For example, it can connect to the device via wired or wireless means. In one alternative implementation, to improve the flexibility of the security enhancement module's configuration, it can be plugged into the conference transmission device for mutual communication. For example, in one implementation, the security enhancement module can connect to the device via a USB interface, or via an internal data bus, such as PICE / LVDS / I2C / UART. In another implementation, the security enhancement module can be inserted into the conference transmission device as a security chip (FPGA), thereby connecting to the SOC (System on Chip) via an internal data bus to communicate with the device. In short, this disclosure does not limit the specific access method of the security enhancement module, as long as it achieves flexible and convenient communication with the conference transmission device.

[0057] Therefore, the security enhancement module can replace the conference transmission device to perform data encryption / decryption and data verification, thereby improving security. Optionally, to prevent untrusted devices from accessing the cloud platform, in this embodiment, device registration and authentication are performed before conference data transmission. Only after successful device authentication is the identity of the participants verified, and conference data is transmitted only after the participants' identities are verified. Figure 4 As shown, the method includes the following steps: I. Equipment Registration Process: Step S1: The conference transmission device sends a device registration request to the cloud platform.

[0058] The device registration request is used to register the relevant information of the conference transmission device on the cloud platform. During the registration process, the cloud platform records not only the device information but also the module information of the security enhancement module associated with that device. Correspondingly, in the subsequent device authentication process, the legitimacy of both the conference transmission device and the security enhancement module is verified to ensure trusted access.

[0059] In the first application scenario, security enhancement modules are pre-assigned to conference transmission devices. Accordingly, the device registration request sent by the conference transmission device includes: module information of the security enhancement module and device information of the conference transmission device. The module information of the security enhancement module uniquely identifies each module; for example, it could be an ID identifier. The device information of the conference transmission device describes its characteristics, including, for example, device service type and / or device authentication type. The device service type describes the type of service offered by the conference transmission device (i.e., conference type, such as internal conference, external conference, etc.). The device authentication type describes the authentication method, which can be set by the device's security level. This method is determined by the device registration request sent by the conference transmission device. Therefore, the correspondence between the conference transmission device and the security enhancement module can be flexibly adjusted, facilitating flexible pairing between them and offering high flexibility.

[0060] In the second application scenario, the security enhancement module is not pre-assigned to the conference transmission device. Instead, after the cloud platform receives the device registration request, it assigns the corresponding security enhancement module to the conference transmission device. In this case, the device registration request sent by the conference transmission device includes the device information of the conference transmission device, but does not include the module information of the security enhancement module. This method directly assigns the security enhancement module by the cloud platform; therefore, the correspondence between the security enhancement module and the conference transmission device is set by the cloud platform and cannot be arbitrarily changed later, resulting in a high level of security.

[0061] In practice, at least one of the two methods mentioned above can be flexibly selected based on the specific characteristics of the meeting.

[0062] Step S2: The cloud platform generates a platform certificate based on the received device registration request.

[0063] Specifically, the cloud platform obtains module information of the security enhancement module and device information of the conference transmission device from the device registration request, and generates a platform certificate based on these information. Optionally, when generating the platform certificate, the module information of the security enhancement module and the device information of the conference transmission device are further encrypted to obtain a ciphertext platform certificate.

[0064] In the first application scenario described above, the cloud platform parses the device registration request, obtaining the module information of the security enhancement module and the device information of the conference transmission device. Using the platform certificate key (e.g., key A), it performs an encryption operation on the module information of the security enhancement module and the device information of the conference transmission device, and obtains the platform certificate based on the encryption result. To improve encryption efficiency, this encryption operation can be a symmetric encryption operation, such as using the AES encryption algorithm. Therefore, the plaintext of the platform certificate includes the module information of the security enhancement module and the device information of the conference transmission device; encryption enhances security during transmission.

[0065] In the second application scenario described above, the cloud platform parses the device registration request, obtains the device information of the conference transmission device contained within, and allocates a corresponding security enhancement module based on the type of the conference transmission device. Using the platform certificate key (e.g., key A), it performs an encryption operation on the module information of the allocated security enhancement module and the device information of the conference transmission device, and obtains the platform certificate based on the encryption result. In this method, the security enhancement module is allocated by the cloud platform based on the device information in the device authentication request.

[0066] Optionally, when there are multiple types of conference transmission devices, different types of security enhancement modules can be set for each type of conference transmission device. Accordingly, the cloud platform selects and allocates the security enhancement module that matches the device type of the current device based on the device information in the device authentication request.

[0067] Step S3: The cloud platform provides the platform certificate to the security enhancement module.

[0068] In this step, the cloud platform can provide the platform certificate to the security enhancement module via the conferencing transmission device, or it can provide the platform certificate directly to the security enhancement module. Correspondingly, the security enhancement module receives and stores the platform certificate generated by the cloud platform in response to the device registration request. For example, in the first application scenario, the cloud platform sends the platform certificate to the conferencing transmission device, which then provides the platform certificate and its key to the security enhancement module. In the second application scenario, the cloud platform directly provides the platform certificate and its key to the security enhancement module. In the former method, the platform certificate stored in the security enhancement module is dynamically added, thus enabling dynamic adaptation to different conferencing transmission devices and improving flexibility. In the latter method, the platform certificate and its key can be directly burned into the security enhancement module, further enhancing security.

[0069] In addition, regardless of the method used, the cloud platform needs to record the correspondence between the module information of the security enhancement module and the device information of the conference transmission device. This correspondence will be used to further enhance security in the subsequent authentication process and prevent security risks caused by malicious replacement of the conference transmission device or security enhancement module.

[0070] II. Equipment Certification Process: Step S4: The conference transmission device sends an authentication command to the security enhancement module.

[0071] In this process, the conference transmission device initiates a device authentication operation, thereby sending an authentication command to the security enhancement module.

[0072] Step S5: The security enhancement module responds to the authentication command by adding auxiliary verification data to the platform certificate to obtain the module certificate.

