Dynamic protection method, system, device, equipment and computer-readable medium

Abstract

The embodiments of the present disclosure disclose a dynamic protection method and system, device, electronic device and computer-readable medium. A specific implementation of the method includes: generating a first temporary private Internet Protocol address and a second temporary private Internet Protocol address; obtaining first communication information and second communication information; sending the first communication information and the second communication information to the second user terminal and the first user terminal respectively through a signaling server; generating a session random identifier, a master public key and a second user identifier corresponding to the second user terminal; generating a second temporary key pair corresponding to the second user terminal; sending the encrypted information corresponding to the first symmetric key to the second user terminal; in response to determining that the second user terminal has obtained the decrypted first symmetric key, performing encrypted communication processing between the first user terminal and the second user terminal. This implementation prevents the leakage of Internet Protocol addresses and improves the level of user privacy protection during session communications.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to a dynamic protection method, apparatus, device, and computer-readable medium. Background Art

[0002] Currently, Web Real-Time Communication (WebRTC) has become one of the primary means of web communication. Security issues associated with WebRTC are typically addressed by using Datagram Transport Layer Security (DTLS) for data encryption and authentication, and Session Traversal Utilities for NAT (STUN) to hide users' private Internet Protocol (IP) addresses.

[0003] However, in practice, it has been found that when using the above-mentioned DTLS for data encryption and authentication and the above-mentioned STUN protocol, the following technical problems often occur:

[0004] When a user terminal uses DTLS in multiple sessions or platforms, it uses the same DTLS certificate. Attackers can analyze and identify the public key information in these identical DTLS certificates to link different sessions. This allows them to understand the user's activity patterns and schedules, and obtain their private information. When a user terminal establishes a session connection using the STUN protocol, it sends and receives the user's corresponding private and public Internet Protocol addresses over a signaling channel. If the signaling channel is unencrypted, the user's private and public Internet Protocol addresses may be leaked.

[0005] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the Invention

[0006] The content of this disclosure is used to briefly introduce concepts that will be described in detail in the detailed description section below. The content of this disclosure is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0007] Some embodiments of the present disclosure propose dynamic protection methods and systems, devices, electronic devices, and computer-readable media to solve one or more of the technical problems mentioned in the above background technology section.

[0008] In a first aspect, some embodiments of the present disclosure provide a dynamic protection method, the method comprising: in response to receiving a session communication request information for a first user terminal and a second user terminal, generating a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal; obtaining first communication information corresponding to the first user terminal and second communication information corresponding to the second user terminal according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address; sending the first communication information and the second communication information to the second user terminal and the first user terminal respectively through a signaling server; in response to determining that the first user terminal and the second user terminal have received the second communication information respectively, The method comprises the following steps: determining the first symmetric key generated at the first user terminal, generating a session random identifier, a master public key and a second user identifier corresponding to the second user terminal, wherein the session corresponding to the session random identifier is a communication session between the first user terminal and the second user terminal; generating a second temporary key pair corresponding to the second user terminal according to the session random identifier, the master public key and the second user identifier; sending encrypted information corresponding to the first symmetric key to the second user terminal, wherein the encrypted information is generated based on the second temporary key pair; in response to determining that the second user terminal has obtained the decrypted first symmetric key, performing encrypted communication processing between the first user terminal and the second user terminal according to the first symmetric key.

[0009] In the second aspect, some embodiments of the present disclosure provide a dynamic protection device, including: a first generating unit, configured to generate a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal in response to receiving session communication request information between the first user terminal and the second user terminal; an acquiring unit, configured to acquire first communication information corresponding to the first user terminal and second communication information corresponding to the second user terminal based on the first temporary private Internet Protocol address and the second temporary private Internet Protocol address; a first sending unit, configured to send the first communication information and the second communication information to the second user terminal and the first user terminal respectively through a signaling server; a second generating unit, configured to generate a first temporary private Internet Protocol address corresponding to the first user terminal and the second user terminal respectively in response to determining that the first user terminal and the second user terminal have received the first temporary private Internet Protocol address and the second temporary private Internet Protocol address respectively. The present invention relates to a method for transmitting the encrypted data of the first user terminal to the user, comprising: generating a first symmetric key, a session random identifier, a master public key and a second user identifier corresponding to the second user terminal, wherein the session corresponding to the session random identifier is a communication session between the first user terminal and the second user terminal; a third generating unit, configured to generate a second temporary key pair corresponding to the second user terminal based on the session random identifier, the master public key and the second user identifier; a second sending unit, configured to send the encrypted information corresponding to the first symmetric key to the second user terminal, wherein the encrypted information is generated based on the second temporary key pair; and an executing unit, configured to execute the encrypted communication processing between the first user terminal and the second user terminal based on the first symmetric key in response to determining that the second user terminal has obtained the decrypted first symmetric key.

[0010] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by one or more processors, the one or more processors implement the method described in any implementation manner in the first aspect.

[0011] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation manner in the first aspect is implemented.

