Secure communication method, related equipment and storage medium

Abstract

The invention discloses a secure communication method and device, network equipment, a terminal and a storage medium. The method comprises the following steps: after at least one terminal is successfully registered, establishing at least one group based on identity information of each terminal; receiving a first message sent by a first terminal in the at least one terminal; the first message at least comprises first authentication information encrypted by using a first secret key; the first secret key is generated based on the role of each terminal; decrypting the first authentication information by using an own second secret key to obtain second authentication information; judging whether the first terminal belongs to a first group based on the second authentication information; under the condition that the first terminal belongs to the first group, sending a second message to the first terminal; the second message comprises a third secret key; the third key is used for the first terminal to carry out a key session with other terminals in the first group.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a secure communication method, related equipment and storage medium. Background Art

[0002] In the classroom scenario, teachers use a new generation of information equipment (such as personal computers (PC), electronic whiteboards, and tablets) to teach, and students also use equipment (tablets, PCs, virtual reality (VR) all-in-one machines) to learn and experiment. In this mode, corresponding teaching content resources are required, such as video resources and VR teaching resources, and the cost of such resources is relatively high. For the producers of content resources, authorization is carried out according to the client, and the use is strictly restricted. Usually, a classroom is used as a unit for unified management and teaching, so there is a strong requirement for data security and communication process security. However, in the relevant technology, the client and the server in the communication process do not implement full-link encryption of the communication link from the client to the server; for the teacher-side user with management authority, their identity is not verified, and the source and authenticity of the instructions and messages cannot be determined. There is currently no effective solution to this problem. Summary of the invention

[0003] To solve related technical problems, the embodiments of the present application provide a secure communication method, apparatus, related equipment and storage medium.

[0004] To achieve the above purpose, the technical solution of the embodiment of the present application is implemented as follows:

[0005] The present application provides a secure communication method, which is applied to a network device; the method includes:

[0006] After at least one terminal is successfully registered, establishing at least one group based on the identity information of each of the terminals;

[0007] Receiving a first message sent by a first terminal among the at least one terminal; the first message at least includes first authentication information encrypted by using a first key; the first key is generated based on a role of each of the terminals;

[0008] Decrypting the first authentication information using its own second secret key to obtain second authentication information;

[0009] Determine whether the first terminal belongs to a first group based on the second authentication information; the first group is any group in the at least one group;

[0010] In the case that the first terminal belongs to the first group, a second message is sent to the first terminal; the second message includes a third key; and the third key is used for the first terminal to conduct a key session with other terminals in the first group.

[0011] In the above scheme, the method further comprises:

[0012] After the network device is successfully registered, the second secret key is obtained.

[0013] In the above scheme, the method further comprises:

[0014] Establishing a terminal corresponding to an administrator of each of the groups based on the identity information of each of the terminals;

[0015] receiving a third message sent by the terminal corresponding to the administrator; the third message at least includes third authentication information encrypted by using a fourth key; the fourth key is a key of the terminal corresponding to the administrator;

[0016] Decrypting the third authentication information using the second secret key to obtain fourth authentication information;

[0017] Verifying the identity information of the terminal corresponding to the administrator based on the fourth authentication information;

[0018] After the identity information of the terminal corresponding to the administrator is successfully verified, the third secret key is generated; and the third secret key is sent to the terminal corresponding to the administrator.

[0019] In the above scheme, the method further comprises:

[0020] receiving a fourth message sent by a second terminal; the fourth message at least including identification information of the second terminal; the second terminal is a terminal in the first group other than the terminal corresponding to the administrator;

[0021] decrypting the third message using the second secret key to obtain fifth authentication information;

[0022] Determining whether the terminal corresponding to the administrator applies for the third key based on the fifth authentication information;

[0023] In a case where the terminal corresponding to the administrator has applied for the third key, the third key is sent to the second terminal.

[0024] The embodiment of the present application also provides a secure communication method, which is applied to a terminal; the method includes:

[0025] Sending a first message to a network device; the first message at least includes first authentication information encrypted by using a first key; the first key is generated based on the role of the terminal; the first authentication information is used by the network device to decrypt the first authentication information by using its own second key to obtain second authentication information; judging whether a first terminal among the terminals belongs to a first group based on the second authentication information; the first group is any group of at least one group established based on the identity information of the terminal;

[0026] In a case where the first terminal belongs to the first group, receiving a second message sent by the network device; the second message includes a third secret key;

[0027] The third secret key is used to establish a secret key session between the first terminal and other terminals in the first group.

