Mail secure communication method, device, equipment and medium

Abstract

The mail secure communication method can be applied to the technical field of information security. The mail secure communication method is applied to a first client, and the method comprises: obtaining mail data and pre-generated first key information; forming a mail digest based on the mail data; encrypting the mail data and the mail digest respectively through the first key information to obtain first mail ciphertext and a digital signature; and sending the first mail ciphertext and the digital signature to a forwarding node. The disclosure also provides a mail secure communication device, equipment and a medium.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of information security, in particular to a mail secure communication method, device, equipment and medium. BACKGROUND

[0002] In modern enterprises, intranet and extranet are common network environments. Intranet is usually a protected network that only allows authorized users to access and usually contains sensitive information and data. Extranet is a public network that allows anyone to access, including hackers and other security threats.

[0003] In this case, if the enterprise needs to communicate between the intranet and the extranet, some security measures are needed to protect the security and privacy of the communication. Such as using bastion host, demilitarized zone and other means to realize information exchange, but this process is not necessarily 100% reliable, the message forwarding passes through multiple nodes, including the sender's email client, the sender's mail server, the recipient's mail server and the recipient's email client. If the forwarding link of the email needs to pass through the security area such as the bastion host or the demilitarized zone, it will also pass through the nodes of these security areas. Each node has the potential to be exploited by attackers to tamper with the email content or obtain sensitive information of the email, so appropriate security measures need to be taken to protect the security and privacy of the email. SUMMARY

[0004] In view of the above problems, the present disclosure provides a mail secure communication method, device, equipment and medium that improves the security, confidentiality and integrity of mail communication.

[0005] According to a first aspect of the present disclosure, a mail secure communication method is provided, the method is applied to a first client, and the method comprises: obtaining mail data and pre-generated first key information; forming a mail digest based on the mail data; encrypting the mail data and the mail digest respectively by the first key information to obtain first mail ciphertext and a digital signature; and sending the first mail ciphertext and the digital signature to a forwarding node.

[0006] According to an embodiment of the present disclosure, the first key information includes a first public key, a first private key and a second public key, and the encrypting the mail data and the mail digest respectively by the first key information to obtain the first mail ciphertext and the digital signature comprises: for the mail data, encrypting the mail data based on the first public key to obtain intermediate mail ciphertext; forming a proxy key based on the first private key and the second public key; and encrypting the mail ciphertext based on the proxy key to obtain the first mail ciphertext.

[0007] According to an embodiment of the present disclosure, wherein the encrypting the mail data and the mail digest respectively by the first key information to obtain the first mail ciphertext and the digital signature further comprises: for the mail digest, encrypting the mail digest based on the first private key to obtain the digital signature.

[0008] According to an embodiment of the present disclosure, wherein the first key information further comprises an intermediate key, and after the encrypting the mail ciphertext based on the proxy key to obtain the first mail ciphertext, the method further comprises: encrypting the first mail ciphertext based on the intermediate key to obtain a second mail ciphertext, wherein the intermediate key is periodically updated; and sending the second mail ciphertext and the digital signature to a forwarding node.

[0009] A second aspect of the present disclosure provides a mail secure communication method, the method is applied to a second client, the method comprises: receiving a first mail ciphertext and a digital signature; receiving second key information; decrypting the first mail ciphertext and the digital signature respectively based on the second key information to obtain mail data and a mail digest; calculating a digest copy based on the mail data; and in the case that the mail digest and the digest copy are consistent, confirming that the mail data is safely received.

[0010] According to an embodiment of the present disclosure, wherein the second key information comprises a first public key and a second private key, and the first mail ciphertext is obtained by encrypting the mail ciphertext based on a proxy re-encryption algorithm, and the decrypting the first mail ciphertext and the digital signature respectively based on the second key information to obtain mail data and a mail digest comprises: for the first mail ciphertext, decrypting the first mail ciphertext based on the second private key to obtain the mail data.

[0011] According to an embodiment of the present disclosure, wherein the decrypting the first mail ciphertext and the digital signature respectively based on the second key information to obtain mail data and a mail digest further comprises: for the digital signature, decrypting the digital signature by the first public key to obtain the mail digest.

[0012] According to an embodiment of the present disclosure, wherein the second key information further comprises an intermediate key, and the mail secure communication method further comprises: receiving a second mail ciphertext and a digital signature; before the decrypting the first mail ciphertext and the digital signature respectively based on the second key information to obtain mail data and a mail digest, after the receiving second key information, the mail secure communication method further comprises: decrypting the second mail ciphertext based on the intermediate key to obtain the first mail ciphertext, and the intermediate key is periodically updated.

[0013] A third aspect of the present disclosure provides a method for secure communication of mail, the method comprising: obtaining, by a first client, mail data and pre-generated first key information; forming, by the first client, a mail digest based on the mail data; encrypting, by the first client, the mail data and the mail digest respectively based on the first key information to obtain first mail ciphertext and a digital signature; sending, by the first client, the first mail ciphertext and the digital signature to a forwarding node; receiving, by a second client, the first mail ciphertext and the digital signature; receiving, by the second client, second key information; decrypting, by the second client, the first mail ciphertext and the digital signature respectively based on the second key information to obtain the mail data and the mail digest; calculating, by the second client, a copy of the digest based on the mail data; and confirming, by the second client, that the mail data is received securely in the case that the mail digest and the copy of the digest are consistent.

[0014] A fourth aspect of the present disclosure provides a device for secure communication of mail, the device being applied to a first client, the device comprising: a first client obtaining module configured to obtain mail information and pre-generated first key information, the mail information comprising mail data and metadata; a digest forming module configured to form a mail digest based on the mail data; an encryption module configured to encrypt the mail data and the mail digest respectively based on the first key information to obtain first mail ciphertext and a digital signature; and a sending module configured to send the first mail ciphertext, the digital signature and the metadata to a forwarding node.