[0073] The security enhancement module responds to the authentication command sent by the conference transmission device by adding auxiliary verification data to the stored platform certificate to obtain the module certificate. This auxiliary verification data includes various supplementary data that enables auxiliary verification functions, such as timestamp data and device fingerprint data.

[0074] Optionally, to enhance security, the platform certificate generated by the cloud platform is in encrypted form. First, the security enhancement module decrypts the encrypted platform certificate using the platform certificate key (e.g., key A) provided by the cloud platform to obtain the plaintext platform certificate. When the platform certificate is obtained using symmetric encryption, the platform certificate key used for decryption is the same as the platform certificate key used for encryption by the cloud platform, thus enabling faster decryption. Of course, in other application scenarios requiring higher security, asymmetric encryption and decryption methods can also be used.

[0075] Then, auxiliary verification data is added to the plaintext platform certificate to obtain the plaintext module certificate. For example, the security enhancement module obtains the internal system time, generates timestamp data based on the internal system time, and adds the timestamp data to the platform certificate to obtain the module certificate. This process is essentially equivalent to a certificate reassembly process. Through certificate reassembly, security can be further improved with the help of auxiliary verification data. For example, if the timestamp data is tampered with, it indicates that the certificate was attacked during transmission.

[0076] Finally, the plaintext module certificate is encrypted using the module certificate key to obtain the ciphertext module certificate. In one optional implementation, the ciphertext platform certificate is obtained using symmetric encryption; the ciphertext module certificate is obtained using asymmetric encryption; and the module certificate key is obtained from the cloud platform. Since the ciphertext module certificate is obtained using asymmetric encryption, the transmission security of the module certificate is improved.

[0077] The module certificate key can be obtained in several ways. For example, in one implementation, the security enhancement module sends a communication request (also called a module certificate key acquisition request) to the cloud platform via a conferencing transmission device. Based on the received communication request, the cloud platform generates a module certificate private key and a module certificate public key. The module certificate private key is stored on the cloud platform, while the module certificate public key is forwarded to the security enhancement module via the conferencing transmission device. The module certificate public key is the module certificate key. Therefore, asymmetric encryption and decryption are achieved using the module certificate private key and module certificate public key.

[0078] Additionally, it should be noted that in this embodiment, the security enhancement module connects to the conference transmission device in a pluggable manner through a preset interface, and the security enhancement module communicates with the conference transmission device through a preset transmission protocol (i.e., the first transmission protocol) corresponding to the preset interface; wherein, the preset interface includes a USB interface, and the preset transmission protocol includes the USB protocol. Furthermore, the conference transmission device communicates with the cloud platform through a platform transmission protocol (also called the first communication protocol), such as the MQTT protocol. MQTT (Message Queuing Telemetry Transport) is a TCP-based unencrypted protocol, a publish / subscribe messaging protocol under the ISO standard (ISO / IEC PRF 20922), operating on the TCP / IP protocol suite. It is a publish / subscribe messaging protocol designed for remote devices with low hardware performance and poor network conditions, thus requiring a message middleware. MQTT is a client-server based message publish / subscribe transport protocol. The MQTT protocol is lightweight, simple, open, and easy to implement, making it widely applicable. In many cases, including constrained environments, such as machine-to-machine (M2M) communication and the Internet of Things (IoT), it is widely used in sensors communicating via satellite links, medical devices that make occasional dial-up calls, smart homes, and some miniaturized devices.

[0079] Accordingly, the conference transmission device needs to perform protocol conversion operations. It converts the data received from the security enhancement module via the second transmission protocol and then sends it to the cloud platform via the first transmission protocol. Conversely, it converts the data received from the cloud platform via the first transmission protocol and then sends it to the security enhancement module via the second transmission protocol. Therefore, in this step, the conference transmission device needs to convert the communication request from the security enhancement module from the USB protocol to the MQTT protocol before transmitting it to the cloud platform. Furthermore, upon receiving the module certificate public key sent by the cloud platform via the MQTT protocol, it performs protocol conversion and sends it to the security enhancement module via the USB protocol.

[0080] Step S6: The security enhancement module sends the module certificate to the cloud platform for device authentication.

[0081] The security enhancement module first sends its module certificate to the conference transmission device, which then forwards the certificate to the cloud platform for device authentication. Correspondingly, the conference transmission device sends the received module certificate from the security enhancement module to the cloud platform for device authentication.

[0082] In one implementation, the security enhancement module sends the encrypted module certificate to the conference transmission device via the USB protocol, and the conference transmission device sends the encrypted module certificate to the cloud platform via the MQTT protocol.

[0083] Step S7: The cloud platform receives the module certificate sent by the security enhancement module through the conference transmission device, parses the module certificate, and performs device authentication based on the parsing result.

[0084] Optionally, when the module certificate is in encrypted form, the cloud platform decrypts the received encrypted module certificate to obtain the plaintext module certificate; it then matches the plaintext module certificate with a pre-generated platform certificate; if the match is successful, the device authentication is successful. Asymmetric decryption of the encrypted module certificate can be performed using the module certificate private key mentioned above.

[0085] The plaintext module certificate includes auxiliary verification data and the plaintext platform certificate obtained from parsing the security enhancement module. Under normal circumstances, the module information of the security enhancement module and the device information of the conferencing transmission device contained in the plaintext platform certificate obtained from parsing the security enhancement module are consistent with the relevant information in the platform certificate pre-generated by the cloud platform. Therefore, if the plaintext module certificate matches the pre-generated platform certificate, device authentication succeeds; if the match fails, device authentication fails.

[0086] In one example, the cloud extracts valid information from the decrypted plaintext of the module certificate, such as the ID identifier of the security enhancement module. This unique ID within the security enhancement module serves as the unique trusted root for the conference transmission device on the cloud platform. Correspondingly, during the comparison process, the cloud platform compares the extracted unique ID of the security enhancement module with the trusted root stored in the cloud. If the comparison is successful, authentication is successful; otherwise, authentication fails. The cloud platform transmits the authentication result in plaintext to the conference transmission device via the MQTT protocol, and the conference transmission device transmits the authentication result to the security enhancement module via the USB protocol. In this example, the cloud platform only compares the module information of the security enhancement module; as long as the module information of the security enhancement module matches, authentication is successful.