[0028] In the above solution, the terminal at least includes a terminal corresponding to the administrator, and the method further includes:

[0029] Sending a third message to the network device; the third message at least includes third authentication information encrypted using a fourth key; the fourth key is the key of the terminal corresponding to the administrator; the third authentication information is used by the network device to decrypt using the second key to obtain fourth authentication information; verifying the identity information of the terminal corresponding to the administrator based on the fourth authentication information; generating the third key after the identity information of the terminal corresponding to the administrator is successfully verified;

[0030] Receive the third secret key sent by the network device.

[0031] In the above solution, the terminal includes at least a second terminal; the second terminal is other terminals in the first group except the terminal corresponding to the administrator; the method further includes:

[0032] Sending a fourth message to the network device; the fourth message at least includes identification information of the second terminal; the fourth message is used by the network device to decrypt using the second secret key to obtain fifth authentication information; based on the fifth authentication information, determining whether the terminal corresponding to the administrator applies for the third secret key;

[0033] In a case where the terminal corresponding to the administrator has applied for the third key, the third key sent by the network device is received.

[0034] The embodiment of the present application also provides a secure communication device, which is arranged on a network device and includes:

[0035] A first establishing unit, configured to establish at least one group based on the identity information of each terminal after at least one terminal is successfully registered;

[0036] A first receiving unit, configured to receive a first message sent by a first terminal among the at least one terminal; the first message at least includes first authentication information encrypted using a first key; the first key is generated based on a role of each of the terminals;

[0037] A first decryption unit, used to decrypt the first authentication information using its own second secret key to obtain second authentication information;

[0038] A first determination unit, configured to determine whether the first terminal belongs to a first group based on the second authentication information; the first group is any group of the at least one group;

[0039] The first sending unit is used to send a second message to the first terminal when the first terminal belongs to the first group; the second message includes a third key; the third key is used for the first terminal to conduct a key session with other terminals in the first group.

[0040] The embodiment of the present application also provides a secure communication device, which is arranged on a terminal and includes:

[0041] A second sending unit is used to send a first message to a network device; the first message at least includes first authentication information encrypted by using a first key; the first key is generated based on the role of the terminal; the first authentication information is used by the network device to decrypt the first authentication information by using its own second key to obtain second authentication information; based on the second authentication information, it is determined whether a first terminal among the terminals belongs to a first group; the first group is any group of at least one group established based on the identity information of the terminal;

[0042] A second receiving unit, configured to receive a second message sent by the network device when the first terminal belongs to the first group; the second message includes a third secret key;

[0043] The second establishing unit uses the third secret key to establish a secret key session between the first terminal and other terminals in the first group.

[0044] The embodiment of the present application also provides a network device, including: a first communication interface and a first processor;

[0045] The first communication interface is used to establish at least one group based on the identity information of each terminal after at least one terminal is successfully registered; receive a first message sent by a first terminal among the at least one terminal; the first message at least includes first authentication information encrypted by using a first key; the first key is generated based on the role of each terminal;

[0046] The first processor is configured to decrypt the first authentication information using its own second secret key to obtain second authentication information; and determine whether the first terminal belongs to a first group based on the second authentication information; the first group is any group in the at least one group;

[0047] The first communication interface is further used to send a second message to the first terminal when the first terminal belongs to the first group; the second message includes a third key; and the third key is used for the first terminal to conduct a key conversation with other terminals in the first group.

[0048] The embodiment of the present application also provides a terminal, including: a second communication interface and a second processor;

[0049] The second communication interface is used to send a first message to the network device; the first message at least includes first authentication information encrypted by using a first key; the first key is generated based on the role of the terminal; the first authentication information is used by the network device to decrypt the first authentication information using its own second key to obtain second authentication information; based on the second authentication information, it is determined whether the first terminal among the terminals belongs to a first group; the first group is any group of at least one group established based on the identity information of the terminal; and when the first terminal belongs to the first group, receiving a second message sent by the network device; the second message includes a third key;

[0050] The second processor is configured to use the third secret key to establish a secret key session between the first terminal and other terminals in the first group.

[0051] The embodiment of the present application further provides a network device, comprising: a first processor and a first memory for storing a computer program that can be run on the processor,

[0052] Wherein, when the first processor is used to run the computer program, it executes the steps of any one of the methods described above on the network device side.

