Dynamic protection method, system, device and equipment and computer readable medium

Abstract

The embodiment of the invention discloses a dynamic protection method, system and device, electronic equipment and a computer readable medium. A specific embodiment of the method comprises the following steps: generating a first temporary private internet protocol address and a second temporary private internet protocol address; acquiring first communication information and second communication information; respectively sending the first communication information and the second communication information to the second user terminal and the first user terminal through a signaling server; generating a session random identifier, a main public key and a second user identifier corresponding to a second user terminal; generating a second temporary key pair corresponding to a second user terminal; sending encrypted information corresponding to the first symmetric key to a second user terminal; and in response to determining that the second user terminal has acquired the decrypted first symmetric key, performing encrypted communication processing between the first user terminal and the second user terminal. According to the embodiment, leakage of the Internet protocol address is prevented, and the privacy protection level of the user during session communication is improved.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to a dynamic protection method, apparatus, device, and computer-readable medium. Background Art

[0002] At present, using Web Real-Time Communication (WebRTC) for communication has become one of the main means of web communication. For the security issues in the process of using WebRTC communication, the commonly used solution is to use Datagram Transport Layer Security (DTLS) to encrypt data and identity authentication. And use Session Traversal Utilities for NAT (STUN) to hide the private Internet Protocol address corresponding to the user.

[0003] However, in practice, it is found that when using the above-mentioned DTLS for data encryption and identity authentication and the above-mentioned STUN protocol, the following technical problems often occur:

[0004] When a user terminal uses DTLS in multiple sessions or platforms, the same DTLS certificate will be used. Attackers can analyze and identify the public key information in these same DTLS certificates to associate different sessions. This allows them to understand the user's activity patterns and schedules and obtain the user's privacy information. When a user terminal uses the above-mentioned STUN protocol to establish a session connection, the user terminal will send and receive the private Internet Protocol address and public Internet Protocol address corresponding to the user terminal through the signaling channel. If the signaling channel is not encrypted, the user's private Internet Protocol address and public Internet Protocol address will be leaked.

[0005] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0006] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0007] Some embodiments of the present disclosure propose dynamic protection methods and systems, devices, electronic devices, and computer-readable media to solve one or more of the technical problems mentioned in the above background technology section.

[0008] In a first aspect, some embodiments of the present disclosure provide a dynamic protection method, the method comprising: in response to receiving a session communication request information for a first user terminal and a second user terminal, generating a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal; obtaining first communication information corresponding to the first user terminal and second communication information corresponding to the second user terminal according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address; sending the first communication information and the second communication information to the second user terminal and the first user terminal respectively through a signaling server; in response to determining that the first user terminal and the second user terminal have received the second communication information respectively, The information and the first communication information are determined to generate a first symmetric key at the first user terminal, and a session random identifier, a master public key and a second user identifier corresponding to the second user terminal are generated, wherein the session corresponding to the session random identifier is a communication session between the first user terminal and the second user terminal; according to the session random identifier, the master public key and the second user identifier, a second temporary key pair corresponding to the second user terminal is generated; the encrypted information corresponding to the first symmetric key is sent to the second user terminal, wherein the encrypted information is generated based on the second temporary key pair; in response to determining that the second user terminal has obtained the decrypted first symmetric key, encrypted communication processing is performed between the first user terminal and the second user terminal according to the first symmetric key.

[0009] In a second aspect, some embodiments of the present disclosure provide a dynamic protection device, including: a first generating unit, configured to generate a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal in response to receiving a session communication request information between the first user terminal and the second user terminal; an acquiring unit, configured to acquire first communication information corresponding to the first user terminal and second communication information corresponding to the second user terminal according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address; a first sending unit, configured to send the first communication information and the second communication information to the second user terminal and the first user terminal respectively through a signaling server; and a second generating unit, configured to generate a first temporary private Internet Protocol address corresponding to the first user terminal and the second user terminal in response to determining that the first user terminal and the second user terminal have received the first temporary private Internet Protocol address and the second temporary private Internet Protocol address respectively. The invention relates to a method for generating a first symmetric key for a first user terminal and a second communication information and the first communication information, and determining to generate a first symmetric key at the first user terminal, generating a session random identifier, a master public key and a second user identifier corresponding to the second user terminal, wherein the session corresponding to the session random identifier is a communication session between the first user terminal and the second user terminal; a third generating unit, configured to generate a second temporary key pair corresponding to the second user terminal according to the session random identifier, the master public key and the second user identifier; a second sending unit, configured to send encrypted information corresponding to the first symmetric key to the second user terminal, wherein the encrypted information is generated based on the second temporary key pair; an executing unit, configured to execute encrypted communication processing between the first user terminal and the second user terminal according to the first symmetric key in response to determining that the second user terminal has obtained the decrypted first symmetric key.

[0010] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner in the first aspect.

[0011] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation manner in the first aspect is implemented.

