Group key negotiation method, communication method and device based on double ratchet algorithm

Abstract

The embodiment of the present application provides a group key negotiation method, a communication method and a device based on a double ratchet algorithm. The method includes: receiving the encryption key and the first plaintext of each second device sent by each second device; randomly generating a second plaintext, and encrypting the second plaintext with the encryption key of the second device for each second device, obtaining a first ciphertext and sending it to the second device; generating its own shared key according to the second plaintext and the first plaintext of all second devices according to a preset key generation method; in response to group communication, generating its own new session key according to the shared key and the preset key update method; when the next preset key negotiation time is reached, and / or, in response to the shared key or session key leakage, returning to the step of receiving the encryption key and the first plaintext of each second device sent by each second device, and obtaining its own new shared key. Information security in group communication can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of big data sharing communication models, and in particular to a group key negotiation method, a communication method and a device based on a double ratchet algorithm. Background Art

[0002] Group key negotiation provides the necessary security support for the big data sharing communication model, which can ensure the security of information in the big data sharing communication model. For the sake of convenience, the big data sharing communication model will be referred to as a group in the following text. Group key negotiation refers to multiple participants (i.e., multiple devices included in the group) establishing a secure session key in an unreliable network environment to ensure the communication security of the group. However, in the current group key negotiation method, all devices in the group usually use the same fixed session key to communicate with other communication devices. Therefore, if the session key is leaked, all information in the communication within the group will be leaked, resulting in low information security in group communication. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a group key negotiation method, a communication method and a device based on a double ratchet algorithm to improve the information security in group communication. The specific technical solution is as follows:

[0004] An embodiment of the present application provides a group key negotiation method based on a double ratchet algorithm, the method is applied to a first device, the first device and at least one second device belong to the same group, the first device is any device in the group, the method includes:

[0005] receiving an encryption key and a first plaintext of each second device sent by each second device, where the first plaintext is randomly generated by each second device, and each second device also sends its own first plaintext to other second devices except itself;

[0006] Randomly generate a second plaintext, and encrypt the second plaintext with the encryption key of the second device for each second device, obtain a first ciphertext and send it to the second device, so that the second device decrypts the received first ciphertext with its own decryption key to obtain the second plaintext, and generates its own group key according to the second plaintext and the first plaintexts of all the second devices according to a preset key generation method, and generates a key according to the preset key update method according to its own group key in response to group communication as its own new group key;

[0007] According to the second plaintext and the first plaintext of all the second devices, the shared key of the device is generated according to the preset key generation method, and in response to the first group communication after obtaining the shared key, the session key of the device is generated according to the shared key according to the preset key update method; in response to the non-first group communication after obtaining the shared key, the new session key of the device is generated according to the shared key and / or part or all of the last round output of the second device according to the preset key update method, wherein the last round output is the output obtained when the device itself generates a key according to the preset key update method last time;

[0008] Generate its own shared key according to the second plaintext and the first plaintext of all the second devices and the preset key generation method;

[0009] In response to the first group communication after obtaining the shared key, generating its own session key according to the shared key and the preset key update method;

[0010] In response to the non-first group communication after obtaining the shared key, generating a new session key of the first device according to the shared key and / or part or all of the previous round output of the first device itself and according to the preset key update method;

[0011] When the next preset key negotiation time is reached, and / or in response to the shared key or session key being leaked, return to the step of receiving the encryption key and the first plaintext of each second device sent by each second device to obtain its own new shared key.

[0012] In a possible embodiment, the method further includes:

[0013] In response to a third device joining the group, receiving an encryption key sent by the third device;

[0014] The second plaintext is encrypted using the encryption key of the third device to obtain a second ciphertext, and the second ciphertext and all the first plaintexts of the second devices are sent to the third device, so that the third device uses its own decryption key to decrypt the received second ciphertext to obtain the second plaintext, and generates its own shared key according to the second plaintext and the first plaintexts of all the second devices according to the preset key generation method, and in response to the first group communication after obtaining the shared key, generates its own session key according to the shared key according to the preset key update method; in response to the non-first group communication after obtaining the shared key, generates its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the second device itself.

[0015] In a possible embodiment, when the next preset key negotiation time is reached, and / or in response to the shared key or session key being leaked, returning to execute the step of receiving the encryption key and the first plaintext of each second device sent by each second device to obtain its own new shared key includes:

[0016] When the next preset key negotiation time is reached, and / or in response to the shared key or session key being leaked, the third device and the second device are used as new second devices, and the steps of receiving the encryption key and the first plaintext of each second device sent by each second device are returned to obtain a new shared key of the second device.

[0017] In a possible embodiment, encrypting the second plaintext using the encryption key of the second device for each second device to obtain the first ciphertext and sending it to the second device includes:

[0018] If a removal instruction for the fourth device is received, for other second devices except the fourth device, the second plaintext is encrypted using the encryption key of the second device to obtain a first ciphertext and send it to the second device;

[0019] If no removal instruction is received, the second plaintext is encrypted with the encryption key of the second device for all the second devices to obtain the first ciphertext and send it to the second device.

[0020] In a possible embodiment, the method further includes:

[0021] sending a verification key of the first device to each of the second devices;

[0022] The step of encrypting the second plaintext by using the encryption key of the second device to obtain the first ciphertext and sending the first ciphertext to the second device includes:

[0023] Encrypting the second plaintext using the encryption key of the second device to obtain a first ciphertext;

[0024] Signing the first ciphertext using a signature key corresponding to the verification key of the first device to obtain a first signature;

[0025] The first ciphertext and the first signature are sent to the second device, so that the second device uses the verification key of the first device to decrypt the first signature. If the decryption result is the same as the first ciphertext, the second device uses its own decryption key to decrypt the received first ciphertext to obtain the second plaintext, and generates its own shared key according to the preset key generation method based on the second plaintext and all the first plaintexts of the second device, and in response to the first group communication after obtaining the shared key, generates its own session key according to the preset key update method according to the shared key; in response to the non-first group communication after obtaining the shared key, generates its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the second device itself.

[0026] In a possible embodiment, generating the own shared key according to the second plaintext and the first plaintext of all the second devices according to the preset key generation method includes:

[0027] Concatenate the second plaintext and the first plaintexts of all the second devices to obtain a concatenated value;

[0028] A hash function is used to convert the concatenated value into a value of a preset length as its own shared key.

[0029] The embodiment of the present application further provides a group communication method, which is applied to a fifth device and includes:

[0030] Encrypting the target plaintext using the session key of the fifth device to obtain the target ciphertext;

[0031] Sending the target ciphertext to each sixth device by means of group communication, so that each sixth device decrypts the target ciphertext using its own session key to obtain the target plaintext;

[0032] The fifth device and the sixth device each determine their own session key according to any of the above-mentioned group key negotiation methods based on the double ratchet algorithm, and the fifth device is the first device or the second device, and the sixth device is other device in the group except the fifth device.

[0033] The embodiment of the present application further provides a group key negotiation device based on a double ratchet algorithm, the device is applied to a first device, the first device and at least one second device belong to the same group, the first device is any device in the group, and the device includes:

[0034] A first plaintext receiving module, used for receiving an encryption key of each second device and a first plaintext sent by each second device, wherein the first plaintext is randomly generated by each second device, and each second device also sends its own first plaintext to other second devices except itself;

[0035] A first ciphertext sending module, used for randomly generating a second plaintext, and for each second device, encrypting the second plaintext with the encryption key of the second device, obtaining a first ciphertext and sending it to the second device, so that the second device decrypts the received first ciphertext with its own decryption key to obtain the second plaintext, and generates its own shared key according to the second plaintext and the first plaintexts of all the second devices according to a preset key generation method, and in response to the first group communication after obtaining the shared key, generates its own session key according to the shared key according to the preset key update method; in response to a non-first group communication after obtaining the shared key, generates its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the second device itself, wherein the previous round output is the output obtained when the device itself generated a key according to the preset key update method last time;

[0036] a shared key generation module, configured to generate its own shared key according to the second plaintext and the first plaintext of all the second devices and according to the preset key generation method;

[0037] A session key generation module, configured to generate its own session key according to the shared key and the preset key update method in response to the first group communication after obtaining the shared key;

[0038] A session key updating module, configured to generate a new session key of the first device according to the preset key updating method in response to a non-first group communication after obtaining the shared key and / or part or all of the previous round output of the first device itself;

[0039] An execution module is used to return to execute the step of receiving the encryption key and the first plaintext of each second device sent by each second device when the next preset key negotiation time is reached and / or in response to the shared key or session key being leaked, so as to obtain its own new shared key.

[0040] The embodiment of the present application further provides a group communication device, which is applied to a fifth device, and includes:

[0041] An encryption module, used to encrypt the target plaintext using the session key of the fifth device itself to obtain a target ciphertext;

[0042] A decryption module, used to send the target ciphertext to each sixth device through group communication, so that each sixth device decrypts the target ciphertext using its own session key to obtain the target plaintext;

[0043] The fifth device and the sixth device each determine their own session key according to any of the above-mentioned group key negotiation methods based on the double ratchet algorithm, and the fifth device is the first device or the second device, and the sixth device is other device in the group except the fifth device.

[0044] The present application also provides an electronic device, including:

[0045] Memory, used to store computer programs;

[0046] The processor is used to implement any of the above-mentioned group key negotiation methods or group communication methods based on the double ratchet algorithm when executing the program stored in the memory.

[0047] The embodiment of the present application also provides a computer program product, which, when executed on a computer, enables the computer to execute any of the above-mentioned group key negotiation methods or group communication methods based on the double ratchet algorithm.

[0048] Beneficial effects of the embodiments of the present application:

[0049] The group key negotiation method, communication method and apparatus based on the double ratchet algorithm provided in the embodiments of the present application can receive the encryption key and the first plaintext of each second device sent by each second device, the first plaintext is randomly generated by each second device, and each second device also sends its own first plaintext to other second devices except itself; the first device randomly generates a second plaintext, and encrypts the second plaintext with the encryption key of the second device for each second device respectively, obtains the first ciphertext and sends it to the second device, so that the second device uses its own decryption key to decrypt the received first ciphertext to obtain the second plaintext, and the second device decrypts the received first ciphertext based on the second plaintext and the decryption key. The first plaintext of the second device generates its own shared key according to the preset key generation method, and in response to the first group communication after obtaining the shared key, generates its own session key according to the preset key update method based on the shared key; in response to the non-first group communication after obtaining the shared key, generates its own new session key according to the preset key update method based on the shared key and / or part or all of the previous round output of the second device itself, wherein the previous round output is the output obtained when the device itself generated the key according to the preset key update method last time; the first device generates its own shared key according to the preset key generation method based on the second plaintext and the first plaintexts of all second devices. In the process of generating the shared key, the first plaintext and the second plaintext are both randomly generated, and the first plaintext is encrypted according to the encryption key of each second device and then sent to each second device, which ensures the confidentiality of the first plaintext, so that only the devices in the group can generate the shared key according to the random first plaintext and the second plaintext, and avoid the shared key from being leaked. At the same time, since the first plaintext and the second plaintext obtained by the first device and each second device are the same, and the preset key generation method used is the same, the shared key generated by the first device and each second device based on the first plaintext and the second plaintext is the same. Therefore, during the group communication process, each device in the group can generate its own session key according to the shared key and the preset key update method in response to the first group communication after obtaining the shared key, and generate its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the first device itself in response to the non-first group communication after obtaining the shared key, so that during the group communication, each device in the group can correspond to different rounds of group communication and use the same new session key to encrypt or decrypt the information transmitted in the group communication of that round.That is to say, during group communication, the sending and receiving of information in one communication corresponds to one session key, and the sending and receiving of information in different communications corresponds to different session keys. Therefore, even if the session key of a certain communication is leaked, the information transmitted in the previous round of group communication cannot be successfully decrypted according to the session key used in the communication, and the information transmitted in the previous round of group communication cannot be obtained, thereby ensuring the forward security of group communication. In addition, it can be understood that both the shared key and the session key can be regarded as the group key, and two adjacent preset key negotiation moments can divide a time period in time, and multiple preset key negotiation moments can divide time into multiple different time periods. By re-negotiating the group key when the next preset key negotiation moment is reached, it can be ensured that the shared keys used for group communication in different time periods divided according to each preset key negotiation moment are different. Even if the shared keys used in a certain time period are cracked, the shared keys used for communication in other subsequent time periods will not be leaked, thereby ensuring the backward security of group communication. Even if the shared key or session key used in group communication is leaked, the group key negotiation can be performed again in response to the shared key or session key leak to obtain a new shared key and session key, that is, a new group key, and the new group key is used for communication to ensure the security of subsequent group communication, that is, to ensure the backward security of group communication. It can be seen that the embodiment of the present application can ensure both the forward security of group communication and the backward security of group communication, thereby improving the information security in group communication.