[0012] The above-mentioned embodiments of the present disclosure have the following beneficial effects: Through the dynamic protection methods of some embodiments of the present disclosure, the anonymity and privacy protection of user terminals when communicating via WebRTC are improved. Specifically, the insecurity of user terminals communicating via WebRTC lies in the fact that when using DTLS in multiple sessions or platforms, user terminals use the same DTLS certificate. Attackers can analyze and identify the public key information in these same DTLS certificates to associate different sessions together, understand the user's activity patterns and schedules, and thus expose the user's privacy. When a user terminal establishes a session connection using the above-mentioned STUN protocol, it sends and receives the user terminal's corresponding private Internet Protocol address and public Internet Protocol address through a signaling channel. If the signaling channel is not encrypted, the user's corresponding private Internet Protocol address and public Internet Protocol address may be leaked. Based on this, the dynamic protection methods of some embodiments of the present disclosure first generate a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal in response to receiving a session communication request message for a first user terminal and a second user terminal. The first temporary private Internet Protocol address and the second temporary private Internet Protocol address are generated to hide the first private Internet Protocol address corresponding to the first user terminal and the second private Internet Protocol address corresponding to the second user terminal. Secondly, based on the first temporary private Internet Protocol address and the second temporary private Internet Protocol address, the first communication information corresponding to the first user terminal and the second communication information corresponding to the second user terminal are obtained. The first communication information includes the first temporary private Internet Protocol address and the first public Internet Protocol address corresponding to the first user terminal, and the second communication information includes the second temporary private Internet Protocol address and the second public Internet Protocol address corresponding to the second user terminal. Thirdly, the first communication information and the second communication information are sent to the second user terminal and the first user terminal respectively via the signaling server. The signaling server is used to negotiate communication and session management between the first user terminal and the second user terminal. The first communication information and the second communication information can be used to establish a communication connection between the first user terminal and the second user terminal. Then, in response to determining that the first user terminal and the second user terminal have received the second communication information and the first communication information, respectively, and determining that a first symmetric key has been generated on the first user terminal, a random session identifier, a master public key, and a second user identifier corresponding to the second user terminal are generated, wherein the random session identifier corresponds to a communication session between the first user terminal and the second user terminal. Here, the first symmetric key is a symmetric key used to perform encrypted communication processing between the first user terminal and the second user terminal.Then, based on the session random identifier, the master public key, and the second user identifier, a second temporary key pair corresponding to the second user terminal is generated. The session random identifier is a random number that is regenerated each time a communication session is initiated. Including the session random identifier in the generation of the temporary public key in the second temporary key pair (the second key pair includes a temporary public key and a temporary private key) ensures the uniqueness of public keys across different communication sessions, preventing the first user terminal from using the same public key from the DTLS certificate across different sessions when communicating using WebRTC, thereby being identified and tracked by an attacker. The master public key is a component of generating the second temporary key pair. The first user identifier and the second user identifier are the email addresses of the user corresponding to the first terminal and the user corresponding to the second terminal, respectively. Subsequently, encrypted information corresponding to the first symmetric key is sent to the second user terminal, where the encrypted information is generated based on the second temporary key pair. Sending the encrypted information corresponding to the first symmetric key to the second user terminal is intended to enhance security during the transmission of the first symmetric key and to enable the first and second user terminals to share the same symmetric key, thereby using the same symmetric key to perform encryption and decryption operations during the communication session. Finally, in response to determining that the second user terminal has obtained the first symmetric key, encrypted communication processing is performed between the first user terminal and the second user terminal based on the first symmetric key. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0014] Figure 1 is a flow chart of some embodiments of the dynamic protection method according to the present disclosure;

[0015] Figure 2 is a schematic structural diagram of some embodiments of the dynamic protection device according to the present disclosure;

[0016] Figure 3 It is a structural diagram of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0017] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0018] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other.

[0019] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0020] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0021] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0022] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0023] refer to Figure 1 , shows a process 100 of some embodiments of the dynamic protection method according to the present disclosure. The dynamic protection method includes the following steps:

[0024] Step 101: In response to receiving a session communication request message for a first user terminal and a second user terminal, generate a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal.

[0025] In some embodiments, in response to receiving session communication request information for a first user terminal and a second user terminal, the execution entity of the dynamic protection method (e.g., an electronic device) may obtain the session communication request information via a wired or wireless connection. The recipient of the session communication request information is the execution entity. Session communication request information refers to request data initiated by the first user terminal and sent to the second user terminal before the session communication is established, requesting the establishment of a specific type of session communication. Furthermore, the first user terminal and the second user terminal may be computers. The first user terminal and the second user terminal each have a corresponding user. For example, the first user terminal corresponds to user A, and the second user terminal corresponds to user B. Furthermore, the first temporary private IP address and the second temporary private IP address are private IP addresses used by the first and second user terminals during a single session communication. Private IP addresses are IP addresses used within a local area network. In practice, the execution entity may use the ifconfig command in a Linux system to generate the first temporary private IP address corresponding to the first user terminal and the second temporary private IP address corresponding to the second user terminal.