[0015] According to an embodiment of the present disclosure, the first key information comprises a first public key, a first private key and a second public key, and the encryption module comprises: a mail data encryption unit configured to, for the mail data, encrypt the mail data based on the first public key to obtain intermediate mail ciphertext; form a proxy key based on the first private key and the second public key; and encrypt the mail ciphertext based on the proxy key to obtain the first mail ciphertext.

[0016] According to an embodiment of the present disclosure, the encryption module further comprises: a mail digest encryption unit configured to, for the mail digest, encrypt the mail digest based on the first private key to obtain the digital signature.

[0017] According to an embodiment of the present disclosure, the first key information further comprises an intermediate key, and the device further comprises: an intermediate key encryption module configured to encrypt the first mail ciphertext based on the intermediate key to obtain second mail ciphertext, wherein the intermediate key is periodically updated; and the forwarding module is further configured to send the second mail ciphertext and the digital signature to a forwarding node.

[0018] A fifth aspect of the present disclosure provides a mail secure communication device, the device is applied to a second client, the device comprises: a second client receiving module configured to receive a first mail ciphertext and a digital signature; the second client receiving module is further configured to receive second key information; a decryption module configured to decrypt the first mail ciphertext and the digital signature based on the second key information, to obtain mail data and a mail digest; a digest replica calculating module configured to calculate a digest replica based on the mail data; and a mail data secure receiving confirming module configured to confirm the mail data secure receiving in the case that the mail digest and the digest replica are consistent.

[0019] According to an embodiment of the present disclosure, the second key information comprises a first public key and a second private key, the first mail ciphertext is encrypted based on a proxy re-encryption algorithm, and the decryption module comprises a mail decryption module configured to decrypt the first mail ciphertext based on the second private key to obtain the mail data.

[0020] According to an embodiment of the present disclosure, the decryption module further comprises a digital signature decryption module configured to decrypt the digital signature based on the first public key to obtain the mail digest.

[0021] According to an embodiment of the present disclosure, the second key information further comprises an intermediate key, the second client receiving module is further configured to receive a second mail ciphertext and a digital signature, and the decryption module is further configured to decrypt the second mail ciphertext based on the intermediate key to obtain the first mail ciphertext, the intermediate key being periodically updated.

[0022] A sixth aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the mail secure communication method.

[0023] A seventh aspect of the present disclosure further provides a computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the mail secure communication method.

[0024] An eighth aspect of the present disclosure further provides a computer program product comprising a computer program that, when executed by a processor, implements the mail secure communication method.

[0025] In the embodiments of the present disclosure, in order to solve the technical problems that the mail authenticity cannot be guaranteed or the mail content is stolen in the sending of the mail between different network domains, in the embodiments of the present disclosure, a mail secure communication method is provided by respectively encrypting mail data and mail abstract and sending to a second client through a bastion host to realize mail secure communication, guaranteeing the security and integrity of the mail.

[0026] The present scheme can achieve at least the following beneficial effects:

[0027] 1. Confidentiality

[0028] The traditional mail forwarding scheme needs to send the mail in plaintext to the mail server, and there is a risk of abusing the mail content. The method of the present patent always exists in the form of ciphertext in the forwarding process, and valuable information cannot be read.

[0029] 2. Security

[0030] The scheme can resist collusion attacks, that is, the collusion of the first client and the forwarding node cannot obtain the private key of the second client, and the collusion of the second client and the forwarding node cannot obtain the private key of the first client. BRIEF DESCRIPTION OF DRAWINGS

[0031] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of the embodiments of the present disclosure taken in conjunction with the accompanying drawings, in which:

[0032] Figure 1 A schematic application scenario diagram of a mail secure communication method according to an embodiment of the present disclosure is shown;

[0033] Figure 2 A schematic flowchart of a mail secure communication method according to an embodiment of the present disclosure is shown;

[0034] Figure 3 A schematic flowchart of a mail secure communication method according to an embodiment of the present disclosure is shown;

[0035] Figure 4 A schematic flowchart of another mail secure communication method according to an embodiment of the present disclosure is shown;

[0036] Figure 5 A schematic flowchart of another mail secure communication method according to an embodiment of the present disclosure is shown;

[0037] Figure 6 A schematic flowchart of a mail secure communication method according to an embodiment of the present disclosure is shown;

[0038] Figure 7 A schematic structural block diagram of a mail secure communication device according to an embodiment of the present disclosure is shown;

[0039] Figure 8 A structural block diagram of a mail secure communication device according to an embodiment of the disclosure is schematically shown; and

[0040] Figure 9 A block diagram of an electronic device suitable for implementing a mail secure communication method according to an embodiment of the disclosure is schematically shown. DETAILED DESCRIPTION

[0041] Hereinafter, embodiments of the disclosure will be described with reference to the accompanying drawings. However, it is to be understood that these descriptions are merely exemplary and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of embodiments of the disclosure. However, it will be apparent to one skilled in the art that one or more embodiments can be practiced without these specific details. In other instances, well-known structures and techniques have been omitted in order to avoid obscuring the concepts of the disclosure.

[0042] The terms used herein are merely used to describe specific embodiments and are not intended to limit the disclosure. The terms "include", "comprise" and the like used herein indicate the presence of the described features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0043] All terms used herein, including technical and scientific terms, have meanings commonly understood by one of ordinary skill in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the specification, and should not be interpreted in an idealized or overly formal manner.

[0044] In the case of using expressions similar to "at least one of A, B, and C, etc.", it should be generally interpreted as having a meaning that includes one or more of the corresponding items (for example, "a system having at least one of A, B, and C" should include a system having A alone, a system having B alone, a system having C alone, a system having A and B together, a system having A and C together, a system having B and C together, and / or a system having A, B, and C together, etc.) in general, as understood by one of ordinary skill in the art.

[0045] Before the embodiments of the disclosure are disclosed in detail, key technical terms involved in the embodiments of the disclosure are described one by one as follows:

[0046] Fortress: A fortress is a security device used to protect the internal network from external attacks. It is usually located between the internal network and the external network, allowing external users to access internal network resources through it. The fortress can implement security functions such as access control, identity verification, data encryption, and audit, thereby protecting internal network resources from unauthorized access.

