Secure communication method, terminal, device, platform, storage medium and product

Abstract

The application discloses a secret communication method, a first terminal, a first device, a first platform, a computer readable storage medium and a computer program product, comprising: the first terminal determines a first key and a second key, encrypts a first parameter based on the first key and the second key to obtain a second parameter, and sends a first request including the second parameter to the first device; the first device receives the first request, sends the second parameter to the first platform; the first platform receives the second parameter, determines a third key and the second key, decrypts the second parameter based on the third key and the second key to obtain the first parameter, performs retrieval based on the first parameter to obtain a second retrieval result, encrypts the second retrieval result based on the second key to obtain a first retrieval result, and sends a first message including the first retrieval result to the first device; the first device receives and forwards the first message to the first terminal; the first terminal receives the first message, and decrypts the first retrieval result based on the second key to obtain the second retrieval result.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication, and particularly relates to a secure communication method, a first terminal, a first device, a first platform, a computer readable storage medium and a computer program product. BACKGROUND

[0002] In the current era, data governance and data sharing have been widely applied in various fields. A data governance platform centrally manages internal and external data assets of an enterprise, and can open the cleaned and integrated data to various application systems and developers by providing standardized Application Program Interface (API) interface services, thereby greatly promoting the full use of data resources. With the development of data classification and security protection, the open interface service function for trusted data in related technologies is not perfect enough. For example, the transmission encryption mode of the data open interface in related technologies considers that it is difficult for a client in an untrusted environment to save key information, and therefore part of the transmission encryption mode considers using a symmetric encryption mode.

[0003] However, when using the symmetric encryption mode for encrypted transmission, once the symmetric key is leaked, all interface service data will be cracked. SUMMARY

[0004] Embodiments of the present application disclose a secure communication method, a first terminal, a first device, a first platform, a computer readable storage medium and a computer program product, which solve the problem that all interface service data in related technologies may be cracked.

[0005] In a first aspect, the present application provides a secure communication method applied to a first terminal, comprising:

[0006] determining a first key and a second key; wherein the second key is a dynamic key;

[0007] encrypting a first parameter based on the first key and the second key to obtain a second parameter; wherein the first parameter includes a keyword supporting retrieval;

[0008] sending a first request to a first device; wherein the first request includes the second parameter;

[0009] receiving a first message sent by the first device; wherein the first message includes a first retrieval result;

[0010] decrypting the first retrieval result based on the second key to obtain a second retrieval result.

[0011] In a second aspect, the embodiments of the present application provide a secure communication method applied to a first device, comprising:

[0012] receiving a first request sent by a first terminal; wherein the first request comprises a second parameter; the second parameter is obtained by encrypting a first parameter based on a first key and a second key by the first terminal; the second key is a dynamic key; and the first parameter comprises a keyword supporting retrieval;

[0013] sending the second parameter to a first platform;

[0014] receiving a first message sent by the first platform and forwarding the first message to the first terminal; wherein the first message comprises a first retrieval result.

[0015] In a third aspect, the embodiments of the present application provide a secure communication method applied to a first platform, comprising:

[0016] receiving a second parameter sent by a first device; wherein the second parameter is obtained by encrypting a first parameter based on a first key and a second key by the first terminal;

[0017] determining a third key and the second key; wherein the second key is a dynamic key; and the first key and the third key are a group of symmetric keys;

[0018] decrypting the second parameter based on the third key and the second key to obtain the first parameter;

[0019] performing retrieval based on the first parameter to obtain a second retrieval result;

[0020] encrypting the second retrieval result based on the second key to obtain a first retrieval result;

[0021] sending a first message to the first device; wherein the first message comprises the first retrieval result.

[0022] In a fourth aspect, the embodiments of the present application provide a first terminal, comprising:

[0023] a first processing module configured to determine a first key and a second key; wherein the second key is a dynamic key;

[0024] the first processing module is further configured to encrypt a first parameter based on the first key and the second key to obtain a second parameter; wherein the first parameter comprises a keyword supporting retrieval;

[0025] a first sending module configured to send a first request to a first device; wherein the first request comprises the second parameter;

[0026] The first receiving module is configured to receive the first message sent by the first device; wherein the first message comprises the first search result.

[0027] The first processing module is further configured to decrypt the first search result based on the second key to obtain a second search result.

[0028] In a fifth aspect, an embodiment of the present application provides a first device, which comprises:

[0029] The second receiving module is configured to receive a first request sent by a first terminal; wherein the first request comprises a second parameter; the second parameter is obtained by encrypting a first parameter based on a first key and a second key by the first terminal; the second key is a dynamic key; and the first parameter comprises a keyword supporting search;

[0030] The second sending module is configured to send the second parameter to a first platform.

[0031] The second receiving module is further configured to receive a first message sent by the first platform and forward the first message to the first terminal; wherein the first message comprises a first search result.

[0032] In a sixth aspect, an embodiment of the present application provides a first platform, which comprises:

[0033] The third receiving module is configured to receive a second parameter sent by a first device; wherein the second parameter is obtained by encrypting a first parameter based on a first key and a second key by the first terminal;

[0034] The third processing module is configured to determine a third key and the second key; wherein the second key is a dynamic key; and the first key and the third key are a group of symmetric keys.

[0035] The third processing module is further configured to decrypt the second parameter based on the third key and the second key to obtain the first parameter.

[0036] The third processing module is further configured to perform search based on the first parameter to obtain a second search result.

[0037] The third processing module is further configured to encrypt the second search result based on the second key to obtain a first search result.

[0038] The third sending module is configured to send a first message to the first device; wherein the first message comprises the first search result.

[0039] In a seventh aspect, an embodiment of the present application provides a first terminal, which comprises:

[0040] A first memory for storing executable instructions;

[0041] A first processor for executing the executable instructions stored in the first memory to implement the secure communication method.

[0042] In an eighth aspect, an embodiment of the present application provides a first device, the first device comprising:

[0043] A second memory for storing executable instructions;

[0044] A second processor for executing the executable instructions stored in the second memory to implement the secure communication method.

[0045] In a ninth aspect, an embodiment of the present application provides a node in a first group, the node in the first group comprising:

[0046] A third memory for storing executable instructions;

[0047] A third processor for executing the executable instructions stored in the third memory to implement the secure communication method.

[0048] In a tenth aspect, an embodiment of the present application provides a computer readable storage medium, the computer readable storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement the secure communication method.

[0049] In an eleventh aspect, an embodiment of the present application provides a computer program product comprising a computer program, the computer program being executable by a processor to implement the secure communication method.

[0050] In a twelfth aspect, an embodiment of the present application provides a computer program which, when executed on a computer, causes the computer to perform the secure communication method.

[0051] The present application protects the data query parameter, i.e., the first parameter, based on a two-layer encryption protection mechanism of the first key and the third key, i.e., RSA and the dynamic key, i.e., the second key, implements "one thing one key", avoids the problem of leakage of trusted data, and improves the security protection and tamper-proofing capability of the request body; meanwhile, the present application encrypts the return value, i.e., the second search result, returned by the first platform to the first device based on the dynamic key, implements dynamic encryption of the return result, effectively prevents key leakage, and ensures the safety of data full-process transmission. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 A schematic diagram of a secure communication system according to an embodiment of the present application;

[0053] Figure 2A schematic diagram of a secure communication platform according to an embodiment of the present application;

[0054] Figure 3 A schematic diagram of a secure communication method according to an embodiment of the present application Figure 1 ;

[0055] Figure 4 An API interface service registration and application flowchart according to an embodiment of the present application;

[0056] Figure 5 An API interface service calling flowchart according to an embodiment of the present application;

[0057] Figure 6 A schematic diagram of a secure communication method according to an embodiment of the present application Figure 2 ;

[0058] Figure 7 A schematic diagram of a HASH operation according to an embodiment of the present application;

[0059] Figure 8 A schematic block diagram of a first terminal according to an embodiment of the present application;

[0060] Figure 9 A schematic block diagram of a first device according to an embodiment of the present application;

[0061] Figure 10 A schematic block diagram of a first node according to an embodiment of the present application;

[0062] Figure 11 A schematic block diagram of a communication device according to an embodiment of the present application. DETAILED DESCRIPTION

[0063] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0064] Figure 1 A schematic diagram of a secure communication system according to an embodiment of the present application.

[0065] As shown in Figure 1 , the secure communication system 100 can include a terminal device 110, a network device 120, and a secure communication platform 130. The network device 120 can communicate with the terminal device 110 through an air interface. The terminal device 110 and the network device 120 support multi-service transmission.

[0066] The secure communication platform 130 is a secure sharing interface service platform for trusted data, and is used to protect data in the transmission and storage process, prevent unauthorized access, tampering or leakage.

[0067] It should be understood that the embodiments of the present application are only exemplarily described with respect to the secure communication system 100, but the embodiments of the present application are not limited thereto. That is, the technical solutions of the embodiments of the present application can be applied to various communication systems to perform encrypted transmission of service data in the various communication systems; for example, the various communication systems include, but are not limited to, a Long Term Evolution (LTE) system, an LTE Time Division Duplex (TDD), a Universal Mobile Telecommunication System (UMTS), an Internet of Things (IoT) system, a Narrow Band Internet of Things (NB-IoT) system, an enhanced Machine-Type Communications (eMTC) system, a 5th Generation Mobile Communication Technology (5G) communication system, also known as a New Radio (NR) communication system, or a future communication system.