[0026] It should be noted that the above-mentioned wireless connection methods may include but are not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0027] In some optional implementations of some embodiments, the execution entity generating the first temporary private Internet Protocol address corresponding to the first user terminal and the second temporary private Internet Protocol address corresponding to the second user terminal may include the following steps:

[0028] The first step is to obtain the first private Internet Protocol address corresponding to the first user terminal and the second private Internet Protocol address corresponding to the second user terminal. The first private Internet Protocol address is the Internet Protocol address used by the first user terminal in the local area network. The second private Internet Protocol address is the Internet Protocol address used by the second user terminal in the local area network. The first private Internet Protocol address and the second private Internet Protocol address cannot be directly routed on the Internet and can only be used within the local area network. In practice, the execution entity can obtain the first private Internet Protocol address and the second private Internet Protocol address in the operating systems corresponding to the first user terminal and the second user terminal, respectively.

[0029] The second step is to establish a first communication connection between the first user terminal and the first proxy server and a second communication connection between the second user terminal and the second proxy server based on the first private Internet Protocol address and the second private Internet Protocol address, so as to obtain the first Internet Protocol address and the second Internet Protocol address respectively as the first temporary private Internet Protocol address and the second temporary private Internet Protocol address. The first proxy server and the second proxy server are a type of proxy server that acts as an intermediary between the user terminal and the server. The first communication connection is a session communication connection established between the first user terminal and the first proxy server, and the second communication connection is a session communication connection established between the second user terminal and the second proxy server. The first Internet Protocol address and the second Internet Protocol address are the Internet Protocol address corresponding to the first proxy server and the Internet Protocol address corresponding to the second proxy server, respectively.

[0030] Step 102: Acquire first communication information corresponding to the first user terminal and second communication information corresponding to the second user terminal according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address.

[0031] In some embodiments, the execution entity may obtain first communication information corresponding to the first user terminal and second communication information corresponding to the second user terminal based on the first temporary private Internet Protocol address and the second temporary private Internet Protocol address. The first communication information and the second communication information are information used to establish a session communication connection between the first user terminal and the second user terminal in WebRTC. The first communication information is relevant information about the first user terminal during the communication process. The second communication information is relevant information about the second user terminal during the communication process.

[0032] In some optional implementations of some embodiments, the execution entity obtaining, according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address, the first communication information corresponding to the first user terminal and the second communication information corresponding to the second user terminal may include the following steps:

[0033] The first step is to obtain, from a target network communication server, a first public Internet Protocol address corresponding to the first user terminal and a second public Internet Protocol address corresponding to the second user terminal based on the first temporary private Internet Protocol address and the second temporary private Internet Protocol address. The target network communication server is a server corresponding to the STUN protocol, and its primary function is to return the Internet Protocol address requested by the user terminal for establishing a session communication connection with another user terminal. The first public Internet Protocol address is the Internet Protocol address used by the first user terminal to establish the session communication connection. The second public Internet Protocol address is the Internet Protocol address used by the second user terminal to establish the session communication connection.

[0034] As an example, first, the execution entity sends the binding request message corresponding to the first user terminal to the server corresponding to the STUN protocol, wherein the binding request message includes the first temporary private Internet Protocol address and port number corresponding to the first user terminal. Then, after receiving the binding request message, the server corresponding to the STUN protocol obtains the first temporary private Internet Protocol address and port number in the binding request message, and constructs a STUN binding response message and sends it to the first user terminal. Then, after receiving the STUN binding response message, the first user terminal obtains the Internet Protocol address and port number in the binding response message, and compares them with the first temporary private Internet Protocol address and port in the previously sent STUN binding request message. Finally, if they are inconsistent, the first public Internet Protocol address corresponding to the first user terminal is returned.

[0035] The second step is to combine the first temporary private Internet Protocol address and the first public Internet Protocol address to obtain first communication information.

[0036] As an example, the first communication information may be: [first temporary private Internet Protocol address, first public Internet Protocol address].

[0037] The third step is to combine the second temporary private Internet Protocol address and the second public Internet Protocol address to obtain second communication information.

[0038] As an example, the second communication information may be: [second temporary private Internet Protocol address, second public Internet Protocol address].

[0039] Step 103: Send the first communication information and the second communication information to the second user terminal and the first user terminal respectively through the signaling server.

[0040] In some embodiments, the execution entity may transmit the first communication information and the second communication information to the second user terminal and the first user terminal, respectively, via a signaling channel through a signaling server. The signaling channel is a communication channel for transmitting information between the signaling server and the user terminal. The signaling server is a server that coordinates communication and information exchange when the first and second user terminals establish a session communication connection via WebRTC.

[0041] Step 104: In response to determining that the first user terminal and the second user terminal receive the second communication information and the first communication information respectively, and determining to generate a first symmetric key at the first user terminal, generate a session random identifier, a master public key and a second user identifier corresponding to the second user terminal.