[0012] The above-mentioned embodiments of the present disclosure have the following beneficial effects: through the dynamic protection method of some embodiments of the present disclosure, the anonymity and privacy protection of the user terminal when communicating through WebRTC are improved. Specifically, the place where the user terminal is insecure when communicating through WebRTC is that the user terminal will use the same DTLS certificate when using DTLS in multiple sessions or platforms. The attacker can analyze and identify the public key information in these same DTLS certificates, thereby associating different sessions together, understanding the user's activity mode and schedule, thereby exposing the user's privacy. When the user terminal uses the above-mentioned STUN protocol to establish a session connection, the private Internet Protocol address and public Internet Protocol address corresponding to the user terminal will be sent and received through the signaling channel. If the signaling channel is not encrypted, the private Internet Protocol address and public Internet Protocol address corresponding to the user will be leaked. Based on this, the dynamic protection method of some embodiments of the present disclosure, first, in response to receiving the session communication request information between the first user terminal and the second user terminal, generates the first temporary private Internet Protocol address corresponding to the first user terminal and the second temporary private Internet Protocol address corresponding to the second user terminal. Wherein, the generation of the first temporary private Internet Protocol address and the second temporary private Internet Protocol address is used to hide the first private Internet Protocol address corresponding to the first user terminal and the second private Internet Protocol address corresponding to the second user terminal. Secondly, according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address, the first communication information corresponding to the first user terminal and the second communication information corresponding to the second user terminal are obtained. Wherein, the first communication information includes the first temporary private Internet Protocol address and the first public Internet Protocol address corresponding to the first user terminal, and the second communication information includes the second temporary private Internet Protocol address and the second public Internet Protocol address corresponding to the second user terminal. Again, the first communication information and the second communication information are sent to the second user terminal and the first user terminal respectively through the signaling server. Wherein, the signaling server is used for negotiating communication and session management between the first user terminal and the second user terminal. The first communication information and the second communication information can be used to establish a communication connection between the first user terminal and the second user terminal. Then, in response to determining that the first user terminal and the second user terminal have received the second communication information and the first communication information respectively, and determining to generate the first symmetric key at the first user terminal, a session random identifier, a master public key, and a second user identifier corresponding to the second user terminal are generated, wherein the session corresponding to the session random identifier is a communication session between the first user terminal and the second user terminal. Here, the first symmetric key is a symmetric key used to perform encrypted communication processing between the first user terminal and the second user terminal.Then, according to the above-mentioned session random identifier, the above-mentioned master public key and the above-mentioned second user identifier, the second temporary key pair corresponding to the above-mentioned second user terminal is generated. Among them, the above-mentioned session random identifier is a random number, which is regenerated each time the session communication is started. The above-mentioned session random identifier is involved in the generation of the temporary public key in the above-mentioned second temporary key pair (the second key pair includes a temporary public key and a temporary private key) to ensure the uniqueness of the public key in different session communications, and avoid the above-mentioned first user terminal using the same public key in the DTLS certificate in different sessions when using WebRTC communication, so as to be identified and tracked by attackers. The above-mentioned master public key is a component for generating the above-mentioned second temporary key pair. The first user identifier and the second user identifier are the emails of the user corresponding to the above-mentioned first terminal and the user corresponding to the above-mentioned second terminal, respectively. Afterwards, the encrypted information corresponding to the above-mentioned first symmetric key is sent to the above-mentioned second user terminal, wherein the above-mentioned encrypted information is generated based on the above-mentioned second temporary key pair. Here, the encrypted information corresponding to the above-mentioned first symmetric key is sent to the above-mentioned second user terminal in order to improve the security in the process of sending the above-mentioned first symmetric key, and to make the above-mentioned first user terminal and the above-mentioned second user terminal share the same symmetric key, so as to perform encryption and decryption operations in the process of session communication with the same symmetric key. Finally, in response to determining that the second user terminal has acquired the first symmetric key, encrypted communication processing is performed between the first user terminal and the second user terminal according to the first symmetric key. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0014] Figure 1 is a flow chart of some embodiments of the dynamic protection method according to the present disclosure;

[0015] Figure 2 is a schematic diagram of the structure of some embodiments of the dynamic protection device according to the present disclosure;

[0016] Figure 3 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0017] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0018] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0019] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0020] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0021] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0022] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0023] refer to Figure 1 , shows a process 100 of some embodiments of the dynamic protection method according to the present disclosure. The dynamic protection method comprises the following steps:

[0024] Step 101: in response to receiving session communication request information for a first user terminal and a second user terminal, generate a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal.