[0047] Demilitarized Zone: The demilitarized zone refers to the security zone between the internal network and the external network. It is usually composed of multiple layers of defense and security measures, including network isolation, access control, data encryption, intrusion detection and firewall, etc. The demilitarized zone can protect the internal network from external attacks and ensure that the internal network data is not accessed by unauthorized third parties.

[0048] In the scenario of forwarding mail across domains, the delivery of a mail between the sender and the recipient is achieved by one or more forwarding nodes forwarding the mail. For these forwarding nodes, if the sent mail is plaintext data, the mail will be intercepted or eavesdropped in any forwarding node, which will affect the confidentiality of the mail. Especially in the case of a compromised forwarding node, the mail communication will be uncontrollable, and the intrusion tolerance of the mail sending system will be insufficient.

[0049] Specifically, forwarding plaintext mail data at least has the following security risk problems, as follows:

[0050] Man-in-the-middle attack: an attacker can intercept the mail and tamper with the mail content or obtain the sensitive information of the mail during the transmission of the mail, thereby destroying the confidentiality and integrity of the mail.

[0051] Replay attack: an attacker can repeatedly send the mail during the transmission of the mail, thereby destroying the confidentiality and integrity of the mail.

[0052] Malware attack: an attacker can implant malware in the mail to obtain the sensitive information of the recipient or control the computer of the recipient.

[0053] Identity spoofing attack: an attacker can fake the identity of the sender to trick the recipient into opening malicious mail or leaking sensitive information.

[0054] In order to solve the technical problems existing in the prior art, the embodiments of the present disclosure provide a mail secure communication method, which is applied to a first client, and the method comprises: obtaining mail data and pre-generated first key information; forming a mail digest based on the mail data; encrypting the mail data and the mail digest respectively through the first key information to obtain first mail ciphertext and a digital signature; and sending the first mail ciphertext and the digital signature to a forwarding node.

[0055] In the embodiments of the present disclosure, in order to solve the technical problems that the authenticity of the mail cannot be guaranteed or the content of the mail is stolen during the sending of the mail between different domains, in the embodiments of the present disclosure, a mail secure communication method is provided by encrypting the mail data and the mail digest respectively and sending them to a second client through a bastion host, so as to ensure the security and integrity of the mail.

[0056] The scheme can achieve at least the following beneficial effects:

[0057] 1. Confidentiality

[0058] The traditional mail forwarding scheme needs to send the mail in plaintext to the mail server, which has the risk of abusing the mail content. The method of the patent always exists in the form of ciphertext during forwarding, and valuable information cannot be read.

[0059] 2. Security

[0060] The scheme can resist collusion attacks, that is, collusion between the first client and the forwarding node cannot obtain the private key of the second client, and collusion between the second client and the forwarding node cannot obtain the private key of the first client.

[0061] Figure 1 An application scenario diagram of a mail secure communication method according to an embodiment of the present disclosure is schematically shown.

[0062] As shown in Figure 1 According to the application scenario 100 of the embodiment, the terminal device 101, the terminal device 102, and the forwarding node 103 can be included.

[0063] The user can use the terminal device 101 or the terminal device 102 to indirectly communicate with the terminal device 102 or the terminal device 101 through the forwarding node 103. Various communication client applications can be installed on the terminal device 101 and the terminal device 102, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0064] The terminal device 101 and the terminal device 102 can be various electronic devices with display screens and supporting web browsing, including but not limited to smartphones, tablet computers, laptop computers, desktop computers, etc.

[0065] The forwarding node 103 can be a server / fortress machine or other device capable of realizing cross-segment communication that provides mail forwarding services, such as for the user to realize communication between the terminal device 101 and the terminal device 102 through the forwarding node 103.

[0066] It should be noted that the mail secure communication method provided by the embodiment of the present disclosure can generally be executed by the terminal device 101 and the terminal device 102. Accordingly, the mail secure communication device provided by the embodiment of the present disclosure can generally be arranged in the terminal device 101 and the terminal device 102.

[0067] It should be understood that Figure 1The number of terminal devices 101, terminal devices 102, and forwarding nodes 103 in the figure is only illustrative. According to the implementation needs, there can be any number of terminal devices 101, terminal devices 102, and forwarding nodes 103.

[0068] The following will be based on Figure 1 The scenario described, by Figures 2-6 The mail secure communication method of the disclosed embodiment is described in detail.

[0069] In the following, the embodiments of the present disclosure will be disclosed in detail from the perspective of the mail sender, as follows:

[0070] Figure 2 The flowchart of the mail secure communication method according to the embodiments of the present disclosure is schematically shown.

[0071] As Figure 2 shown, the mail secure communication method of the embodiment includes operation S210 to operation S240, which can be executed by the terminal device 101, wherein the first client is arranged in the terminal device 101.

[0072] In operation S210, the mail data and the pre-generated first key information are obtained.

[0073] The mail data, i.e., the mail content uploaded by the user, is received by the first client.

[0074] The first key information can be a symmetric key, the first key information can also be an asymmetric key, and the first key information can also be a key set including both symmetric and asymmetric keys. The first key information can be pre-generated on the terminal device 101, or the first key information can be pre-generated by a remote key generation platform (e.g., generated by an authorized management center).

[0075] In operation S220, a mail digest is formed based on the mail data.

[0076] Specifically, the hash value of the mail data is calculated to generate the mail digest corresponding to the mail data. The mail digest is used to judge whether the mail data has been tampered with during the transmission process. The calculation algorithm of the digest can be a common hash algorithm such as MD5 or SHA1.

[0077] In operation S230, the mail data and the mail digest are respectively encrypted by the first key information to obtain the first mail ciphertext and the digital signature.

[0078] Specifically, the mail data and the mail digest are respectively encrypted by different encryption manners, and the mail data is encrypted to generate the first mail ciphertext, and the mail digest is encrypted to generate the digital signature.