[0050] In the embodiment of the present application, when the next preset key negotiation time is reached and / or a group key leak occurs, a new round of group key negotiation can be performed, and a new round of shared keys can be obtained according to the first plaintext and the second plaintext according to the preset key generation method to implement the update iteration of the shared keys. In addition, after the group key negotiation is performed in the current round to obtain the shared keys of the current round, the session keys used in the group communication in the current round can be continuously updated according to the preset key update method based on the shared keys of the current round. After the group key negotiation is performed in the next round to obtain the shared keys of the next round, the session keys used in the group communication in the next round can be continuously updated according to the preset key update method based on the shared keys of the next round. That is to say, the embodiment of the present application includes multiple different rounds of updating and iterating the shared key, and in each round, the session key in that round can be updated according to the shared key negotiated in that round, which is equivalent to embedding the update and iteration of the session key in each round in the round of updating and iterating the shared key, and neither the update and iteration of the shared key nor the update and iteration of the session key can reverse the key before iteration according to the key after iteration. Therefore, these two update and iteration processes can be regarded as a one-way iterative update process of a key, which has the same one-way characteristic as the ratchet. Therefore, these two update and iteration processes have the same characteristics as the double ratchet structure formed by the two ratchets, and the scheme of the present application is implemented based on these two update and iteration processes. Therefore, it can be regarded as a group key negotiation method based on the double ratchet algorithm.

[0051] Of course, implementing any product or method of the present application does not necessarily require achieving all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0053] Figure 1 A schematic diagram of a flow chart of a group key negotiation method based on a double ratchet algorithm provided in an embodiment of the present application;

[0054] Figure 2 A schematic diagram of a process for generating a group key of a device itself provided in an embodiment of the present application;

[0055] Figure 3a A schematic diagram of a process for updating a session key using a key derivation function provided in an embodiment of the present application;

[0056] Figure 3bAnother schematic diagram of a process of updating a session key using a key derivation function provided in an embodiment of the present application;

[0057] Figure 3c A schematic diagram of another process of updating a session key using a key derivation function provided in an embodiment of the present application;

[0058] Figure 4a Another schematic diagram of a flow chart of a group key negotiation method based on a double ratchet algorithm provided in an embodiment of the present application;

[0059] Figure 4b A timeline diagram provided for an embodiment of the present application;

[0060] Figure 4c Another timeline schematic diagram provided for an embodiment of the present application;

[0061] Figure 5 A schematic diagram of another flow chart of a group key negotiation method based on a double ratchet algorithm provided in an embodiment of the present application;

[0062] Figure 6a A schematic diagram of another flow chart of a group key negotiation method based on a double ratchet algorithm provided in an embodiment of the present application;

[0063] Figure 6b A schematic diagram of another process of a group key negotiation method based on a double ratchet algorithm provided in an embodiment of the present application;

[0064] Figure 7 A schematic diagram of a flow chart of a group communication method provided in an embodiment of the present application;

[0065] Figure 8 A schematic diagram of a process of group communication provided in an embodiment of the present application;

[0066] Fig. 9 A schematic diagram of the structure of a group key agreement device based on a double ratchet algorithm provided in an embodiment of the present application;

[0067] Fig.10 A schematic diagram of the structure of a group communication device provided in an embodiment of the present application;

[0068] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0069] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field based on the present application belong to the scope of protection of the present application.

[0070] In order to more clearly explain the group key negotiation method, communication method and device based on the double ratchet algorithm provided by the present application, some terms appearing in this document are explained below:

[0071] Double Ratchet Algorithm: Double ratchet algorithm is a key negotiation and encryption communication scheme commonly used in cryptographic protocols, which aims to provide end-to-end secure communication. The design goal of the double ratchet algorithm is to protect the information content and communication security of both parties in an insecure communication environment. The core idea of ​​the double ratchet algorithm is to use two independent ratchet algorithms to manage long-term keys and temporary session keys. The double ratchet algorithm can achieve forward security and backward security, that is, protect the past and future communication content from key leakage or cracking. During the communication process, the double ratchet algorithm can ensure that the keys of the two parties in communication are always synchronized and updated. Whenever one party sends information, it will use its own ratchet algorithm to update the key and send the updated key to the other party so that the other party can perform the corresponding key update. In the following text, the long-term key is called the shared key and the temporary session key is called the session key.

[0072] Forward Secrecy: Forward secrecy ensures that new keys generated after a certain point in time will not leak past communication content, which can ensure the confidentiality of communication sessions before the current communication session. In other words, even if an attacker obtains the shared key of the current communication session, he cannot decrypt the communication content of the previous communication session encrypted by the key. Forward secrecy is one of the important attributes for protecting communication security. When facing the risk that the shared key may be leaked or destroyed, forward secrecy can ensure that the content of past communications remains confidential, which helps reduce the impact of security risks on communications.

[0073] Self-healing: The rapid self-healing of a cryptographic scheme is a key feature that ensures that the cryptographic system can quickly recover and maintain a secure state when attacked or when a key is leaked. In terms of key updates, self-healing means that the cryptographic system can quickly generate new keys and apply them to the affected communications or data encryption. Even if an attacker obtains the shared key of the current communication session, the communication content of subsequent communication sessions cannot be decrypted because the subsequent communication sessions have been encrypted with the new key. A cryptographic scheme with rapid self-healing can better respond to potential security threats and attack incidents, minimize the impact of attacks on the cryptographic system, and protect the data security and privacy of users.

[0074] KDF (Key Derivation Function): A key derivation function is a cryptographic algorithm used to generate more keys and key-related data, such as encryption keys, verification keys, initialization vectors, etc., from the input initial key material. KDF is commonly used in cryptographic protocols and systems to derive multiple keys or key-related parameters to ensure the security and confidentiality of communications. The input of KDF usually includes one or more initial key materials (such as passwords, seeds, keys, etc.), as well as some additional parameters (such as salt value, number of iterations, etc.). By combining the above inputs with a series of complex hash functions, pseudo-random functions, or cryptographic algorithms, KDF can generate high-quality, unique, and secure keys.

[0075] Symmetric key ratchet: Symmetric key ratchet is also called message key ratchet or key derivation function ratchet. Every time a user sends or receives a message, a key derivation function is used to derive the next key from the current key. The above process is irreversible, that is, even if the current key is known, the previous key cannot be calculated. Therefore, the symmetric key ratchet can ensure forward security.

[0076] DH (Diffie-Hellman, a public key algorithm) ratchet: Based on the Diffie-Hellman key exchange protocol, the Diffie-Hellman ratchet is used to periodically update the shared key of both parties. After a certain time interval or number of messages, the communicating parties will perform a new key exchange and generate a new session key. The above process is independent of the evolution of the symmetric key ratchet, which further enhances security.

[0077] In order to more clearly illustrate the group key negotiation method based on the double ratchet algorithm provided by the present application, the possible application scenarios of the group key negotiation method based on the double ratchet algorithm provided by the present application will be exemplified below. It can be understood that the following examples are only possible application scenarios of the group key negotiation method based on the double ratchet algorithm provided by the present application. In other possible embodiments, the group key negotiation method based on the double ratchet algorithm provided by the present application can be applied to other possible application scenarios, and the following examples do not impose any limitations on this.

[0078] In the application scenario of end-to-end encrypted communication, the two parties usually use a key negotiation protocol, such as X3DH (eXtended Triple Diffie-Hellman key exchange) to agree on a shared key. After that, the two parties will use the key derivation function ratchet to generate a session key based on the shared key, that is, each time a message is sent, a new session key is generated using the key derivation function to receive or send encrypted information.

[0079] If an attacker steals the sending and receiving chain keys of one party, the attacker can calculate the keys for all future messages and decrypt all future communication messages. To prevent this, the double ratchet algorithm combines the symmetric key ratchet with the Diffie-Hellman ratchet. Through the periodic update of the Diffie-Hellman ratchet, even if the current key is compromised, it will not affect the security of subsequent sessions. In other words, the double ratchet algorithm can ensure the forward and backward security of communication between the two parties.

[0080] Therefore, in the current application scenarios of end-to-end encrypted communication, the end-to-end encryption scheme implemented by the double ratchet algorithm and the epoch key exchange technology is usually used to effectively improve the security of communication and the flexibility of key management. However, the combination of the double ratchet mechanism and the epoch key exchange may cause certain computing and storage pressures on resource-constrained devices. At the same time, since the epoch key exchange mechanism relies on the synchronization of both devices, the above end-to-end encryption scheme may increase additional communication overhead in the case of asynchrony or information delay.

[0081] In addition, the current double ratchet algorithm is mainly aimed at two-party communication scenarios. It protects the privacy and data security of both parties through the double ratchet algorithm and epoch key exchange technology, but cannot be applied to multi-party communication, that is, it cannot be applied to group communication scenarios. If DH is simply extended to multiple parties, each new participant needs to perform a key exchange with all existing participants, which will cause the computational cost and network communication volume to grow exponentially. In addition, as the number of participants increases, key management becomes extremely complex. Simply applying the double ratchet algorithm to a multi-party scenario requires ensuring that each participant has the correct set of keys to communicate securely with other parties, which will increase the burden on key storage and updates for each participant.

[0082] In group communication application scenarios, group key negotiation is usually used to ensure the security of information in group communication. Group key negotiation needs to solve problems such as network latency and asynchronous interaction among members that are common in distributed systems, and also ensure the two-way security of communication in dynamic changes. In addition, in the face of the massive information flow and processing pressure brought by big data sharing, the group key negotiation method needs to have lower computing and communication overhead to adapt to resource-constrained scenarios.

[0083] Based on this, in order to improve the information security in group communication, reduce the computation and communication overhead of group key negotiation, and realize group communication in an asynchronous environment, the present application provides a group key negotiation method based on a double ratchet algorithm, which is applied to a first device, the first device and at least one second device belong to the same group, and the first device is any device in the group, see Figure 1 , the group key negotiation method based on the double ratchet algorithm includes:

[0084] S101, receiving the encryption key of each second device and the first plaintext sent by each second device.

[0085] The first plaintext is randomly generated by each second device, and each second device also sends its own first plaintext to other second devices except itself.

[0086] S102, randomly generate a second plaintext, and encrypt the second plaintext with the encryption key of the second device for each second device respectively, obtain the first ciphertext and send it to the second device, so that the second device decrypts the received first ciphertext with its own decryption key to obtain the second plaintext, and generates its own shared key according to the second plaintext and the first plaintexts of all second devices according to the preset key generation method, and in response to the first group communication after obtaining the shared key, generates its own session key according to the shared key according to the preset key update method; in response to the non-first group communication after obtaining the shared key, generates its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the second device itself, wherein the previous round output is the output obtained when the device itself generated a key according to the preset key update method last time.

[0087] S103: Generate a shared key of the second device according to the second plaintext and the first plaintext of all second devices and a preset key generation method.

[0088] S104, in response to the first group communication after obtaining the shared key, generating its own session key according to the shared key and a preset key updating method.

[0089] S105, in response to the non-first group communication after obtaining the shared key, generating a new session key of the first device according to a preset key updating method based on the shared key and / or part or all of the previous round output of the first device itself.

[0090] S106, when the next preset key negotiation time is reached, and / or in response to the shared key or session key being leaked, return to the step of receiving the encryption key of each second device itself and the first plaintext sent by each second device to obtain its own new shared key.