[0053] The embodiment of the present application further provides a terminal, comprising: a second processor and a second memory for storing a computer program that can be run on the processor,

[0054] Wherein, when the second processor is used to run the computer program, it executes the steps of any one of the methods described above on the terminal side.

[0055] An embodiment of the present application further provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned methods on the network device side are implemented, or the steps of any of the above-mentioned methods on the terminal are implemented.

[0056] The secure communication method, apparatus, related equipment and storage medium provided in the embodiments of the present application, after the network device is connected to at least one terminal and successfully registers, establishes at least one group based on the identity information of each terminal; receives a first message sent by a first terminal among the at least one terminal; the first message at least includes first authentication information encrypted using a first key; the first key is generated based on the role of each terminal; the first authentication information is decrypted using its own second key to obtain second authentication information; based on the second authentication information, determines whether the first terminal belongs to the first group; the first group is any group in the at least one group; if the first terminal belongs to the first group, sends a second message to the first terminal; the second message includes a third key; the third key is used for the first terminal to communicate with the first terminal The other terminals in the first group conduct a secret key conversation; accordingly, corresponding to the terminal, a first message is sent to the network device; the first message at least includes first authentication information encrypted using a first secret key; the first secret key is generated based on the role of the terminal; the first authentication information is used by the network device to decrypt the first authentication information using its own second secret key to obtain second authentication information; based on the second authentication information, it is determined whether the first terminal among the terminals belongs to the first group; the first group is any group of at least one group established based on the identity information of the terminal; when the first terminal belongs to the first group, a second message sent by the network device is received; the second message includes a third secret key; the third secret key is used to establish a secret key conversation between the first terminal and other terminals in the first group.

[0057] Using the technical solution of the embodiment of the present application, the terminal sends a first message to the network device; the first message includes at least first authentication information encrypted by using a first key, and the network device sends a second message to the terminal; the second message includes a third key, that is, during the communication process, the communication between the network device (for example, the server) and the terminal (for example, the client) is fully encrypted; and the first message sent by the terminal includes the first authentication information encrypted by using the first key, and the first key is generated based on the role of the terminal, that is, when the network device receives the message from the terminal, it can verify the identity of the terminal through the first key to ensure the source and authenticity of the message; at least one group is established based on the identity information of each of the terminals, and the identity information of the members in the group, such as administrators or members, and the group information to which each of the terminals belongs, can be determined, so that the message is only transmitted and shared within the group. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 This is a flowchart of a secure communication method according to an embodiment of the present application;

[0059] Figure 2 This is another flow chart of the secure communication method according to an embodiment of the present application;

[0060] Figure 3 A schematic diagram of a message communication process provided by an embodiment of the present application;

[0061] Figure 4 A schematic diagram of a message server registration provided in an embodiment of the present application;

[0062] Figure 5 A schematic diagram of an administrator terminal registration provided in an embodiment of the present application;

[0063] Figure 6 A schematic diagram of generating a group data encryption key provided in an embodiment of the present application;

[0064] Figure 7 A schematic diagram of message transmission between a group administrator and a message server provided in an embodiment of the present application;

[0065] Figure 8 A schematic diagram of a device for secure communication according to an embodiment of the present application;

[0066] Fig. 9 A schematic diagram of another device for secure communication according to an embodiment of the present application;

[0067] Fig.10 This is a schematic diagram of the structure of the network device according to the embodiment of the present application;

[0068] Fig.11 This is a schematic diagram of the structure of the terminal in the embodiment of the present application;

[0069] Fig.12 This is a schematic diagram of the structure of the secure communication system according to an embodiment of the present application. DETAILED DESCRIPTION

[0070] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0071] In the classroom scenario, teachers use a new generation of information equipment (such as PCs, electronic whiteboards, and tablets) to teach, and students also use equipment (tablets, PCs, and VR all-in-ones) to learn and experiment. In this mode, corresponding teaching content resources are required, such as video resources and VR teaching resources. The cost of such resources is relatively high. For content resource producers, authorization is performed based on the client, and their use is strictly restricted. Usually, a classroom is used as a unit for unified management of teaching, so there are strong requirements for data security and communication process security. Usually in the process of network communication, in order to ensure the authenticity of the identities of the communicating parties, the network authentication protocol (kerberos) is used for identity authentication. There are three roles in the kerberos communication protocol, namely:

[0072] Client: The party that sends the request;

[0073] Server: The party that receives the request;

[0074] Key distribution center (KDC): includes authentication server (AS) and ticket granting server (TGS). The ticket granting server is used to issue the service granting ticket (ticket) required for the entire authentication process and when the client accesses the server; the authentication server is specifically used to authenticate the identity of the client and issue the ticket granting ticket (TGT) for the client to access the TGS.