[0079] According to an embodiment of the present disclosure, the first key information includes a first public key, a first private key, and a second public key, and the mail data and the mail digest are respectively encrypted by the first key information to obtain the first mail ciphertext and the digital signature, including: for the mail data, the mail data is encrypted based on the first public key to obtain an intermediate mail ciphertext; a proxy key is formed based on the first private key and the second public key; and the mail ciphertext is encrypted based on the proxy key to obtain the first mail ciphertext.

[0080] Specifically, the formation manner of the first mail ciphertext is as follows:

[0081] First, the mail data "m" is encrypted by the first public key "pk1" to obtain the intermediate mail ciphertext "c1", in other words, c1=Enc(pk1, m), wherein "Enc()" refers to an encryption algorithm, which is an asymmetric encryption algorithm.

[0082] Then, the proxy key "rk" is generated by "sk1" and "pk2", in other words, rk=ReKey(sk1, pk2), wherein "ReKey()" refers to a proxy re-key generation algorithm.

[0083] Finally, the intermediate mail ciphertext "c1" is encrypted by the proxy key "rk" to obtain the first mail ciphertext "c2", in other words, c2=ReEnc(rk, c1), wherein "ReEnc()" refers to a proxy re-encryption algorithm.

[0084] According to an embodiment of the present disclosure, the mail data and the mail digest are respectively encrypted by the first key information to obtain the first mail ciphertext and the digital signature, and further including: for the mail digest, the mail digest is encrypted based on the first private key to obtain the digital signature.

[0085] Specifically, the formation manner of the mail digest is as follows:

[0086] The mail digest "a" is encrypted by the first private key "sk1" to obtain the digital signature "b", in other words, b=Enc(sk1, a), wherein "Enc()" refers to an encryption algorithm, which is an asymmetric encryption algorithm.

[0087] In operation S240, the first mail ciphertext and the digital signature are sent to a forwarding node.

[0088] The forwarding node can be a device such as a bastion host that connects different network domains.

[0089] Specifically, in addition to the first mail ciphertext and the digital signature, metadata (for example, the sender, the recipient, and a number, etc.) also needs to be sent to the forwarding node to guide the forwarding node to forward the first mail ciphertext and the digital signature to the target (for example, the terminal device 102 where the second client is located).

[0090] It should be noted that in the embodiments of the present disclosure, the sender first client and the receiver second client need to be users of the same user group, and for the users of the same user group, corresponding keys are allocated in advance to realize subsequent encrypted communication.

[0091] In the embodiments of the present disclosure, in order to solve the technical problems that the sending of the mail between different network domains cannot guarantee the authenticity of the mail or the content of the mail is stolen, the present disclosure provides a method for realizing secure mail communication by respectively encrypting mail data and mail abstract and sending to the second client through the bastion host to guarantee the security and integrity of the mail.

[0092] The present scheme can at least achieve the following beneficial effects:

[0093] 1. Confidentiality

[0094] The traditional mail forwarding scheme needs to send the mail plaintext to the mail server, which has the risk of misusing the mail content. The method of the present patent always exists in the form of ciphertext during forwarding, and valuable information cannot be read.

[0095] 2. Security

[0096] The scheme can resist collusion attacks, that is, the collusion of the first client and the forwarding node cannot obtain the private key of the second client, and the collusion of the second client and the forwarding node also cannot obtain the private key of the first client.

[0097] On the basis of the above-mentioned encrypted communication, in order to further ensure the security of the mail communication, the following operations can also be further performed:

[0098] Figure 3 A flowchart of a mail secure communication method according to an embodiment of the present disclosure is schematically shown.

[0099] As Figure 3 shown, the mail secure communication method of the embodiment further includes operations S310-S320 performed after the above-mentioned operation S230 in addition to the above-mentioned operations S210-S240.

[0100] According to the embodiments of the present disclosure, the first key information further includes an intermediate key.

[0101] The intermediate key can be a symmetric key.

[0102] In operation S310, the first email ciphertext is encrypted based on the intermediate key to obtain the second email ciphertext, wherein the intermediate key is updated periodically.

[0103] For example, the intermediate key of the symmetric key can be periodically updated at both the sender and receiver to improve the security of the first email ciphertext.

[0104] Specifically, the second encrypted email is formed as follows:

[0105] The first email ciphertext "c2" is encrypted using the intermediate key "k" to obtain the second email ciphertext "c3". In other words, it is denoted as c3 = Enc(k, c2), where "Enc(,)" refers to the encryption algorithm, which is a symmetric encryption algorithm.

[0106] In operation S320, the second email ciphertext and the digital signature are sent to the forwarding node.

[0107] The email can then be propagated by sending a second encrypted email with the corresponding data signature.

[0108] The embodiments of this disclosure will be described in detail below from the perspective of the email receiver:

[0109] Figure 4 A flowchart illustrating another secure email communication method according to an embodiment of this disclosure is shown schematically.

[0110] like Figure 4 As shown, the email secure communication method of this embodiment includes operations S410 to S450, which can be executed by terminal device 102, wherein the second client is set in terminal device 102.

[0111] In operation of S410, the first email ciphertext and digital signature are received.

[0112] Specifically, it receives the first email ciphertext and digital signature from terminal device 101, which is forwarded via a forwarding node.

[0113] In operation S420, the second key information is received.

[0114] The second key information can be a symmetric key, an asymmetric key, or a set of keys that includes both symmetric and asymmetric keys. The first key information can be pre-generated on the terminal device 101 or pre-generated by a remote key generation platform (e.g., generated by an authorization management center).

[0115] In operation S430, the first mail ciphertext and the digital signature are respectively decrypted based on the second key information, to obtain mail data and a mail digest.

[0116] Specifically, the mail data and the mail digest are respectively encrypted by different encryption manners, and the mail data is encrypted to generate the first mail ciphertext, and the mail digest is encrypted to generate the digital signature.