[0025] In some embodiments, in response to receiving the session communication request information between the first user terminal and the second user terminal, the execution subject (for example, an electronic device) of the above-mentioned dynamic protection method can obtain the above-mentioned session communication request information through a wired connection method or a wireless connection method. Among them, the receiving object of the session communication request information is the execution subject. The session communication request information refers to the request data initiated by the above-mentioned first user terminal and sent to the above-mentioned second user terminal before the session communication is established, which is used to request the establishment of a specific type of session communication. Secondly, the above-mentioned first user terminal and the above-mentioned second user terminal can be computer devices. The first user terminal and the second user terminal have corresponding users respectively. For example, the first user terminal corresponds to user A. The second user terminal corresponds to user B. Thirdly, the above-mentioned first temporary private Internet Protocol address and the above-mentioned second temporary private Internet Protocol address are private Internet Protocol addresses used by the above-mentioned first user terminal and the above-mentioned second user terminal during a single session communication process. The private Internet Protocol address is an Internet Protocol address used in a local area network. In practice, the above-mentioned execution subject can use the ifconfig command under the Linux system to generate the first temporary private Internet Protocol address corresponding to the above-mentioned first user terminal and the second temporary private Internet Protocol address corresponding to the above-mentioned second user terminal.

[0026] It should be noted that the above-mentioned wireless connection methods may include but are not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or developed in the future.

[0027] In some optional implementations of some embodiments, the execution subject generates the first temporary private Internet Protocol address corresponding to the first user terminal and the second temporary private Internet Protocol address corresponding to the second user terminal, which may include the following steps:

[0028] The first step is to obtain the first private Internet Protocol address corresponding to the first user terminal and the second private Internet Protocol address corresponding to the second user terminal. The first private Internet Protocol address is the Internet Protocol address used by the first user terminal in the local area network. The second private Internet Protocol address is the Internet Protocol address used by the second user terminal in the local area network. The first private Internet Protocol address and the second private Internet Protocol address cannot be directly routed on the Internet and can only be used within the local area network. In practice, the execution subject can obtain the first private Internet Protocol address and the second private Internet Protocol address in the operating systems corresponding to the first user terminal and the second user terminal, respectively.

[0029] The second step is to establish a first communication connection between the first user terminal and the first proxy server and a second communication connection between the second user terminal and the second proxy server based on the first private Internet Protocol address and the second private Internet Protocol address, so as to obtain the first Internet Protocol address and the second Internet Protocol address respectively as the first temporary private Internet Protocol address and the second temporary private Internet Protocol address. Among them, the first proxy server and the second proxy server are a kind of proxy server, which acts as a medium between the user terminal and the server. The first communication connection is a session communication connection established between the first user terminal and the first proxy server, and the second communication connection is a session communication connection established between the second user terminal and the second proxy server. The first Internet Protocol address and the second Internet Protocol address are the Internet Protocol address corresponding to the first proxy server and the Internet Protocol address corresponding to the second proxy server, respectively.

[0030] Step 102: Acquire first communication information corresponding to the first user terminal and second communication information corresponding to the second user terminal according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address.

[0031] In some embodiments, the execution subject may obtain the first communication information corresponding to the first user terminal and the second communication information corresponding to the second user terminal according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address. The first communication information and the second communication information are information used to establish a session communication connection between the first user terminal and the second user terminal in WebRTC. The first communication information is the relevant information of the first user terminal during the communication process. The second communication information is the relevant information of the second user terminal during the communication process.

[0032] In some optional implementations of some embodiments, the execution subject obtains the first communication information corresponding to the first user terminal and the second communication information corresponding to the second user terminal according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address, which may include the following steps:

[0033] The first step is to obtain the first public Internet Protocol address corresponding to the first user terminal and the second public Internet Protocol address corresponding to the second user terminal from the target network communication server according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address. The target network communication server is a server corresponding to the STUN protocol, and its main function is to return the Internet Protocol address applied by the user terminal for establishing a session communication connection with other user terminals. The first public Internet Protocol address is the Internet Protocol address used by the first user terminal to establish a session communication connection. The second public Internet Protocol address is the Internet Protocol address used by the second user terminal to establish a session communication connection.

[0034] As an example, first, the execution entity sends the binding request message corresponding to the first user terminal to the server corresponding to the STUN protocol, wherein the binding request message includes the first temporary private Internet Protocol address and port number corresponding to the first user terminal. Then, after receiving the binding request message, the server corresponding to the STUN protocol obtains the first temporary private Internet Protocol address and port number in the binding request message, and constructs a STUN binding response message and sends it to the first user terminal. Then, after receiving the STUN binding response message, the first user terminal obtains the Internet Protocol address and port number in the binding response message, and compares them with the first temporary private Internet Protocol address and port in the previously sent STUN binding request message. Finally, if there is inconsistency, the first public Internet Protocol address corresponding to the first user terminal is returned.

[0035] The second step is to combine the first temporary private Internet Protocol address and the first public Internet Protocol address to obtain first communication information.

[0036] As an example, the first communication information may be: [first temporary private Internet Protocol address, first public Internet Protocol address].

[0037] The third step is to combine the second temporary private Internet Protocol address and the second public Internet Protocol address to obtain second communication information.

[0038] As an example, the second communication information may be: [second temporary private Internet Protocol address, second public Internet Protocol address].

[0039] Step 103: Send the first communication information and the second communication information to the second user terminal and the first user terminal respectively through the signaling server.