[0087] To enhance security, in other examples, the cloud platform compares not only the module information of the security enhancement module but also the device information of the conference transmission device. Authentication is successful only when the combination of the module information of the security enhancement module and the device information of the conference transmission device matches the content pre-stored by the cloud platform. This method authenticates by combining the module information of the security enhancement module and the device information of the conference transmission device. If any device in the conference transmission device or the security enhancement module changes, authentication will fail, thereby improving security.

[0088] Step S8: The cloud platform sends the authentication result back to the conference transmission device.

[0089] III. Identity Verification Process The device registration and authentication process is primarily used to verify the legitimacy of the conference transmission equipment and security enhancement modules. In other embodiments, the device registration and authentication process can be omitted. For example, when the conference transmission equipment is used frequently, the device registration and authentication process can be skipped, and implementation can begin directly from the identity verification process.

[0090] The identity verification process aims to verify the legitimacy of attendees in order to prevent unauthorized individuals from participating in the meeting. Figure 5 A schematic diagram illustrating the specific process of authentication and conference data transmission is shown. For example... Figure 5 As shown, authentication and conference data transmission specifically include the following steps: Step S11: The conference transmission device receives and obtains the participant identity information contained in the participant configuration request sent by the cloud platform.

[0091] In response to input from meeting configuration personnel, the cloud platform sends a participant configuration request to the data transmission device. This request includes participant identification information to indicate the participant's identity. The meeting transmission device stores this identification information for subsequent verification.

[0092] For example, when a cloud platform creates a meeting, it sets the identity and permissions of the participants and transmits the participants' IDs to the meeting transmission device via the MQTT protocol, so that the meeting transmission device can store the participants' IDs locally.

[0093] Step S12: The conference transmission device sends the acquired identity verification data to the security enhancement module.

[0094] The identification data is used to identify the participants. The identification data transmitted by the conference transmission equipment includes at least one of the following: device-collected data used to identify participants. This device-collected data includes at least one of the following: facial image data, iris image data, fingerprint data, and password data.

[0095] The conference transmission equipment can include various data acquisition modules, such as camera modules, iris recognition modules, fingerprint input modules, and password input modules. Correspondingly, these modules can flexibly collect various forms of identity verification data. Furthermore, in remote conferencing scenarios, identity verification data can also be facial image data uploaded by various conference clients to verify the identity of the participants corresponding to each client.

[0096] For example, information about meeting participants can be collected through camera capture and feature extraction, and then transmitted to the conference transmission device. The conference transmission device extracts facial feature information and transmits this facial feature information as identity recognition data to the security enhancement module.

[0097] Step S13: The security enhancement module matches the received identity recognition data with the security verification data pre-stored in the security enhancement module, and determines the identity recognition result corresponding to the identity recognition data based on the matching result.

[0098] The security verification data pre-stored in the security enhancement module refers to user personal data related to personnel identity verification, such as facial features and iris features of company employees. For example, security verification data includes the characteristic data and identification information of registered members. In this embodiment, to improve the security of user personal data, the aforementioned user personal data is stored in the security enhancement module, and external devices cannot access the security verification data stored in the security enhancement module, thereby improving information security. Therefore, in this embodiment, the identity recognition result corresponding to the identity recognition data includes the identification information of the attendees; wherein, the data collected by the device includes at least one of the following: facial image data, iris image data, fingerprint data, and password data; the identification information includes: name, unique identifier, and brief introduction information.

[0099] Optionally, before receiving the identity verification data sent by the conference transmission device, the security enhancement module further receives and stores the aforementioned security verification data from the host computer. The security verification data from the host computer is in encrypted form. Accordingly, when matching the identity verification data with the security verification data pre-stored in the security enhancement module, the encrypted security verification data is decrypted using a verification key to obtain plaintext security verification data; the identity verification data is then matched with the plaintext security verification data. The verification key and decryption algorithm can be obtained through negotiation with the host computer. In summary, because the security verification data stored internally by the security enhancement module is in encrypted form, even if the security enhancement module is maliciously compromised, the security verification data will not be leaked.

[0100] When matching identity recognition data with security verification data pre-stored in the security enhancement module, this can be achieved in the following ways: First, the security enhancement module decrypts the ciphertext of the security verification data using a symmetric decryption algorithm and a verification key, obtaining the plaintext of the facial feature database (i.e., the feature data of registered members) and the form (i.e., the identification information of registered members stored in a data table). The security enhancement module then compares the identity verification data sent by the conference transmission device with the facial feature database one-to-one, recording the sequence number of the comparison result (i.e., the number of the facial feature with the highest similarity). Using this sequence number, the module retrieves the corresponding ID number from the plaintext of the form and sends this ID number as the identity verification result to the device. In one implementation, the facial feature database is a 20,000-base database, storing 20,000 sets of facial feature information, each set containing 512 floating-point numbers. The form contains the ID numbers corresponding to the feature database information.

[0101] Step S14: The security enhancement module sends the identity verification result to the conference transmission device.

[0102] Step S15: The conference transmission device verifies the identity of the participants based on the identity recognition results.

[0103] The conference transmission device receives the identity verification result returned by the security enhancement module after matching the identity verification data with pre-stored security verification data. This result is then matched against the personnel identity information contained in the participant configuration request received from the cloud platform. Based on the matching result, the device verifies the participant's identity. For example, the conference transmission device compares the ID (i.e., personnel identity information) issued by the cloud platform with the ID (i.e., the ID number retrieved from the plaintext of the form) transmitted by the security enhancement module. If they match completely, the conference starts normally; otherwise, it prompts whether authorized personnel are allowed to participate.

[0104] Step S16: After the participant's authentication is successful, the conference transmission device sends the unencrypted first conference data to the security enhancement module.

[0105] The conference transmission device generates first conference data based on the conference content (including notes, etc.) and sends the unencrypted first conference data to the security enhancement module.