[0117] According to an embodiment of the present disclosure, the second key information comprises a first public key and a second private key, the first mail ciphertext is obtained by encrypting the mail ciphertext based on a proxy re-encryption algorithm, and the second key information is used to respectively decrypt the first mail ciphertext and the digital signature to obtain the mail data and the mail digest, which comprises: for the first mail ciphertext, the first mail ciphertext is decrypted based on the second private key to obtain the mail data.

[0118] Specifically, the decryption manner of the first mail ciphertext is as follows:

[0119] The first mail ciphertext "c2" is decrypted by the second public key "pk2" to obtain the mail data "m", in other words, denoted as m=Dec(sk2, c2), wherein "Dec(, )" refers to a decryption algorithm, and it should be noted that, since the first mail ciphertext is formed by using the proxy re-encryption algorithm, the second public key is used to directly decrypt the first mail ciphertext.

[0120] According to an embodiment of the present disclosure, the second key information comprises a first public key and a second private key, the first mail ciphertext is obtained by encrypting the mail ciphertext based on a proxy re-encryption algorithm, and the second key information is used to respectively decrypt the first mail ciphertext and the digital signature to obtain the mail data and the mail digest, which comprises: for the first mail ciphertext, the first mail ciphertext is decrypted based on the second private key to obtain the mail data.

[0121] Specifically, the decryption manner of the first mail ciphertext is as follows:

[0122] The digital signature "b" is decrypted by the first public key "pk1" to obtain the mail digest "a", in other words, denoted as a=Dec(pk1, b), wherein "Dec(, )" refers to a decryption algorithm, and it should be noted that, since the mail digest is a digital signature encrypted based on the first private key, the first public key is used to decrypt the digital signature.

[0123] In operation S440, a digest copy is calculated based on the mail data.

[0124] Specifically, the mail digest is recalculated by the decrypted mail data, denoted as a digest copy.

[0125] In operation S450, in the case that the mail summary and the summary copy are consistent, it is confirmed that the mail data is safely received.

[0126] By comparing the consistency of the mail summary and the summary copy, it is ensured that the mail is not tampered during transmission

[0127] In the embodiments of the present disclosure, in order to solve the technical problems that the authenticity of the mail cannot be guaranteed or the content of the mail is stolen in the sending of the mail between different network domains, in the embodiments of the present disclosure, a mail secure communication is implemented by respectively encrypting the mail data and the mail summary and sending to the second client through the bastion host, so as to guarantee the security and integrity of the mail.

[0128] The present scheme can at least achieve the following beneficial effects:

[0129] 1. Confidentiality

[0130] The traditional mail forwarding scheme needs to send the mail in plaintext to the mail server, which has the risk of abusing the content of the mail. The method of the present patent always exists in the form of ciphertext during forwarding, and valuable information cannot be read.

[0131] 2. Security

[0132] The scheme can resist collusion attacks, that is, the collusion of the first client and the forwarding node cannot obtain the private key of the second client, and the collusion of the second client and the forwarding node cannot obtain the private key of the first client.

[0133] Of course, on the basis of the above-mentioned encrypted communication, the sender may further encrypt the first mail ciphertext through an intermediate key to form a second mail ciphertext in order to further ensure the security of the mail communication. When the receiver receives the second mail ciphertext, the decryption process is as follows:

[0134] Figure 5 A flowchart of another mail secure communication method according to an embodiment of the present disclosure is schematically shown.

[0135] As shown in the figure, the mail secure communication method of the embodiment further includes operations S510-S520 in addition to the above-mentioned operations S410-S450, and the operation S520 is executed after the above-mentioned operation S420 and before the above-mentioned operation S430. Figure 5

[0136] In operation S510, the second mail ciphertext and the digital signature are received.

[0137] In operation S520, the second mail ciphertext is decrypted based on the intermediate key to obtain the first mail ciphertext, and the intermediate key is periodically updated.

[0138] ​Specifically, the decryption of the second mail ciphertext is as follows:

[0139] The second mail ciphertext c3 is decrypted by the intermediate key k to obtain the first mail ciphertext c2, in other words, c2=Dec(k, c3), wherein "Dec()" refers to a decryption algorithm, and it is to be noted that the above steps of decrypting and verifying the signature of the first mail ciphertext can be repeated.

[0140] Figure 6 The full flowchart of the mail secure communication method according to the embodiment of the present disclosure is schematically shown.

[0141] As shown in Figure 6

[0142] The authorized center generates two public and private key pairs (pk1, sk1) and (pk2, sk2) and an intermediate key k;

[0143] The authorized center transmits (pk1, sk1), pk2 and the intermediate key k to user A for storage;

[0144] The authorized center transmits (pk2, sk2), pk1 and the intermediate key k to user B for storage;

[0145] The key distribution can be as follows: 1. Protocol distribution, which refers to the algorithm and protocol for negotiating and sharing keys by parties, including Diffie-Hellman key exchange, RSA key exchange, ECDH key exchange, kerberos identity authentication protocol, etc. 2. Library distribution methods include the following: manual distribution: the administrator manually distributes the key library to the users or systems that need it, which is suitable for small network environments. 3. Centralized management: the key library is centrally managed on one or more servers, and users obtain the required keys from the server, which is suitable for small and medium-sized network environments. 4. Automatic distribution: using automated tools to automatically distribute the key library to the users or systems that need it, which is suitable for large network environments. 5. PKI (Public Key Infrastructure): by establishing PKI, the key library is distributed according to the certificate, which is suitable for network environments that require high security, such as finance, military, etc.

[0146] User A encrypts the mail data m in the form of c3=Enc(k, ReEnc(ReKey(sk1, pk2), Enc(pk1, m))) to form the ciphertext c3;

[0147] User A calculates the digest a of m using a hash algorithm;

[0148] User A encrypts the digest a in the form of b=Enc(sk1, a) to form the digital signature b;

[0149] ​transmitting c3, b and metadata by user A to the forwarding node to forward the mail to user B

[0150] forwarding c3 and b by the forwarding node to user B;

[0151] decrypting c3 by user B in the form of m = Dec(sk2, Dec(k, c3)) to form the mail data m;

[0152] decrypting b by user B in the form of a = Dec(pk1, b) to form the digest a;

[0153] calculating the digest copy a' of m by user B using a hash algorithm;

[0154] judging the consistency of a and a' by user B to ensure that the mail data m has not been tampered with.