[0075] The Kerberos authentication process is simplified as follows:

[0076] When a client accesses each network service it wants to access, it needs to carry a ticket that is specifically used to access the service and can prove its identity. Only when the server receives the ticket can it determine that the client's identity is correct and provide services to the client. Therefore, the entire process can be simplified into two steps:

[0077] (1) The client requests the KDC to obtain a service grant ticket for the target service it wants to access;

[0078] (2) The client uses the service grant ticket obtained from the KDC to access the corresponding network service.

[0079] During the communication process, the group management end needs to send instructions to the group administrator, which leads to the following problems:

[0080] 1. The communication between the client and the server does not implement full-link encryption from the client to the server;

[0081] 2. The teacher's teaching management control terminal in the classroom scenario fails to verify the teacher's identity and group permissions, or there is a risk of unauthorized operation of the student terminals of different groups;

[0082] 3. For teachers with management privileges, their identities are not verified, and the source and authenticity of instructions and messages cannot be determined;

[0083] 4. Different clients have different authorization resource permissions according to different regional groups. Malicious users can obtain client information through channel monitoring and forge messages to obtain access rights to unauthorized resources.

[0084] 5. There is no trusted third party to manage the keys at all levels during the message transmission process, and some messages are stored in the configuration file as configuration information;

[0085] 6. The Kerberos protocol is mainly used for individual identity authentication during the communication process and is not suitable for group identity authentication or information sharing and transmission.

[0086] Based on this, an embodiment of the present application provides a secure communication method, which is applied to a network device; Figure 1 This is a flow chart of the secure communication method according to an embodiment of the present application. Figure 1 As shown, the method includes:

[0087] Step S101: after at least one terminal is successfully registered, at least one group is established based on the identity information of each terminal;

[0088] Step S102: receiving a first message sent by a first terminal among the at least one terminal; the first message at least includes first authentication information encrypted by using a first key; the first key is generated based on the role of each of the terminals;

[0089] Step S103: decrypt the first authentication information using its own second secret key to obtain second authentication information;

[0090] Step S104: determining whether the first terminal belongs to a first group based on the second authentication information; the first group is any group in the at least one group;

[0091] Step S105: When the first terminal belongs to the first group, a second message is sent to the first terminal; the second message includes a third key; the third key is used for the first terminal to conduct a key conversation with other terminals in the first group.

[0092] The specific application scenario of the secure communication method can be determined according to actual conditions and is not limited here. As an example, the secure communication method can be a group control secure communication method in teaching.

[0093] It should be noted that the network device and the terminal can be determined according to actual conditions and are not limited here. As an example, the network device can be a message server and / or AS; the terminal can be a client; the client can include an administrator terminal and a member terminal, the administrator terminal can be exemplified as a teacher terminal; the member terminal can be exemplified as a student terminal.

[0094] In step S101, after at least one terminal is successfully registered, at least one group is established based on the identity information of each terminal; it can be understood that first, a group is established on the system management end (the background management end is set in AS), which is recorded as G i , a group can be understood as a unit that communicates with each other; during the registration process, the terminal enters the corresponding identity information to select a group.

[0095] It should be noted that the registration of the terminal is the registration of the client, including the registration of members and group administrators.

[0096] The registration process of the client can be understood on the network device side as follows: the method further includes:

[0097] The network device establishes at least one group; receives a fifth message sent by the client; the fifth message includes at least group information selected by the client;

[0098] Decrypting the fifth message using its own second secret key to obtain sixth authentication information;

[0099] Determining whether the group information selected by the client exists based on the sixth authentication information;

[0100] In the case that the group information exists, the client is bound to the group selected by the client, and a sixth message is sent to the client; the sixth message indicates that the client is successfully registered.

[0101] In this embodiment, the fifth message is encrypted using the public key of the AS; the fifth message includes the identity information, time information and group information of the client, which can be exemplified as a user name, password, etc.; the user name can be recorded as ID gi_ui , the password information can be recorded as PWD gi_ui ; The group can be denoted by G i .