[0106] Step S17: The security enhancement module obtains the meeting key corresponding to the first meeting data, and encrypts the first meeting data using the meeting key to obtain the encrypted second meeting data.

[0107] The security enhancement module is used to perform encryption operations on the first meeting data. The meeting key can be generated in several ways: In one implementation, the conference key is generated by a security enhancement module, and to improve security, it undergoes secondary encryption: First, a conference key corresponding to the first conference data is generated, and this key is used to encrypt the first conference data. The conference key can be calculated by the security enhancement module based on module information (e.g., the security enhancement module derives conference key B from its internal unique identifier, also called device DNA); or, the conference key can be determined by the security enhancement module based on the data type of the first conference data, for example, setting different conference keys for different types and security levels of conference data. Then, the conference key is encrypted using a security key provided by the cloud platform to obtain a ciphertext key. Based on the encrypted first conference data and the ciphertext key, the second conference data is obtained. Therefore, the second conference data includes: the first conference data encrypted with the conference key and the ciphertext key (i.e., the result of encrypting the conference key with the security key). For example, the security enhancement module encrypts the conference content using symmetric encryption and conference key B to obtain ciphertext conference content, which is then sent to the cloud platform via the conference transmission device. Simultaneously, the conference key B is encrypted using symmetric encryption and key C (security key), resulting in key B ciphertext, which is then sent to the cloud platform via the conference transmission device. Correspondingly, the cloud platform stores the aforementioned second conference data.

[0108] The security keys provided by the cloud platform can be generated using either symmetric or asymmetric encryption algorithms, and can be either fixed or variable. Because variable keys can be dynamically changed, they are suitable for scenarios requiring higher security. Furthermore, the security keys can be further encrypted to prevent attacks that could compromise plaintext transmission.

[0109] Optionally, the security key can be dynamically obtained through key negotiation: the conference transmission device sends a key negotiation request to the cloud platform; based on the result returned by the cloud platform, it provides a security key from the cloud platform to the security enhancement module; wherein, the security key is generated according to the device service type and / or device authentication type of the conference transmission device. Specifically, when providing the security key from the cloud platform to the security enhancement module, the cloud platform sends a first key obtained by encrypting the security key using its platform private key to the security enhancement module, so that the security enhancement module can decrypt the first key using a pre-obtained platform public key to obtain the security key. Correspondingly, the security enhancement module receives the security key returned by the cloud platform in response to the key negotiation request sent by the conference transmission device. For example, the security enhancement module receives the first key obtained by encrypting the security key using its platform private key; and decrypts the first key using a pre-obtained platform public key to obtain the security key. In summary, this disclosure does not limit the frequency of security key acquisition or the specific encryption method.

[0110] In other implementations, the conference key can be obtained directly through a key negotiation request. Furthermore, the conference key can be used for both symmetric and asymmetric encryption.

[0111] Step S18: The security enhancement module sends the encrypted second conference data to the conference transmission device.

[0112] Step S19: The conference transmission device sends the encrypted second conference data to the cloud platform, so that the cloud platform can provide the second conference data to the conference client.

[0113] Step S20: The conference client retrieves encrypted second conference data from the conference transmission device from the cloud platform.

[0114] The second meeting data is obtained by encrypting the first meeting data provided by the meeting transmission device using a meeting key via a security enhancement module. The meeting client can obtain the second meeting data through meeting download portals provided by the cloud platform (such as hyperlinks, download buttons, or shared QR codes); this invention does not limit the specific method of acquisition.

[0115] Step S21: The conference client obtains the conference key and decrypts the second conference data using the conference key to obtain the unencrypted first conference data.

[0116] The meeting client obtains the ciphertext key contained in the second meeting data. This ciphertext key is obtained by encrypting the meeting key with a security key provided by the cloud platform. Correspondingly, the meeting client decrypts the ciphertext key using the security key provided by the cloud platform to obtain the meeting key. The method for obtaining the security key is the same as that used by the meeting transmission device, and will not be elaborated here.

[0117] For example, the meeting client downloads the ciphertext of the meeting information and the ciphertext of key B from the cloud platform. It then decrypts the ciphertext of key B using symmetric decryption and the built-in key C (i.e., the security key) to obtain the plaintext of key B. Finally, it decrypts the ciphertext of the meeting content using symmetric decryption and key B to obtain the plaintext of the meeting content.

[0118] In summary, this disclosure proposes a secure meeting management system based on a security enhancement module. By incorporating this module, sensitive data is stored and securely computed within it, and the computation results are fed back to the device, effectively reducing the risk of sensitive data leakage. Simultaneously, key management is performed within the security enhancement module to enhance key security. Furthermore, meeting content is transmitted in encrypted form throughout the entire cloud-to-cloud process, with private key sharing between the device and client sides, protecting the security of meeting content on the public cloud. This secure meeting management system consists of a meeting client, a cloud platform, a device (i.e., the meeting transmission device), and a security enhancement module. The meeting client can be designed based on operating systems such as Android and Linux; this disclosure does not restrict the operating system environment. The cloud platform includes public clouds, private clouds, and private deployments of public clouds; this disclosure does not restrict the cloud deployment environment. In this embodiment, the meeting transmission device refers to a conference all-in-one machine, and the security enhancement module can be connected to the meeting transmission device via USB or a security chip, among other methods.