[0042] In some embodiments, the execution subject may generate a session random identifier, a master public key, and a second user identifier corresponding to the second user terminal in response to determining that the first user terminal and the second user terminal have received the second communication information and the first communication information respectively, and determining that the first symmetric key is generated at the first user terminal. The session corresponding to the session random identifier is the communication session between the first user terminal and the second user terminal. The session random identifier is a random number, which is regenerated each time the session communication is started. The master public key is a public key. The second user identifier is the email of the user corresponding to the second user terminal. The first symmetric key is a key type used in an encryption technology, and the first user terminal and the second user terminal use the same first symmetric key to encrypt and decrypt information. The first symmetric key can be generated by the following steps (the execution subject of the following generation steps is the first user terminal):

[0043] The first step is to obtain the network device log, traffic status and protocol status corresponding to the first user terminal.

[0044] In the second step, in response to abnormalities in the network device log, the traffic status, and the protocol status, the following generation steps are performed:

[0045] Sub-step 1: Execute a connection with a hardware security device, wherein the hardware security device may be a hardware security module (HSM).

[0046] Sub-step 2: Send a hardware key generation request to the hardware security device to obtain a hardware key, wherein the hardware key generation request may specify the length and generation algorithm of the hardware key, and the hardware key is a true random number. Here, the hardware key is a key generated by the hardware security device.

[0047] Sub-step three: input the hardware key into a symmetric encryption algorithm to generate a first key. The symmetric encryption algorithm may be Advanced Encryption Standard (AES).

[0048] Sub-step four: determining the first key as the first symmetric key.

[0049] In the third step, in response to the network device log, the traffic status, and the protocol status being normal, the following generation steps are performed:

[0050] Sub-step 1: Obtain a symmetric key table, wherein the symmetric key table stores at least one key. The symmetric key table is a data structure for storing keys. For example, the symmetric key table can be a queue in a data structure.

[0051] Sub-step 2: Generate at least one random number using a random number generator. For each of the at least one random number, perform the following generation steps:

[0052] In the first sub-step, the random number is input into a hash function to obtain a hash key, wherein the hash function may be a SHA-256 function.

[0053] The second sub-step is to input the above hash key into the above symmetric key table.

[0054] In step 4, in response to the first user terminal generating the first symmetric key, a hash key is randomly selected from the symmetric key table as the first symmetric key. In step 105, a second temporary key pair corresponding to the second user terminal is generated based on the random session identifier, the master public key, and the second user identifier.

[0055] In some embodiments, the execution entity may generate a second temporary key pair corresponding to the second user terminal based on the session random identifier, the master public key, and the second user identifier. The second temporary key pair is only used to establish a session connection between the second user terminal and the first user terminal, and becomes invalid when the session connection is closed. The second temporary key pair includes a second temporary public key and a second temporary private key. The second temporary public key and the second temporary private key are respectively a public key generated at the second user terminal and a private key generated at the second user terminal, and are only used to establish a session connection between the second user terminal and the first user terminal, and become invalid when the session connection is closed.

[0056] As an example, first, the above-mentioned execution entity can concatenate the above-mentioned session random identifier, the master public key, and the second user identifier to obtain a string. Then, the above-mentioned execution entity can use a hash function to perform a hash operation on the above-mentioned string to obtain a hash value of a fixed length. Then, the above-mentioned hash value is divided into two parts of the same length. The first part is used as the second temporary private key, and the second part is used as the generation parameter corresponding to the second temporary public key. Here, the first temporary private key and the generation parameter can be XORed to obtain the operation result. Finally, the above-mentioned operation result is determined as the second temporary public key corresponding to the above-mentioned second user terminal.

[0057] In some optional implementations of some embodiments, the execution entity generates the second temporary key pair corresponding to the second user terminal based on the random session identifier, the master public key, and the second user identifier, which may include the following steps:

[0058] In the first step, the second user identifier is combined with the random session identifier to generate a second public key combined identifier.

[0059] For example, the second public key combined with the identifier may be: [second user identifier, session random identifier].

[0060] In the second step, a second temporary key pair corresponding to the second user terminal is generated based on the master public key and the second public key combined with the identifier.

[0061] In some embodiments, the execution entity may generate a second temporary key pair corresponding to the second user terminal based on the master public key and the second public key combined with an identifier.

[0062] As an example, the execution entity may use encryption software to generate a second temporary key pair corresponding to the second user terminal based on the master public key and the second public key combined with the identifier. The encryption software may be GNUPrivacy Guard.

[0063] Optionally, generating a second temporary key pair corresponding to the second user terminal based on the master public key and the second public key combined with the identifier includes:

[0064] Sub-step one: combine the master public key and the second public key with the identifier to obtain second combination information.

[0065] For example, the second combined information may be: [master public key, second public key combined identifier].

[0066] Sub-step 2: Using the Key Generation Center (KGC) in SM9, the second combined information is processed to obtain a second temporary key pair.