[0102] The fifth message can be expressed as: pub as [ID gi_ui ,hpwd,T,G i ], where hpwd = h(PWD gi_ui ). ID gi_ui Is the user's unique identifier, PWD gi_ui is the password set by the user, T is the timestamp, G is i is the group number, h(PWD gi_ui ) is the hash value of the client login password.

[0103] The second secret key of the user can be understood as the private key of the AS or the private key of the message server. In this embodiment, the second secret key can be the private key of the AS. The sixth authentication information can be understood as the identity information, time information and group information contained in the fourth message, which can be recorded as ID gi_ui 、h(PWD gi_ui ), T, G i The fourth message is decrypted using its own second secret key to obtain the sixth authentication information; an example can be illustrated as follows: after receiving the message, AS uses its own private key to decrypt and obtain ID gi_ui 、h(PWD gi_ui ), T, G i .

[0104] The determination of whether the group information selected by the client exists based on the sixth authentication information can be understood as checking the group G i It should be noted that judging whether the time information sent by the client meets the requirement based on the sixth authentication information can be understood as whether the timestamp T is within the allowed range, which can be determined according to actual conditions and is not limited here.

[0105] In the case where the group information exists, the client is bound to the group selected by the client, and a sixth message is sent to the client; it can be understood that in group G i If the timestamp T is within the allowed range, the user and the group are bound and a successful registration message is returned. The sixth message can be recorded as E hpwd [ID gi_ui ,G i,T]. It should be noted that, when the group information exists, the identity information of the client is stored, which can be understood as i exists, the timestamp T is within the allowed range, and the ID gi_ui 、h(PWD gi_ui ) and other information are stored in the database.

[0106] It should be noted that the registration process on the member side is the same as the registration process on the client side.

[0107] The registration of the group administrator can be understood on the network device side as, after the client is registered according to the registration process of the client, the method further includes:

[0108] receiving a seventh message sent by the administrator terminal; the seventh message at least including identification information of the administrator terminal;

[0109] decrypting the seventh message using its own second secret key to obtain seventh authentication information;

[0110] Verifying the identity information of the administrator terminal based on the seventh authentication information;

[0111] After the identity information of the administrator terminal is successfully verified, an eighth message is sent to the administrator terminal; the eighth message indicates that the administrator terminal has completed registration.

[0112] It should be noted that first, the group administrator terminal registers the client in accordance with the above-mentioned client registration method, and then performs designated settings of the group administrator in the background according to the client type and offline communication information according to the deployment method, and notifies the AS to identify and record the client group information.

[0113] In this embodiment, the seventh message is encrypted using the public key of the AS; the seventh message includes the identity information, time information and group information of the administrator terminal. The seventh message can be recorded as pub as [ID gm_i ,G i ,h(PWD gm_i ),T]. Among them, ID gm_i G is the unique identifier of the group administrator. i is the group number, h(PWD gm_i ) is the hash value of the client login password.

[0114] The second secret key of the user can be understood as the private key of the AS or the private key of the message server. In this embodiment, the second secret key can be the private key of the AS. The seventh authentication information can be understood as the identity information, time information and group information contained in the sixth message, which can be recorded as IDgm_i 、h(PWD gm_i ), G i and T. The seventh message is decrypted using its own second secret key to obtain the seventh authentication information; it can be understood that after receiving the message, AS uses its own private key to decrypt and obtain ID gm_i 、h(PWD gm_i ), G i and T.

[0115] The identity information of the administrator terminal is verified based on the seventh authentication information; after the identity information of the administrator terminal is successfully verified, an eighth message is sent to the administrator terminal; it can be understood that AS verifies the timestamp T and the group number G i , and based on their user ID gm_i Verify the hash value of the password h(PWD gm_i ), after successful verification, a public-private key pair corresponding to the administrator terminal is generated. The public key of the administrator terminal can be recorded as pub gm_i , the private key of the administrator terminal can be recorded as priv gm_i The public-private key pair is sent to the group administrator terminal using the session key. The session key can be h(PWD gm_i ). The eighth message can be recorded as E key_gmi [ID gm_i ,pub gm_i ,priv gm_i ,priv as (priv gm_i ),G i ,T], where key_gmi=h(PWD gm_i ).