[0155] Based on the above-mentioned mail secure communication method, the present disclosure further provides a mail secure communication device. The following will be described in detail Figure 7 and Figure 8 the mail secure communication device.

[0156] Figure 7 The structure block diagram of the mail secure communication device according to the embodiment of the present disclosure is schematically shown.

[0157] As shown in Figure 7 , the mail secure communication device 700 of the embodiment includes a first client obtaining module 710, a digest forming module 720, an encryption module 730 and a sending module 740.

[0158] The first client obtaining module 710 is configured to obtain mail information and pre-generated first key information, wherein the mail information includes mail data and metadata. In an embodiment, the first client obtaining module 710 can be configured to perform the operation S210 described above, and details are not repeated here.

[0159] The digest forming module 720 is configured to form a mail digest based on the mail data. In an embodiment, the digest forming module 720 can be configured to perform the operation S220 described above, and details are not repeated here.

[0160] The encryption module 730 is configured to encrypt the mail data and the mail digest respectively by the first key information to obtain a first mail ciphertext and a digital signature. In an embodiment, the encryption module 730 can be configured to perform the operation S230 described above, and details are not repeated here.

[0161] The sending module 740 is configured to send the first mail ciphertext, the digital signature, and the metadata to a forwarding node. In an embodiment, the sending module 740 can be configured to perform operation S240 described above, and details are not repeated here.

[0162] In an embodiment of the present disclosure, in order to solve the technical problem that the authenticity of the mail cannot be guaranteed or the content of the mail is stolen in the sending of the mail between different network domains, an embodiment of the present disclosure provides a method for realizing secure communication of the mail by respectively encrypting the mail data and the mail digest and sending to the second client through the bastion host, so as to guarantee the security and integrity of the mail.

[0163] The present scheme can achieve at least the following beneficial effects:

[0164] 1. Confidentiality

[0165] The traditional mail forwarding scheme needs to send the mail in plaintext to the mail server, and there is a risk of abusing the content of the mail. The method of the present patent always exists in the form of ciphertext in the forwarding process, and valuable information cannot be read.

[0166] 2. Security

[0167] The scheme can resist collusion attacks, that is, the collusion of the first client and the forwarding node cannot obtain the private key of the second client, and the collusion of the second client and the forwarding node cannot obtain the private key of the first client.

[0168] According to an embodiment of the present disclosure, the first key information includes a first public key, a first private key, and a second public key, and the encryption module includes: a mail data encryption unit configured to, for the mail data, encrypt the mail data based on the first public key to obtain intermediate mail ciphertext; form a proxy key based on the first private key and the second public key; and encrypt the mail ciphertext based on the proxy key to obtain first mail ciphertext.

[0169] According to an embodiment of the present disclosure, the encryption module further includes: a mail digest encryption unit configured to, for the mail digest, encrypt the mail digest based on the first private key to obtain a digital signature.

[0170] According to an embodiment of the present disclosure, the first key information further includes an intermediate key, and the device further includes: an intermediate key encryption module configured to encrypt the first mail ciphertext based on the intermediate key to obtain second mail ciphertext, wherein the intermediate key is periodically updated; and the forwarding module is further configured to send the second mail ciphertext and the digital signature to a forwarding node.

[0171] According to an embodiment of the present disclosure, any one or more of the first client obtaining module 710, the digest forming module 720, the encrypting module 730, and the sending module 740 can be combined in one module, or any one of them can be split into multiple modules. Alternatively, at least part of the function of one or more of these modules can be combined with at least part of the function of other modules, and implemented in one module. According to an embodiment of the present disclosure, at least one of the first client obtaining module 710, the digest forming module 720, the encrypting module 730, and the sending module 740 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on substrate, a system on package, an application specific integrated circuit (ASIC), or any other reasonable way of hardware or firmware that can be integrated or packaged with a circuit, or implemented in any one of software, hardware, and firmware or in a proper combination of any of them. Alternatively, at least one of the first client obtaining module 710, the digest forming module 720, the encrypting module 730, and the sending module 740 can be at least partially implemented as a computer program module that can perform the corresponding function when the computer program module is run.

[0172] Figure 8 A structural block diagram of the mail secure communication device according to an embodiment of the present disclosure is schematically shown.

[0173] As shown in Figure 8 , the mail secure communication device 800 of this embodiment includes a second client receiving module 810, a decrypting module 820, a digest copy calculating module 830, and a mail data secure receiving confirmation module 840.

[0174] The second client receiving module 810 is configured to receive the first mail ciphertext and the digital signature. In an embodiment, the second client receiving module 810 can be configured to perform the operation S410 described above, and details are not repeated here.

[0175] The second client receiving module 810 is further configured to receive the second key information. In an embodiment, the second client receiving module 810 can be further configured to perform the operation S420 described above, and details are not repeated here.

[0176] The decrypting module 820 is configured to decrypt the first mail ciphertext and the digital signature based on the second key information, respectively, to obtain the mail data and the mail digest. In an embodiment, the decrypting module 820 can be configured to perform the operation S430 described above, and details are not repeated here.

[0177] The summary copy computing module 830 is configured to compute a summary copy based on the mail data. In an embodiment, the summary copy computing module 830 can be configured to perform operation S440 described above, and thus repeated details are not provided herein.

[0178] The mail data secure receiving confirmation module 840 is configured to confirm secure receiving of the mail data when the mail summary and the summary copy are consistent. In an embodiment, the mail data secure receiving confirmation module 840 can be configured to perform operation S450 described above, and thus repeated details are not provided herein.

[0179] In an embodiment of the present disclosure, in order to solve the technical problem that the sending of the mail between different network domains cannot guarantee the authenticity of the mail or the content of the mail is stolen, in an embodiment of the present disclosure, a mail secure communication is implemented by encrypting the mail data and the mail summary respectively and sending to the second client through the bastion host, so as to guarantee the security and integrity of the mail.