[0067] Step 106: Send the encrypted information corresponding to the first symmetric key to the second user terminal.

[0068] In some embodiments, the execution entity may send encrypted information corresponding to the first symmetric key to the second user terminal, where the encrypted information is generated using the second temporary public key. In practice, the execution entity may send the second temporary public key of the second temporary key pair to the first user terminal via the signaling server. The first symmetric key is then encrypted using the second temporary public key to obtain the encrypted information. Finally, the encrypted information is sent to the second user terminal.

[0069] In some optional implementations of some embodiments, the encrypted information is generated by the following steps:

[0070] In the first step, the first symmetric key is truncated to obtain a front-end key and a back-end key, wherein the length of the front-end key is equal to the length of the back-end key.

[0071] The second step is to generate a first blinding factor and a second blinding factor, wherein the first blinding factor and the second blinding factor can be blinding factors.

[0072] The third step is to use the first blinding factor to perform blinding processing on the previous key to obtain the first blinded key.

[0073] The fourth step is to use the second blinding factor to perform blinding processing on the latter key to obtain the second blinded key.

[0074] In the fifth step, the first blinding factor and the second blinding key are concatenated to obtain first blinded information.

[0075] Step 6: Concatenate the second blinding factor and the first blinding key to obtain second blinding information.

[0076] Step 7: Obtain the second temporary public key in the second temporary key pair.

[0077] In the eighth step, the second temporary public key is used to perform encryption operations on the first blinded information and the second blinded information respectively to obtain first encrypted information and second encrypted information.

[0078] In the ninth step, the first encrypted information and the second encrypted information are determined as the encrypted information.

[0079] In some optional implementations of some embodiments, the encrypted information is generated by the following steps:

[0080] In the first step, the first symmetric key is randomly truncated multiple times to obtain a set of fragmented key segments. The fragmented key segments include a front-end key and a back-end key. The length of the front-end key can be the same as or different from the length of the back-end key.

[0081] In the second step, for each segment key group in the segment key group set, perform the following information generation steps:

[0082] Sub-step 1: determine the front-end key and the back-end key corresponding to the above-mentioned fragment key group, and use them as the target front-end key and the target back-end key respectively.

[0083] Sub-step 2: Determine the length between the target front-end key and the target back-end key.

[0084] Sub-step 3: In response to determining that the target front-end key is longer than the target back-end key, inputting the target front-end key into a first coding model to generate first front-end coding information, and inputting the target back-end key into a second coding model to generate first back-end coding information. The first coding model and the second coding model may have different numbers of convolutional layers.

[0085] Sub-step 4: Input the first front-end encoding information and the first back-end encoding information into a decoding model to generate a second decoding vector as the initial encrypted information. The decoding model corresponds to a smaller number of upsampling layers than the first and second encoding models. The initial encrypted information may be in vector form.

[0086] Sub-step 3: In response to determining that the target front-end key is shorter than the target back-end key, inputting the target front-end key into a second encoding model to generate second front-end encoding information, and inputting the target back-end key into the first encoding model to generate second back-end encoding information. The first encoding model and the second encoding model may have different numbers of convolutional layers.

[0087] Sub-step 4: Input the second front-end encoding information and the second back-end encoding information into the decoding model to generate a second decoding vector as the initial encrypted information. The first decoding model corresponds to a smaller number of upsampling layers than the first and second encoding models. The initial encrypted information may be in vector form.

[0088] The third step is to randomly extract a target number of initial encrypted information from the obtained initial encrypted information set to obtain an initial encrypted information group.

[0089] In the fourth step, each initial encrypted information in the initial encrypted information group is spliced ​​together to generate spliced ​​information as encrypted information.

[0090] Optionally, as one of the inventive points, the technical problem of "data leakage during the encryption process and the relatively fixed encryption process making the encryption result easily crackable" is addressed. Based on this, the present disclosure ensures uncertainty in the encryption process by setting a first encoding model, a second encoding model, and a first decoding model, as well as random interception and random extraction, thereby ensuring randomness in the encryption process.

[0091] Step 107 : In response to determining that the second user terminal has obtained the decrypted first symmetric key, encrypted communication processing is performed between the first user terminal and the second user terminal according to the first symmetric key.

[0092] In some embodiments, the execution entity may, in response to determining that the second user terminal has obtained the decrypted first symmetric key, execute encrypted communication processing between the first user terminal and the second user terminal based on the first symmetric key. The decrypted first symmetric key is generated by the execution entity after the second user terminal decrypts the encrypted information using the second temporary private key in the second temporary key pair. In practice, the execution entity may use the first symmetric key at the first user terminal to encrypt the communication data to obtain a ciphertext. The ciphertext is then sent to the second user terminal, which decrypts the ciphertext using the first symmetric key to obtain the communication data.

[0093] Optionally, to perform the encrypted communication process between the first user terminal and the second user terminal, the execution subject may perform the following steps:

[0094] The first step is to generate a first user identifier corresponding to the first user terminal, wherein the first user identifier is the email of the user corresponding to the first user terminal.