[0119] In this embodiment, the cloud platform is used for: secure meeting creation, secure access management, encrypted storage of meeting content, and encrypted storage of key B. The meeting transmission device is used for: camera capture and feature extraction. The security enhancement module is used for: sensitive data storage, secure computation, and data encryption. The meeting client is used for: encrypted acquisition of meeting content, encrypted decryption of key, and encrypted decryption of meeting content. Sensitive data is encrypted and stored within the security enhancement module, and this sensitive data includes: a facial feature database, a fingerprint database, digital certificates, keys, and forms. In this embodiment, the facial feature database and forms refer to the facial information of employees within an organization or company, and the forms refer to the physical information corresponding to the feature information, such as ID numbers, names, and ages. In this embodiment, the camera primarily captures images of meeting participants and transmits the information to the device. The device extracts facial features and sends them to the security enhancement module for facial feature comparison. Based on the comparison results, the ID information corresponding to the form is transmitted to the device. The security enhancement module has at least the following characteristics: sensitive data is stored in encrypted form within the security enhancement module. Sensitive data is encrypted using customized host computer software and stored within the security enhancement module using symmetric encryption. Sensitive data within the security enhancement module can only be written to, not read. Furthermore, the entire conference content is transmitted in encrypted form: this process is jointly completed by the client, cloud, device, and security enhancement module. The cloud handles encrypted storage, the device generates the shared QR code, the security enhancement module encrypts and decrypts the content, and the client downloads and decrypts the conference content.

[0120] Furthermore, the security key in this embodiment can be flexibly set according to the authentication type of the conference transmission device: When the device authentication type is the first authentication type (such as one device, one key), the security key corresponds to the device identifier. This type requires generating a key for each device separately, and due to the uniqueness of the device, the security is relatively high. When the device authentication type is the second authentication type (such as one model, one key), the security key corresponds to the device model. This type requires generating a key for each device model separately, and since the same model may contain multiple devices, the security is slightly lower than the security key of the first authentication type. When the device authentication type is the third authentication type (such as unified key type), the security key corresponds to the device service type. This type can generate a unified security key for all devices, and therefore has the lowest security. For example, the same security key can be generated for conference transmission devices of the same service type.

[0121] In this embodiment, the conference transmission device communicates with the cloud platform via a first communication protocol, and with the security enhancement module via a second communication protocol. The first communication protocol includes the MQTT protocol, and the second communication protocol includes the USB protocol. Accordingly, the conference transmission device needs to perform corresponding protocol conversion processing based on the data type. In this embodiment, since the transmission protocol used between the conference transmission device and the cloud platform differs from the transmission protocol used between the conference transmission device and the security enhancement module, the conference transmission device needs to perform protocol conversion processing on the received or to-be-sent data. Furthermore, by using different transmission protocols between different devices, network attacks between devices can be avoided, improving security.

[0122] In addition, the security enhancement module communicates with the conference transmission device through a preset application programming interface (API); the preset API is provided by the software development kit corresponding to the security enhancement module.

[0123] Therefore, this disclosure maximizes device security by adding a security enhancement module to the device side and establishing device authentication and secure data interaction methods between the security enhancement module, the device, and the platform. The security enhancement module interacts with the device via a USB interface to ensure compatibility with existing devices. Furthermore, a secure data interaction mechanism is built between the security enhancement module, the device, and the cloud platform through the security SDK on the device side. The security enhancement module possesses at least the following characteristics: It provides trusted storage for sensitive data such as keys and certificates, preventing external transmission via the USB interface. Sensitive data is stored internally in an encrypted manner, ensuring that even if the security enhancement module is compromised, the plaintext information of the internally stored encrypted data cannot be directly accessed. For example, the security key stored internally by the security enhancement module is stored in ciphertext form through a double encryption process. Additionally, sensitive data stored internally by the security enhancement module is not shared externally. Sensitive data such as certificates can be written to using customized host computer software, and it is write-only, not readable. Moreover, the encryption and decryption processes are all completed internally by the security enhancement module, avoiding the vulnerability caused by encryption and decryption on external devices. The security enhancement module can dynamically perform key negotiation with the cloud platform through the conference transmission device, and the frequency of key negotiation can be flexibly adjusted according to the device type and authentication method. Furthermore, the security key obtained through key negotiation can be generated in different ways based on the device type and authentication method, facilitating the determination of the security key generation method according to the data security level and further enhancing security. Keys during authentication and data transmission can be flexibly set according to the data type. For example, the cloud platform dynamically determines a key matching the data type to be transmitted. That is, the type of key and the encryption / decryption method can be flexibly set according to the data type and the interaction process. For example, different encryption / decryption methods can be selected for different interaction processes, such as using a symmetric key for the platform certificate and an asymmetric key for the module certificate, thus setting the key and encryption / decryption method according to the interaction process and data security level. In addition, in the application scenario disclosed herein, the security enhancement module is provided by the IoT cloud platform and is therefore a trusted device, while the conference transmission device is an external device independent of the cloud platform and is therefore an untrusted device. To avoid security problems caused by attacks on untrusted devices, sensitive data and the encryption / decryption process are all implemented by the security enhancement module. Furthermore, to enhance security, a Software Development Kit (SDK) is provided for the security enhancement module. Correspondingly, the conference transmission device only needs to integrate this SDK to communicate with the security enhancement module and the cloud platform. That is, data transmission between the security enhancement module and the conference transmission device is conducted through a pre-defined application programming interface (API); and this API is provided by the corresponding SSD for the security enhancement module.Therefore, in this embodiment, data transmission between the conference transmission device and the security enhancement module must be achieved by calling the application programming interface (API) functions provided by the SDK. For example, when the conference transmission device sends data to the security enhancement module, it needs to call the sending API class that matches the data type being sent; when the conference transmission device receives data returned by the security enhancement module, it needs to call the receiving API class that matches the data type being received. Since the parameters and execution logic of each API function included in the SDK are predefined, it is possible to avoid writing execution logic related to accessing sensitive data into the API functions during SDK configuration, thereby preventing the problem of malicious access to sensitive data.

[0124] This disclosure also provides a conference transmission device, which can be the security enhancement module mentioned above. For example... Figure 6 As shown, a conference transmission apparatus provided in one embodiment of this disclosure includes: The receiving module 61 is configured to receive unencrypted first conference data sent by the conference transmission device after the participant's authentication is successful; Encryption module 62 is configured to obtain a conference key corresponding to the first conference data, and encrypt the first conference data using the conference key to obtain encrypted second conference data; The sending module 63 is configured to send the encrypted second conference data to the conference transmission device, so that the conference transmission device can provide the encrypted second conference data to the conference client through the cloud platform.