[0040] In some embodiments, the execution subject may send the first communication information and the second communication information to the second user terminal and the first user terminal respectively through a signaling channel through a signaling server. The signaling channel is a communication channel for transmitting information between the signaling server and the user terminal. The signaling server is a server that coordinates communication and information exchange when the first user terminal and the second user terminal establish a session communication connection through WebRTC.

[0041] Step 104, in response to determining that the first user terminal and the second user terminal have received the second communication information and the first communication information respectively, and determining to generate a first symmetric key at the first user terminal, generate a session random identifier, a master public key and a second user identifier corresponding to the second user terminal.

[0042] In some embodiments, the execution subject may generate a session random identifier, a master public key, and a second user identifier corresponding to the second user terminal in response to determining that the first user terminal and the second user terminal have received the second communication information and the first communication information, respectively, and determining that the first symmetric key is generated at the first user terminal. The session corresponding to the session random identifier is a communication session between the first user terminal and the second user terminal. The session random identifier is a random number, which is regenerated each time the session communication is started. The master public key is a public key. The second user identifier is the email of the user corresponding to the second user terminal. The first symmetric key is a key type used in an encryption technology, and the first user terminal and the second user terminal use the same first symmetric key to encrypt and decrypt information. The first symmetric key can be generated by the following steps (the execution subject of the following generation step is the first user terminal):

[0043] The first step is to obtain the network device log, traffic status and protocol status corresponding to the first user terminal.

[0044] In the second step, in response to the network device log, the traffic status, and the protocol status being abnormal, the following generation steps are performed:

[0045] Sub-step 1: Execute a connection with a hardware security device, wherein the hardware security device may be a hardware security module (HSM).

[0046] Sub-step 2: Send a hardware key generation request to the hardware security device to obtain a hardware key, wherein the hardware key generation request may specify the length and generation algorithm of the hardware key, and the hardware key is a true random number. Here, the hardware key is a key generated by the hardware security device.

[0047] Sub-step three: input the hardware key into a symmetric encryption algorithm to generate a first key. The symmetric encryption algorithm may be Advanced Encryption Standard (AES).

[0048] Sub-step four: determining the first key as the first symmetric key.

[0049] In the third step, in response to the network device log, the traffic status, and the protocol status being normal, the following generation steps are performed:

[0050] Sub-step 1: obtaining a symmetric key table, wherein the symmetric key table stores at least one key. The symmetric key table is a data structure for storing keys. For example, the symmetric key table can be a queue in a data structure.

[0051] Sub-step 2: Generate at least one random number using a random number generator, and for each of the at least one random number, perform the following generation steps:

[0052] The first sub-step is to input the random number into a hash function to obtain a hash key, wherein the hash function may be a SHA-256 function.

[0053] The second sub-step is to input the above-mentioned hash key into the above-mentioned symmetric key table.

[0054] Step 4: In response to the first user terminal generating the first symmetric key, a hash key is randomly selected from the symmetric key table as the first symmetric key. Step 105: Generate a second temporary key pair corresponding to the second user terminal according to the session random identifier, the master public key and the second user identifier.

[0055] In some embodiments, the execution entity may generate a second temporary key pair corresponding to the second user terminal based on the session random identifier, the master public key, and the second user identifier. The second temporary key pair is only used to establish a session connection between the second user terminal and the first user terminal, and becomes invalid when the session connection is closed. The second temporary key pair includes a second temporary public key and a second temporary private key. The second temporary public key and the second temporary private key are respectively a public key generated at the second user terminal and a private key generated at the second user terminal, and are only used to establish a session connection between the second user terminal and the first user terminal, and become invalid when the session connection is closed.

[0056] As an example, first, the execution entity can concatenate the random session identifier, the master public key, and the second user identifier to obtain a string. Then, the execution entity can use a hash function to perform a hash operation on the string to obtain a hash value of a fixed length. Then, the hash value is divided into two parts of the same length. The first part is used as the second temporary private key, and the second part is used as the generation parameter corresponding to the second temporary public key. Here, the first temporary private key and the generation parameter can be XORed to obtain the operation result. Finally, the operation result is determined as the second temporary public key corresponding to the second user terminal.

[0057] In some optional implementations of some embodiments, the execution subject generates the second temporary key pair corresponding to the second user terminal according to the random session identifier, the master public key and the second user identifier, which may include the following steps:

[0058] The first step is to combine the second user identifier with the random session identifier to generate a second public key combined identifier.

[0059] For example, the second public key combined with the identifier may be: [second user identifier, session random identifier].

[0060] The second step is to generate a second temporary key pair corresponding to the second user terminal based on the master public key and the second public key combined with the identifier.

[0061] In some embodiments, the execution entity may generate a second temporary key pair corresponding to the second user terminal based on the master public key and the second public key combined with an identifier.

[0062] As an example, the execution subject may generate a second temporary key pair corresponding to the second user terminal using encryption software according to the master public key and the second public key combined with the identifier. The encryption software may be GNU Privacy Guard.