[0095] In the second step, in response to determining to generate a second symmetric key in the above-mentioned second user terminal, a first temporary key pair corresponding to the above-mentioned first user terminal is generated according to the above-mentioned session random identifier, the above-mentioned master public key and the above-mentioned first user identifier.

[0096] The third step is to send the encrypted information corresponding to the second symmetric key to the first user terminal, where the encrypted information is generated based on the first temporary key pair. In practice, the execution entity can send the first temporary public key of the first temporary key pair to the second user terminal via the signaling server. The second symmetric key is then encrypted using the first temporary public key to obtain the encrypted information. Finally, the encrypted information is sent to the first user terminal.

[0097] In the fourth step, in response to determining that the first user terminal has obtained the decrypted second symmetric key, encrypted communication processing is performed between the first user terminal and the second user terminal based on the second symmetric key. The decrypted second symmetric key is generated by the execution entity after the first user terminal uses the first temporary private key in the first temporary key pair to decrypt the encrypted information. In practice, the execution entity can use the second symmetric key at the second user terminal to encrypt the communication data to obtain ciphertext. The ciphertext is then sent to the first user terminal, which decrypts the ciphertext using the second symmetric key to obtain the communication data.

[0098] The above-mentioned embodiments of the present disclosure have the following beneficial effects: Through the dynamic protection methods of some embodiments of the present disclosure, the anonymity and privacy protection of user terminals when communicating via WebRTC are improved. Specifically, the insecurity of user terminals communicating via WebRTC lies in the fact that when using DTLS in multiple sessions or platforms, user terminals use the same DTLS certificate. Attackers can analyze and identify the public key information in these same DTLS certificates to associate different sessions together, understand the user's activity patterns and schedules, and thus expose the user's privacy. When a user terminal establishes a session connection using the above-mentioned STUN protocol, it sends and receives the user terminal's corresponding private Internet Protocol address and public Internet Protocol address through a signaling channel. If the signaling channel is not encrypted, the user's corresponding private Internet Protocol address and public Internet Protocol address may be leaked. Based on this, the dynamic protection methods of some embodiments of the present disclosure first generate a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal in response to receiving a session communication request message for a first user terminal and a second user terminal. The first temporary private Internet Protocol address and the second temporary private Internet Protocol address are generated to hide the first private Internet Protocol address corresponding to the first user terminal and the second private Internet Protocol address corresponding to the second user terminal. Secondly, based on the first temporary private Internet Protocol address and the second temporary private Internet Protocol address, the first communication information corresponding to the first user terminal and the second communication information corresponding to the second user terminal are obtained. The first communication information includes the first temporary private Internet Protocol address and the first public Internet Protocol address corresponding to the first user terminal, and the second communication information includes the second temporary private Internet Protocol address and the second public Internet Protocol address corresponding to the second user terminal. Thirdly, the first communication information and the second communication information are sent to the second user terminal and the first user terminal respectively via the signaling server. The signaling server is used to negotiate communication and session management between the first user terminal and the second user terminal. The first communication information and the second communication information can be used to establish a communication connection between the first user terminal and the second user terminal. Then, in response to determining that the first user terminal and the second user terminal have received the second communication information and the first communication information, respectively, and determining that a first symmetric key has been generated on the first user terminal, a random session identifier, a master public key, and a second user identifier corresponding to the second user terminal are generated, wherein the random session identifier corresponds to a communication session between the first user terminal and the second user terminal. Here, the first symmetric key is a symmetric key used to perform encrypted communication processing between the first user terminal and the second user terminal.Then, based on the session random identifier, the master public key, and the second user identifier, a second temporary key pair corresponding to the second user terminal is generated. The session random identifier is a random number that is regenerated each time a communication session is initiated. Including the session random identifier in the generation of the temporary public key in the second temporary key pair (the second key pair includes a temporary public key and a temporary private key) ensures the uniqueness of public keys across different communication sessions, preventing the first user terminal from using the same public key from the DTLS certificate across different sessions when communicating using WebRTC, thereby being identified and tracked by an attacker. The master public key is a component of generating the second temporary key pair. The first user identifier and the second user identifier are the email addresses of the user corresponding to the first terminal and the user corresponding to the second terminal, respectively. Subsequently, encrypted information corresponding to the first symmetric key is sent to the second user terminal, where the encrypted information is generated based on the second temporary key pair. Sending the encrypted information corresponding to the first symmetric key to the second user terminal is intended to enhance security during the transmission of the first symmetric key and to enable the first and second user terminals to share the same symmetric key, thereby using the same symmetric key to perform encryption and decryption operations during the communication session. Finally, in response to determining that the second user terminal has obtained the first symmetric key, encrypted communication processing is performed between the first user terminal and the second user terminal based on the first symmetric key.

[0099] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a dynamic protection device. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the dynamic protection device can be specifically applied to various electronic devices.