[0068] In Figure 1 In the secure communication system 100 shown, the network device 120 can be an access network device that communicates with the terminal device 110. The access network device can provide communication coverage for a specific geographic area, and can communicate with the terminal device 110 located in the coverage area.

[0069] The network device 120 can be an evolved node B (eNB or eNodeB) in a long term evolution (LTE) system, or a next generation radio access network (NG RAN) device, or a base station (gNB) in an NR system, or a radio controller in a cloud radio access network (CRAN), or a relay station, an access point, a vehicle-mounted device, a wearable device, a hub, a switch, a bridge, a router, or a network device in a future evolved public land mobile network (PLMN), etc.

[0070] The terminal device 110 includes, but is not limited to, any terminal device connected to the network device 120 or other terminal devices by wired or wireless connection.

[0071] For example, the terminal device 110 can refer to an access terminal, a user equipment (UE), a subscriber unit, a subscriber station, a mobile station, a mobile, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, a wireless communication device, a user agent, or a user device. The access terminal can be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, an IoT device, a satellite handset, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device with wireless communication function, a computing device, or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal device in a 5G network, or a terminal device in a future evolved network, etc.

[0072] The terminal device 110 can be used for device-to-device (D2D) communication.

[0073] Figure 1 An example is shown, which includes one base station, one platform, and two terminal devices. Optionally, the key communication system 100 can include multiple base stations, and each base station can include other numbers of terminal devices within its management range, which is not limited in the embodiments of the present application.

[0074] It should be noted that, Figure 1This application merely illustrates the system to which this application applies; of course, the methods shown in the embodiments of this application can also be applied to other systems. Furthermore, the terms "system" and "network" are often used interchangeably herein. The term "and / or" in this application merely describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this application generally indicates that the preceding and following related objects have an "or" relationship. It should also be understood that "instruction" mentioned in the embodiments of this application can be a direct instruction, an indirect instruction, or an indication of a related relationship. For example, A instructing B can mean that A directly instructs B, for example, B can be obtained through A; it can also mean that A indirectly instructs B, for example, A instructs C, B can be obtained through C; or it can mean that there is a related relationship between A and B. It should also be understood that "correspondence" mentioned in the embodiments of this application can indicate a direct or indirect correspondence between two things, or an related relationship between two things, or a relationship of instruction and being instructed, configuration and being configured, etc. It should also be understood that the "predefined" or "predefined rules" mentioned in the embodiments of this application can be implemented by pre-storing corresponding codes, tables, or other means that can be used to indicate relevant information in the device (e.g., including terminal devices and network devices), and this application does not limit the specific implementation method. For example, predefined can refer to those defined in a protocol. It should also be understood that in the embodiments of this application, the "protocol" can refer to standard protocols in the field of communication, such as LTE protocol, NR protocol, and related protocols applied to future communication systems, and this application does not limit this.

[0075] To facilitate understanding of the technical solutions of the embodiments of this application, the relevant technologies of the embodiments of this application are described below. The following relevant technologies are optional solutions and can be combined with the technical solutions of the embodiments of this application in any way, and they all fall within the protection scope of the embodiments of this application.

[0076] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0077] Figure 2 This is a schematic block diagram of the secure communication platform provided in the embodiments of this application.

[0078] The Secure Communication Platform 130, a secure sharing interface service platform for trusted data, ensures the security, reliability, and integrity of data during request authentication, querying, processing, and transmission through a trusted execution environment, multiple encryption methods, and blockchain technology. It provides strong protection for the open sharing of trusted data. The Secure Communication Platform 130 mainly consists of a data layer, a trusted execution environment, server-side components, and client-side components.

[0079] Data Layer: Responsible for receiving and storing data products from different data sources input from the data governance platform. The database formats for storage include, but are not limited to, full-text search databases (such as Elasticsearch, ES), data warehouses (such as Hive), and relational databases (such as MySQL / Oracle). All databases employ authentication and authorization, enable audit logs, and use Transport Layer Security (TLS) / Secure Sockets Layer (SSL) for secure data transmission.

[0080] Trusted Execution Environment (TEE): A core component of the secure shared interface service platform, TEE provides a secure and isolated execution space, ensuring the confidentiality, integrity, and availability of data during processing and transmission. Within this environment, data operations (such as querying, encryption, and computation) are subject to strict access control and auditing. TEE primarily includes a request authentication module, an asymmetric encryption algorithm (e.g., Rivest-Shamir-Adleman, RSA) key management module, a dynamic key management module, a data service bus module, and various database adapter modules (e.g., ES adapter, HIVE adapter, MySQL adapter, Oracle adapter). It's important to note that TEE manages the generation, storage, and dynamic key policies of RSA and dynamic keys, supporting the decryption of request parameters, requester authentication, and encryption of query results. Furthermore, it handles various query requests uniformly based on the data bus mechanism and invokes database adapters according to the specific database requests of the business. These database adapters connect to the database and perform queries within the trusted environment via TLS / SSL secure transmission.

[0081] The server-side is responsible for processing requests from clients, interacting with the trusted execution environment (TEA), and obtaining the data required by the data layer. It primarily includes modules for user management, data auditing, data resource management, data marts, interface service approval, interface service management, data service forwarding, key lifecycle management, and blockchain evidence storage. The server manages users and authorizations across the platform through the user management module. Data resource registration, data resource approval, and the data mart module are responsible for publishing approved data resources to the data mart for other users to browse and apply for interface services. The interface service approval module manages the application process for data sharing interfaces, while the interface service management module manages the sharing parameters, scope of use, and openness of data sharing interfaces. Data service forwarding accepts data requests from clients and forwards them to the TEA, as well as returning the results from the TEA to the client. Key lifecycle management manages the key replacement cycle and dynamic encryption strategies for dynamic keys, enhancing key security. Simultaneously, the blockchain evidence storage module records request information, response information, and interface permission information during data interface access. This provides evidence for subsequent data traceability and auditing while ensuring user data privacy is not compromised.

[0082] The client is the interface through which users interact with the secure shared interface service platform. It supports integration into user programs as a Software Development Kit (SDK) or deployment as a standalone client on the user's local machine. It is responsible for sending requests and receiving data returned by the server. The client includes an API service module, a dynamic key generation module, a data encryption / decryption processing module, and a blockchain evidence storage module. The API service module primarily provides a RESTful interface to users. The data encryption / decryption processing module is responsible for encrypting and decrypting data based on the client's key information. The dynamic key generation module derives dynamic keys based on the parameters of the client's request. The client's encryption strategy relies on the server's key lifecycle management, implementing a key replacement mechanism through periodic version updates, synchronizing the dynamic key module, and synchronizing the RSA key. The blockchain evidence storage module records the client's key generation records, interface usage records, query result records, etc., providing data auditing and evidence traceability functions while ensuring client data security.

[0083] Figure 3 This is a flowchart illustrating a secure communication method provided in an embodiment of this application, as shown below. Figure 3 As shown, this method is applied to Figure 1 The secure communication system 100 shown includes a method comprising:

[0084] Step 301: The first terminal determines the first key and the second key.

[0085] The second key is a dynamic key.

[0086] In some embodiments, the first terminal, i.e. Figure 1 Terminal device 110 in the middle receives the first device, that is Figure 1 The first key is sent by the network device 120 or obtained from the storage module of the first terminal.

[0087] In this embodiment of the application, the first device sends the first key in the following ways: in-band, out-of-band, media, signaling, data, message, control plane, user plane, etc.

[0088] In this embodiment of the application, the first key is the first terminal and the first platform, i.e. Figure 1 The symmetric key is a shared symmetric key between secure communication platforms, or a symmetric key derived from the shared symmetric key. This symmetric key can be pre-installed in the first terminal using an offline method, for subsequent secure communication by the first terminal. The symmetric key can be a pair or multiple pairs. The symmetric key can be generated using a (quantum) random number generator.

[0089] In this embodiment of the application, the second key is a dynamic key derived by the dynamic key generation module based on the request parameters of the first terminal.

[0090] In this embodiment of the application, secure communication includes querying sensitive information, transmitting encrypted emails, transmitting encrypted calls, transmitting encrypted short messages, transmitting encrypted instant messages, transmitting encrypted audio and video conferences, and transmitting encrypted 5G messages.

[0091] Step 302: The first terminal encrypts the first parameter based on the first key and the second key to obtain the second parameter.

[0092] The first parameter includes keywords that support the search.

[0093] In this embodiment of the application, the first parameter is a parameter related to the request.

[0094] In some embodiments, the first terminal receives a dynamic encryption policy number sent by the first device, or obtains the dynamic encryption policy number from the storage module of the first terminal; determines a dynamic key encryption / decryption method based on the dynamic encryption policy number; encrypts the first parameter according to the dynamic key encryption / decryption method based on the second key to obtain the encrypted first parameter; signs the first parameter based on the second key to obtain a signature string; and encrypts the signature string, the encrypted first parameter, user authorization authentication information, application programming interface service identifier, session identifier, and salt value based on the first key to obtain the second parameter.