[0091] By applying the embodiments of the present application, on the one hand, the first device can receive the encryption key of each second device and the first plaintext sent by each second device, the first plaintext is randomly generated by each second device, and each second device also sends its own first plaintext to other second devices other than itself; the first device randomly generates a second plaintext, and encrypts the second plaintext for each second device using the encryption key of the second device, obtains a first ciphertext and sends it to the second device, so that the second device uses its own decryption key to decrypt the received first ciphertext to obtain a second plaintext, and the second device decrypts the received first ciphertext based on the second plaintext and the first plaintexts of all second devices. According to the preset key generation method, the shared key of the device is generated, and in response to the first group communication after obtaining the shared key, the session key of the device is generated according to the preset key update method according to the shared key; in response to the non-first group communication after obtaining the shared key, the new session key of the device is generated according to the preset key update method according to the shared key and / or part or all of the previous round output of the second device, wherein the previous round output is the output obtained when the device itself generated the key according to the preset key update method last time; the first device generates its own shared key according to the preset key generation method according to the second plaintext and the first plaintext of all second devices. In the process of generating the shared key, the first plaintext and the second plaintext are both randomly generated, and the first plaintext is encrypted according to the encryption key of each second device and then sent to each second device, which ensures the confidentiality of the first plaintext, so that only the devices in the group can generate the shared key according to the random first plaintext and the second plaintext, and avoid the disclosure of the shared key. At the same time, since the first plaintext and the second plaintext obtained by the first device and each second device are the same, and the preset key generation method used is the same, the shared keys generated by the first device and each second device according to the first plaintext and the second plaintext are the same. Therefore, during the group communication process, each device in the group can generate its own session key according to the shared key and the preset key update method in response to the first group communication after obtaining the shared key, and generate its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the first device itself in response to the non-first group communication after obtaining the shared key, so that during the group communication, each device in the group can use the same new session key to encrypt or decrypt the information transmitted in the group communication of different rounds corresponding to the group communication. That is to say, during the group communication, the sending and receiving of information in one communication corresponds to one session key, and the sending and receiving of information in different communications corresponds to different session keys. Therefore, even if the session key of a certain communication is leaked, the information transmitted in the previous round of group communication cannot be successfully decrypted according to the session key used in the communication, and the information transmitted in the previous round of group communication cannot be obtained, thereby ensuring the forward security of the group communication.Furthermore, it can be understood that both the shared key and the session key can be regarded as the group key. Two adjacent preset key negotiation moments can divide a time period in time, and multiple preset key negotiation moments can divide the time into multiple different time periods. By re-negotiating the group key when the next preset key negotiation moment is reached, it can be ensured that the shared keys used for group communication are different in each different time period divided according to each preset key negotiation moment. Even if the shared keys used in a certain time period are cracked, the shared keys used for subsequent communications in other time periods will not be leaked, thereby ensuring the backward security of the group communication. Even if the shared key or session key used for group communication is leaked, the group key negotiation can be re-performed in response to the leak of the shared key or session key to obtain a new shared key and session key, that is, to obtain a new group key, and use the new group key for communication to ensure the security of subsequent group communication, that is, to ensure the backward security of group communication. It can be seen that the embodiment of the present application can ensure both the forward security of group communication and the backward security of group communication, thereby improving the information security in group communication.

[0092] In the embodiment of the present application, when the next preset key negotiation time is reached and / or a group key leak occurs, a new round of group key negotiation can be performed, and a new round of shared keys can be obtained according to the first plaintext and the second plaintext according to the preset key generation method to implement the update iteration of the shared keys. In addition, after the group key negotiation is performed in the current round to obtain the shared keys of the current round, the session keys used in the group communication in the current round can be continuously updated according to the preset key update method based on the shared keys of the current round. After the group key negotiation is performed in the next round to obtain the shared keys of the next round, the session keys used in the group communication in the next round can be continuously updated according to the preset key update method based on the shared keys of the next round. That is to say, the embodiment of the present application includes multiple different rounds of updating and iterating the shared key, and in each round, the session key in that round can be updated according to the shared key negotiated in that round, which is equivalent to embedding the update and iteration of the session key in each round in the round of updating and iterating the shared key, and neither the update and iteration of the shared key nor the update and iteration of the session key can reverse the key before iteration according to the key after iteration. Therefore, these two update and iteration processes can be regarded as a one-way iterative update process of a key, which has the same one-way characteristic as the ratchet. Therefore, these two update and iteration processes have the same characteristics as the double ratchet structure formed by the two ratchets, and the scheme of the present application is implemented based on these two update and iteration processes. Therefore, it can be regarded as a group key negotiation method based on the double ratchet algorithm.

[0093] On the other hand, the first device can use the encryption key of each second device to encrypt the second plaintext to obtain the first ciphertext, and send the first ciphertext to each second device. Each second device can decrypt the received first ciphertext according to the decryption key corresponding to the encryption key stored in itself, thereby ensuring the confidentiality of the first plaintext, thereby ensuring the confidentiality of the shared key generated according to the first plaintext and the second plaintext. In the above process, each second device does not need to encrypt the first plaintext selected by itself, and can also ensure the confidentiality of the generated shared key, so that each device in the group does not need to perform encryption and decryption calculations on the first plaintext, thereby efficiently realizing key sharing within the group, and significantly reducing the calculation and communication costs during group key negotiation, and reducing the calculation and communication overhead of group key negotiation. In addition, each device in the group updates the negotiated session key by generating a key according to the same preset key update method. In other words, each device can calculate a new session key by itself, and there is no need for all devices to negotiate the new session key online at the same time. Therefore, the embodiment of the present application can ensure that the transmission of information in group communication can remain secure and orderly even when a certain device is asynchronously online, realize group communication in an asynchronous environment, can adapt well to the instability of network conditions, and improve the overall fault tolerance of the group communication system.

[0094] The above S101-S106 will be described exemplarily below:

[0095] In S101, it is assumed that the group includes n devices, and the group is denoted as U, and each device in the group is denoted as U 1 , U 2 , …, U n , then group U={U 1 , U 2 , …, U n}, the first device is any device in group U. If the first step in the group key negotiation is initiated by the first device, that is, the first step is for the first device to send information to each second device, then the first device can be regarded as the initiator of the group key negotiation. In other possible embodiments, the first step in the group key negotiation may not be initiated by the first device. For example, during the group key negotiation, device U 1 First device U 3 Send information to inform device U 3 The first device in the group key negotiation process then executes S101-S105. At this time, the initiator of the group key negotiation is device U. 1 , and the first device is device U 3 If the first device is U 1 , then U 2 , …, Un As the second device, this will be taken as an example below to exemplarily illustrate the group key negotiation method based on the double ratchet algorithm provided in the present application.

[0096] Each device in the group can obtain its own decryption key and encryption key through a pre-set public key encryption scheme. If the public key encryption scheme M=(KG, E, D), KG is the key generation algorithm, E is the encryption algorithm, and D is the decryption algorithm, then the device can calculate its own public key PK (public key) and private key SK (secret key) according to the key generation algorithm KG. The public key PK is used to encrypt information, and the private key SK is used to decrypt information. Therefore, the public key PK can also be regarded as an encryption key, and the private key SK can be regarded as a decryption key. Each device in the group can input different values ​​into the key generation algorithm KG to obtain different decryption keys SK and encryption keys PK. In the following, the decryption key of the i-th device itself is denoted as SK i , the encryption key is denoted as PK i , that is, device U 1 The decryption key is SK 1 , the encryption key is PK 1 ; Equipment U 2 The decryption key is SK 2 , the encryption key is PK 2 ; ..., and so on. The decryption key SK of the same device i and encryption key PK i As a set of corresponding keys, the encryption key PK of a certain device can be i Encrypt a plaintext to obtain the ciphertext corresponding to the plaintext, and use the decryption key SK of the device i Decrypt the ciphertext to obtain the plaintext.

[0097] Each device in the group obtains its own encryption key PK i and the decryption key SK i After that, it can be the second device U 2 , …, U n Only its own encryption key PK i Send to the first device U 1 At the same time, the second device U 2 , …, U n No need to use your own encryption key PK i The first device does not need to send its encryption key PK to any other second device other than itself. 1 is sent to each second device, then in this embodiment, the first device U 1 Can receive the second device U 2 , …, Un The encryption key PK sent i In other possible embodiments, each device in the group may obtain its own encryption key PK i and the decryption key SK i After that, each device in the group will send its own encryption key PK i Send to other devices other than itself, that is, the second device U 2 , …, U n The encryption key PK i Send to the first device U 1 At the same time, the first device U 1 You also need to use your own encryption key PK 1 Sent to each second device.

[0098] As analyzed above, the embodiment of the present application can implement the update iteration of the shared key by repeatedly executing S101-S105. If each execution of S101-S105 is regarded as a different round, then for each different round, each second device needs to randomly generate its own plaintext of the current round as the first plaintext, and send its own first plaintext to other devices in the group except itself. For example, assuming that the first device in the group is U 1 , and there are three second devices in the group, namely U 2 , U 3 , U 4 , then for U 2 , the first device U 1 and other second devices U except the second device 3 , U 4 Both can receive U 2 The first plain text sent. The first plain text can be in any form such as a numerical value or a character. i The first randomly generated plaintext is denoted as r i , the first device is U 1 , the second device is U 2 , …, U n In the example of , i∈[2,n]. The second device U i The first plaintext r generated randomly by itself i The steps of sending to other devices in the group except the second device U i The encryption key PK i The steps of sending to other devices in the group except the device itself may be performed simultaneously or sequentially.

[0099] In S102, the first device U 1 Randomly generate the second plaintext r1 , the second plaintext r 1 It can be in any form, such as numeric value or character, and the second plaintext r 1 The form should be the same as the first plaintext r i And respectively for each second device U i , using the second device U i The encryption key PK i For the second plaintext r 1 Encrypt and get the first ciphertext Since each second device will obtain a first ciphertext, the number of first ciphertexts obtained by the first device is the same as the number of second devices. If the first ciphertext set is recorded as ENC, then . First device U 1 The first ciphertext set ENC is sent to each second device.

[0100] As described in S101, for each different round, each second device needs to randomly generate its own plaintext for the current round as the first plaintext. Similarly, for each different round, the first device also needs to randomly generate its own plaintext for the current round as the second plaintext. 1 Randomly generate the second plaintext r 1 The process can be a second device U i Randomly generate its own first plaintext r i The process is carried out simultaneously. i The first plaintext r generated randomly by itself i The process of sending to other devices in the group except itself, and the first device U 1 The process of sending the first ciphertext set ENC to each second device may be performed simultaneously.

[0101] Second device U i Upon receiving the first device U 1 After sending the first ciphertext set ENC, you can use your own decryption key SK i Decrypt the first ciphertext set ENC to obtain the second plaintext r 1 , the process can be expressed as .

[0102] The way in which the second device generates its own shared key is the same as the way in which the first device generates its own shared key in S103 below, and the relevant description in S103 below can be referred to, and no further description is given here. Similarly, the way in which the second device generates its own session key is the same as the way in which the first device generates its own session key in S104-S105 below, and the relevant description in S104-S105 below can be referred to, and no further description is given here.

[0103] In S103, as described in S101 above, each second device randomly generates its own first plaintext, and sends its own first plaintext to other devices in the group except itself, and each second device can obtain the second plaintext by decrypting the first ciphertext set ENC. Therefore, each device in the group can obtain the second plaintext and the first plaintext of all second devices. Since each device in the group generates its own shared key and session key in the same way, the following only describes the first device U 1 The process of generating a shared key and a session key is described as an example. The principle is the same for other devices and will not be repeated here.

[0104] In one possible embodiment, see Figure 2 , the first device U can be generated by the following method 1 Its own shared key, including:

[0105] S1031, concatenate the second plaintext and the first plaintext of all second devices to obtain a concatenated value.

[0106] The second plaintext r 1 and the first plaintext r of all second devices 2 、r 3 ,…,r n Perform the head-to-tail splicing to get the splicing value, then the splicing value can be expressed as r 1 ‖r 2 ‖r 3 ‖…‖r n .

[0107] S1032, using a hash function to convert the concatenated value into a value of a preset length as its own shared key.

[0108] The hash function is defined as , the hash function represents converting a value of indefinite length into a value of a preset length n. 1 The shared key of itself is recorded as SV, then SV=H(r 1 ‖r 2 ‖r 3 ‖…‖r n SV can be regarded as the shared key in the aforementioned DH ratchet. Each device in the group generates the same SV according to the second plaintext and the first plaintext of all second devices in accordance with the preset key generation method.

[0109] In other possible embodiments, the preset key generation method may be to calculate the average value of the second plaintext and the first plaintext of all the second devices. Correspondingly, the average value of the second plaintext and the first plaintext of all the second devices may be used as the first device U 1Its own shared key.

[0110] In S104, the first group communication after obtaining the shared key refers to: the first group communication after each execution of S101-S103 to obtain the shared key. Exemplarily, assuming that S101-S103 are executed at time t1 to obtain the shared key, the first group communication after time t1 is the first group communication after obtaining the shared key, and S101-S103 are executed at time t2 to obtain the shared key, and t2>t1, the first group communication after time t2 is also the first group communication after obtaining the shared key.