[0100] like Figure 2As shown, a dynamic protection device 200 includes: a first generating unit 201, an acquiring unit 202, a first sending unit 203, a second generating unit 204, a third generating unit 205, a second sending unit 206, and an executing unit 207. The first generating unit 201 is configured to: in response to receiving a session communication request information for a first user terminal and a second user terminal, generate a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal. The acquiring unit 202 is configured to: based on the first temporary private Internet Protocol address and the second temporary private Internet Protocol address, acquire first communication information corresponding to the first user terminal and second communication information corresponding to the second user terminal. The first sending unit 203 is configured to: send the first communication information and the second communication information to the second user terminal and the first user terminal respectively via a signaling server. The second generation unit 204 is configured to, in response to determining that the first user terminal and the second user terminal have received the second communication information and the first communication information, respectively, and determining that a first symmetric key has been generated on the first user terminal, generate a random session identifier, a master public key, and a second user identifier corresponding to the second user terminal, wherein the random session identifier corresponds to a communication session between the first user terminal and the second user terminal. The third generation unit 205 is configured to generate a second temporary key pair corresponding to the second user terminal based on the random session identifier, the master public key, and the second user identifier. The second sending unit 206 is configured to send encrypted information corresponding to the first symmetric key to the second user terminal, wherein the encrypted information is generated based on the second temporary key pair. The execution unit 207 is configured to, in response to determining that the second user terminal has obtained the decrypted first symmetric key, execute encrypted communication processing between the first user terminal and the second user terminal based on the first symmetric key.

[0101] It is understood that the units described in the dynamic protection device 200 are similar to those described in the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the dynamic protection device 200 and the units included therein, and will not be repeated here.

[0102] Reference below Figure 3 , which shows a structural schematic diagram of an electronic device (eg, an electronic device) 300 suitable for implementing some embodiments of the present disclosure. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0103] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. Various programs and data required for the operation of the electronic device 300 are also stored in the RAM 303. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0104] Typically, the following devices may be connected to the I / O interface 305: an input device 306 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 308 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 309. The communication device 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as needed.

[0105] In particular, according to some embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, some embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from a network via the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are performed.

[0106] It should be noted that in some embodiments of the present disclosure, the computer-readable medium mentioned above may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or device. In some embodiments of the present disclosure, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0107] In some embodiments, the client and server can communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0108] The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; or it may exist independently without being assembled into the electronic device. The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: in response to receiving a session communication request information between the first user terminal and the second user terminal, generates a first temporary private Internet Protocol address corresponding to the above-mentioned first user terminal and a second temporary private Internet Protocol address corresponding to the above-mentioned second user terminal; obtains the first communication information corresponding to the above-mentioned first user terminal and the second communication information corresponding to the above-mentioned second user terminal according to the above-mentioned first temporary private Internet Protocol address and the above-mentioned second temporary private Internet Protocol address; sends the above-mentioned first communication information and the above-mentioned second communication information to the above-mentioned second user terminal and the above-mentioned first user terminal respectively through the signaling server; in response to determining that the above-mentioned first user terminal and the above-mentioned second user terminal are respectively connected The second communication information and the first communication information are received, and it is determined that a first symmetric key is generated at the first user terminal, and a session random identifier, a master public key and a second user identifier corresponding to the second user terminal are generated, wherein the session corresponding to the session random identifier is a communication session between the first user terminal and the second user terminal; based on the session random identifier, the master public key and the second user identifier, a second temporary key pair corresponding to the second user terminal is generated; the encrypted information corresponding to the first symmetric key is sent to the second user terminal, wherein the encrypted information is generated based on the second temporary key pair; in response to determining that the second user terminal has obtained the decrypted first symmetric key, encrypted communication processing is performed between the first user terminal and the second user terminal based on the first symmetric key.

[0109] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0110] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0111] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be provided in a processor, for example, may be described as: a processor comprising a first generating unit, an acquiring unit, a first sending unit, a second generating unit, a third generating unit, a second sending unit and an executing unit. The names of these units do not, in certain circumstances, constitute a limitation on the units themselves. For example, the first generating unit may also be described as a "unit for generating a first temporary private Internet Protocol address corresponding to the above-mentioned first user terminal and a second temporary private Internet Protocol address corresponding to the above-mentioned second user terminal".

[0112] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0113] The above description is only an illustration of some preferred embodiments of the present disclosure and the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with (but not limited to) technical features with similar functions disclosed in the embodiments of the present disclosure.

Claims

1. A dynamic protection method, comprising: In response to receiving a communication request for a session between a first user terminal and a second user terminal, generating a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal; acquiring, according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address, first communication information corresponding to the first user terminal and second communication information corresponding to the second user terminal; sending the first communication information and the second communication information to the second user terminal and the first user terminal respectively through a signaling server; In response to determining that the first user terminal and the second user terminal have received the second communication information and the first communication information, respectively, and determining to generate a first symmetric key on the first user terminal, generating a random session identifier, a master public key, and a second user identifier corresponding to the second user terminal, wherein the session corresponding to the random session identifier is a communication session between the first user terminal and the second user terminal; Generate a second temporary key pair corresponding to the second user terminal according to the random session identifier, the master public key, and the second user identifier; Sending encrypted information corresponding to the first symmetric key to the second user terminal, wherein the encrypted information is generated based on the second temporary key pair; In response to determining that the second user terminal has acquired the decrypted first symmetric key, encrypted communication processing is performed between the first user terminal and the second user terminal based on the first symmetric key.