[0180] The present scheme can at least achieve the following beneficial effects:

[0181] 1. Confidentiality

[0182] The traditional mail forwarding scheme needs to send the mail in plaintext to the mail server, and there is a risk of abusing the mail content. The method of the present patent always exists in the form of ciphertext in the forwarding process, and valuable information cannot be read.

[0183] 2. Security

[0184] The scheme can resist collusion attacks, that is, the collusion of the first client and the forwarding node cannot obtain the private key of the second client, and the collusion of the second client and the forwarding node cannot obtain the private key of the first client.

[0185] According to an embodiment of the present disclosure, the second key information includes a first public key and a second private key, the first mail ciphertext is obtained by encrypting the mail ciphertext based on a proxy re-encryption algorithm, and the decryption module includes a mail decryption module configured to decrypt the first mail ciphertext based on the second private key to obtain the mail data.

[0186] According to an embodiment of the present disclosure, the decryption module further includes a digital signature decryption module configured to decrypt the digital signature based on the first public key to obtain the mail summary.

[0187] According to an embodiment of the present disclosure, the second key information further comprises an intermediate key, and the second client receiving module is further configured to receive a second mail ciphertext and a digital signature; and the decryption module is further configured to decrypt the second mail ciphertext based on the intermediate key to obtain the first mail ciphertext, wherein the intermediate key is periodically updated.

[0188] According to an embodiment of the present disclosure, any one or more of the second client receiving module 810, the decryption module 820, the digest copy calculating module 830 and the mail data secure receiving confirmation module 840 can be combined in one module, or any one of them can be split into multiple modules. Alternatively, at least part of the function of one or more of these modules can be combined with at least part of the function of the other modules, and implemented in one module. According to an embodiment of the present disclosure, at least one of the second client receiving module 810, the decryption module 820, the digest copy calculating module 830 and the mail data secure receiving confirmation module 840 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system on package, an application specific integrated circuit (ASIC), or any other reasonable way of integrating or packaging a circuit, etc. hardware or firmware, or in any one of software, hardware and firmware three implementation ways or in any appropriate combination of any of them. Alternatively, at least one of the second client receiving module 810, the decryption module 820, the digest copy calculating module 830 and the mail data secure receiving confirmation module 840 can be at least partially implemented as a computer program module which can perform corresponding functions when it is run.

[0189] Figure 9 A block diagram of an electronic device suitable for implementing a mail secure communication method according to an embodiment of the present disclosure is schematically shown.

[0190] As shown in Figure 9 The electronic device 900 according to an embodiment of the present disclosure includes a processor 901 which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 902 or loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 can include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset, and / or a special-purpose microprocessor (such as an application specific integrated circuit (ASIC)), etc. The processor 901 can also include an on-board memory for cache use. The processor 901 can include a single processing unit or a plurality of processing units for performing different actions of the method processes according to an embodiment of the present disclosure.

[0191] In the RAM 903, various programs and data required for the operation of the electronic device 900 are stored. The processor 901, the ROM 902, and the RAM 903 are connected to each other via the bus 904. The processor 901 performs various operations of the method flow according to the embodiments of the present disclosure by executing the programs in the ROM 902 and / or the RAM 903. It should be noted that the programs can also be stored in one or more memories other than the ROM 902 and the RAM 903. The processor 901 can also perform various operations of the method flow according to the embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0192] According to an embodiment of the present disclosure, the electronic device 900 can further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 can further include one or more of the following components connected to the I / O interface 905: an input part 906 including a keyboard, a mouse, etc.; an output part 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage part 908 including a hard disk, etc.; and a communication part 909 including a network interface card such as a LAN card, a modem, etc. The communication part 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as necessary. A removable medium 911 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is mounted on the drive 910 as necessary, so that a computer program read out therefrom is installed in the storage part 908 as necessary.

[0193] The present disclosure also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments; or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, when the one or more programs are executed, the method according to the embodiments of the present disclosure is implemented.

[0194] According to an embodiment of the present disclosure, the computer readable storage medium can be a nonvolatile computer readable storage medium, for example, can include, but is not limited to, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a Read Only Memory (ROM), an Erasable Programmable Read Only Memory (EPROM or Flash memory), a portable compact disc read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In the present disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer readable storage medium can include one or more memories such as the ROM 902 and / or the RAM 903 described above and / or one or more memory other than the ROM 902 and the RAM 903.

[0195] Embodiments of the present disclosure also include a computer program product, which includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the item recommendation method provided by the embodiments of the present disclosure.

[0196] The above-described functions defined in the system / device of the embodiments of the present disclosure are performed when the computer program is executed by the processor 901. According to an embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by computer program modules.

[0197] In one embodiment, the computer program can rely on tangible storage media such as optical storage media, magnetic storage media, etc. In another embodiment, the computer program can also be transmitted, distributed, and downloaded in the form of signals on network media and installed and downloaded through the communication part 909 and / or installed from the detachable medium 911. The program codes contained in the computer program can be transmitted by any appropriate network media, including but not limited to wireless, wired, etc., or any appropriate combination thereof.

[0198] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909 and / or installed from the detachable medium 911. When the computer program is executed by the processor 901, the above-described functions defined in the system of the embodiments of the present disclosure are performed. According to an embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0199] According to embodiments of the present disclosure, program code of the computer program for performing the methods provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages, and can be implemented in a computer program product. Specifically, the computer program can be implemented in a high-level procedural and / or object-oriented programming language, and / or in assembly / machine language. The programming language includes, but is not limited to, Java, C++, python, “C” language, or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's device, and partly on a remote computing device, or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider (ISP).