[0111] The preset key updating method can be implemented by the aforementioned key derivation function KDF. The first device U1 can input the initial key INK and the shared key SV generated in S103 into the key derivation function KDF to obtain the output of the key derivation function KDF. From left to right, the front preset position located in the output of the key derivation function KDF is used as the input of the next round of the key derivation function KDF, and the other part of the output of the key derivation function KDF is used as the session key of the first device U1 itself. In this embodiment, the number of bits of the front preset position should be less than the number of bits of the output of the key derivation function KDF.

[0112] The above process can be expressed as: KDF(INK, SV)=I‖SEK, where KDF(·,·) is the key derivation function, INK is the initial key, SV is the shared key, I is the input of the next round of the key derivation function, SEK is the session key, and ‖ represents concatenation.

[0113] In other possible embodiments, the first device U1 may also input the shared key generated in S103 into a key derivation function KDF to obtain an output of the key derivation function KDF as a session key.

[0114] In S105, if, when generating the session key, the first preset position at the output of the key derivation function KDF is used as the input of the next round of the key derivation function KDF in order from left to right, and the other part of the output of the key derivation function KDF is used as the session key of the first device U1 itself, then when updating the session key, the shared key and the I output by the first device itself in the previous round can be input into the key derivation function KDF to obtain the new I output by the key derivation function KDF and the new session key, that is, according to the shared key and the part of the first device itself output in the previous round, the new session key of itself is generated according to the preset key update method. In this example, the session key update method can be as follows: Figure 3a As shown, please refer to the following Figure 3a The relevant description will not be repeated here.

[0115] If the output of the key derivation function KDF is used as the session key when generating the session key, then when updating the session key, only the session key output by the first device in the previous round can be input into the KDF to obtain a new session key output by the KDF, that is, according to all the previous round outputs of the first device itself, a new session key of its own is generated according to the preset key update method. In this example, the session key update method can be as follows: Figure 3b As shown, please refer to the following Figure 3b Alternatively, the shared key and the session key output by the first device in the previous round can be input into KDF to obtain a new session key output by KDF, that is, according to the shared key and the first device's previous round output, a new session key is generated according to the preset key update method. In this example, the session key update method can be as follows: Figure 3c As shown, please refer to the following Figure 3c The relevant description will not be repeated here.

[0116] In other possible embodiments, the input of the key derivation function KDF may also include only the shared key. For example, a counter may be set in the key derivation function KDF. Each time the session key is updated, the counter is incremented by one. Each time the aforementioned S101-S103 is executed to obtain a new shared key, the counter is reset to an initial value, which may be any value such as 0, 1, or 2. The output of KDF is obtained based on the shared key and the value of the counter as the session key. Since the counter is incremented by one each time the session key is updated, the values ​​of the counter in different rounds are different when the session key is updated, so that in different rounds of session key update, the session keys obtained based on the shared key and the value of the counter are different. Furthermore, although the value of the counter changes from the initial value when the session key is generated based on shared key 1, after shared key 1 is updated to obtain shared key 2, the value of the counter still changes from the initial value when the session key is generated based on shared key 1, but since shared key 1 and shared key 2 are different, when the session key is generated based on the same counter value, the shared keys based on them are different, so that in different shared key update rounds, the session keys obtained based on the shared keys and the counter values ​​are also different.

[0117] As analyzed above, the embodiment of the present application can implement the update iteration of the shared key by repeatedly executing S101-S105. Several group communications will occur between two shared key update processes. Between the two shared key update processes, the session key can be updated in response to the group communication. Figure 3aAnd the scenario of group communication is exemplified to illustrate the way in which the key derivation function updates the session key. In the scenario of group communication, any device in the group acts as the sender, and all other devices in the group except the sender act as the receiver, and group communication is achieved through information transmission between the sender and the receiver. Exemplarily, assuming that the sender is the aforementioned first device and the receiver is the aforementioned second device, when the first device needs to send plaintext 1, the initial key INK is used as the input 1 of the key derivation function KDF, and the shared key SV is used as the input 2 of KDF to the key derivation function KDF, and the KDF output I and the session key SEK (hereinafter referred to as SEK1) are obtained, and the plaintext 1 is encrypted with SEK1 to obtain the ciphertext 1, and the ciphertext 1 is sent as information to each second device. When the second device receives the ciphertext 1, that is, when the second device receives the information, the initial key INK can be used as the input 1 of the key derivation function KDF, and the shared key SV can be used as the input 2 of the KDF to input the key derivation function KDF, to obtain the KDF output I and SEK1, and use SEK1 to decrypt the received ciphertext 1 to obtain the plaintext 1. In the above process, the second device can obtain SEK1 immediately according to the above method when receiving the ciphertext 1, or it can wait for a period of time after receiving the ciphertext 1 and then obtain SEK1 according to the above method. In the above method, all devices in the group can realize the update of the first round of session keys.

[0118] Afterwards, if the first device needs to send plaintext 2, the first device uses I output by KDF during the first round of session key update as KDF input 1, and the shared key SV as KDF input 2 to KDF, obtains the new I output by KDF and the new session key SEK (hereinafter referred to as SEK2), uses SEK2 to encrypt plaintext 2 to obtain ciphertext 2, and sends ciphertext 2 as information to each second device. When the second device receives ciphertext 2, that is, when the second device receives information, it can use I output by KDF during the first round of session key update as KDF input 1, and the shared key SV as KDF input 2 to KDF, obtain the new I output by KDF and SEK2, and use SEK2 to decrypt the received ciphertext 2 to obtain plaintext 2. Similarly, in the above process, the second device can obtain SEK2 immediately according to the above method when receiving ciphertext 2, or it can wait for a period of time after receiving ciphertext 2 and then obtain SEK2 according to the above method. The above method can enable all devices in the group to update the second round of session keys. By analogy, the devices in the group may update the session key according to the above manner in response to sending information for group communication or receiving information for group communication.

[0119] In other possible embodiments, the information of the first group communication can also be encrypted and decrypted using a shared key, and the information of subsequent rounds of group communication can be encrypted and decrypted using a session key, and the session key can be updated after each group communication information is sent or received. Exemplarily, assuming that the sender is the aforementioned first device, the receiver is the aforementioned second device, and in the first group communication after the devices in the group negotiate to obtain the shared key SV, the first device needs to send plaintext 1. At this time, the first device uses SV to encrypt plaintext 1 to obtain ciphertext 1, and sends ciphertext 1 as information to each second device. When the second device receives ciphertext 1, it uses SV to decrypt the received ciphertext 1 to obtain plaintext 1.

[0120] After sending the plaintext 1, the first device uses the initial key INK as the input 1 of the key derivation function KDF and the shared key SV as the input 2 of the KDF to the key derivation function KDF, and obtains I output by KDF and the session key SEK1. After decrypting and obtaining the plaintext 1, the second device uses the initial key INK as the input 1 of the key derivation function KDF and the shared key SV as the input 2 of KDF to the key derivation function KDF, and obtains I output by KDF and the session key SEK1. In the above manner, all devices in the group can realize the update of the first round of session keys.

[0121] Afterwards, if the first device needs to send plaintext 2 during the second group communication, SEK1 is used to encrypt plaintext 2 to obtain ciphertext 2, and ciphertext 2 is sent to each second device as information. When the second device receives ciphertext 2, SEK1 is used to decrypt the received ciphertext 2 to obtain plaintext 2. After the first device sends plaintext 2, the first device uses I output by KDF during the first round of update as KDF input 1, and the shared key SV as KDF input 2 to KDF, and obtains the new I output by KDF and session key SEK2. After the second device decrypts and obtains plaintext 2, I output by KDF during the first round of update is used as KDF input 1, and the shared key SV is used as KDF input 2 to KDF, and obtains the new I output by KDF and session key SEK2. Through the above method, all devices in the group can realize the update of the second round of session keys. By analogy, each device in the group can update the session key according to the above session key update method, and communicate in group according to the updated session key.

[0122] In other possible embodiments, the shared key may be used to encrypt and decrypt the information of the first group communication, the session key may be used to encrypt and decrypt the information of the subsequent rounds of group communication, and the session key may be updated each time information for group communication is sent or received. Exemplarily, assuming that the sender is the aforementioned first device, the receiver is the aforementioned second device, and in the first group communication after the devices in the group negotiate to obtain the shared key SV, the first device needs to send plaintext 1. At this time, the first device uses SV to encrypt plaintext 1 to obtain ciphertext 1, and sends ciphertext 1 as information to each second device. When the second device receives ciphertext 1, it uses SV to decrypt the received ciphertext 1 to obtain plaintext 1.

[0123] Afterwards, if the first device needs to send plaintext 2 during the second group communication, the initial key INK is used as the input 1 of the key derivation function KDF, and the shared key SV is used as the input 2 of KDF to the key derivation function KDF, and the I output by KDF and the session key SEK are obtained. The plaintext 2 is encrypted using SEK to obtain the ciphertext 2, and the ciphertext 2 is sent as information to each second device. When the second device receives the ciphertext 2, the initial key INK can be used as the input 1 of the key derivation function KDF, and the shared key SV can be used as the input 2 of KDF to the key derivation function KDF, and the I output by KDF and SEK are obtained. The received ciphertext 2 is decrypted using SEK to obtain the plaintext 2. In the above process, the second device can obtain the SEK immediately according to the above method when receiving the ciphertext 2, or it can wait for a period of time after receiving the ciphertext 2 and then obtain the SEK according to the above method. The above method can enable all devices in the group to update the first round of session keys. In subsequent group communications, each device may perform group communication in the manner described in the second group communication, and the devices in the group may update the session key in response to sending information for group communication or receiving information for group communication.

[0124] The way in which the first device updates the session key as the receiver is the same as the way in which the second device updates the session key in the above example, which will not be repeated here. Similarly, the way in which a second device updates the session key as the sender is the same as the way in which the first device updates the session key in the above example, which will not be repeated here.

[0125] In the above-mentioned embodiment of session key update, after obtaining the session key, only the session key is used to encrypt and decrypt the information in the group communication. In other possible embodiments, after obtaining the session key, the sender can also first encrypt the plaintext with the session key during group communication to obtain ciphertext 1, then encrypt ciphertext 1 with the shared key to obtain ciphertext 2, and send ciphertext 2 to the receiver, and the receiver decrypts ciphertext 2 with the shared key to obtain ciphertext 1, and then decrypts ciphertext 1 with the session key to obtain plaintext. In another possible embodiment, after obtaining the session key, the sender can also first encrypt the plaintext with the shared key during group communication to obtain ciphertext 1, then encrypt ciphertext 1 with the session key to obtain ciphertext 2, and send ciphertext 2 to the receiver, and the receiver decrypts ciphertext 2 with the session key to obtain ciphertext 1, and then decrypts ciphertext 1 with the shared key to obtain plaintext.

[0126] Furthermore, in the above-mentioned embodiments of updating the session key, the shared key and the initial key or I are used as inputs of the key derivation function to update the session key. In other possible embodiments, the session key may also be updated by Figure 3b The session key is updated in the session key update method shown in FIG. 1 . In the first round of update, the shared key SV is input into the key derivation function KDF to obtain the session key SEK output by KDF. In the second round of update, the session key SEK output by KDF in the first round of update is input into KDF to obtain the new session key SEK output by KDF. By analogy, a new session key can be obtained in each round of update.

[0127] In other possible embodiments, Figure 3c The session key is updated in the session key update method shown in FIG. 1. In the first round of update, the initial key INK is used as the input 1 of the key derivation function KDF, and the shared key SV is used as the input 2 of the KDF to input the key derivation function KDF to obtain the session key SEK output by KDF. In the second round of update, the SEK output by KDF in the first round of update is used as the input 1 of KDF, and the shared key SV is used as the input 2 of KDF to input the KDF to obtain the new session key SEK output by KDF. By analogy, a new session key can be obtained in each round of update.