[0125] In one optional implementation, the encryption module is specifically configured as follows: Generate a meeting key corresponding to the first meeting data, and encrypt the first meeting data using the meeting key; The conference key is encrypted using a security key provided by the cloud platform to obtain a ciphertext key; The second meeting data is obtained based on the encrypted first meeting data and the ciphertext key.

[0126] In one optional implementation, the conference key is calculated by the security enhancement module based on module information; or, the conference key is determined by the security enhancement module based on the data type of the first conference data.

[0127] In one optional implementation, the encryption module is specifically configured as follows: The cloud platform receives the security key returned in response to the key negotiation request sent by the conference transmission device; wherein the security key is generated based on the device service type and / or device authentication type of the conference transmission device.

[0128] In one optional implementation, the encryption module is specifically configured as follows: The system receives a first key obtained by encrypting the security key using the platform's private key; and decrypts the first key using the platform's public key obtained in advance to obtain the security key.

[0129] In one alternative implementation, the apparatus further includes: The authentication module is configured to receive authentication data sent by the conference transmission device; match the authentication data with security verification data pre-stored by the security enhancement module; determine the authentication result corresponding to the authentication data based on the matching result; and send the authentication result to the conference transmission device so that the conference transmission device can authenticate the participants based on the authentication result.

[0130] In one alternative implementation, the apparatus further includes: The storage module is configured to receive and store the security verification data from the host computer; wherein the security verification data from the host computer is in encrypted form.

[0131] In one optional implementation, the identification data sent by the conference transmission device includes at least one of the following: device-collected data used to identify the participants; The security verification data includes: characteristic data of registered members and identification information of registered members; The identity recognition result corresponding to the identity recognition data includes: the identification information of the attendee; wherein, the data collected by the device includes at least one of the following: facial image data, iris image data, fingerprint data, and password data; the identification information includes: name, unique identifier, and brief introduction information.

[0132] In one alternative implementation, the apparatus further includes: The device authentication module is configured to receive and store the platform certificate generated by the cloud platform in response to the device registration request; in response to the authentication command sent by the conference transmission device, it adds auxiliary verification data to the platform certificate to obtain a module certificate, and sends the module certificate to the conference transmission device so that the conference transmission device can provide the module certificate to the cloud platform for device authentication; wherein, if the device authentication is successful, the identity verification of the participants is performed.

[0133] This disclosure also provides a conference transmission device, which can be the conference transmission equipment mentioned above. For example... Figure 7 As shown, a conference transmission apparatus provided in one embodiment of this disclosure includes: The first sending module 71 is configured to send unencrypted first meeting data to the security enhancement module after the participant's authentication is successful; The receiving module 72 is configured to receive encrypted second conference data obtained by the security enhancement module after encrypting the first conference data with the obtained conference key; The second sending module 73 is configured to send the encrypted second conference data to the cloud platform so that the cloud platform can provide the second conference data to the conference client.

[0134] In one optional implementation, the conference key is generated by the security enhancement module, and the second conference data further includes: a ciphertext key obtained by encrypting the conference key with a security key provided by the cloud platform.

[0135] In one alternative implementation, the apparatus further includes: The key negotiation module is configured to send a key negotiation request to the cloud platform; and, based on the result returned by the cloud platform, provide the security key from the cloud platform to the security enhancement module; wherein the security key is generated according to the device service type and / or device authentication type of the conference transmission device.

[0136] In one optional implementation, the key negotiation module is specifically configured as follows: The cloud platform encrypts the security key using its private key to obtain a first key, which is then sent to the security enhancement module. The security enhancement module then decrypts the first key using the pre-obtained platform public key to obtain the security key.

[0137] In one alternative implementation, the apparatus further includes: The identity verification module is configured to send the acquired identity recognition data to the security enhancement module; receive the identity recognition result returned by the security enhancement module after matching the identity recognition data with pre-stored security verification data; match the identity recognition result with the personnel identity information contained in the participant configuration request received from the cloud platform, and verify the identity of the participant based on the matching result.

[0138] In one alternative implementation, the apparatus further includes: The registration and authentication module is configured to send a device registration request to the cloud platform, so that the security enhancement module receives and stores the platform certificate generated by the cloud platform in response to the device registration request; send an authentication instruction to the security enhancement module, so that the security enhancement module adds auxiliary verification data to the platform certificate to obtain a module certificate; and send the received module certificate from the security enhancement module to the cloud platform for the cloud platform to perform device authentication.

[0139] This disclosure also provides a conference client. For example... Figure 8 As shown, one embodiment of this disclosure provides a conference client including: The acquisition module 81 is configured to acquire encrypted second conference data from the conference transmission device from the cloud platform; wherein the second conference data is obtained by the security enhancement module encrypting the first conference data provided by the conference transmission device using a conference key; The decryption module 82 is configured to obtain the conference key and decrypt the second conference data using the conference key to obtain the unencrypted first conference data.

[0140] In one optional implementation, the acquisition module is specifically configured as follows: Obtain the ciphertext key contained in the second meeting data; wherein, the ciphertext key is obtained by encrypting the meeting key with the security key provided by the cloud platform; The conference key is obtained by decrypting the ciphertext key using the security key provided by the cloud platform.

[0141] This disclosure also provides a conference transmission system. For example... Figure 9 As shown, one embodiment of the present disclosure provides a conference transmission system including: The system comprises a first conference transmission device 91, a second conference transmission device 92, a conference client 93, and a cloud platform 94. The first conference transmission device 91 can be... Figure 6 The security enhancement module shown, the second data transmission device 92 can be Figure 7 The structure of the conference transmission equipment and conference client 93 shown can be found in [reference needed]. Figure 8 As shown.

[0142] Reference Figure 10 This disclosure provides an electronic device, which includes: One or more processors 901; The memory 902 stores one or more programs that, when executed by one or more processors, enable the one or more processors to implement any of the above-mentioned methods for transmitting conference data. One or more I / O interfaces 903 are connected between the processor and the memory and configured to enable information exchange between the processor and the memory.