[0095] Here, the dynamic key encryption / decryption method is used to characterize the algorithm used to encrypt the request parameters with the dynamic key. The algorithm includes, but is not limited to, symmetric encryption algorithms such as AES and SM4.

[0096] In this embodiment, the first terminal inputs the second key and the first parameter into a Message Authentication Code (MAC) algorithm to obtain a first message verification code, i.e., a signature string. The first message verification code can at least be used to verify the authenticity and integrity of the first information.

[0097] Here, MAC is a technology that ensures integrity and performs authentication. The input to the Message Authentication Code is a message of arbitrary length and a key shared between the sender and the receiver. It can output fixed-length data, which is called the MAC, sometimes also called the authentication tag.

[0098] It should be noted that the dynamic key management module in the first platform and the client have pre-configured multiple types of dynamic key encryption and decryption methods and assigned them unified numbers. The first terminal can obtain these pre-configured and numbered dynamic key encryption and decryption methods upon logging into the client.

[0099] Step 303: The first terminal sends a first request, including the second parameter, to the first device.

[0100] Step 304: The first device receives a first request including the second parameter.

[0101] Step 305: The first device sends the second parameter to the first platform.

[0102] It should be noted that, in order to protect the privacy of user query information and prevent the leakage of returned result data, the user query process needs to be encrypted. Key management and encryption / decryption processes must be performed within the trusted execution environment of the first platform to ensure the security, integrity, and reliability of data transmission from the query to the database response. Therefore, the first device sends the relevant parameters to the first platform.

[0103] Step 306: The first platform receives the second parameter.

[0104] In this embodiment of the application, after the first platform receives the second parameter, the first platform verifies whether the identifier of the requested device is compliant. If it is not compliant, the search is rejected or the request is not responded to.

[0105] In this embodiment of the application, after the first platform receives the second parameter, the first platform verifies whether the application interface service and the identifier of the application interface service correspond. If they do not correspond, the retrieval is rejected or the request is not responded to.

[0106] Step 307: The first platform determines the third key and the second key.

[0107] The first key and the third key are a set of symmetric keys.

[0108] In some embodiments, the first platform obtains a third key locally.

[0109] In some embodiments, after the first platform obtains the signature string, the first platform verifies the signature string.

[0110] Step 308: The first platform decrypts the second parameter based on the third key and the second key to obtain the first parameter.

[0111] In some embodiments, the first platform obtains the dynamic encryption policy number from the local machine; based on the dynamic encryption policy number, it determines the dynamic key encryption / decryption method; based on the second key, it decrypts the encrypted first parameter according to the dynamic key encryption / decryption method to obtain the first parameter. It should be noted that the decryption algorithm is also pre-configured to be consistent between the server and client during version synchronization, including but not limited to symmetric encryption algorithms such as AES and SM4.

[0112] Step 309: The first platform performs a search based on the first parameter to obtain the second search result.

[0113] In this embodiment of the application, the first platform first determines the corresponding database based on the keywords that support retrieval, and then retrieves the corresponding database based on the keywords.

[0114] Step 310: The first platform encrypts the second search result based on the second key to obtain the first search result.

[0115] Here, the second key is used to encrypt the retrieval results, still employing the dynamic key encryption and decryption method determined by the dynamic encryption strategy number, which makes it easier for the first terminal to decrypt.

[0116] Step 311: The first platform sends a first message, including the first search result, to the first device.

[0117] It should be noted that the open interface services provided by the data platforms of related technologies focus primarily on user authentication while neglecting the secure encryption of data communication. They have not yet provided mature solutions for trusted data sharing services. Furthermore, from the perspective of the applicability of the interface services, many application scenarios involve non-system users needing to access or call authorized data APIs without logging in. This necessitates new security measures to ensure the secure opening of trusted data, especially regarding query parameters during access, secure data storage by the data provider, and encryption during communication. All of these require a system architecture based on a trusted environment and communication confidentiality mechanisms. This application constructs a data API service device based on a first platform, namely a trusted execution environment, server, and client, which protects the secure encryption of user query requests and returned results during transmission, while also making authorization authentication more convenient and reliable for users.

[0118] Step 312: The first device receives a first message including the first search result.

[0119] Step 313: The first device forwards a first message, including the first search result, to the first terminal.

[0120] Step 314: The first terminal receives the first message.

[0121] Step 315: The first terminal decrypts the first search result based on the second key to obtain the second search result.

[0122] Here, the second key encrypts the retrieval results, and decryption is performed using a dynamic key encryption and decryption method determined by a dynamic encryption strategy number, thus enabling the first terminal to decrypt more quickly.

[0123] This application provides a secure communication method, comprising: a first terminal determining a first key and a second key, wherein the second key is a dynamic key; the first terminal encrypting a first parameter based on the first key and the second key to obtain a second parameter, wherein the first parameter includes keywords supporting retrieval; the first terminal sending a first request including the second parameter to a first device; the first device receiving the first request including the second parameter; the first device sending the second parameter to a first platform; the first platform receiving the second parameter; the first platform determining a third key and a second key, wherein the first key and the third key are a set of symmetric keys; the first platform decrypting the second parameter based on the third key and the second key to obtain the first parameter; the first platform performing a retrieval based on the first parameter to obtain a second retrieval result; the first platform encrypting the second retrieval result based on the second key to obtain a first retrieval result; the first platform sending a first message including the first retrieval result to a first device; the first device receiving the first message including the first retrieval result; the first device forwarding the first message including the first retrieval result to a first terminal; the first terminal receiving the first message; and the first terminal decrypting the first retrieval result based on the second key to obtain the second retrieval result. In other words, this application uses a two-layer encryption protection mechanism based on a first key and a third key, namely RSA and a dynamic key, namely a second key, to protect the data query parameters, namely the first parameter, achieving "one key for each matter," avoiding the leakage of trusted data, and improving the security protection and anti-tampering capabilities of the request body. At the same time, this application uses a dynamic key to encrypt the return value fed back from the first platform to the first device, namely the second search result, to achieve dynamic encryption of the return result, effectively preventing key leakage and ensuring the security of data transmission throughout the entire process.

[0124] It should be noted that this application adopts a four-layer architecture based on the client, server, trusted execution environment and data layer to form a secure sharing interface service platform for trusted data, namely the first platform. Based on blockchain-based evidence storage, traceability and auditing, it ensures the security, reliability and integrity of data in the process of request authentication, query, processing and transmission, and provides strong protection for the open sharing environment of trusted data.

[0125] In some embodiments, the method provided in this application includes the following:

[0126] Step A1: The first terminal sends a second request to the first device.

[0127] The second request is used to register and apply for data resources; the data resources include one or more of the following: the types of fields that can be opened, the types of fields that can be retrieved, whether they have been de-identified, and the scope of user permissions that can be opened.

[0128] Step A2: The first device receives the second request.

[0129] Step A3: Review the second request and publish the relevant information of the data resources to the data mart of the first device.

[0130] The relevant information includes data resource cataloging and data summary information.

[0131] Step A4: The first terminal sends a third request to the first device.

[0132] The third request is used to apply for open application programming interface (API) services.

[0133] Step A5: The first device receives the third request.

[0134] Step A6: The first device reviews the third request and sends the API key (APIKey) and interface specification, including user authorization and authentication information, to the first terminal.

[0135] Among them, the user authorization and authentication information is generated by the first platform based on the username, password, application interface service identifier, request data table name, device whitelist list, and creation time information.

[0136] The interface specification, or call specification, includes the routing information of the first terminal, user authorization and authentication information, the identifier of the application programming interface service, search keyword information, and the format of the query results.

[0137] Step A7: The first terminal receives the API Key and interface specification.

[0138] It should be noted that steps A1 to A7 are the transaction process of interface service registration and application business, which mainly focuses on data resources. This process enables data providers to open up data resources to data demanders. The data resources here are shared data synchronized to the data layer through the operation of the data governance platform. Shared data can be original data resources, standard data after data processing, or de-identified data.

[0139] Figure 4 This application provides a flowchart of the API interface service registration and application process; the steps for API interface service registration and application are as follows: Figure 4 As shown:

[0140] Step 401: User requests registration data resources.

[0141] Step 402: Server-side administrator approval.

[0142] Step 403: The server publishes the data to the data mart; here, you can view the data summary information on the data mart.

[0143] Step 404: Users apply for open data API services.

[0144] Step 405: Server-side administrator approval.

[0145] Step 406: Generate the API open service and send the API key and calling rules of the API interface to the applicant.