[0128] Figure 3a In the session key update method shown, the key derivation function includes two inputs, input 1 is the initial key or KDF output I, and input 2 is the shared key, wherein the shared key is unchanged, and as the session key update round changes, the KDF output I changes, that is, in different session key update rounds, the input 1 of the key derivation function is different. Figure 3bIn the session key update method shown, the input of the key derivation function changes with the change of the session key output by the key derivation function in the previous round, that is, the input of the key derivation function is different in different session key update rounds. Figure 3c In the session key update method shown, the key derivation function includes two inputs, input 1 is the initial key or session key, and input 2 is the shared key, wherein the shared key is constant, and as the session key update round changes, the session key output by the KDF changes, that is, in different session key update rounds, input 1 of the key derivation function is different.

[0129] As analyzed above, Figure 3a , Figure 3b , Figure 3c In the session key update method shown, the input of the key derivation function changes with the change of the session key update round, and the key derivation function is a fixed function. In different session key update rounds, the input of the key derivation function is different, and correspondingly, the session key output by the key derivation function is also different. Therefore, Figure 3a , Figure 3b , Figure 3c The session key updating method shown can make the session keys obtained in different rounds different, thereby realizing the updating of the session key.

[0130] The above has been an exemplary description of the update method of the session key. Figure 1 Example, for Figure 1 S106 in the embodiment is described as an example. In S106, as described above with respect to the key derivation function ratchet, Figure 3a , Figure 3b , Figure 3c The session key update method shown is irreversible, and even if the session key obtained during a round of update is leaked, the session key of the previous round cannot be calculated based on the session key of that round, that is, the group communication content of the previous round will not be cracked, thereby ensuring the forward security of the group communication. However, since the session key is obtained based on the shared key and the initial key, if the shared key and / or the session key are leaked, the session key required for subsequent group communication may be calculated based on the shared key and / or the session key, resulting in a problem of low backward security of the group communication.

[0131] Therefore, in order to improve the backward security of group communication, the shared key used for group communication can be updated through S106. After the shared key is updated through S106 to obtain a new shared key, the above S104-S105 are executed according to the new shared key SV to obtain a new session key for group communication.

[0132] Specifically, the method for updating the shared key used for group communication can be method 1: when the next preset key negotiation time is reached, return to the step of receiving the encryption key and the first plaintext of each second device sent by each second device to obtain its own new shared key.

[0133] Among them, the preset key negotiation moment can be set periodically according to user needs, that is, the duration between two adjacent preset key negotiation moments in each preset key negotiation moment is the same. For the convenience of description below, the duration between two adjacent preset key negotiation moments is referred to as the preset duration. Exemplarily, the preset duration can be set to 10 days, 20 days, 30 days, and so on. If the preset duration is set to 30 days, the time when S101-S105 is executed for the first time to perform group key negotiation is 20210301, that is, the first preset key negotiation moment is 20210301 (the first preset key negotiation moment is March 1, 2021, and the same applies to other preset key negotiation moments below), then the second preset key negotiation moment is 20210331, the third preset key negotiation moment is 20210430, ..., and so on.

[0134] Each time the next preset key negotiation time is reached, the aforementioned S101-S103 needs to be executed once, and the group key negotiation is re-performed, that is, each device in the group generates a new shared key SV by executing S101-S103, and in the subsequent group communication, the aforementioned S104-S105 is executed according to the new shared key SV to obtain a new session key for group communication. Taking the above-mentioned preset key negotiation time as an example, if the current time is 20210312, the next preset key negotiation time is the second preset key negotiation time 20210331, then, when the preset key negotiation time 20210331 is reached, the aforementioned S101-S103 needs to be executed once, and the group key negotiation is re-performed, that is, each device in the group generates a new shared key SV by executing S101-S103, and in the subsequent group communication, the aforementioned S104-S105 is executed according to the new shared key SV to obtain a new session key for group communication.

[0135] In other possible embodiments, the preset key negotiation moment may also be set non-periodically according to user needs. Specifically, if the user needs to update the shared key at a certain moment, the moment may be set as the preset key negotiation moment. Exemplarily, assuming that the moment of the first execution of S101-S105 for group key negotiation is 20210526, that is, the first preset key negotiation moment is 20210526. After that, the user wants to update the shared key on June 10, 2021, then the second preset key negotiation moment is set to 20210610. After that, the user wants to update the shared key again on July 31, 2021, then the third preset key negotiation moment is set to 20210731. In this embodiment, the duration of the interval between two adjacent preset key negotiation moments in each preset key negotiation moment is not exactly the same.

[0136] The method for updating the shared key used for group communication can also be method 2: in response to the shared key or session key being leaked, returning to the step of receiving the encryption key and the first plaintext of each second device sent by each second device to obtain its own new shared key.

[0137] That is to say, when the shared key SV and / or session key SEK is leaked, it is necessary to return to execute the aforementioned S101-S103 and re-negotiate the group key. That is, each device in the group generates a new shared key SV by executing S101-S103, and in subsequent group communications, executes the aforementioned S104-S105 according to the new shared key SV to obtain a new session key for group communication.

[0138] The method for updating the shared key used for group communication can also be the aforementioned method one and the aforementioned method two: when the next preset key negotiation time is reached, return to execute the step of receiving the encryption key and the first plaintext of each second device sent by each second device to obtain its own new shared key; and, in response to the shared key or session key being leaked, return to execute the step of receiving the encryption key and the first plaintext of each second device sent by each second device to obtain its own new shared key.

[0139] In this embodiment, each time the next preset key negotiation time is reached, and when the shared key SV and / or the session key SEK is leaked, it is necessary to execute the aforementioned S101-S103 once and re-negotiate the group key, that is, each device in the group generates a new shared key SV by executing S101-S103, and in subsequent group communications, executes the aforementioned S104-S105 according to the new shared key SV to obtain a new session key for group communication.

[0140] When the shared key used for group communication is updated by the three methods of method 1, method 2, method 1 and method 2, the first device can be a different device from the first device used in the previous group key negotiation. Moreover, when the shared key used for group communication is updated, the steps executed each time are the same, which are the aforementioned S101-S105, but because the first plaintext and the second plaintext are randomly generated, the first plaintext in different shared key update rounds can be regarded as different plaintexts, and the second plaintext in different shared key update rounds can be regarded as different plaintexts. Then, in different shared key update rounds, the shared keys generated according to the first plaintext and the second plaintext are different, and thus the session keys generated according to the shared keys are different, that is, the shared keys and session keys generated each time the aforementioned S101-S105 are executed are different.

[0141] In order to make the first plaintext in different shared key update rounds different plaintexts, and the second plaintext in different shared key update rounds different plaintexts, in a possible embodiment, the first plaintext and the second plaintext are generated in the following manner: each second device and the first device respectively obtain the timestamp of the current shared key update round, use the timestamp as the initial value of the random generation algorithm, and generate the first plaintext and the second plaintext through the random generation algorithm. It can be understood that each shared key update round needs to execute the aforementioned S101-S105, and the time for each execution of the aforementioned S101-S105 is different, that is, the timestamps of different shared key update rounds are different, therefore, in different shared key update rounds, the initial values ​​of the random generation algorithm when generating the first plaintext and the second plaintext are different. Furthermore, since the random generation algorithm uses the initial value, device serial number and other materials as input, and obtains the output result according to the preset corresponding relationship, the output result is the plaintext generated by the random algorithm. Therefore, the plaintext generated by the random generation algorithm according to different initial values ​​should be different, that is, the first plaintext in different shared key update rounds is different plaintext, and the second plaintext in different shared key update rounds is different plaintext. In addition, since the device serial numbers of each device in the group are different, in the same shared key update round, the plaintext generated by the random generation algorithm according to different initial values ​​should be different, that is, the first plaintext and the second plaintext generated by different devices in the same shared key update round are different plaintexts.

[0142] The above S101-S106 have been described as examples. It is understandable that in group communication, group structure adjustment or device update may occur, so the device members included in the group will change. If the number of devices included in the group increases, how to enable the newly added devices to obtain the shared key and session key used in the group communication becomes an urgent problem to be solved.

[0143] Based on this, in a possible embodiment, see Figure 4a The group key negotiation method based on the double ratchet algorithm provided in the present application also includes:

[0144] S401: In response to a third device joining the group, receiving an encryption key sent by the third device.

[0145] Corresponding to the description in S101 above, the third device is recorded as U n+1 , then after the third device joins the group, group U={U 1 , U 2 , …, U n , U n+1}.

[0146] Third Device U n+1 The decryption key SK can be calculated based on the key generation algorithm KG in the public key encryption scheme M=(KG, E, D) n+1 , and the encryption key PK n+1 , and the encryption key PK n+1 Send to the first device U 1 , then the first device U 1 Can receive the third device U n+1 The encryption key PK sent n+1 .

[0147] In this embodiment, the third device U n+1 You can only use the encryption key PK n+1 Send to the first device U 1 , you can also use the encryption key PK n+1 Send to the first device U 1 And all second devices U 2 , …, U n .

[0148] S402, encrypt the second plaintext using the encryption key of the third device to obtain the second ciphertext, and send the second ciphertext and the first plaintext of all second devices to the third device, so that the third device decrypts the received second ciphertext using its own decryption key to obtain the second plaintext, and generates its own shared key according to the second plaintext and the first plaintext of all second devices according to the preset key generation method, and in response to the first group communication after obtaining the shared key, generates its own session key according to the shared key according to the preset key update method; in response to the non-first group communication after obtaining the shared key, generates its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the second device itself.

[0149] First Device U1 Using a third device U n+1 The encryption key PK n+1 For the second plaintext r 1 Encrypt and get the second ciphertext ENC', then , and the first ciphertext ENC' and the first plaintext r of all second devices 2 ‖r 3 ‖…‖r n Send to the third device U n+1 .

[0150] Third Device U n+1 After receiving the first ciphertext ENC' and the first plaintext r of all second devices 2 ‖r 3 ‖…‖r n After that, you can use your own decryption key SK n+1 Decrypt the first ciphertext ENC' to obtain the second plaintext r 1 , that is . Third device U n+1 After getting the second plaintext r 1 After that, the method of generating its own shared key and its own session key is the same as that of the first device U in the aforementioned S103-S105. 1 The method of generating its own shared key and its own session key is the same, and reference may be made to the related descriptions in the aforementioned S103-S105, which will not be repeated here.

[0151] By selecting this embodiment, the encryption key of the third device that joins the group can be received, and the second plaintext can be encrypted with the encryption key to obtain the second ciphertext, and the second ciphertext and the first plaintext of all the second devices can be sent to the third device, so that the third device can decrypt the second ciphertext according to its own decryption key to obtain the second plaintext. In addition, the third device can generate a shared key according to the second plaintext and the first plaintext of all the second devices according to a preset key generation method, and in response to group communication, generate a key according to its own group key and a preset key update method as a session key, so that the third device can obtain the shared key and session key for group communication, and perform group communication normally according to the shared key and session key. At the same time, in the process of the third device obtaining the shared key and session key for group communication, other devices in the group do not need to perform a new group key negotiation again, thereby reducing the calculation and communication overhead of group key negotiation.

[0152] exist Figure 4aIn the illustrated embodiment, since a third device is added to the group, when the shared key used for group communication is updated, the first device, the second device, and the third device included in the group need to jointly negotiate the group key. Figure 4a In the illustrated embodiment, the shared key used for group communication may be updated by the following method three and / or method four.

[0153] Method 3:

[0154] When the next preset key negotiation time is reached, the third device and the second device are used as new second devices, and the process returns to the step of receiving the encryption key and the first plaintext of each second device sent by each second device to obtain a new shared key of the second device.

[0155] The next preset key negotiation time refers to the first preset key negotiation time after the third device joins the group. Figure 4b As shown, Figure 4b Where t1 is the preset key negotiation time 1, t2 is the preset key negotiation time 2, t3 is the time when the third device joins the group, t1<t3<t2. Then, Figure 4b In the example shown, the first preset key negotiation time after the third device joins the group is time t2, that is, the next preset key negotiation time is time t2. When time t2 is reached, the third device and the second device are used as new second devices, and the steps of receiving the encryption key and the first plaintext of each second device sent by each second device are returned to obtain a new shared key for themselves.

[0156] When the next preset key negotiation time is reached, the third device U n+1 and the second device is used as a new second device, the new second device includes: 2 , …, U n , U n+1 At this time, the first device U 1 and the second device U 2 , …, U n , U n+1 Re-execute the aforementioned S101-S103 and re-negotiate the group key, that is, each device in the group generates a new shared key SV by executing S101-S103, and in response to the group communication, executes the aforementioned S104-S105 according to the new shared key SV to obtain a new session key.