[0063] Optionally, the generating of the second temporary key pair corresponding to the second user terminal according to the master public key and the second public key combined with the identifier includes:

[0064] Sub-step one: combine the master public key and the second public key with the identifier to obtain second combination information.

[0065] For example, the second combined information may be: [primary public key, second public key combined with identifier].

[0066] Sub-step two: using the Key Generation Center (KGC) in SM9, the second combination information is processed to obtain a second temporary key pair.

[0067] Step 106: Send the encrypted information corresponding to the first symmetric key to the second user terminal.

[0068] In some embodiments, the execution entity may send the encrypted information corresponding to the first symmetric key to the second user terminal, wherein the encrypted information is generated by the second temporary public key. In practice, the execution entity may send the second temporary public key in the second temporary key pair to the first user terminal through the signaling server. Then, the first symmetric key is encrypted using the second temporary public key to obtain the encrypted information. Finally, the encrypted information is sent to the second user terminal.

[0069] In some optional implementations of some embodiments, the above encryption information is generated by the following steps:

[0070] In the first step, the first symmetric key is truncated to obtain a front-end key and a back-end key, wherein the length of the front-end key is equal to the length of the back-end key.

[0071] The second step is to generate a first blinding factor and a second blinding factor, wherein the first blinding factor and the second blinding factor may be blind factors.

[0072] The third step is to use the first blinding factor to perform blinding processing on the previous key to obtain a first blinded key.

[0073] The fourth step is to use the second blinding factor to perform blinding processing on the latter key to obtain a second blinded key.

[0074] The fifth step is to concatenate the first blinding factor and the second blinding key to obtain the first blinding information.

[0075] The sixth step is to concatenate the second blinding factor and the first blinding key to obtain the second blinding information.

[0076] Step 7: Obtain the second temporary public key in the above second temporary key pair.

[0077] In the eighth step, the second temporary public key is used to perform encryption operations on the first blinded information and the second blinded information respectively to obtain the first encrypted information and the second encrypted information.

[0078] In the ninth step, the first encrypted information and the second encrypted information are determined as the encrypted information.

[0079] In some optional implementations of some embodiments, the above encryption information is generated by the following steps:

[0080] In the first step, the first symmetric key is randomly truncated multiple times to obtain a set of fragment key groups. The fragment key group includes: a front-end key and a back-end key. The length of the front-end key can be the same as or different from the length of the back-end key.

[0081] In the second step, for each segment key group in the segment key group set, the following information generation steps are performed:

[0082] Sub-step 1, determining the front-end key and the back-end key corresponding to the above-mentioned fragment key group, and using them as the target front-end key and the target back-end key respectively.

[0083] Sub-step 2, determining the length between the above-mentioned target front-end key and the above-mentioned target back-end key.

[0084] Sub-step 3, in response to determining that the target front-end key is longer than the target back-end key, inputting the target front-end key into a first coding model to generate first front-end coding information, and inputting the target back-end key into a second coding model to generate first back-end coding information. The first coding model and the second coding model may be convolutional layers of different numbers.

[0085] Sub-step 4, inputting the first front-end encoding information and the first rear-end encoding information into a decoding model to generate a second decoding vector as initial encryption information. The decoding model corresponds to a smaller number of upsampling layers than the first encoding model and the second encoding model. The initial encryption information may be in vector form.

[0086] Sub-step 3, in response to determining that the target front-end key is shorter than the target back-end key, inputting the target front-end key into the second coding model to generate second front-end coding information, and inputting the target back-end key into the first coding model to generate second back-end coding information. The first coding model and the second coding model may be convolutional layers of different numbers.

[0087] Sub-step 4, inputting the second front-end encoding information and the second rear-end encoding information into the decoding model to generate a second decoding vector as the initial encryption information. The first decoding model corresponds to a smaller number of upsampling layers than the first encoding model and the second encoding model. The initial encryption information may be in vector form.

[0088] The third step is to randomly extract a target number of initial encrypted information from the obtained initial encrypted information set to obtain an initial encrypted information group.

[0089] The fourth step is to concatenate the initial encrypted information in the initial encrypted information group to generate concatenated information as encrypted information.

[0090] Optionally, as one of the invention points, the technical problem of "data leakage exists in the encryption process, and the encryption process is relatively fixed, resulting in the encryption result being easy to be cracked" is solved. Based on this, the present disclosure ensures the uncertainty of the encryption process by setting a first encoding model, a second encoding model and a first decoding model, as well as random interception and random extraction, so as to ensure the randomness of the encryption process.

[0091] Step 107: In response to determining that the second user terminal has obtained the decrypted first symmetric key, encrypted communication processing is performed between the first user terminal and the second user terminal according to the first symmetric key.