[0146] Furthermore, requests initiated by the applicant based on the API Key and calling rules do not require login authentication. That is, the applicant user logs into the server-side page, mounts the data resources to be opened in the corresponding location of the data resource directory (if the required directory does not exist, it is applied for to create one first), and submits a registration application. The application details include the types of fields that can be opened, the types of fields allowed to be searched, whether anonymization processing is required, and the scope of user permissions. After approval by the service administrator, the data resources can be officially published and listed. Once listed, the data resources can be viewed centrally in the data mart, providing data resource cataloging and data summary information. The applicant then logs into the server-side page, browses the data entries visible within the authorized scope in the data mart, and applies for API access services for the required data resources (one table corresponds to one API service). Here, the applicant needs to specify the device IP whitelist, usage limit, and usage time limit. After approval, the applicant will be returned with the specific API Key and calling rules for the open API interface. The API Key is kept by the applicant. When calling the API interface, the applicant initiates a request according to the calling rules, and no longer needs login authentication; instead, authentication is completed based on the API Key and IP information within the request interface.

[0147] Furthermore, the API Key needs to encompass the user's authorization and authentication information. To prevent forgery and cracking, its complexity needs to be increased. Therefore, the API Key is generated based on the applicant's username, password, API service identifier (serverid), requested table name, device IP whitelist (iplist), and creation time (createtime). An encryption algorithm, such as HMAC-SHA256, is used to generate the API Key in a trusted execution environment and then provides it to the server. The basic steps of HMAC-SHA256 encryption based on user registration interface information can be represented as follows: First, obtain the fourth key from the trusted execution environment, i.e., the private key SK, username, password, serverid, tablename, iplist, and createtime in the current environment; based on username, password, serverid, tablename, iplist, and createtime, generate the first string M; based on SK and M, generate the user authorization and authentication information.

[0148] Here, you can obtain the private key SK for the current environment through the RSA management tool.

[0149] Here, M, which is the construction of the plaintext information of APIKey, is based on formula (1) and uses special characters to connect the required information strings.

[0150] M=concat(username||password||serverid||tablename||iplist||createtime) (1)

[0151] Here, based on SK and M, the generated user authorization and authentication information includes:

[0152] According to the HMAC-SHA256 algorithm, APIKey is obtained based on SK, M and formula (2).

[0153] HMAC ( SK , M ) = SHA256 ( SK ⊕opad, SHA256 ( SK ⊕ ipad, M ) ) (2)

[0154] In the formula: ⊕ represents the XOR operation, opad and ipad are two specific constant vectors. Typically, ipad is padded to 64 bytes with 0x36, and opad is padded to 64 bytes with 0x5C. SHA256 represents a secure hash function that outputs 256 bits.

[0155] In some embodiments, the first terminal and the first platform of this application determine the second key through the following steps:

[0156] Step B1: Obtain the session identifier, user authorization and authentication information, application programming interface service identifier, and first terminal identifier.

[0157] Here, the first terminal directly obtains the call identifier, user authorization and authentication information, application programming interface service identifier, and the first terminal's identifier. It should be noted that the user authorization and authentication information can be sent from the first platform to the first terminal via the first device.

[0158] Here, the first platform decrypts the second parameter based on the third key to obtain the user authorization authentication information, the application programming interface service identifier, the session identifier, and the salt value. It should be noted that the identifier of the first terminal can be pre-sent to the first platform by the first terminal through the first device; or obtained by the first platform from the message corresponding to the second parameter; or obtained by the first platform through detection.

[0159] In this embodiment of the application, the identification information of the first terminal includes, but is not limited to, the Mobile Station international Integrated Services Digital Network number (MSISDN), the International Mobile Subscriber Identity (IMSI), the International Mobile Equipment Identity (IMEI), service identifiers (such as the terminal's domain name), and the service number of a user's application (such as the user identifier of a chat software, communication software, or other software installed on the terminal).

[0160] Step B2: Generate a multi-factor cipher for dynamic encryption based on the session identifier, user authorization and authentication information, application programming interface service identifier, and first terminal identifier.

[0161] Step B3: Determine the second key based on multi-factor cryptography.

[0162] In this embodiment, step D3, determining the second key based on multi-factor cryptography, includes the following steps: determining a pseudo-random function; obtaining a specified number of iteration rounds, the required output key length, and a randomly generated salt value; and deriving the second key based on multi-factor cryptography, the specified number of iteration rounds, the length, the salt value, and the pseudo-random function. Clearly, generating a derived key with high complexity, good security, and strong anti-cracking capabilities based on multiple request parameters, and optimizing the encryption process performance, can effectively improve the efficiency of generating the derived key. Furthermore, it enables the construction of a dynamic encryption method based on session parameters and interface business parameters based on request parameters shared between the first terminal and the first platform.

[0163] This application constructs a multi-factor derived key based on request parameters and performs key generation and dynamic encryption / decryption operations at both ends respectively. This avoids the insecurity of dynamic key storage, reduces the risk of key transmission, and solves the problem of insufficient security protection and low reliability when users query trusted data through the client. It achieves "one key for one event" and ensures that each session has a unique key, thus achieving a higher level of security protection.

[0164] In some embodiments, the method provided in this application includes the following:

[0165] Step C1: The first terminal sends a fourth request to the first platform.

[0166] The fourth request is used to update / initialize key information.

[0167] In this embodiment of the application, the first platform may be a device that provides key or key management services for at least two terminals conducting secure communication under a secure communication system; the first platform includes, but is not limited to, a key management center (KMC), a key management system (KMS), a key service center, a security service center, a key management platform / facilities that provide services for a specific business, etc.

[0168] Step C2: The first platform receives the fourth request.

[0169] Step C3: The first platform generates the updated / initialized first key and the updated / initialized third key.

[0170] Step C4: The first platform and the first terminal jointly pre-configure multiple types of dynamic key encryption and decryption methods to generate an updated / initialized dynamic key policy number.

[0171] Step C5: The first platform sends the updated / initialized first key and the updated / initialized dynamic key policy number to the first device.

[0172] Step C6: The first device receives the updated / initialized first key and the updated / initialized dynamic key policy number.

[0173] Step C7: The first device sends a notification message to the first terminal.

[0174] The notification message is used to notify the first terminal to update the stored first key and dynamic key policy number.

[0175] Step C8: The first terminal receives the notification message.

[0176] In this embodiment of the application, steps C1 to C8 are the process by which the entire service platform periodically initializes (updates) the keys used. The server initiates a request to initialize the key according to the timing policy provided by the key lifecycle management, generates the latest version key and discards the previous version key in the trusted execution environment, and shares the latest version key.

[0177] under, Figure 5 This application will illustrate an exemplary application of calling an API interface service in a real-world application scenario. The steps for calling the API interface service are as follows: Figure 5 As shown:

[0178] Step 501: The client initiates a data query request. That is, the authorized user of the client, in accordance with the calling convention, sends the APIKey, serverid, and original query parameters to the client's API service interface on a machine under the whitelist specified by the open API interface and initiates a data query request.

[0179] Step 502: The client encrypts the query parameters using the dynamic key generated according to the dynamic key policy and the public key of the trusted execution environment, obtains the encrypted parameters and query signature, and packages the query signature and encrypted parameters into an encrypted query body and sends it to the server.

[0180] Step 503: The server receives the encrypted query body and forwards it to the trusted execution environment for processing.

[0181] Step 504: In a trusted execution environment, decrypt the encrypted query body using the private key and dynamic key, and verify whether the requested IP address is correct, whether the service corresponds to the API Key, and whether the query signature is consistent. If the request does not comply with the rules, proceed directly to step 505; if the request is compliant, proceed to step 506.

[0182] Step 505: Report the non-compliant request to the server and proceed to step 508.

[0183] Step 506: Query the corresponding database. That is, the data service bus selects the corresponding database adapter based on the decrypted relevant information, and then performs a secure query on the matching database to obtain the query results.

[0184] Step 507: Dynamically encrypt the query results to obtain encrypted results. That is, after obtaining the query results, the query results are encrypted using the dynamic key generated by the dynamic encryption module to obtain encrypted results; then execute step 508.

[0185] Step 508: The server forwards relevant data to the client's request interface. This relevant data includes requests for non-compliant data or encrypted results.

[0186] Step 509: The client decrypts the encrypted result to obtain the plaintext query result. That is, the client decrypts the encrypted result, verifies the signature information, and returns the plaintext query result to the caller through the API interface after successful verification.

[0187] It should be noted that during the entire API interface communication process, only the client of the authorized user can view the plaintext query parameters and query results. During the transmission process from the client to the server and from the server to the trusted execution environment, the data is protected by encryption to protect information security. This can effectively prevent problems such as unauthorized interface access, third-party packet sniffing to steal or tamper with data, and abnormal interface calls from different locations.

[0188] In this embodiment of the application, under the open interface service architecture for trusted data, it is assumed that the client is in an open and uncontrollable environment, posing various security risks of cracking or tampering. Therefore, a trusted execution environment needs to be built outside the client and server. Key management is placed in the trusted execution environment, and trusted operations such as authentication, encryption, and decryption are performed on the data communication between the client and the server to ensure data integrity and confidentiality. Therefore, based on the trusted data secure sharing API interface service, this embodiment of the application provides a secure communication method, the overall process of which is as follows: Figure 6 As shown:

[0189] First, the entire service platform periodically initializes (updates) the keys used, that is...