[0143] Among them, processor 901 is a device with data processing capabilities, including but not limited to central processing unit (CPU); memory 902 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); I / O interface (read-write interface) 903 is connected between processor 901 and memory 902, and can realize information interaction between processor 901 and memory 902, including but not limited to data bus (Bus).

[0144] In some embodiments, the processor 901, memory 902, and I / O interface 903 are interconnected via a bus, and thus connected to other components of the computing device.

[0145] This embodiment also provides a computer-readable medium storing a computer program. When the program is executed by a processor, it implements the conference data transmission method provided in this embodiment. To avoid repetition, the specific steps of the conference data transmission method will not be repeated here.

[0146] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0147] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0148] It is understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of this disclosure, and this disclosure is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of this disclosure, and these modifications and improvements are also considered to be within the scope of protection of this disclosure.

Claims

1. A method for transmitting conference data, applied to a security enhancement module, comprising: Once the participant's identity is verified, the system receives the first unencrypted meeting data sent by the conference transmission device. Obtain the meeting key corresponding to the first meeting data, and encrypt the first meeting data using the meeting key to obtain the encrypted second meeting data; The encrypted second meeting data is sent to the meeting transmission device, so that the meeting transmission device can provide the encrypted second meeting data to the meeting client through the cloud platform; The identity verification of the meeting participants includes: receiving identity recognition data sent by the conference transmission device; matching the identity recognition data with security verification data pre-stored by the security enhancement module, and determining the identity recognition result corresponding to the identity recognition data based on the matching result; sending the identity recognition result to the conference transmission device so that the conference transmission device can verify the identity of the meeting participants based on the identity recognition result; and prior to the identity verification of the meeting participants, the method further includes: receiving and storing a platform certificate generated by the cloud platform in response to a device registration request; in response to an authentication instruction sent by the conference transmission device, adding auxiliary verification data to the platform certificate to obtain a module certificate, and sending the module certificate to the conference transmission device so that the conference transmission device can provide the module certificate to the cloud platform for device authentication; wherein, if the device authentication is successful, the identity verification of the meeting participants is performed.

2. The method according to claim 1, wherein, The step of obtaining the conference key corresponding to the first conference data and encrypting the first conference data using the conference key to obtain the encrypted second conference data includes: Generate a meeting key corresponding to the first meeting data, and encrypt the first meeting data using the meeting key; The conference key is encrypted using a security key provided by the cloud platform to obtain a ciphertext key; The second meeting data is obtained based on the encrypted first meeting data and the ciphertext key.

3. The method according to claim 2, wherein, The conference key is calculated by the security enhancement module based on module information; or, the conference key is determined by the security enhancement module based on the data type of the first conference data.

4. The method according to claim 2, wherein, Before encrypting the conference key using a security key provided by the cloud platform, the method further includes: The cloud platform receives the security key returned in response to the key negotiation request sent by the conference transmission device; wherein the security key is generated based on the device service type and / or device authentication type of the conference transmission device.

5. The method according to claim 4, wherein, The security key returned by the cloud platform in response to the key negotiation request sent by the conference transmission device includes: The system receives a first key obtained by encrypting the security key using the platform's private key; and decrypts the first key using the platform's public key obtained in advance to obtain the security key.

6. The method according to claim 1, wherein, Before receiving the identity verification data sent by the conference transmission device, the method further includes: receiving and storing the security verification data from the host computer; wherein the security verification data from the host computer is in encrypted form; The step of matching the identity recognition data with the security verification data pre-stored in the security enhancement module includes: The encrypted security verification data is decrypted using a verification key to obtain plaintext security verification data; the identity verification data is then matched with the plaintext security verification data.

7. The method according to claim 6, wherein, The identity verification data sent by the conference transmission device includes at least one of the following: device-collected data used to identify the identity of the participants; The security verification data includes: characteristic data of registered members and identification information of registered members; The identity recognition result corresponding to the identity recognition data includes: the identification information of the attendee; wherein, the data collected by the device includes at least one of the following: facial image data, iris image data, fingerprint data, and password data; the identification information includes: name, unique identifier, and brief introduction information.

8. The method according to any one of claims 1-5, wherein, The security enhancement module communicates with the conference transmission device through a preset application programming interface (API); wherein the preset API is provided by a software development kit (SDK) corresponding to the security enhancement module.

9. A method for transmitting conference data, applied to a conference transmission device, comprising: Once the participants' identities are verified, the unencrypted initial meeting data is sent to the security enhancement module. The security enhancement module receives encrypted second conference data obtained by encrypting the first conference data using the acquired conference key. The encrypted second meeting data is sent to the cloud platform so that the cloud platform can provide the second meeting data to the meeting client; The process includes, before sending the unencrypted first meeting data to the security enhancement module, the following steps: sending the acquired identity recognition data to the security enhancement module; receiving the identity recognition result returned by the security enhancement module after matching the identity recognition data with pre-stored security verification data; matching the identity recognition result with the personnel identity information contained in the participant configuration request received from the cloud platform, and verifying the participant's identity based on the matching result; and before the participant's identity verification, the process includes: sending a device registration request to the cloud platform so that the security enhancement module receives and stores the platform certificate generated by the cloud platform in response to the device registration request; sending an authentication instruction to the security enhancement module so that the security enhancement module adds auxiliary verification data to the platform certificate to obtain a module certificate; and sending the received module certificate from the security enhancement module to the cloud platform for device authentication by the cloud platform.

10. The method according to claim 9, wherein, The conference key is generated by the security enhancement module, and the second conference data further includes: a ciphertext key obtained by encrypting the conference key with a security key provided by the cloud platform.

11. The method according to claim 10, wherein, Before receiving the encrypted second conference data obtained by the security enhancement module encrypting the first conference data using the acquired conference key, the method further includes: Send a key negotiation request to the cloud platform; Based on the results returned by the cloud platform, the security key from the cloud platform is provided to the security enhancement module; wherein the security key is generated according to the device service type and / or device authentication type of the conference transmission device.