[0092] In some embodiments, the execution subject may, in response to determining that the second user terminal has obtained the decrypted first symmetric key, perform encrypted communication processing between the first user terminal and the second user terminal according to the first symmetric key. The decrypted first symmetric key is generated by the execution subject after the second user terminal uses the second temporary private key in the second temporary key pair to decrypt the encrypted information. In practice, the execution subject may encrypt the communication data using the first symmetric key at the first user terminal to obtain a ciphertext. The ciphertext is then sent to the second user terminal, and the second user terminal decrypts the ciphertext using the first symmetric key to obtain the communication data.

[0093] Optionally, to perform encrypted communication processing between the first user terminal and the second user terminal, the execution subject may perform the following steps:

[0094] The first step is to generate a first user identifier corresponding to the first user terminal, wherein the first user identifier is an email of a user corresponding to the first user terminal.

[0095] In the second step, in response to determining to generate a second symmetric key at the second user terminal, a first temporary key pair corresponding to the first user terminal is generated according to the random session identifier, the master public key and the first user identifier.

[0096] The third step is to send the encrypted information corresponding to the second symmetric key to the first user terminal, wherein the encrypted information is generated based on the first temporary key pair. In practice, the execution entity can send the first temporary public key in the first temporary key pair to the second user terminal through the signaling server. Then, the second symmetric key is encrypted using the first temporary public key to obtain the encrypted information. Finally, the encrypted information is sent to the first user terminal.

[0097] In the fourth step, in response to determining that the first user terminal has obtained the decrypted second symmetric key, the encrypted communication processing between the first user terminal and the second user terminal is performed according to the second symmetric key. The decrypted second symmetric key is generated by the execution subject after the first user terminal uses the first temporary private key in the first temporary key pair to decrypt the encrypted information. In practice, the execution subject can use the second symmetric key to encrypt the communication data at the second user terminal to obtain the ciphertext. The ciphertext is then sent to the first user terminal, and the first user terminal decrypts the ciphertext using the second symmetric key to obtain the communication data.

[0098] The above-mentioned embodiments of the present disclosure have the following beneficial effects: through the dynamic protection method of some embodiments of the present disclosure, the anonymity and privacy protection of the user terminal when communicating through WebRTC are improved. Specifically, the place where the user terminal is insecure when communicating through WebRTC is that the user terminal will use the same DTLS certificate when using DTLS in multiple sessions or platforms. The attacker can analyze and identify the public key information in these same DTLS certificates, thereby associating different sessions together, understanding the user's activity mode and schedule, thereby exposing the user's privacy. When the user terminal uses the above-mentioned STUN protocol to establish a session connection, the private Internet Protocol address and public Internet Protocol address corresponding to the user terminal will be sent and received through the signaling channel. If the signaling channel is not encrypted, the private Internet Protocol address and public Internet Protocol address corresponding to the user will be leaked. Based on this, the dynamic protection method of some embodiments of the present disclosure, first, in response to receiving the session communication request information between the first user terminal and the second user terminal, generates the first temporary private Internet Protocol address corresponding to the first user terminal and the second temporary private Internet Protocol address corresponding to the second user terminal. Wherein, the generation of the first temporary private Internet Protocol address and the second temporary private Internet Protocol address is used to hide the first private Internet Protocol address corresponding to the first user terminal and the second private Internet Protocol address corresponding to the second user terminal. Secondly, according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address, the first communication information corresponding to the first user terminal and the second communication information corresponding to the second user terminal are obtained. Wherein, the first communication information includes the first temporary private Internet Protocol address and the first public Internet Protocol address corresponding to the first user terminal, and the second communication information includes the second temporary private Internet Protocol address and the second public Internet Protocol address corresponding to the second user terminal. Again, the first communication information and the second communication information are sent to the second user terminal and the first user terminal respectively through the signaling server. Wherein, the signaling server is used for negotiating communication and session management between the first user terminal and the second user terminal. The first communication information and the second communication information can be used to establish a communication connection between the first user terminal and the second user terminal. Then, in response to determining that the first user terminal and the second user terminal have received the second communication information and the first communication information respectively, and determining to generate the first symmetric key at the first user terminal, a session random identifier, a master public key, and a second user identifier corresponding to the second user terminal are generated, wherein the session corresponding to the session random identifier is a communication session between the first user terminal and the second user terminal. Here, the first symmetric key is a symmetric key used to perform encrypted communication processing between the first user terminal and the second user terminal.Then, according to the above-mentioned session random identifier, the above-mentioned master public key and the above-mentioned second user identifier, the second temporary key pair corresponding to the above-mentioned second user terminal is generated. Among them, the above-mentioned session random identifier is a random number, which is regenerated each time the session communication is started. The above-mentioned session random identifier is involved in the generation of the temporary public key in the above-mentioned second temporary key pair (the second key pair includes a temporary public key and a temporary private key) to ensure the uniqueness of the public key in different session communications, and avoid the above-mentioned first user terminal using the same public key in the DTLS certificate in different sessions when using WebRTC communication, so as to be identified and tracked by attackers. The above-mentioned master public key is a component for generating the above-mentioned second temporary key pair. The first user identifier and the second user identifier are the emails of the user corresponding to the above-mentioned first terminal and the user corresponding to the above-mentioned second terminal, respectively. Afterwards, the encrypted information corresponding to the above-mentioned first symmetric key is sent to the above-mentioned second user terminal, wherein the above-mentioned encrypted information is generated based on the above-mentioned second temporary key pair. Here, the encrypted information corresponding to the above-mentioned first symmetric key is sent to the above-mentioned second user terminal in order to improve the security in the process of sending the above-mentioned first symmetric key, and to make the above-mentioned first user terminal and the above-mentioned second user terminal share the same symmetric key, so as to perform encryption and decryption operations in the process of session communication with the same symmetric key. Finally, in response to determining that the second user terminal has acquired the first symmetric key, encrypted communication processing is performed between the first user terminal and the second user terminal according to the first symmetric key.