[0190] Step 601: The server initiates an initialization key request to the trusted execution environment according to the timing policy provided by the key lifecycle management.

[0191] Step 602: Generate a public key and a private key in a trusted execution environment, and obtain the current dynamic key policy number;

[0192] Step 603: The Trusted Execution Environment returns the public key and dynamic key policy number to the server;

[0193] Step 604: The server notifies the client to update the stored public key and / or dynamic key policy number; that is, generating the latest version of the key and discarding the previous version key in the trusted execution environment. In the data open interface encryption process, RSA public key encryption and dynamic key encryption are mainly used. The RSA management module generates the required public and private keys, while the dynamic key management module and the client jointly pre-configure multiple types of dynamic key encryption and decryption methods and assign them unified numbers. When generating the dynamic key policy, the required encryption policy number is provided. Then, the latest public key generated by the trusted execution environment and the dynamic key policy number are sent to the server. The server writes the latest public key and encryption policy into the new version of the client software / SDK package (obfuscated and packaged) in hard-coded form and notifies the client to update the version. If the client uses an expired or invalid key for communication, the server returns a prompt to update the version information. In this way, the service platform periodically completes the initialization / update of the keys used.

[0194] Secondly, the entire service platform uses keys for encrypted communication, that is...

[0195] Step 605: The user initiates a data query request to the server via encrypted communication by calling the API interface through the client / SDK. The data query request includes the original query parameters. The data query request requires the API key (APIKey) provided when registering the interface service and the user's authorization and authentication information to be prepared in advance. The interface specification includes the client routing information of the request, query parameters (APIKey, serverid, keywords), and the return value format results. The data provider determines which fields are allowed as keywords when registering the service. The data provider also determines the scope of publicly disclosed fields and the corresponding anonymized fields when registering the service.

[0196] Step 606: The client encrypts the original query parameters based on the dynamic key valid for this session and generates a signature; that is, the client generates a unique sessionid based on this session, generates a dynamic key, and uses the dynamic key to dynamically encrypt the original query parameters keywords to obtain the dynamically encrypted query parameters; at the same time, a dynamic signature is generated.

[0197] Step 607: The client uses a public key to encrypt the dynamic signature, the dynamically encrypted query parameters, APIKey, serverid, and sessionid twice to obtain a double-encrypted query structure.

[0198] Step 608: The client sends the double-encrypted query structure to the server.

[0199] Step 609: After receiving the client's request, the server adds the IP address of the server that sent the request to the request header and then forwards it to the trusted execution environment for processing.

[0200] Step 610: In a trusted execution environment, decrypt the double-encrypted query structure using the locally managed private key to obtain the dynamic signature, dynamically encrypted query parameters, APIKey, serverid, and sessionid.

[0201] Step 611: Generate a dynamic key using a dynamic key strategy in a trusted execution environment; based on the dynamic key, dynamically decrypt the dynamically encrypted query parameters to obtain the original query parameters keywords.

[0202] Step 612: Verify the compliance of the request in a trusted execution environment, i.e., whether the APIKey and serverid are consistent and whether the IP is in the whitelist of the service. If the requirements are met, proceed to step 613; otherwise, the server will report the non-compliance of the request to the client.

[0203] Step 613: Query the results through the data service bus and encrypt them with a dynamic key. That is, obtain the query configuration information through the serverid, select the corresponding database adapter to perform the query, and then encrypt the results with the dynamic key generated in step 611 to obtain the dynamically encrypted query results.

[0204] Step 614: Send the dynamically encrypted query results to the server.

[0205] Step 615: The server returns the dynamically encrypted query results to the client via a session.

[0206] Step 616: The client decrypts the dynamically encrypted query result using the dynamic key generated at the start of this session (i.e., in step 607), and returns the plaintext result to the calling user so that the user can obtain the plaintext query result.

[0207] It should be noted that this application can employ multi-factor derived dynamic keys combined with RSA encrypted communication. The encryption and decryption process for the request parameters is as follows:

[0208] This system framework uses dynamic encryption by transmitting encryption factors. The server and client then calculate the derived dynamic key locally, and encrypt and decrypt using a pre-shared symmetric encryption algorithm. Therefore, it's necessary to increase the complexity and security of the dynamic key. Referring to the algorithmic approach of cryptographic derivation functions (e.g., Password-Based Key Derivation Function 2, PBKDF2), the system constructs the initial cipher based on existing encryption factors. A complex key derivation function, namely a multi-factor key derivation function (e.g., Multi-Factor Key Derivation Function, MFKDF), is used to generate the dynamic key. This allows specifying the output key length according to the encryption strategy while ensuring encryption efficiency. During dynamic key initialization, multiple symmetric encryption algorithm strategies are pre-configured. The system requires that parameters such as sessionid, APIKey, serverid, and IP address in the request parameters be extracted into the dynamic key using a hash algorithm, and then encrypted using algorithms such as Advanced Encryption Standard (AES) / SM4. The public key is also generated by the server based on a trusted execution environment. The client needs to periodically update and obtain the dynamic encryption strategy and public key.

[0209] When a client initiates a session, it first generates a unique session ID based on the timestamp. Then, it constructs a multi-factor password (MFP) for dynamic encryption based on the APIKey, serverid, IP address in the request header, and formula (3) in the request parameters.

[0210] MFP=hash(sessionid||APIKey||serverid||IP) (3)

[0211] Then, the pseudo-random function (PRF) is selected as HMAC-SHA256, and the salt value salt is generated using a random function. The number of iteration rounds c, the required output key length dklen (e.g., 256 bits for AES algorithm and 128 bits for SM4 algorithm) and formula (4) are specified. The dynamic key AK for this session can be derived as follows:

[0212] AK client =MFKDF-HMAC-SHA256(MFP,salt,c,dklen) (4)

[0213] The specified number of iteration rounds c and key length dklen can be pre-set in the client code through version synchronization, and only the salt value salt needs to be passed during each communication.

[0214] Next, the query parameter keywords in the request parameters are encrypted using dynamic encryption and formula (5) to obtain the dynamically encrypted query parameter Params. AK :

[0215] Params AK =AK_Encrypt(AK,keywords) (5)

[0216] In the formula, the AK_Encrypt function determines the symmetric encryption algorithm to be used, including but not limited to AES and SM4, based on the dynamic encryption strategy. Simultaneously, the HMACSHA256 algorithm and formula (6) are used to calculate the digital signature of the query parameter keywords:

[0217] sign keywords =HMACSHA256(AK,keywords) (6)

[0218] After calculation, all request information, signature, and formula (7) are encrypted using the current public key PK to obtain the secondary encrypted request body EncryptRequestBody. PK And send it to the server:

[0219]

[0220] After the server forwards the request to the trusted execution environment, it first uses the local private key SK to access the EncryptRequestBody. PK Decryption yields APIKey, serverid, and sign.keywords sessionid, Params AK After obtaining the requester's IP address through the request header, the same strategy as the client can be used to generate a dynamic key in a trusted execution environment. Then, the query parameters are obtained by decryption. The decryption algorithm is also consistent with the pre-configuration of the server and client during version synchronization, including but not limited to symmetric encryption algorithms such as AES algorithm and SM4 algorithm, as shown in formulas (8) and (9):

[0221] AK server =MFKDF-HMAC-SHA256(MFP,salt,c,dklen) (8)

[0222] keywords = AK_Decrypt(AK) server Params AK (9)

[0223] After obtaining the keywords, the HMACSHA256 algorithm can be used to calculate the digest signature, which is then compared with the sign. keywords Verify the consistency of the query parameters.

[0224] It should be noted that a dynamic key derivation algorithm of MFKDF-HMAC-SHA256 is proposed. It uses multi-parameter factors as initialization parameters to calculate complex and reliable dynamic keys, and refines the decomposition of the HMAC-SHA256 encryption process. By optimizing intermediate variables, the computational efficiency is improved, which can effectively improve the encryption computation efficiency of dynamic key derivation, achieving an efficiency optimization effect of nearly 1 times. This helps to quickly generate dynamic keys when calling open interfaces.

[0225] Furthermore, the encryption and decryption methods for the query results are described in detail below:

[0226] After obtaining the plaintext query keywords in the trusted execution environment, the corresponding database adapter is located based on the serverid for querying. The query results (results) then need to be encrypted again using a dynamic key. Here, the dynamic key continues to use the AK generated above. server The results are dynamically encrypted according to formula (10) to obtain EncryptR. AK :

[0227] EncryptR AK =AK_Encrypt(AK server (results) (10)

[0228] Among them, EncryptR AKThe server returns the AK to the currently requesting client, and the client uses formula (11) to generate the AK based on this session locally. client Decryption is performed, and the client obtains the plaintext query results.

[0229] results = AK_Decrypt(AK client EncryptR AK (11)

[0230] It should be noted that, to improve the security and complexity of the dynamic key, this application introduces parameters from multiple API sessions (APIKey, sessionid, serverid, IP), extracting their multi-factor cipher (MFP) to replace the original password in the algorithm. Furthermore, the PRF pseudo-random function is chosen as HMAC-SHA256 to enhance the complexity of iterative encryption while ensuring stable computational efficiency in the client environment. Table 1 shows the basic flow of the MFPKDF-HMAC-SHA256 algorithm:

[0231]

[0232] The INT function converts an integer i to a 4-byte (32-bit) big-endian representation; the FirstBytes function truncates U... j The first r bytes; "||" represents the concatenation operator; "⊕" represents the XOR operator.