12. The method according to claim 11, wherein, Providing the security key from the cloud platform to the security enhancement module includes: The cloud platform encrypts the security key using its private key to obtain a first key, which is then sent to the security enhancement module. The security enhancement module then decrypts the first key using the pre-obtained platform public key to obtain the security key.

13. The method according to any one of claims 9-12, wherein, The conference transmission device communicates with the cloud platform via a first communication protocol, and the conference transmission device communicates with the security enhancement module via a second communication protocol; wherein the first communication protocol includes the MQTT protocol, and the second communication protocol includes the USB protocol.

14. A method for transmitting conference data, applied to a conference client, comprising: Once the device authentication and the participant authentication are successful, encrypted second meeting data from the conference transmission device is retrieved from the cloud platform; wherein, the second meeting data is obtained by the security enhancement module encrypting the first meeting data provided by the conference transmission device using a conference key; Obtain the conference key, and use the conference key to decrypt the second conference data to obtain the unencrypted first conference data; The identity verification of the meeting participants includes: the security enhancement module receiving identity recognition data sent by the conference transmission device; matching the identity recognition data with security verification data pre-stored by the security enhancement module, and determining the identity recognition result corresponding to the identity recognition data based on the matching result; sending the identity recognition result to the conference transmission device so that the conference transmission device can verify the identity of the meeting participants based on the identity recognition result; and prior to the identity verification of the meeting participants, the security enhancement module also includes: receiving and storing the platform certificate generated by the cloud platform in response to the device registration request; in response to the authentication instruction sent by the conference transmission device, adding auxiliary verification data to the platform certificate to obtain a module certificate, and sending the module certificate to the conference transmission device so that the conference transmission device can provide the module certificate to the cloud platform for device authentication; wherein, if the device authentication is successful, the identity verification of the meeting participants is performed.

15. The method according to claim 14, wherein, The process of obtaining the conference key includes: Obtain the ciphertext key contained in the second meeting data; wherein, the ciphertext key is obtained by encrypting the meeting key with the security key provided by the cloud platform; The conference key is obtained by decrypting the ciphertext key using the security key provided by the cloud platform.

16. A conference data transmission device, comprising: The receiving module is configured to receive unencrypted first conference data sent by the conference transmission device after the participant's authentication is successful; The encryption module is configured to acquire a conference key corresponding to the first conference data, and encrypt the first conference data using the conference key to obtain encrypted second conference data. The sending module is configured to send the encrypted second conference data to the conference transmission device, so that the conference transmission device can provide the encrypted second conference data to the conference client through the cloud platform; The device authentication module is configured to receive and store the platform certificate generated by the cloud platform in response to the device registration request; In response to the authentication command sent by the conference transmission device, auxiliary verification data is added to the platform certificate to obtain a module certificate. The module certificate is then sent to the conference transmission device, which provides the module certificate to the cloud platform for device authentication. If device authentication is successful, the identity verification of the participants is performed. This identity verification includes: receiving identity recognition data sent by the conference transmission device; matching the pre-stored security verification data of the identity recognition data with the matching result to determine the identity recognition result corresponding to the identity recognition data; and sending the identity recognition result to the conference transmission device, which then verifies the identity of the participants based on the identity recognition result.

17. A conference data transmission device, comprising: The first sending module is configured to send unencrypted first meeting data to the security enhancement module after the participant's authentication is successful; The receiving module is configured to receive encrypted second conference data obtained by the security enhancement module after encrypting the first conference data with the obtained conference key; The second sending module is configured to send the encrypted second meeting data to the cloud platform, so that the cloud platform can provide the second meeting data to the meeting client; The authentication module is configured to send the acquired identity verification data to the security enhancement module; The system receives the identity recognition result returned by the security enhancement module after matching the identity recognition data with the pre-stored security verification data; it then matches the identity recognition result with the personnel identity information contained in the participant configuration request received from the cloud platform, and verifies the identity of the participant based on the matching result. The registration and authentication module is configured to send a device registration request to the cloud platform, so that the security enhancement module receives and stores the platform certificate generated by the cloud platform in response to the device registration request; Send an authentication command to the security enhancement module so that the security enhancement module can add auxiliary verification data to the platform certificate to obtain the module certificate; The received module certificate from the security enhancement module is sent to the cloud platform for device authentication.

18. A conferencing client, comprising: The acquisition module is configured to acquire encrypted second meeting data from the conference transmission device from the cloud platform when the device authentication is successful and the identity verification of the participants is successful; wherein the second meeting data is obtained by the security enhancement module encrypting the first meeting data provided by the conference transmission device using a conference key; The decryption module is configured to obtain the conference key and decrypt the second conference data using the conference key to obtain the unencrypted first conference data; The identity verification of the meeting participants includes: the security enhancement module receiving identity recognition data sent by the conference transmission device; matching the identity recognition data with security verification data pre-stored by the security enhancement module, and determining the identity recognition result corresponding to the identity recognition data based on the matching result; sending the identity recognition result to the conference transmission device so that the conference transmission device can verify the identity of the meeting participants based on the identity recognition result; and prior to the identity verification of the meeting participants, the security enhancement module also includes: receiving and storing the platform certificate generated by the cloud platform in response to the device registration request; in response to the authentication instruction sent by the conference transmission device, adding auxiliary verification data to the platform certificate to obtain a module certificate, and sending the module certificate to the conference transmission device so that the conference transmission device can provide the module certificate to the cloud platform for device authentication; wherein, if the device authentication is successful, the identity verification of the meeting participants is performed.

19. A conference transmission system, comprising: The conference data transmission device of claim 16, the conference data transmission device of claim 17, the conference client of claim 18, and the cloud platform.

20. An electronic device comprising: One or more processors; A memory having stored thereon one or more programs that, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 1-8, 9-13, or 14-15; One or more I / O interfaces are connected between the processor and the memory and configured to enable information interaction between the processor and the memory.

21. A computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the method according to any one of claims 1-8, 9-13, or 14-15.

Images