[0157] In other possible examples, when the next preset key negotiation time is reached, the third device U may also n+1 As the first new device, the U 1 , U 2 , …, Un As the second device, the aforementioned S101-S103 is executed to renegotiate the group key, that is, each device in the group generates a new shared key SV by executing S101-S103, and in subsequent group communications, the aforementioned S104-S105 is executed according to the new shared key SV to obtain a new session key for group communication.

[0158] If multiple different third devices join the group, then each time a third device joins the group, it is necessary to use the third device and the second device as new second devices at the next preset key negotiation time, return to the step of receiving the encryption key and the first plaintext of each second device sent by each second device, and obtain a new shared key. Exemplarily, assuming that the third device 1 joins the group, then after the third device 1 joins the group and at the next preset key negotiation time, the third device 1 and the second device are used as new second devices, return to the step of receiving the encryption key and the first plaintext of each second device sent by each second device, and obtain a new shared key. Afterwards, if the third device 2 joins the group, then after the third device 2 joins the group and at the next preset key negotiation time, the third device 2 and the second device are used as new second devices, return to the step of receiving the encryption key and the first plaintext of each second device sent by each second device, and obtain a new shared key.

[0159] Method 4:

[0160] In response to the shared key or session key being leaked, the third device and the second device are used as new second devices, and the step of receiving the encryption key and the first plaintext of each second device sent by each second device is returned to obtain a new shared key of the second device.

[0161] On the third device U n+1 After joining the group, if the shared key SV and / or session key SEK is leaked, the third device U n+1 and the second device is used as a new second device, the new second device includes: 2 , …, U n , U n+1 At this time, the first device U 1 and the second device U 2 , …, U n , U n+1 The above steps S101-S105 are executed again to obtain a new shared key SV and a new session key generated according to the new shared key SV.

[0162] In other possible examples, in the third device U n+1After joining the group, if the shared key SV and / or session key SEK is leaked, it can also be leaked by the third device U n+1 As the first new device, the U 1 , U 2 , …, U n As the second device, the aforementioned S101-S103 is executed to renegotiate the group key, that is, each device in the group generates a new shared key SV by executing S101-S103, and in subsequent group communications, the aforementioned S104-S105 is executed according to the new shared key SV to obtain a new session key for group communication.

[0163] It is understandable that after the third device joins the group, when the shared key or session key is leaked for the first time, the third device and the second device are regarded as the new second device. Then, when the shared key or session key is leaked again, the third device is already regarded as the second device, and there is no third device in the group, so there is no need to perform the step of treating the third device and the second device as the new second device. If the shared key or session key is leaked again, a new third device joins the group, then the step of treating the third device and the second device as the new second device is performed. Therefore, in the process of updating the shared key through method 4, the third devices in different update rounds refer to different devices.

[0164] Exemplarily, if the shared key used for group communication is updated through method 4, and assuming that the third device 1 joins the group, then after the third device 1 joins the group, when the shared key or session key is leaked for the first time, the third device 1 and the second device are used as new second devices, and the steps of receiving the encryption key and the first plaintext sent by each second device are returned to obtain a new shared key. Afterwards, if the third device 2 joins the group, then after the third device 2 joins the group, when the shared key or session key is leaked for the first time, the third device 2 and the second device are used as new second devices, and the steps of receiving the encryption key and the first plaintext sent by each second device are returned to obtain a new shared key.

[0165] If the shared key used for group communication is updated through method 3 and method 4, see Figure 4c As shown, Figure 4c Where t1 is the preset key negotiation time 1, t2 is the preset key negotiation time 2, t3 is the time when the third device joins the group, and Figure 4c In the equation t1<t3<t4<t2, if the shared key or session key is leaked at time t4, then Figure 4cIn the example shown, time t4 is less than time t2, that is, after the third device joins the group, before the next preset key negotiation time, i.e., time t2, the shared key or session key is leaked. At this time, when time t4 is reached, it is necessary to respond to the shared key or session key leakage, use the third device and the second device as new second devices, return to the step of receiving the encryption key and the first plaintext of each second device sent by each second device, and obtain its own new shared key. When time t2 is reached, the second device already includes the third device. When time t2 is reached, it is no longer necessary to use the third device and the second device as new second devices, and directly return to the step of receiving the encryption key and the first plaintext of each second device sent by each second device.

[0166] Understandably, Figure 4c This is only one possible example. In other possible examples, time t4 is greater than time t2, that is, after the third device joins the group, before the next preset key negotiation time, that is, time t3, no shared key or session key is leaked. At this time, when time t2 is reached, that is, when the next preset key negotiation time is reached, the third device and the second device are used as new second devices, and the steps of receiving the encryption key and the first plaintext of each second device sent by each second device are returned to obtain the new shared key of the second device. When time t4 is reached, the second device already includes the third device. When time t4 is reached, there is no need to use the third device and the second device as new second devices, and the steps of receiving the encryption key and the first plaintext of each second device sent by each second device are directly returned to.

[0167] By selecting this embodiment, after the third device joins the group, and when the next preset key negotiation time is reached and / or the group key (i.e., shared key or session key) is leaked, the third device and the second device can be used as new second devices, and all devices in the group can re-negotiate the group key together, ensuring that all devices in the group can update the shared key and session key at the same time, thereby improving the timeliness of the shared key and session key update by all devices in the group and also improving the security of group communication.

[0168] The above has been an example of how a newly added device obtains the shared key and session key used in group communication. As described above, the device members included in the group will change, so the number of devices included in the group may not only increase, but also decrease, that is, there may be a situation where a device in the group is deleted. Then, how to prevent the deleted device from joining the group communication and not leak the shared key and session key used in the group communication has become an urgent problem to be solved.

[0169] Based on this, in a possible embodiment, see Figure 5 In the aforementioned S102, for each second device, the second plaintext is encrypted using the encryption key of the second device to obtain the first ciphertext and send it to the second device, including:

[0170] S1021: If a removal instruction for the fourth device is received, for other second devices except the fourth device, the second plaintext is encrypted using the encryption key of the second device to obtain the first ciphertext and send it to the second device.

[0171] The fourth device is denoted as U j , j∈[1,n], then upon receiving the j After the removal instruction is issued, the aforementioned S101-S105 needs to be executed again to re-negotiate the group key so that even if the removed fourth device U j Leaking the shared key and session key used in group communication will not affect the group communication after the shared key and session key are updated.

[0172] During the execution of S101-S105, due to the fourth device U j has been removed, therefore, when the first device encrypts the second plaintext, it needs to use the encryption key of the second device except the fourth device to encrypt the second plaintext, obtain the first ciphertext, and send the first ciphertext to the second device.

[0173] For example, the first device is U 1 For example, in this example, j≠1, the first device uses the encryption key PK 2 , PK 3 ,…,PK j-1 , PK j+1 ,…,PK n Encrypt the second plaintext to get the first ciphertext set .

[0174] When sending the first ciphertext to the second device, the first ciphertext can be sent to all the second devices. In this example, although the fourth device receives the first ciphertext, since the first ciphertext does not contain the ciphertext encrypted by the encryption key of the fourth device, the fourth device still cannot decrypt the first ciphertext to obtain the second plaintext, that is, the fourth device cannot obtain the shared key and the session key. Alternatively, when sending the first ciphertext to the second device, the first ciphertext can be sent to other second devices except the fourth device.

[0175] Afterwards, the other second devices and the first device except the fourth device can obtain the first plaintext and the second plaintext of all the other second devices except the fourth device. Then, the other second devices and the first device except the fourth device, that is, the devices in the group, can generate a new shared key based on the first plaintext and the second plaintext of all the other second devices except the fourth device, and generate a new session key based on the new shared key.

[0176] S1022: If no removal instruction is received, encrypt the second plaintext for all second devices using the encryption key of the second device to obtain the first ciphertext and send it to the second device.

[0177] In the case where the removal instruction is not received, all devices in the group need to participate in the group key negotiation. Therefore, the first device needs to encrypt the second plaintext with the encryption key of the second device for all second devices, obtain the first ciphertext and send it to the second device. S1022 is the same as the specific implementation of S102 above, and the relevant description of S102 above can be referred to, which will not be repeated here.

[0178] By selecting this embodiment, when a removal instruction for the fourth device is received, the second plaintext can be encrypted by using the encryption key of the second device for other second devices except the fourth device, and the first ciphertext is obtained and sent to the second device, so that the fourth device cannot obtain the second plaintext of the first device, thereby making it impossible for the fourth device to generate a new shared key and session key. At the same time, the fourth device cannot continue to participate in group communication, and the fourth device can be prevented from leaking new shared keys and session keys, thereby improving the security of group communication.

[0179] The above has provided an exemplary description of how to prevent the deleted device from joining the group communication and not leak the shared key and session key used in the group communication. As described above, the first device can be regarded as the initiator of the group key negotiation. If an attacker obtains the encryption key of each member in the group and initiates the group key negotiation to each device in the group, the ciphertext received by each device may invade the device and allow the attacker to obtain the relevant information of each device in the group. It is also possible that the determined shared key and session key are obtained by the attacker, thereby reducing the security of the group communication.

[0180] Based on this, in order to further improve the security of group communication, in a possible embodiment, see Figure 6a The group key negotiation method based on the double ratchet algorithm provided in this application includes:

[0181] S107: Send the verification key of the first device to each second device.

[0182] S101, receiving the encryption key of each second device and the first plaintext sent by each second device.

[0183] S102a, randomly generate a second plaintext, and encrypt the second plaintext using the encryption key of the second device for each second device to obtain a first ciphertext.

[0184] S102b: Sign the first ciphertext using a signature key corresponding to the verification key of the first device to obtain a first signature.

[0185] S102c, sending the first ciphertext and the first signature to the second device, so that the second device uses the verification key of the first device to decrypt the first signature. If the decryption result is the same as the first ciphertext, the second device uses its own decryption key to decrypt the received first ciphertext to obtain a second plaintext, and generates its own shared key according to the second plaintext and the first plaintexts of all second devices according to a preset key generation method, and in response to the first group communication after obtaining the shared key, generates its own session key according to the shared key according to a preset key update method; in response to the non-first group communication after obtaining the shared key, generates its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the second device itself, wherein the previous round output is the output obtained when the device itself generated a key according to the preset key update method last time.

[0186] S103: Generate a shared key of the second device according to the second plaintext and the first plaintext of all second devices and a preset key generation method.

[0187] S104, in response to the first group communication after obtaining the shared key, generating its own session key according to the shared key and a preset key updating method.

[0188] S105, in response to the non-first group communication after obtaining the shared key, generating a new session key of the first device according to a preset key updating method based on the shared key and / or part or all of the previous round output of the first device itself.

[0189] S106, when the next preset key negotiation time is reached, and / or in response to the shared key or session key being leaked, return to the step of receiving the encryption key of each second device itself and the first plaintext sent by each second device to obtain its own new shared key.

[0190] Figure 6a The embodiment shown and Figure 1 The difference of the embodiment shown is that: Figure 1Based on the embodiment shown, S107 is added, and S102 includes S102a-S102c. S101 and S103-S106 have been described exemplarily in the foregoing text, so only S107 will be described in the following text. Figure 6a S107 and S102a-S102c in are exemplarily described.

[0191] In S107, the first device may obtain its own signature key and verification key through a pre-set digital signature scheme. , is the key generation algorithm, S is the signature algorithm, and V is the signature verification algorithm. Then the first device can use the digital signature scheme In Calculate its own signature key DK i And the verification key VK i .

[0192] Since the first device is any device in the group, each time the group key negotiation method based on the double ratchet algorithm provided in the present application is executed, the first device can be a different device. Therefore, if only the first device generates its own signature key DK each time, i And the verification key VK i , when performing different rounds of group key negotiation, a different first device may need to regenerate its own signature key DK each time i And the verification key VK i And the verification key VK i The group key negotiation is sent to the second device, resulting in a high communication cost for group key negotiation.

[0193] Therefore, in one possible embodiment, all devices in the group can use the digital signature scheme In Calculate its own signature key DK i And the verification key VK i , and its own verification key VK i Send to other devices in the group except the device itself.

[0194] Understandably, Figure 6a The order of the steps shown is only a possible example. In other possible embodiments, S107 and S101 may be executed simultaneously, or S101 may be executed first and then S107.

[0195] In S102a, the method of obtaining the first ciphertext is the same as the method of obtaining the first ciphertext in the aforementioned S102. Please refer to the relevant description of the aforementioned S102, which will not be repeated here.