[0099] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a dynamic protection device. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the dynamic protection device can be specifically applied to various electronic devices.

[0100] like Figure 2As shown, a dynamic protection device 200 includes: a first generating unit 201, an acquiring unit 202, a first sending unit 203, a second generating unit 204, a third generating unit 205, a second sending unit 206 and an executing unit 207. The first generating unit 201 is configured to: in response to receiving a session communication request information between a first user terminal and a second user terminal, generate a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal. The acquiring unit 202 is configured to: acquire the first communication information corresponding to the first user terminal and the second communication information corresponding to the second user terminal according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address. The first sending unit 203 is configured to: send the first communication information and the second communication information to the second user terminal and the first user terminal respectively through a signaling server. The second generating unit 204 is configured to: in response to determining that the first user terminal and the second user terminal have received the second communication information and the first communication information respectively, and determining to generate the first symmetric key at the first user terminal, generate a session random identifier, a master public key and a second user identifier corresponding to the second user terminal, wherein the session corresponding to the session random identifier is a communication session between the first user terminal and the second user terminal. The third generating unit 205 is configured to: generate a second temporary key pair corresponding to the second user terminal according to the session random identifier, the master public key and the second user identifier. The second sending unit 206 is configured to: send the encrypted information corresponding to the first symmetric key to the second user terminal, wherein the encrypted information is generated based on the second temporary key pair. The executing unit 207 is configured to: in response to determining that the second user terminal has obtained the decrypted first symmetric key, perform the encrypted communication processing between the first user terminal and the second user terminal according to the first symmetric key.

[0101] It is understood that the units described in the dynamic protection device 200 are similar to those described in the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the dynamic protection device 200 and the units included therein, and will not be described in detail here.

[0102] Reference below Figure 3 , which shows a structural schematic diagram of an electronic device (eg, an electronic device) 300 suitable for implementing some embodiments of the present disclosure. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0103] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0104] Typically, the following devices may be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0105] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0106] It should be noted that the computer-readable medium in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, the computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0107] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0108] The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; or it may exist independently without being installed in the electronic device. The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: in response to receiving a session communication request information for the first user terminal and the second user terminal, generates a first temporary private Internet Protocol address corresponding to the above-mentioned first user terminal and a second temporary private Internet Protocol address corresponding to the above-mentioned second user terminal; obtains the first communication information corresponding to the above-mentioned first user terminal and the second communication information corresponding to the above-mentioned second user terminal according to the above-mentioned first temporary private Internet Protocol address and the above-mentioned second temporary private Internet Protocol address; sends the above-mentioned first communication information and the above-mentioned second communication information to the above-mentioned second user terminal and the above-mentioned first user terminal respectively through the signaling server; in response to determining that the above-mentioned first user terminal and the above-mentioned second user terminal are respectively connected The second communication information and the first communication information are received, and it is determined that a first symmetric key is generated at the first user terminal, and a session random identifier, a master public key and a second user identifier corresponding to the second user terminal are generated, wherein the session corresponding to the session random identifier is a communication session between the first user terminal and the second user terminal; a second temporary key pair corresponding to the second user terminal is generated according to the session random identifier, the master public key and the second user identifier; encrypted information corresponding to the first symmetric key is sent to the second user terminal, wherein the encrypted information is generated based on the second temporary key pair; in response to determining that the second user terminal has obtained the decrypted first symmetric key, encrypted communication processing is performed between the first user terminal and the second user terminal according to the first symmetric key.

[0109] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0110] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0111] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be provided in a processor, for example, may be described as: a processor comprising a first generating unit, an acquiring unit, a first sending unit, a second generating unit, a third generating unit, a second sending unit and an executing unit. Among them, the names of these units do not constitute a limitation on the units themselves in certain circumstances, for example, the first generating unit may also be described as "a unit for generating a first temporary private Internet Protocol address corresponding to the above-mentioned first user terminal and a second temporary private Internet Protocol address corresponding to the above-mentioned second user terminal".