[0233] To ensure the security of the derived function result, the number of iterations c usually needs to reach more than 1000. Therefore, the computational load in the MFPKDF-HMAC-SHA256 algorithm increases with the number of iterations, and is mainly concentrated in the HMAC-SHA256 calculation. Here, for formula (4), substituting the MFPKDF input parameters, it can be seen that one encryption calculation includes 4 operations, such as Figure 7 As shown. From Figure 7 Analysis shows that the MFP parameters remain unchanged during each iteration, and `ipad` and `opad` are constants. Therefore, `MFP⊕ipad` and `MFP⊕opad` do not actually change in each iteration. Thus, the calculation results of `MFP⊕ipad` and `MFP⊕opad` can be cached during the first iteration, and then directly read from the cached variables in the subsequent (c-1) iterations, avoiding redundant calculations. This optimization reduces the time complexity of the encryption operation from 4c to (2c+1), nearly doubling the computational efficiency for encryption scenarios where `c` is very large.

[0234] Embodiments of this application provide a first terminal, which can be used to implement... Figure 3A corresponding embodiment provides a secure communication method, referring to... Figure 8 As shown, the first terminal 800 includes:

[0235] The first processing module 801 is used to determine the first key and the second key; wherein the second key is a dynamic key;

[0236] The first processing module 801 is used to encrypt the first parameter based on the first key and the second key to obtain the second parameter; wherein the first parameter includes keywords that support retrieval;

[0237] The first sending module 802 is used to send a first request to the first device; wherein the first request includes a second parameter;

[0238] The first receiving module 803 is used to receive a first message sent by the first device; wherein the first message includes a first search result;

[0239] The first processing module 801 is used to decrypt the first search result based on the second key to obtain the second search result.

[0240] In other embodiments of this application, the first receiving module 803 is used to receive the first key sent by the first device or obtained from the storage module of the first terminal;

[0241] The first acquisition module 804 is used to acquire the session identifier, user authorization and authentication information, application programming interface service identifier, and first terminal identifier;

[0242] The first processing module 801 is used to generate a multi-factor cipher for dynamic encryption based on the session identifier, user authorization and authentication information, application programming interface service identifier and the identifier of the first terminal.

[0243] The first processing module 801 is used to determine the second key based on multi-factor cryptography.

[0244] In other embodiments of this application, the first processing module 801 is used to determine a pseudo-random function;

[0245] The first acquisition module 804 is used to acquire the specified number of iteration rounds, the required output key length, and the randomly generated salt value;

[0246] The first processing module 801 is used to derive the second key based on multi-factor cryptography, a specified number of iteration rounds, length, salt value, and pseudo-random function.

[0247] In other embodiments of this application, the first receiving module 803 is used to receive the dynamic encryption strategy number sent by the first device or obtained from the storage module of the first terminal.

[0248] The first processing module 801 is used to determine the dynamic key encryption / decryption method based on the dynamic encryption strategy number;

[0249] The first processing module 801 is used to encrypt the first parameter based on the second key and according to the dynamic key encryption and decryption method to obtain the encrypted first parameter.

[0250] The first processing module 801 is used to sign the first parameter based on the second key to obtain a signature string;

[0251] The first processing module 801 is used to encrypt the signature string, the encrypted first parameter, the user authorization authentication information, the identifier of the application interface service, the session identifier and the salt value based on the first key to obtain the second parameter.

[0252] In other embodiments of this application, the first sending module 802 is used to send a second request to the first device;

[0253] The second request is used to register and apply for data resources; the data resources include one or more of the following: the types of fields that can be opened, the types of fields that can be retrieved, whether they have been de-identified, and the scope of user permissions that can be opened.

[0254] In other embodiments of this application, the first sending module 802 is used to send a third request to the first device; wherein, the third request is used to request the application programming interface open service;

[0255] The first receiving module 803 is used to receive user authorization and authentication information and interface specifications sent by the first device; wherein, the user authorization and authentication information is generated by the first platform based on the username, password, application programming interface service identifier, request data table name, device whitelist list, and creation time information; the interface specifications include the routing information of the first terminal, user authorization and authentication information, application programming interface service identifier, search keyword information, and the format of the query results.

[0256] In other embodiments of this application, the first receiving module 803 is used to receive a notification message sent by the first device; wherein the notification message is used to notify the first terminal to update the stored first key and dynamic key policy number; the notification message includes the updated / initialized first key and the updated / initialized dynamic key policy number.

[0257] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0258] It should be noted that, in the embodiments of this application, if the above-mentioned secure communication method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal device to execute all or part of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0259] Embodiments of this application provide a first device that can be used to implement Figure 3 A corresponding embodiment provides a secure communication method, referring to... Figure 9 As shown, the first device 900 includes:

[0260] The second receiving module 901 is used to receive a first request sent by the first terminal; wherein the first request includes a second parameter; the second parameter is obtained by the first terminal encrypting the first parameter based on a first key and a second key; the second key is a dynamic key; the first parameter includes keywords that support retrieval;

[0261] The second sending module 902 is used to send the second parameter to the first platform;

[0262] The second receiving module 901 is used to receive a first message sent by the first platform and forward the first message to the first terminal; wherein the first message includes a first search result.

[0263] In other embodiments of this application, the second receiving module 901 is used to receive a second request sent by the first terminal; wherein the second request is used to register and apply for data resources; the data resources include one or more of the following: open field categories, allowed search field categories, whether de-identification processing is performed, and open user permission scope;

[0264] The second processing module 903 is used to review the second request and publish the relevant information of the data resource to the data mart of the first device; wherein, the relevant information includes data resource cataloging and data summary information.

[0265] In other embodiments of this application, the second receiving module 901 is used to receive a third request sent by the first terminal; the third request is used to request the application programming interface open service.

[0266] The second processing module 903 is used to review the third request and send user authorization and authentication information and interface specifications to the first terminal. The user authorization and authentication information is generated by the first platform based on the applicant's username, password, application programming interface service identifier, request data table name, device whitelist, and creation time information. The interface specifications include the first terminal's routing information, user authorization and authentication information, application programming interface service identifier, search keyword information, and query result format.

[0267] In other embodiments of this application, the second sending module 902 is used to send a fourth request to the first platform; wherein the fourth request is used to update / initialize key information;

[0268] The second receiving module 901 is used to receive the updated / initialized first key and the updated / initialized dynamic key policy number sent by the first platform;

[0269] The second sending module 902 is used to send a notification message to the first terminal; wherein the notification message is used to notify the first terminal to update the stored first key and dynamic key policy number.

[0270] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0271] It should be noted that, in the embodiments of this application, if the above-mentioned secure communication method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, in essence, or the part that contributes to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a network device to execute all or part of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, ROMs, magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0272] Embodiments of this application provide a first platform that can implement Figure 3 A corresponding embodiment provides a secure communication method, referring to... Figure 10 As shown, the first platform 1000 includes:

[0273] The third receiving module 1001 is used to receive the second parameter sent by the first device; wherein the second parameter is obtained by the first terminal encrypting the first parameter based on the first key and the second key;

[0274] The third processing module 1002 is used to determine the third key and the second key; wherein the second key is a dynamic key; and the first key and the third key are a set of symmetric keys.

[0275] The third processing module 1002 is used to decrypt the second parameter based on the third key and the second key to obtain the first parameter;

[0276] The third processing module 1002 is used to perform a search based on the first parameter and obtain the second search result;

[0277] The third processing module 1002 is used to encrypt the second search result based on the second key to obtain the first search result;

[0278] The third sending module 1003 is used to send a first message to the first device; wherein the first message includes a first search result.

[0279] In other embodiments of this application, the third acquisition module 1004 is used to acquire a third key from the local machine;

[0280] The third processing module 1002 is used to decrypt the second parameter based on the third key to obtain the signature string, the encrypted first parameter, user authorization and authentication information, application interface service identifier, session identifier and salt value.

[0281] The third processing module 1002 is used to generate a multi-factor cipher for dynamic encryption based on the session identifier, user authorization and authentication information, application programming interface service identifier and the identifier of the first terminal.

[0282] The third processing module 1002 is used to determine the second key based on multi-factor cryptography.

[0283] In other embodiments of this application, the third processing module 1002 is used to determine a pseudo-random function;

[0284] The third acquisition module 1004 is used to acquire the specified number of iteration rounds, the required output key length, and the salt value;

[0285] The third processing module 1002 is used to derive the second key based on multi-factor cryptography, a specified number of iteration rounds, length, salt value, and pseudo-random function.

[0286] In other embodiments of this application, the third acquisition module 1004 is used to acquire the dynamic encryption strategy number from the local machine;

[0287] The third processing module 1002 is used to determine the dynamic key encryption / decryption method based on the dynamic encryption strategy number;

[0288] The third processing module 1002 is used to decrypt the encrypted first parameter based on the second key and according to the dynamic key encryption and decryption method to obtain the first parameter.