[0116] In step S102, the second key can be understood as the private key of the message server. The first terminal can be an administrator terminal or a member terminal, and the member terminal can be understood as other terminals in a group except the administrator terminal. The first key can be understood as a key generated by the terminal for conducting a session with a network device. If the first terminal is an administrator terminal, the first key can be understood as a session key generated by the administrator terminal, which can be recorded as key_gm_msg; if the first terminal is a member terminal (also understood as a client), the first key can be understood as a session key generated by the client (member terminal), which can be recorded as key_gui_msg.

[0117] When the first terminal is an administrator terminal, the receiving of a first message sent by a first terminal in the at least one terminal; the first message at least includes first authentication information encrypted using a first secret key; it can be understood that the server receives the first message sent by the administrator terminal, and the first message can be recorded as pub msg [ID gmi ,G i ,key_gm_msg,priv gmi (key_gm_msg),T]; the first authentication information can be recorded as ID gmi , G i 、key_gm_msg、priv gmi (key_gm_msg) and T; where ID gmi Is a unique identifier.

[0118] In step S103, the second secret key can be understood as the private key of the network device. The first authentication information is decrypted using its own second secret key to obtain the second authentication information; it can be understood that after receiving the message, the message server uses the private key to decrypt and obtain the second authentication information; the second authentication information is ID gmi , G i 、key_gm_msg、priv gmi (key_gm_msg) and T. It should be noted that the first authentication information and the second authentication information contain the same content.

[0119] In step S104, it is determined based on the second authentication information whether the first terminal belongs to a first group; the first group is any group in the at least one group, which can be understood as the message server verifying the received message.

[0120] Before step S105, the method further includes: sending a ninth message to the first terminal; the ninth message is encrypted using a temporary session key; the ninth message indicates that the message server has established a long link with the administrator terminal, which can be recorded as E key_gm_msg [ID gmi ,G i ,T]; The temporary session key is a temporary session key between the message server and the terminal corresponding to the administrator, which can be recorded as key_gm_msg.

[0121] Receive the tenth message sent by the terminal corresponding to the administrator; the tenth message at least includes the target message encrypted using the third secret key; the tenth message can be recorded as E key_gm_msg [ID gmi ,G i ,E key_data(Msg),T], the third key can be recorded as key_data; the target message can be recorded as Msg.

[0122] The tenth message is decrypted to obtain the eighth authentication information; and the target message encrypted by the third secret key is stored; the eighth authentication information can be recorded as ID gmi , G i 、E key_data (Msg) and T; the third encrypted target message can be recorded as E key_data (Msg). It should be noted that the message server will key_data After (Msg) is stored in the message queue, query the first group (which can be recorded as G i ) and store the user IDs that need to pull messages into the list.

[0123] When the first terminal is a member terminal, in step S102, the first message sent by the first terminal of the at least one terminal is received; the first message at least includes first authentication information encrypted by a first key; the first key is generated based on the role of each terminal; it can be understood that the message server receives the first message sent by the client (member terminal); the first message can be recorded as pub msg [ID gi_ui ,G i ,key_gui_msg,T]; the first key can be recorded as a temporary session key between the message server and the client, which can be recorded as key_gui_msg; the first authentication information may include ID gi_ui , G i , key_gui_msg and T.

[0124] In step S103, the first authentication information is decrypted using its own second secret key to obtain second authentication information; it can be understood that after the message server receives the message, it can use its own private key to decrypt and obtain the second authentication information; the second authentication information contains the same content as the first authentication.

[0125] In step S104, the first terminal is determined to belong to the first group based on the second authentication information; it can be understood that the second authentication information is used to query whether the user is in the first group (which can be recorded as G i )middle.

[0126] In step S105, if the first terminal belongs to the first group, a second message is sent to the first terminal; the second message includes a third key; the third key is used for the first terminal to conduct a key session with other terminals in the first group. It can be understood that if the message server passes the verification, the message server obtains the message from the memory and returns it to the terminal corresponding to the member. The second message can be recorded as E key_gui_msg [ID gi_ui ,G i ,E key_data (Msg),T]; the third secret key can be recorded as key_data.

[0127] Using the technical solution of the embodiment of the present application, the terminal sends a first message to the network device; the first message includes at least first authentication information encrypted by using a first key, and the network device sends a second message to the terminal; the second message includes a third key, that is, during the communication process, the communication between the network device (for example, the server) and the terminal (for example, the client) is fully encrypted; and the first message sent by the terminal includes the first authentication information encrypted by using the first key, and the first key is generated based on the role of the terminal, that is, when the network device receives the message from the terminal, it can verify the identity of the terminal through the first key to ensure the source and authenticity of the message.