[0196] In S102b, the first device is used as U 1 For example, the first device U 1 The signing key is DK 1 , the verification key is VK 1 . Using the signature key DK 1 Sign the first ciphertext set ENC to obtain the first signature SIG, then .

[0197] In S102c, the first device may send the first ciphertext set ENC and the first signature SIG to the second device. After receiving the first ciphertext and the first signature sent by the first device, the second device may decrypt the first signature according to the verification key of the first device, obtain the decryption result, and determine whether the decryption result is the same as the first ciphertext. If the decryption result is the same as the first ciphertext, it means that the information received by the second device is sent by the first device, and the received first ciphertext can be decrypted to obtain the second plaintext, and then obtain its own shared key and session key, and the first device executes S103-S105 to obtain its own shared key and session key. If the decryption result is different from the first ciphertext, it means that the information received by the second device is not sent by the first device, then this round of group key negotiation can be terminated, the second device no longer decrypts the first ciphertext, and the first device does not need to execute S103-S105.

[0198] For example, the first device is U 1 For example, the second device uses the verification key VK of the first device 1 Decrypt the first signature and get the decrypted result , and determine whether the de-signed result is the same as the first ciphertext set ENC. , that is , it means that the information received by the second device is received by the first device U 1 The second device can decrypt the received first ciphertext set ENC to obtain the second plaintext r 1 , and then obtain its own shared key and session key, and the first device executes S103-S105 to obtain its own shared key and session key. , it means that the information received by the second device is not received by the first device U 1 The second device no longer decrypts the first ciphertext, and the first device U 1 There is no need to execute S103-S105. The manner in which the second device obtains its own shared key and session key can refer to the above description of S103-S105, which will not be repeated here.

[0199] By selecting this embodiment, the first device can use its own signature key to sign the first ciphertext to obtain the first signature, and send the first signature and the first ciphertext to the second device. The second device uses the verification key of the first device to de-sign the first signature, and determines whether the de-signed result is the same as the first ciphertext to determine whether the device sending information to the second device is the first device. If the de-signed result is the same as the first ciphertext, the device sending information to the second device is the first device, and the group key negotiation can continue to obtain the shared key and session key of each device. In this embodiment, the above-mentioned verification method can avoid the influence of the information sent by the external device to the second device on the group key negotiation process, thereby ensuring the security of the group key negotiation process and improving the security of group communication.

[0200] In other possible embodiments, see Figure 6b The group key negotiation method based on the double ratchet algorithm shown in FIG. 100 is as follows: in the aforementioned S102b, the first device U 1 You can use the signature key DK 1 For the device set U contained in the group = {U 1 , U 2 , …, U n} and the first ciphertext set ENC to sign, and obtain the first signature SIG, then in this embodiment, For the convenience of description, the device set U included in the group is referred to as the group member set U below.

[0201] Correspondingly, in the aforementioned S102c, the first device may send the group member set U, the first ciphertext set ENC, and the first signature SIG obtained by signing the group member set U and the first ciphertext set ENC to the second device, that is, {U, SIG, ENC} is sent to the second device. This process corresponds to Figure 6b Members of U 1 broadcast The second device needs to determine the received group member set U and the first ciphertext set ENC and the de-signature result Are they the same? , it means that the information received by the second device is received by the first device U 1 The second device can use its own decryption key SK i Decrypt the received first ciphertext set ENC , get the second plaintext r 1 , and then according to the second plaintext r 1 and the first plaintext r of all second devices 2 , r 3 ,…,r n, calculate its own shared key SV = H (r 1 ‖r 2 ‖r 3 ‖…‖r n ), obtains its own session key based on SV, and the first device executes S103-S105 to obtain its own shared key SV and its own session key.

[0202] like , it means that the information received by the second device is not received by the first device U 1 The second device no longer decrypts the first ciphertext, and the first device U 1 There is no need to execute S103-S105.

[0203] By selecting this embodiment, the negotiation of the group key can be completed through only one round of process, which greatly optimizes the allocation of computing and communication resources. The first device, the initiator of the group key negotiation, encrypts the second plaintext n-1 times, that is, the first device only undertakes the encryption task n-1 times, and undertakes the broadcasting task of the first ciphertext, the group member set and the first signature. The remaining n-1 second devices only need to perform a decryption operation once to achieve group key negotiation. Thereby, the overall computing overhead and network communication burden of the group key negotiation method based on the double ratchet algorithm are significantly reduced, and it is suitable for deployment in scenarios with strict restrictions on computing power and network bandwidth. In addition, the computing overhead can be further reduced by selecting a more suitable key generation algorithm. Compared with other group key negotiation methods, the group key negotiation method based on the double ratchet algorithm provided in this application is more efficient and more practical.

[0204] The group key negotiation method based on the double ratchet algorithm provided in this application can be applied to products such as video acquisition equipment and instant messaging tools, thereby building a secure smart Internet of Things ecosystem.

[0205] Based on the aforementioned group key negotiation method based on the double ratchet algorithm, the embodiment of the present application further provides a group communication method, which is applied to the fifth device, see Figure 7 , the group communication method includes:

[0206] S701, encrypt the target plaintext using the session key of the fifth device itself to obtain the target ciphertext.

[0207] S702, sending the target ciphertext to each sixth device through group communication, so that each sixth device uses its own session key to decrypt the target ciphertext to obtain the target plaintext.

[0208] The fifth device and the sixth device each determine their own session key according to any of the aforementioned group key negotiation methods based on the double ratchet algorithm, and the fifth device is the first device or the second device, and the sixth device is other device in the group except the fifth device.

[0209] When this embodiment is selected, during group communication, each target plaintext that needs to be sent corresponds to a separate session key. Even when a sixth device is not online synchronously, the sixth device can subsequently decrypt the target ciphertext according to the session key corresponding to the target ciphertext to obtain the target plaintext, thereby ensuring the security and orderliness of information transmission. The group communication method provided by the present application based on the aforementioned group key negotiation method based on the double ratchet algorithm can adapt well to the instability of network conditions, improve the overall fault tolerance of the group communication system, and ensure the continuity and security of communication without the need for all devices in the group to be online at the same time.

[0210] The following will be combined Figure 8 The group communication schematic diagram shown is an exemplary description of the aforementioned S701-S702.

[0211] Figure 8 The sender is the fifth device in S701-S702, and the receiver is the sixth device in S701-S702. The group key negotiation method based on the double ratchet algorithm and the group communication method provided in this application should be applied to the same group. Therefore, the fifth device is any device in the group to which the group key negotiation method based on the double ratchet algorithm is applied, that is, the fifth device is the aforementioned first device or the aforementioned second device, and the sixth device is the other device in the aforementioned group except the fifth device. And hereinafter, Figure 8 The shared key 1, shared key 2, shared key 3, and shared key 4 are recorded as SV1, SV2, SV3, and SV4 respectively, and the session key 1, session key 2, session key 3, and session key 4 are recorded as SEK1, SEK2, SEK3, and SEK4 respectively.

[0212] The sender inputs the shared key SV1 and the initial key INK into the key derivation function KDF, obtains the KDF output I (denoted as I1) and the session key SEK1, and encrypts the target plaintext m1 with SEK1 to obtain the target ciphertext c1, and sends the target ciphertext c1 to the receiver. The receiver can also input the shared key SV1 and the initial key INK into the key derivation function KDF to obtain the KDF output I1 and the session key SEK1, and use the session key SEK1 to decrypt the received target ciphertext c1 to obtain the target plaintext m1.

[0213] When the sender needs to conduct a new round of group communication, that is, when the target plaintext m2 needs to be sent, the shared key SV2 and I1 can be input into the key derivation function KDF to obtain the new I (denoted as I2) and session key SEK2 output by KDF, and the target plaintext m2 is encrypted by SEK2 to obtain the target ciphertext c2, and the target ciphertext c2 is sent to the receiver. The receiver can also input the shared key SV2 and I1 into the key derivation function KDF to obtain I2 and session key SEK2 output by KDF, and use the session key SEK2 to decrypt the received target ciphertext c2 to obtain the target plaintext m2.

[0214] Similarly, the sender uses the session key SEK3 to encrypt the target plaintext m3, obtains the target ciphertext c3, and sends the target ciphertext c3 to the receiver. The receiver uses the session key SEK3 to decrypt the received target ciphertext c3 and obtains the target plaintext m3. The sender uses the session key SEK4 to encrypt the target plaintext m4, obtains the target ciphertext c4, and sends the target ciphertext c4 to the receiver. The receiver uses the session key SEK4 to decrypt the received target ciphertext c4 and obtains the target plaintext m4.

[0215] exist Figure 8 In the group communication process shown, if the aforementioned group key negotiation method based on the double ratchet algorithm is not re-executed, that is, no new shared key is obtained, then SV1=SV2=SV3=SV4. If the aforementioned group key negotiation method based on the double ratchet algorithm is re-executed after the communication of the target plaintext m2 is completed and a new shared key is obtained, then SV1=SV2, SV3=SV4, and SV1≠SV3.

[0216] Corresponding to the aforementioned group key negotiation method based on the double ratchet algorithm, the embodiment of the present application further provides a group key negotiation device based on the double ratchet algorithm, the device is applied to a first device, the first device and at least one second device belong to the same group, the first device is any device in the group, see Fig. 9 , the device comprises:

[0217] A first plaintext receiving module 901 is used to receive the encryption key of each second device and the first plaintext sent by each second device, where the first plaintext is randomly generated by each second device, and each second device also sends its own first plaintext to other second devices except itself;

[0218] The first ciphertext sending module 902 is used to randomly generate a second plaintext, and encrypt the second plaintext with the encryption key of the second device for each second device, obtain the first ciphertext and send it to the second device, so that the second device decrypts the received first ciphertext with its own decryption key to obtain the second plaintext, and generates its own shared key according to the second plaintext and the first plaintexts of all second devices according to the preset key generation method, and generates its own session key according to the shared key according to the preset key update method in response to the first group communication after obtaining the shared key; in response to the non-first group communication after obtaining the shared key, generates its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the second device itself, wherein the previous round output is the output obtained when the device itself generated a key according to the preset key update method last time;

[0219] A shared key generation module 903, configured to generate its own shared key according to the second plaintext and the first plaintexts of all second devices and according to a preset key generation method;

[0220] The session key generation module 904 is used to generate its own session key according to the shared key and a preset key update method in response to the first group communication after obtaining the shared key;

[0221] The session key updating module 905 is used to generate a new session key of the first device according to a preset key updating method based on the shared key and / or part or all of the previous round output of the first device in response to the non-first group communication after obtaining the shared key;

[0222] Execution module 906 is used to return to the step of receiving the encryption key and the first plaintext of each second device sent by each second device when the next preset key negotiation time is reached and / or in response to the shared key or session key leakage, to obtain its own new shared key.

[0223] In a possible embodiment, the device further includes:

[0224] an encryption key receiving module, configured to receive an encryption key sent by a third device in response to the third device joining the group;

[0225] The second ciphertext sending module is used to encrypt the second plaintext with the encryption key of the third device to obtain the second ciphertext, and send the second ciphertext and the first plaintext of all the second devices to the third device, so that the third device decrypts the received second ciphertext with its own decryption key to obtain the second plaintext, and generates its own shared key according to the second plaintext and the first plaintext of all the second devices according to the preset key generation method, and in response to the first group communication after obtaining the shared key, generates its own session key according to the shared key according to the preset key update method; in response to the non-first group communication after obtaining the shared key, generates its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the second device itself.

[0226] In a possible embodiment, when the next preset key negotiation time is reached, and / or in response to the shared key or session key being leaked, returning to the step of receiving the encryption key of each second device and the first plaintext sent by each second device to obtain its own new shared key includes:

[0227] When the next preset key negotiation time is reached, and / or in response to the shared key or session key being leaked, the third device and the second device are used as new second devices, and the steps of receiving the encryption key and the first plaintext of each second device sent by each second device are returned to obtain a new shared key of the second device.

[0228] In a possible embodiment, for each second device, encrypting the second plaintext using the encryption key of the second device to obtain the first ciphertext and sending it to the second device includes:

[0229] If a removal instruction for the fourth device is received, for other second devices except the fourth device, the second plaintext is encrypted using the encryption key of the second device to obtain the first ciphertext and send it to the second device;

[0230] If no removal instruction is received, the second plaintext is encrypted with the encryption key of the second device for all second devices to obtain the first ciphertext and send it to the second device.