[0289] In other embodiments of this application, the third processing module 1002 is used to verify whether the identifier of the requested device is compliant;

[0290] The third processing module 1002 is used to verify whether the application interface service and the application interface service identifier correspond;

[0291] The third processing module 1002 is used to verify the signature string.

[0292] In other embodiments of this application, the third receiving module 1001 is used to receive a fourth request sent by the first device; wherein the fourth request is used to update / initialize key information;

[0293] The third processing module 1002 is used to generate the updated / initialized first key and the updated / initialized third key;

[0294] The third processing module 1002 is used to unify the numbering and pre-set multiple types of dynamic key encryption and decryption methods with the first terminal, and generate the updated / initialized dynamic key strategy number.

[0295] The third sending module 1003 is used to send the updated / initialized first key and the updated / initialized dynamic key policy number to the first device.

[0296] In other embodiments of this application, the third acquisition module 1004 is used to acquire the fourth key, username, password, identifier of application interface service, request data table name, device whitelist list, and creation time information;

[0297] The third processing module 1002 is used to generate a first string based on the username, password, application interface service identifier, request data table name, device whitelist list, and creation time information.

[0298] The third processing module 1002 is used to generate user authorization authentication information based on the fourth key and the first string.

[0299] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0300] It should be noted that, in the embodiments of this application, if the above-mentioned secure communication method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, in essence, or the part that contributes to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a network device to execute all or part of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, ROMs, magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0301] Figure 11 This is a schematic structural diagram of a communication device 1100 provided in an embodiment of this application. The communication device can be a first terminal, a first device, or a first platform. Figure 11 The communication device 1100 shown includes a processor 1110, which can call and run computer programs from memory to implement the methods in the embodiments of this application.

[0302] Optionally, such as Figure 11 As shown, the communication device 1100 may further include a memory 1120. The processor 1110 can retrieve and run computer programs from the memory 1120 to implement the methods described in this embodiment.

[0303] The memory 1120 can be a separate device independent of the processor 1110, or it can be integrated into the processor 1110.

[0304] Optionally, such as Figure 11 As shown, the communication device 1100 may also include a transceiver 1130. The processor 1110 can control the transceiver 1130 to communicate with other devices. Specifically, it can send information or data to other devices or receive information or data sent by other devices.

[0305] The transceiver 1130 may include a transmitter and a receiver. The transceiver 1130 may further include an antenna, and the number of antennas may be one or more.

[0306] Optionally, the communication device 1100 may specifically be the first terminal / first platform / first device in the embodiments of this application, and the communication device 1100 may implement the corresponding processes implemented by the first terminal / first platform / first device in the various methods of the embodiments of this application. For the sake of brevity, it will not be described in detail here.

[0307] For example, this application also provides a computer program product, including a computer program that can be executed by the processor 1110 of the communication device 1100 to perform the steps described in any of the foregoing methods.

[0308] It should be understood that the processor in the embodiments of this application may be an integrated circuit chip with signal processing capabilities. In implementation, the steps of the above method embodiments can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor described above can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0309] As one embodiment, the processor may include one or more general-purpose central processing units (CPUs). Each of these processors may be a single-core processor or a multi-core processor. Here, "processor" may refer to one or more devices, circuits, and / or processing cores used for processing data (e.g., executing instructions).

[0310] It is understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be ROM, Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), or flash memory. The volatile memory can be Random Access Memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DR RAM). It should be noted that the memory used in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0311] This application also provides a computer-readable storage medium for storing computer programs.

[0312] The computer-readable storage medium can be applied to the first terminal / first platform / first device in the embodiments of this application, and the computer program causes the computer to execute the corresponding processes implemented by the first terminal / first platform / first device in the various methods of the embodiments of this application. For the sake of brevity, it will not be described in detail here.

[0313] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0314] A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

[0315] The secure communication method, first terminal, first device, first platform, computer-readable storage medium, and computer program product provided in the embodiments of this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

[0316] It should be understood that the phrases "an embodiment," "an embodiment," "an embodiment of this application," "the foregoing embodiment," "some implementations," or "some embodiments" mentioned throughout the specification mean that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, the phrases "an embodiment," "an embodiment," "an embodiment of this application," "the foregoing embodiment," "some implementations," or "some embodiments" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments of this application are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0317] Unless otherwise specified, the execution of any step in the embodiments of this application by the first terminal / first device / first platform may be performed by the processor of the first terminal / first device / first platform. Unless otherwise specified, the embodiments of this application do not limit the order in which the first terminal / first device / first platform performs the following steps. In addition, the methods used to process data in different embodiments may be the same or different methods.

[0318] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0319] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0320] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0321] The methods disclosed in the several method embodiments provided in this application can be arbitrarily combined to obtain new method embodiments without conflict. The features disclosed in the several product embodiments provided in this application can be arbitrarily combined to obtain new product embodiments without conflict. The features disclosed in the several method or device embodiments provided in this application can be arbitrarily combined to obtain new method embodiments or device embodiments without conflict.

[0322] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0323] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0324] The singular forms “a,” “the,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise.

[0325] It should be noted that in the various embodiments involved in this application, all steps or some steps may be performed, as long as a complete technical solution can be formed.

[0326] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A secure communication method, characterized in that, Applied to a first terminal, the method includes: Determine the first key and the second key; wherein the second key is a dynamic key; Based on the first key and the second key, the first parameter is encrypted to obtain the second parameter; wherein, the first parameter includes keywords that support retrieval; Send a first request to the first device; wherein the first request includes a second parameter; Receive a first message sent by the first device; wherein the first message includes a first search result; Based on the second key, the first search result is decrypted to obtain the second search result; The process of determining the second key includes: obtaining a session identifier, user authorization and authentication information, an application programming interface (API) service identifier, and the identifier of the first terminal; generating a multi-factor cipher for dynamic encryption based on the session identifier, user authorization and authentication information, API service identifier, and the first terminal identifier; and determining the second key based on the multi-factor cipher. The step of determining the second key based on the multi-factor cryptography includes: determining a pseudo-random function; obtaining a specified number of iteration rounds, a required output key length, and a randomly generated salt value; and deriving the second key based on the multi-factor cryptography, the specified number of iteration rounds, the length, the salt value, and the pseudo-random function. The step of encrypting the first parameter based on the first key and the second key to obtain the second parameter includes: receiving a dynamic encryption policy number sent by the first device or obtaining it from the storage module of the first terminal; determining a dynamic key encryption / decryption method based on the dynamic encryption policy number; encrypting the first parameter according to the dynamic key encryption / decryption method based on the second key to obtain the encrypted first parameter; signing the first parameter based on the second key to obtain a signature string; and encrypting the signature string, the encrypted first parameter, the user authorization authentication information, the identifier of the application programming interface service, the session identifier, and the salt value based on the first key to obtain the second parameter.

2. The method according to claim 1, characterized in that, Determining the first key includes: The first key is received from the first device or obtained from the storage module of the first terminal.

3. The method according to claim 1, characterized in that, The method further includes: Send a second request to the first device; The second request is used to register and apply for data resources; the data resources include one or more of the following: open field categories, allowed search field categories, whether data is anonymized, and open user permission scope.

4. The method according to claim 1, characterized in that, The method further includes: Send a third request to the first device; wherein the third request is used to request the application programming interface (API) open service; Receive the API key and interface specification, including user authorization and authentication information, sent by the first device; The user authorization and authentication information is generated by the first platform based on the username, password, application programming interface service identifier, request data table name, device whitelist, and creation time information; the interface specification includes the routing information of the first terminal, user authorization and authentication information, application programming interface service identifier, search keyword information, and query result format.

5. The method according to claim 1, characterized in that, The method further includes: Receive notification messages sent by the first device; The notification message is used to notify the first terminal to update the stored first key and dynamic key policy number; the notification message includes the updated / initialized first key and the updated / initialized dynamic key policy number.

6. A secure communication method, characterized in that, Applied to a first device, the method includes: The system receives a first request sent by a first terminal; wherein the first request includes a second parameter; the second parameter is obtained by the first terminal encrypting the first parameter based on a first key and a second key; the second key is a dynamic key; and the first parameter includes keywords that support retrieval. Send the second parameter to the first platform; The system receives a first message sent by the first platform and forwards the first message to the first terminal; wherein the first message includes a first search result. The second key is derived by the first terminal based on multi-factor cryptography, a specified number of iteration rounds, the required output key length, a randomly generated salt value, and a pseudo-random function; the multi-factor cryptography is used for dynamic encryption and is generated based on the session identifier, user authorization authentication information, application programming interface service identifier, and the identifier of the first terminal. The second parameter is obtained by the first terminal encrypting the signature string, the encrypted first parameter, the user authorization authentication information, the application programming interface service identifier, the session identifier, and the salt value based on the first key; the signature string is obtained by signing the first parameter based on the second key; the encrypted first parameter is obtained by encrypting the first parameter according to the dynamic key encryption and decryption method; the dynamic key encryption and decryption method is determined based on the dynamic encryption policy number; the dynamic encryption policy number is sent by the first device to the first terminal.