[0128] In an optional embodiment of the present application, the method further includes: after the network device is successfully registered, obtaining the second secret key.

[0129] It should be noted that the network device includes a message server and an AS. The registered network device in this embodiment is a message server, and the message server is registered through the AS. The AS is the authentication center, which is a trusted third party of the entire system and has the highest security level. Its master key is set manually or imported through an IC card. The master key is used to protect the data security of the AS authentication center.

[0130] In an optional embodiment of the present application, the method also includes: establishing a terminal corresponding to each administrator of the group based on the identity information of each terminal; receiving a third message sent by the terminal corresponding to the administrator; the third message at least includes third authentication information encrypted using a fourth key; the fourth key is the key of the terminal corresponding to the administrator; using the second key to decrypt the third authentication information to obtain fourth authentication information; verifying the identity information of the terminal corresponding to the administrator based on the fourth authentication information; generating the third key after the identity information of the terminal corresponding to the administrator is successfully verified; and sending the third key to the terminal corresponding to the administrator.

[0131] In this embodiment, the fourth key is the key of the terminal corresponding to the administrator, which can be understood as the private key of the terminal corresponding to the administrator. The third message is the message of the administrator terminal applying for group communication data to the AS, which can be recorded as pub as [ID gm_i ,G i ,priv gm_i (ID gm_i ‖T),T], where ID gm_i For GM i Unique identifier, cascade ID gm_i ‖T and sign.

[0132] The third authentication information is decrypted using the second secret key to obtain the fourth authentication information; it can be understood that after the AS receives the message, it uses the private key to decrypt it, and the fourth authentication information can be recorded as ID gm_i , G i ,priv gm_i (ID gm_i ||T) and T; the fourth authentication information and the third authentication information contain the same content.

[0133] The identity information of the terminal corresponding to the administrator is verified based on the fourth authentication information; after the identity information of the terminal corresponding to the administrator is successfully verified, the third secret key is generated; the third secret key is sent to the terminal corresponding to the administrator; it can be understood that the identity of the terminal corresponding to the administrator is verified using the public key of the terminal corresponding to the administrator, and if the verification is successful, a data encryption key is generated and stored in a local encryption database, and sent to the terminal corresponding to the administrator; the message sent can be recorded as pub gm_i [ID gm_i ,G i ,G key_data ,priv as (key_data), T]. The third key is a data encryption key, which is a symmetric key used to encrypt data and is shared within the group.

[0134] By adopting the technical solution of the embodiment of the present application, the data encryption key can only be applied for by the group administrator to ensure the security of the data, wherein the data encryption key is a symmetric key generated by the AS, which not only ensures data security but also improves data acquisition efficiency, and is transmitted and shared within the group on a group basis.

[0135] In an optional embodiment of the present application, the method also includes: receiving a fourth message sent by a second terminal; the fourth message includes at least identification information of the second terminal; the second terminal is a terminal other than the terminal corresponding to the administrator in the first group; decrypting the third message using the second key to obtain fifth authentication information; judging whether the terminal corresponding to the administrator has applied for the third key based on the fifth authentication information; and sending the third key to the second terminal if the terminal corresponding to the administrator has applied for the third key.

[0136] In this embodiment, the second terminal can be understood as other terminals in a group except the terminal corresponding to the administrator, and can also be a member terminal. The fourth message is a message for the member terminal to apply for a data encryption key from the AS, which can be recorded as pub as [ID gi_ui ,G i ,h(PWD gm_i ),T]. The identification information includes ID gi_ui , G i and h(PWD gm_i ), where ID gi_ui It is the unique identifier of the user; the fourth message is encrypted using the public key of the AS.

[0137] The second secret key can be understood as the private key of AS; the fifth authentication information can be recorded as ID gi_ui , G i 、h(PWD gm_i ) and T. The use of the second secret key to decrypt the fourth message to obtain the fifth authentication information can be understood as that after the AS obtains the message, it uses the private key to decrypt and obtain the fifth authentication information.