[0231] In a possible embodiment, the device further includes:

[0232] A verification key sending module, used to send the verification key of the first device to each second device;

[0233] Encrypting the second plaintext using the encryption key of the second device to obtain the first ciphertext and sending it to the second device includes:

[0234] Encrypting the second plaintext using the encryption key of the second device to obtain the first ciphertext;

[0235] Signing the first ciphertext using a signature key corresponding to the verification key of the first device to obtain a first signature;

[0236] The first ciphertext and the first signature are sent to the second device, so that the second device uses the verification key of the first device to decrypt the first signature. If the decryption result is the same as the first ciphertext, the second device uses its own decryption key to decrypt the received first ciphertext to obtain a second plaintext, and generates its own shared key according to the second plaintext and the first plaintexts of all second devices according to a preset key generation method, and in response to the first group communication after obtaining the shared key, generates its own session key according to the shared key according to a preset key update method; in response to the non-first group communication after obtaining the shared key, generates its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the second device itself.

[0237] In a possible embodiment, generating a shared key of the second device according to the second plaintext and the first plaintext of all second devices according to a preset key generation method includes:

[0238] Concatenate the second plaintext and the first plaintexts of all second devices to obtain a concatenated value;

[0239] Use a hash function to convert the concatenated value into a value of a preset length as its own shared key.

[0240] Corresponding to the aforementioned group communication method, the embodiment of the present application further provides a group communication device, which is applied to a fifth device, see Fig.10 , the device comprises:

[0241] The encryption module 101 is used to encrypt the target plaintext using the session key of the fifth device itself to obtain the target ciphertext;

[0242] The decryption module 102 is used to send the target ciphertext to each sixth device through group communication, so that each sixth device decrypts the target ciphertext using its own session key to obtain the target plaintext;

[0243] The fifth device and the sixth device each determine their own session key according to any of the aforementioned group key negotiation methods based on the double ratchet algorithm, and the fifth device is the first device or the second device, and the sixth device is other device in the group except the fifth device.

[0244] The present application also provides an electronic device, such as Fig.11 As shown, including:

[0245] A memory 111, used for storing computer programs;

[0246] The processor 112 is configured to execute the program stored in the memory 111, and when the electronic device is the aforementioned first device, implement the following steps:

[0247] receiving the encryption key of each second device and the first plaintext sent by each second device, where the first plaintext is randomly generated by each second device, and each second device also sends its own first plaintext to other second devices except itself;

[0248] A second plaintext is randomly generated, and the second plaintext is encrypted with the encryption key of the second device for each second device, to obtain a first ciphertext and send it to the second device, so that the second device decrypts the received first ciphertext with its own decryption key to obtain a second plaintext, and generates its own shared key according to the second plaintext and the first plaintexts of all second devices according to a preset key generation method, and in response to the first group communication after obtaining the shared key, generates its own session key according to the shared key according to a preset key update method; in response to a non-first group communication after obtaining the shared key, generates its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the second device itself, wherein the previous round output is the output obtained when the device itself generated a key according to the preset key update method last time;

[0249] Generate its own shared key according to the second plaintext and the first plaintexts of all second devices and a preset key generation method;

[0250] In response to the first group communication after obtaining the shared key, generating its own session key according to the shared key and a preset key update method;

[0251] In response to the non-first group communication after obtaining the shared key, generating a new session key of the first device according to a preset key update method based on the shared key and / or part or all of the previous round output of the first device;

[0252] When the next preset key negotiation time is reached, and / or in response to the shared key or session key being leaked, the step of receiving the encryption key and the first plaintext of each second device sent by each second device is returned to obtain its own new shared key.

[0253] When the electronic device is the fifth device described above, the following steps are implemented:

[0254] Encrypting the target plaintext using the session key of the fifth device to obtain the target ciphertext;

[0255] Sending the target ciphertext to each sixth device through group communication, so that each sixth device uses its own session key to decrypt the target ciphertext to obtain the target plaintext;

[0256] The fifth device and the sixth device each determine their own session key according to any of the aforementioned group key negotiation methods based on the double ratchet algorithm, and the fifth device is the first device or the second device, and the sixth device is other device in the group except the fifth device.

[0257] Furthermore, the electronic device may further include a communication bus and / or a communication interface, and the processor 112, the communication interface, and the memory 111 communicate with each other via the communication bus.

[0258] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0259] The communication interface is used for communication between the above electronic device and other devices.

[0260] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0261] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0262] In another embodiment provided in the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned group key negotiation methods or group communication methods based on the double ratchet algorithm are implemented.

[0263] In another embodiment provided by the present application, a computer program product including instructions is also provided. When the computer program product is executed on a computer, the computer executes any group key negotiation method or group communication method based on the double ratchet algorithm in the above embodiments.

[0264] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a solid-state hard disk (SSD), etc.

[0265] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0266] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the embodiments of the device, electronic device, computer-readable storage medium, and computer program product containing instructions, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0267] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. A group key negotiation method based on a double ratchet algorithm, characterized in that: The method is applied to a first device, the first device and at least one second device belong to the same group, and the first device is any device in the group, and the method includes: receiving an encryption key and a first plaintext of each second device sent by each second device, where the first plaintext is randomly generated by each second device, and each second device also sends its own first plaintext to other second devices except itself; A second plaintext is randomly generated, and for each second device, the second plaintext is encrypted using the encryption key of the second device to obtain a first ciphertext and send it to the second device, so that the second device uses its own decryption key to decrypt the received first ciphertext to obtain the second plaintext, and generates its own shared key according to the second plaintext and the first plaintexts of all the second devices according to a preset key generation method, and in response to the first group communication after obtaining the shared key, generates its own session key according to the shared key according to a preset key update method; in response to a non-first group communication after obtaining the shared key, generates its own new session key according to the shared key and / or part or all of the previous round output of the second device according to the preset key update method, wherein the previous round output is the output obtained when the device itself generated a key according to the preset key update method last time; Generate a shared key of the first device and each of the second devices according to the preset key generation method according to the second plaintext and the first plaintext of all the second devices, wherein the shared keys generated by the first device and each of the second devices are the same; In response to the first group communication after obtaining the shared key, generating its own session key according to the shared key and the preset key update method; In response to the non-first group communication after obtaining the shared key, generating a new session key of the first device according to the shared key and / or part or all of the previous round output of the first device itself and according to the preset key update method; When the next preset key negotiation time is reached, and / or in response to the shared key or session key being leaked, return to the step of receiving the encryption key and the first plaintext of each second device sent by each second device to obtain its own new shared key.

2. The method according to claim 1, characterized in that The method further comprises: In response to a third device joining the group, receiving an encryption key sent by the third device; The second plaintext is encrypted using the encryption key of the third device to obtain a second ciphertext, and the second ciphertext and all the first plaintexts of the second devices are sent to the third device, so that the third device uses its own decryption key to decrypt the received second ciphertext to obtain the second plaintext, and generates its own shared key according to the second plaintext and the first plaintexts of all the second devices according to the preset key generation method, and in response to the first group communication after obtaining the shared key, generates its own session key according to the shared key according to the preset key update method; in response to the non-first group communication after obtaining the shared key, generates its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the second device itself.

3. The method according to claim 2, characterized in that When the next preset key negotiation time is reached, and / or in response to the shared key or session key being leaked, returning to the step of receiving the encryption key and the first plaintext of each second device sent by each second device to obtain its own new shared key, includes: When the next preset key negotiation time is reached, and / or in response to the shared key or session key being leaked, the third device and the second device are used as new second devices, and the steps of receiving the encryption key and the first plaintext of each second device sent by each second device are returned to obtain a new shared key of the second device.

4. The method according to claim 1, characterized in that: The encrypting the second plaintext using the encryption key of the second device for each of the second devices to obtain the first ciphertext and sending the first ciphertext to the second device includes: If a removal instruction for the fourth device is received, for other second devices except the fourth device, the second plaintext is encrypted using the encryption key of the second device to obtain a first ciphertext and send it to the second device; If no removal instruction is received, the second plaintext is encrypted with the encryption key of the second device for all the second devices to obtain the first ciphertext and send it to the second device.

5. The method according to claim 1, characterized in that The method further comprises: sending a verification key of the first device to each of the second devices; The step of encrypting the second plaintext by using the encryption key of the second device to obtain the first ciphertext and sending the first ciphertext to the second device includes: Encrypting the second plaintext using the encryption key of the second device to obtain a first ciphertext; Signing the first ciphertext using a signature key corresponding to the verification key of the first device to obtain a first signature; The first ciphertext and the first signature are sent to the second device, so that the second device uses the verification key of the first device to decrypt the first signature. If the decryption result is the same as the first ciphertext, the second device uses its own decryption key to decrypt the received first ciphertext to obtain the second plaintext, and generates its own shared key according to the preset key generation method based on the second plaintext and all the first plaintexts of the second device, and in response to the first group communication after obtaining the shared key, generates its own session key according to the preset key update method according to the shared key; in response to the non-first group communication after obtaining the shared key, generates its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the second device itself.

6. The method according to claim 1, characterized in that The step of generating the own shared key according to the second plaintext and the first plaintext of all the second devices and the preset key generation method includes: Concatenate the second plaintext and the first plaintexts of all the second devices to obtain a concatenated value; A hash function is used to convert the concatenated value into a value of a preset length as its own shared key.

7. A group communication method, characterized in that: The method is applied to a fifth device, and the method includes: Encrypting the target plaintext using the session key of the fifth device to obtain the target ciphertext; Sending the target ciphertext to each sixth device by means of group communication, so that each sixth device decrypts the target ciphertext using its own session key to obtain the target plaintext; Among them, the fifth device and the sixth device each determine their own session key according to the group key negotiation method based on the double ratchet algorithm described in any one of claims 1-6, and the fifth device is the first device or the second device, and the sixth device is other device in the group except the fifth device.

8. A group key negotiation device based on a double ratchet algorithm, characterized in that: The apparatus is applied to a first device, the first device and at least one second device belong to the same group, the first device is any device in the group, and the apparatus includes: A first plaintext receiving module, used for receiving an encryption key of each second device and a first plaintext sent by each second device, wherein the first plaintext is randomly generated by each second device, and each second device also sends its own first plaintext to other second devices except itself; A first ciphertext sending module, used for randomly generating a second plaintext, and for each second device, encrypting the second plaintext with the encryption key of the second device, obtaining a first ciphertext and sending it to the second device, so that the second device decrypts the received first ciphertext with its own decryption key to obtain the second plaintext, and generates its own shared key according to the second plaintext and the first plaintexts of all the second devices according to a preset key generation method, and in response to the first group communication after obtaining the shared key, generates its own session key according to the shared key according to the preset key update method; in response to a non-first group communication after obtaining the shared key, generates its own new session key according to the preset key update method according to the shared key and / or part or all of the previous round output of the second device itself, wherein the previous round output is the output obtained when the device itself generated a key according to the preset key update method last time; a shared key generation module, configured to generate its own shared key according to the second plaintext and the first plaintexts of all the second devices and according to the preset key generation method, wherein the shared keys generated by the first device and each of the second devices are the same; A session key generation module, configured to generate its own session key according to the shared key and the preset key update method in response to the first group communication after obtaining the shared key; A session key updating module, configured to generate a new session key of the first device according to the preset key updating method in response to a non-first group communication after obtaining the shared key and / or part or all of the previous round output of the first device itself; An execution module is used to return to execute the step of receiving the encryption key and the first plaintext of each second device sent by each second device when the next preset key negotiation time is reached and / or in response to the shared key or session key being leaked, so as to obtain its own new shared key.

9. A group communication device, characterized in that: The device is applied to a fifth device, and the device includes: An encryption module, used to encrypt the target plaintext using the session key of the fifth device itself to obtain a target ciphertext; A decryption module, used to send the target ciphertext to each sixth device through group communication, so that each sixth device decrypts the target ciphertext using its own session key to obtain the target plaintext; Among them, the fifth device and the sixth device each determine their own session key according to the group key negotiation method based on the double ratchet algorithm described in any one of claims 1-6, and the fifth device is the first device or the second device, and the sixth device is other device in the group except the fifth device.

10. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, for implementing the method described in any one of claims 1 to 6 or 7 when executing a program stored in a memory.

11. A computer program product, characterized in that When the method is executed on a computer, the computer is enabled to execute the method described in any one of claims 1 to 6 or 7.

Images