2. The method according to claim 1, further comprising: generating a first user identifier corresponding to the first user terminal; In response to determining to generate a second symmetric key on the second user terminal, generating a first temporary key pair corresponding to the first user terminal according to the random session identifier, the master public key, and the first user identifier; Sending encrypted information corresponding to the second symmetric key to the first user terminal, wherein the encrypted information is generated based on the first temporary key pair; In response to determining that the first user terminal has acquired the decrypted second symmetric key, encrypted communication processing is performed between the first user terminal and the second user terminal based on the second symmetric key.

3. The method according to claim 1, wherein generating a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal comprises: Obtaining a first private Internet Protocol address corresponding to the first user terminal and a second private Internet Protocol address corresponding to the second user terminal; Based on the first private Internet Protocol address and the second private Internet Protocol address, a first communication connection is established between the first user terminal and the first proxy server, and a second communication connection is established between the second user terminal and the second proxy server, so as to obtain the first Internet Protocol address and the second Internet Protocol address, respectively, as the first temporary private Internet Protocol address and the second temporary private Internet Protocol address.

4. The method according to claim 1, wherein obtaining first communication information corresponding to the first user terminal and second communication information corresponding to the second user terminal based on the first temporary private Internet Protocol address and the second temporary private Internet Protocol address comprises: acquiring, from a target network communication server, a first public Internet Protocol address corresponding to the first user terminal and a second public Internet Protocol address corresponding to the second user terminal, based on the first temporary private Internet Protocol address and the second temporary private Internet Protocol address; combining the first temporary private Internet Protocol address and the first public Internet Protocol address to obtain first communication information; The second temporary private Internet Protocol address and the second public Internet Protocol address are combined to obtain second communication information.

5. The method according to claim 1, wherein generating a second temporary key pair corresponding to the second user terminal based on the random session identifier, the master public key, and the second user identifier comprises: combining the second user identifier with the session random identifier to generate a second public key combined identifier; A second temporary key pair corresponding to the second user terminal is generated according to the master public key and the second public key combined identifier.

6. The method according to claim 5, wherein: The generating, based on the master public key and the second public key combined with the identifier, a second temporary key pair corresponding to the second user terminal includes: Combining the master public key and the second public key with the identifier to obtain second combination information; The second combination information is processed by a key generation center to obtain a second temporary key pair.

7. The method according to claim 1, wherein the encrypted information is generated by: The first symmetric key is truncated to obtain a front-end key and a back-end key, wherein: The length of the front key is equal to the length of the back key; generating a first blinding factor and a second blinding factor; Performing blinding processing on the previous-stage key using the first blinding factor to obtain a first blinded key; Performing blinding processing on the subsequent key using the second blinding factor to obtain a second blinded key; Concatenate the first blinding factor and the second blinding key to obtain first blinding information; Concatenate the second blinding factor and the first blinding key to obtain second blinding information; Obtaining a second temporary public key in the second temporary key pair; Using the second temporary public key, perform encryption operations on the first blinded information and the second blinded information respectively to obtain first encrypted information and second encrypted information; The first encrypted information and the second encrypted information are determined as the encrypted information.

8. A dynamic protection device comprising: a first generating unit configured to, in response to receiving session communication request information for a first user terminal and a second user terminal, generate a first temporary private Internet Protocol address corresponding to the first user terminal and a second temporary private Internet Protocol address corresponding to the second user terminal; an acquiring unit configured to acquire, according to the first temporary private Internet Protocol address and the second temporary private Internet Protocol address, first communication information corresponding to the first user terminal and second communication information corresponding to the second user terminal; a first sending unit, configured to send the first communication information and the second communication information to the second user terminal and the first user terminal respectively through a signaling server; a second generating unit, configured to, in response to determining that the first user terminal and the second user terminal have respectively received the second communication information and the first communication information, and determining to generate a first symmetric key at the first user terminal, generate a random session identifier, a master public key, and a second user identifier corresponding to the second user terminal, wherein the session corresponding to the random session identifier is a communication session between the first user terminal and the second user terminal; a third generating unit, configured to generate a second temporary key pair corresponding to the second user terminal according to the random session identifier, the master public key, and the second user identifier; a second sending unit, configured to send encrypted information corresponding to the first symmetric key to the second user terminal, wherein the encrypted information is generated based on the second temporary key pair; The execution unit is configured to, in response to determining that the second user terminal has obtained the decrypted first symmetric key, execute encryption communication processing between the first user terminal and the second user terminal according to the first symmetric key.

9. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

10. A computer-readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images