[0112] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0113] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. A dynamic protection method, comprising: In response to receiving a session communication request information for a first user terminal and a second user terminal, generating a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal; Acquire, according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address, first communication information corresponding to the first user terminal and second communication information corresponding to the second user terminal; Sending the first communication information and the second communication information to the second user terminal and the first user terminal respectively through a signaling server; In response to determining that the first user terminal and the second user terminal have received the second communication information and the first communication information respectively, and determining to generate a first symmetric key at the first user terminal, generating a random session identifier, a master public key, and a second user identifier corresponding to the second user terminal, wherein the session corresponding to the random session identifier is a communication session between the first user terminal and the second user terminal; Generate a second temporary key pair corresponding to the second user terminal according to the session random identifier, the master public key and the second user identifier; Sending encrypted information corresponding to the first symmetric key to the second user terminal, wherein the encrypted information is generated based on the second temporary key pair; In response to determining that the second user terminal has acquired the decrypted first symmetric key, encrypted communication processing is performed between the first user terminal and the second user terminal based on the first symmetric key.

2. The method according to claim 1, further comprising: Generate a first user identifier corresponding to the first user terminal; In response to determining to generate a second symmetric key at the second user terminal, generating a first temporary key pair corresponding to the first user terminal according to the random session identifier, the master public key and the first user identifier; Sending encrypted information corresponding to the second symmetric key to the first user terminal, wherein the encrypted information is generated based on the first temporary key pair; In response to determining that the first user terminal has acquired the decrypted second symmetric key, encrypted communication processing is performed between the first user terminal and the second user terminal based on the second symmetric key.

3. The method according to claim 1, wherein generating a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal comprises: Acquire a first private Internet Protocol address corresponding to the first user terminal and a second private Internet Protocol address corresponding to the second user terminal; Based on the first private Internet Protocol address and the second private Internet Protocol address, a first communication connection between the first user terminal and the first proxy server and a second communication connection between the second user terminal and the second proxy server are established to obtain the first Internet Protocol address and the second Internet Protocol address, respectively, as the first temporary private Internet Protocol address and the second temporary private Internet Protocol address.

4. The method according to claim 1, wherein obtaining first communication information corresponding to the first user terminal and second communication information corresponding to the second user terminal according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address comprises: Acquire, from a target network communication server, a first public Internet Protocol address corresponding to the first user terminal and a second public Internet Protocol address corresponding to the second user terminal according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address; combining the first temporary private Internet Protocol address and the first public Internet Protocol address to obtain first communication information; The second temporary private Internet Protocol address and the second public Internet Protocol address are combined to obtain second communication information.

5. The method according to claim 1, wherein generating a second temporary key pair corresponding to the second user terminal according to the session random identifier, the master public key and the second user identifier comprises: Combining the second user identifier with the session random identifier to generate a second public key combined identifier; A second temporary key pair corresponding to the second user terminal is generated according to the master public key and the second public key combined with the identifier.

6. The method according to claim 5, wherein: The generating, according to the master public key and the second public key in combination with the identifier, a second temporary key pair corresponding to the second user terminal includes: Combine the master public key and the second public key with the identifier to obtain second combination information; The second combination information is processed by a key generation center to obtain a second temporary key pair.

7. The method according to claim 1, wherein the encrypted information is generated by: The first symmetric key is truncated to obtain a front-end key and a back-end key, wherein: The length of the front-end key is equal to the length of the back-end key; generating a first blinding factor and a second blinding factor; Using the first blinding factor to perform blinding processing on the previous-stage key to obtain a first blinded key; Using the second blinding factor to perform blinding processing on the subsequent key to obtain a second blinded key; Concatenate the first blinding factor and the second blinding key to obtain first blinding information; Concatenate the second blinding factor and the first blinding key to obtain second blinding information; Obtaining a second temporary public key in the second temporary key pair; Using the second temporary public key, respectively perform encryption operations on the first blinded information and the second blinded information to obtain first encrypted information and second encrypted information; The first encrypted information and the second encrypted information are determined as the encrypted information.

8. A dynamic protection device, comprising: A first generating unit, configured to generate a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal in response to receiving session communication request information between the first user terminal and the second user terminal; an acquiring unit, configured to acquire first communication information corresponding to the first user terminal and second communication information corresponding to the second user terminal according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address; A first sending unit, configured to send the first communication information and the second communication information to the second user terminal and the first user terminal respectively through a signaling server; a second generating unit, configured to generate a session random identifier, a master public key, and a second user identifier corresponding to the second user terminal in response to determining that the first user terminal and the second user terminal have received the second communication information and the first communication information respectively, and determining to generate a first symmetric key at the first user terminal, wherein the session corresponding to the session random identifier is a communication session between the first user terminal and the second user terminal; A third generating unit is configured to generate a second temporary key pair corresponding to the second user terminal according to the session random identifier, the master public key and the second user identifier; a second sending unit, configured to send encrypted information corresponding to the first symmetric key to the second user terminal, wherein the encrypted information is generated based on the second temporary key pair; The execution unit is configured to, in response to determining that the second user terminal has acquired the decrypted first symmetric key, execute encryption communication processing between the first user terminal and the second user terminal according to the first symmetric key.

9. An electronic device, comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

10. A computer readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images