7. The method according to claim 6, characterized in that, The method further includes: The system receives a second request sent by a first terminal; wherein the second request is used to register and apply for data resources; the data resources include one or more of the following: open field categories, allowed search field categories, whether data is anonymized, and open user permission scope; The second request is reviewed, and the relevant information of the data resource is published to the data mart of the first device; wherein, the relevant information includes data resource cataloging and data summary information.

8. The method according to claim 6, characterized in that, The method further includes: Receive a third request sent by the first terminal; the third request is used to request the application programming interface (API) open service; The system reviews the third request and sends an API key and interface specification, including user authorization and authentication information, to the first terminal. The user authorization and authentication information is generated by the first platform based on the applicant's username, password, application programming interface service identifier, request data table name, device whitelist, and creation time information; the interface specification includes the first terminal's routing information, user authorization and authentication information, application programming interface service identifier, search keyword information, and query result format.

9. The method according to claim 6, characterized in that, The method further includes: A fourth request is sent to the first platform; wherein the fourth request is used to update / initialize key information; Receive the updated / initialized first key and the updated / initialized dynamic key policy number sent by the first platform; A notification message is sent to the first terminal; wherein the notification message is used to notify the first terminal to update the stored first key and dynamic key policy number.

10. A secure communication method, characterized in that, Applied to a first platform, the method includes: The first terminal receives a second parameter sent by the first device; wherein the second parameter is obtained by encrypting the first parameter based on a first key and a second key. Determine the third key and the second key; wherein the second key is a dynamic key; the first key and the third key are a set of symmetric keys; Based on the third key and the second key, the second parameter is decrypted to obtain the first parameter; The search is performed based on the first parameter, and the second search result is obtained. Based on the second key, the second search result is encrypted to obtain the first search result; Send a first message to the first device; wherein the first message includes a first search result; The determination of the second key includes: decrypting the second parameter based on the third key to obtain a signature string, an encrypted first parameter, user authorization and authentication information, an application programming interface (API) service identifier, a session identifier, and a salt value; the signature string is obtained by signing the first parameter based on the second key; generating a multi-factor cipher for dynamic encryption based on the session identifier, user authorization and authentication information, API service identifier, and first terminal identifier; and determining the second key based on the multi-factor cipher. The step of determining the second key based on the multi-factor cryptography includes: determining a pseudo-random function; obtaining a specified number of iteration rounds, a required output key length, and the salt value; and deriving the second key based on the multi-factor cryptography, the specified number of iteration rounds, the length, the salt value, and the pseudo-random function. The step of decrypting the second parameter based on the third key and the second key to obtain the first parameter includes: obtaining the dynamic encryption strategy number from the local machine; determining the dynamic key encryption / decryption method based on the dynamic encryption strategy number; and decrypting the encrypted first parameter based on the second key and according to the dynamic key encryption / decryption method to obtain the first parameter.

11. The method according to claim 10, characterized in that, The determination of the third key includes: Obtain the third key locally.

12. The method according to claim 10, characterized in that, The method further includes: Verify whether the identifier of the device requested for retrieval is compliant; or; Verify that the application interface service and the application interface service identifier correspond; or, Verify the signature string.

13. The method according to claim 10, characterized in that, The method further includes: Receive a fourth request sent by the first device; wherein the fourth request is used to update / initialize key information; Generate the updated / initialized first key and the updated / initialized third key; The unified number and the first terminal are pre-configured with multiple types of dynamic key encryption and decryption methods to generate an updated / initialized dynamic key policy number; Send the updated / initialized first key and the updated / initialized dynamic key policy number to the first device.

14. The method according to claim 10, characterized in that, The method further includes: Obtain the fourth key, username, password, API service identifier, request data table name, device whitelist list, and creation time information; Generate the first string based on the username, password, API service identifier, requested data table name, device whitelist, and creation time information; Based on the fourth key and the first string, user authorization and authentication information is generated.

15. A first terminal, characterized in that, The first terminal includes: The first processing module is used to determine the first key and the second key; wherein the second key is a dynamic key; The first processing module is further configured to encrypt the first parameter based on the first key and the second key to obtain the second parameter; wherein the first parameter includes keywords that support retrieval; A first sending module is configured to send a first request to a first device; wherein the first request includes a second parameter; A first receiving module is configured to receive a first message sent by the first device; wherein the first message includes a first search result; The first processing module is further configured to decrypt the first search result based on the second key to obtain the second search result; The first processing module is further configured to acquire a session identifier, user authorization and authentication information, application programming interface service identifier, and first terminal identifier; generate a multi-factor cipher for dynamic encryption based on the session identifier, user authorization and authentication information, application programming interface service identifier, and first terminal identifier; and determine the second key based on the multi-factor cipher. The first processing module is further configured to determine a pseudo-random function; obtain a specified number of iteration rounds, a required output key length, and a randomly generated salt value; and derive the second key based on the multi-factor cryptography, the specified number of iteration rounds, the length, the salt value, and the pseudo-random function. The first receiving module is further configured to receive the dynamic encryption policy number sent by the first device or obtained from the storage module of the first terminal. The first processing module is further configured to: determine a dynamic key encryption / decryption method based on the dynamic encryption strategy number; encrypt the first parameter according to the dynamic key encryption / decryption method based on the second key to obtain an encrypted first parameter; sign the first parameter based on the second key to obtain a signature string; and encrypt the signature string, the encrypted first parameter, the user authorization authentication information, the identifier of the application programming interface service, the session identifier, and the salt value based on the first key to obtain a second parameter.

16. A first device, characterized in that, The first device includes: The second receiving module is used to receive a first request sent by the first terminal; wherein the first request includes a second parameter; the second parameter is obtained by the first terminal encrypting the first parameter based on a first key and a second key; the second key is a dynamic key; and the first parameter includes keywords that support retrieval. The second sending module is used to send the second parameter to the first platform; The second receiving module is further configured to receive a first message sent by the first platform and forward the first message to the first terminal; wherein the first message includes a first search result; The second key is derived by the first terminal based on multi-factor cryptography, a specified number of iteration rounds, the required output key length, a randomly generated salt value, and a pseudo-random function; the multi-factor cryptography is used for dynamic encryption and is generated based on the session identifier, user authorization authentication information, application programming interface service identifier, and the identifier of the first terminal. The second parameter is obtained by the first terminal encrypting the signature string, the encrypted first parameter, the user authorization authentication information, the application programming interface service identifier, the session identifier, and the salt value based on the first key; the signature string is obtained by signing the first parameter based on the second key; the encrypted first parameter is obtained by encrypting the first parameter according to the dynamic key encryption and decryption method; the dynamic key encryption and decryption method is determined based on the dynamic encryption policy number; the dynamic encryption policy number is sent by the first device to the first terminal.

17. A first platform, characterized in that, The first platform includes: The third receiving module is used to receive the second parameter sent by the first device; wherein the second parameter is obtained by the first terminal encrypting the first parameter based on the first key and the second key; The third processing module is used to determine the third key and the second key; wherein the second key is a dynamic key; the first key and the third key are a set of symmetric keys; The third processing module is also used to decrypt the second parameter based on the third key and the second key to obtain the first parameter; The third processing module is also used to perform a search based on the first parameter to obtain a second search result; The third processing module is further configured to encrypt the second search result based on the second key to obtain the first search result; The third sending module is used to send a first message to the first device; wherein the first message includes a first search result; The third processing module is further configured to decrypt the second parameter based on the third key to obtain a signature string, an encrypted first parameter, user authorization and authentication information, an application programming interface service identifier, a session identifier, and a salt value; the signature string is obtained by signing the first parameter based on the second key; the third processing module is further configured to generate a multi-factor cipher for dynamic encryption based on the session identifier, user authorization and authentication information, application programming interface service identifier, and first terminal identifier; and determine the second key based on the multi-factor cipher. The third processing module is further configured to determine the pseudo-random function; obtain the specified number of iteration rounds, the required output key length, and the salt value; and derive the second key based on the multi-factor cryptography, the specified number of iteration rounds, the length, the salt value, and the pseudo-random function. The third processing module is further configured to obtain a dynamic encryption strategy number from the local machine; determine a dynamic key encryption / decryption method based on the dynamic encryption strategy number; and decrypt the encrypted first parameter based on the second key and according to the dynamic key encryption / decryption method to obtain the first parameter.

18. A communication device, characterized in that, The communication device includes: Memory, used to store executable instructions; The processor, when executing executable instructions stored in the memory, implements the secure communication method according to any one of claims 1 to 5, or the secure communication method according to any one of claims 6 to 9, or the secure communication method according to any one of claims 10 to 14.

19. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the secure communication method of any one of claims 1 to 5, or the secure communication method of any one of claims 6 to 9, or the secure communication method of any one of claims 10 to 14.

20. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the secure communication method according to any one of claims 1 to 5, or the secure communication method according to any one of claims 6 to 9, or the secure communication method according to any one of claims 10 to 14.

Images