[0200] The computer program product of the present disclosure can be a computer program product, which is a machine-readable medium (or computer readable medium) having stored therein a sequence of instructions readable by a machine (e.g., a computer). The instructions in the machine-readable medium focus on the function of the computer program (e.g., in the form of a program unit) and on the cooperation behavior between such program units. The program can be distributed over networks coupled to one or more processors or computers, and can be stored on computer readable media including computer program products, hard drives, RAMs, or any other device (internal or external) from which a processor or computer reads incoming data or instructions. In addition to being distributed over the Internet, or over any other publicly or privately accessed network, the aforementioned program product can also be stored in the memory of the respective machine and / or processor.

[0201] Those skilled in the art can understand that the features described in various embodiments of the present disclosure and / or claims can be combined or / and integrated, even if such combinations or integrations are not explicitly described in the present disclosure. In particular, the features described in various embodiments of the present disclosure and / or claims can be combined and / or integrated in various combinations, without departing from the spirit and teachings of the present disclosure. All these combinations and / or integrations fall within the scope of the present disclosure.

[0202] The above describes embodiments of the present disclosure. However, these embodiments are merely for illustrative purposes, and are not intended to limit the scope of the present disclosure. Although each embodiment is described above separately, this does not mean that the measures in each embodiment cannot be used advantageously in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Those skilled in the art can make various substitutions and modifications without departing from the scope of the present disclosure, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims

1. A method for secure communication of mail, characterized by, The method is applied to a first client, The method comprises: obtaining mail data and pre-generated first key information; forming a mail digest based on the mail data; encrypting the mail data and the mail digest respectively by using the first key information to obtain first mail ciphertext and a digital signature; and sending the first mail ciphertext and the digital signature to a forwarding node.

2. The method of claim 1, wherein, Among them, the first key information comprises a first public key, a first private key and a second public key, the first mail ciphertext and the digital signature are obtained by encrypting the mail data and the mail digest respectively by using the first key information, comprising: for the mail data, encrypting the mail data based on the first public key to obtain intermediate mail ciphertext; forming a proxy key based on the first private key and the second public key; and encrypting the mail ciphertext based on the proxy key to obtain the first mail ciphertext.

3. The method of claim 2, wherein, Among them, the first mail ciphertext and the digital signature are obtained by encrypting the mail data and the mail digest respectively by using the first key information, further comprising: for the mail digest, encrypting the mail digest based on the first private key to obtain the digital signature.

4. The method of claim 2, wherein, Among them, the first key information further comprises an intermediate key, after the first mail ciphertext is obtained by encrypting the mail ciphertext based on the proxy key, the method comprises: encrypting the first mail ciphertext based on the intermediate key to obtain second mail ciphertext, wherein the intermediate key is periodically updated; and sending the second mail ciphertext and the digital signature to a forwarding node.

5. A method for secure communication of mail, characterized by The method is applied to a second client, The method comprises: receiving first mail ciphertext and a digital signature; receiving second key information; decrypting the first mail ciphertext and the digital signature respectively based on the second key information to obtain mail data and a mail digest; calculating a digest copy based on the mail data; and in the case that the mail digest and the digest copy are consistent, confirming that the mail data is safely received.

6. The method of claim 5, wherein, Among them, the second key information comprises a first public key and a second private key, and the first mail ciphertext comprises mail ciphertext encrypted based on a proxy re-encryption algorithm, decrypting the first mail ciphertext and the digital signature respectively based on the second key information to obtain mail data and a mail digest, comprising: for the first mail ciphertext, decrypting the first mail ciphertext based on the second private key to obtain the mail data.

7. The method of claim 6, wherein, Among them, decrypting the first mail ciphertext and the digital signature respectively based on the second key information to obtain mail data and a mail digest, further comprising: for the digital signature, decrypting the digital signature by using the first public key to obtain the mail digest.

8. The method of claim 6, wherein, Among them, the second key information further comprises an intermediate key, and the mail secure communication method further comprises: receiving second mail ciphertext and a digital signature; after receiving the second key information before decrypting the first mail ciphertext and the digital signature respectively based on the second key information to obtain mail data and a mail digest, the mail secure communication method further comprises: decrypt the second mail ciphertext based on the intermediate key, to obtain the first mail ciphertext, the intermediate key being periodically updated.

9. A method for secure communication of mail, characterized by The method comprises: obtaining, by the first client, mail data and pre-generated first key information; forming, by the first client, a mail digest based on the mail data; encrypting, by the first client, the mail data and the mail digest respectively through the first key information, to obtain first mail ciphertext and a digital signature; sending, by the first client, the first mail ciphertext and the digital signature to a forwarding node; receiving, by the second client, the first mail ciphertext and the digital signature; receiving, by the second client, second key information; decrypting, by the second client, the first mail ciphertext and the digital signature respectively based on the second key information, to obtain the mail data and the mail digest; calculating, by the second client, a digest copy based on the mail data; and confirming, by the second client, safe reception of the mail data in a case where the mail digest and the digest copy are consistent.

10. A secure mail communication device, characterized by The device is applied to a first client, The device comprises: a first client obtaining module configured to obtain mail information and pre-generated first key information, the mail information comprising mail data and metadata; a digest forming module configured to form a mail digest based on the mail data; an encryption module configured to encrypt the mail data and the mail digest respectively through the first key information, to obtain first mail ciphertext and a digital signature; and a sending module configured to send the first mail ciphertext, the digital signature, and the metadata to a forwarding node.

11. A secure mail communication device, characterized by The device is applied to a second client, The device comprises: a second client receiving module configured to receive first mail ciphertext and a digital signature; the second client receiving module is further configured to receive second key information; a decryption module configured to decrypt the first mail ciphertext and the digital signature respectively based on the second key information, to obtain mail data and a mail digest; a digest copy calculating module configured to calculate a digest copy based on the mail data; and a mail data safe reception confirming module configured to confirm safe reception of the mail data in a case where the mail digest and the digest copy are consistent.

12. An electronic device comprising: one or more processors; a storage device for storing one or more computer programs, characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-8.

13. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method according to any one of claims 1-8.

14. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method according to any one of claims 1-8. The computer program is executed by the processor to implement the steps of the method according to any one of claims 1-8.

Images