[0138] The method determines whether the terminal corresponding to the administrator has applied for the third key based on the fifth authentication information; if the terminal corresponding to the administrator has applied for the third key, sends the third key to the second terminal; it can be understood as verifying the user's identification and password hash value, checking the timestamp and grouping information, checking whether the group has applied for the data encryption key by the terminal corresponding to the administrator, and if the verification is successful, returning the data encryption key to the member terminal; the message sent can be recorded as E key_gui [ID gi_ui ,G i ,key_data,priv as (key_data),T],key_gui=h(PWD gi_ui ).

[0139] By adopting the technical solution of the embodiment of the present invention, the data encryption key is a symmetric key generated by the AS, which ensures data security while improving data acquisition efficiency, and is transmitted and shared within the group on a group basis.

[0140] Accordingly, an embodiment of the present application also provides a secure communication method, which is applied to a terminal; Figure 2 FIG. 2 is another flow chart of the secure communication method according to an embodiment of the present application; Figure 2 As shown, the method includes:

[0141] Step S201: Send a first message to a network device; the first message includes at least first authentication information encrypted by using a first key; the first key is generated based on the role of the terminal; the first authentication information is used by the network device to decrypt the first authentication information by using its own second key to obtain second authentication information; based on the second authentication information, determine whether a first terminal among the terminals belongs to a first group; the first group is any group of at least one group established based on the identity information of the terminal;

[0142] Step S202: When the first terminal belongs to the first group, receiving a second message sent by the network device; the second message includes a third secret key;

[0143] Step S203: using the third secret key to establish a secret key session between the first terminal and other terminals in the first group.

[0144] It should be noted that the network device and the terminal can be determined according to actual conditions and are not limited here. As an example, the network device can be a message server and / or AS; the terminal can be a client; the client can include an administrator terminal and a member terminal, the administrator terminal can be exemplified as a teacher terminal; the member terminal can be exemplified as a student terminal.

[0145] Before step S201, the registration process of the terminal and the network device needs to be completed. It should be noted that the registration of the terminal is the registration of the client, including the registration of members and group administrators.

[0146] The registration process of the client can be understood on the terminal side as follows: the method further includes:

[0147] Sending a fifth message to the network device; the fifth message at least includes the selected group information; the fifth message is used by the network device to decrypt the fifth message using its own second secret key to obtain sixth authentication information; judging whether the group information selected by the client exists based on the sixth authentication information; if the group information exists, binding the client with the group selected by the client;

[0148] A sixth message sent by the network device is received; the sixth message indicates that the registration is successful.

[0149] In this embodiment, the fifth message is encrypted using the public key of the AS; the fifth message includes the identity information, time information and group information of the client, which can be exemplified as a user name, password, etc.; the user name can be recorded as ID gi_ui , the password information can be recorded as PWD gi_ui ; The group can be denoted by G i .

[0150] The fifth message can be expressed as: pub as =[ID gi_ui ,hpwd,T,G i ], where hpwd = h(PWD gi_ui ). ID gi_ui Is the user's unique identifier, PWD gi_ui is the password set by the user, T is the timestamp, G is i is the group number, h(PWD gi_ui ) is the hash value of the client login password.

[0151] The second secret key of the user can be understood as the private key of the AS or the private key of the message server. In this embodiment, the second secret key can be the private key of the AS. The sixth authentication information can be understood as the identity information, time information and group information contained in the fourth message, which can be recorded as ID gi_ui 、h(PWD gi_ui ), T, G i The fourth message is decrypted using its own second secret key to obtain the sixth authentication information; an example can be illustrated as follows: after receiving the message, AS uses its own private key to decrypt and obtain ID gi_ui 、h(PWD gi_ui ), T, G i .

[0152] The network device determines whether the group information selected by the client exists based on the sixth authentication information; it can be understood as checking the group G i It should be noted that the network device determines whether the time information sent by the client meets the requirements based on the sixth authentication information, which can be understood as whether the timestamp T is within the allowed range. The range can be determined according to actual conditions and is not limited here.

[0153] When the group information exists, the network device binds the client to the group selected by the client and sends a sixth message to the client. It can be understood that the network device binds the client to the group selected by the client in group G. iIf the timestamp T is within the allowed range, the user and the group are bound and a successful registration message is returned. The sixth message can be recorded as E hpwd [ID gi_ui ,G i ,T]. It should be noted that, when the group information exists, the network device stores the identity information of the client, which can be understood as i exists, the timestamp T is within the allowed range, and the ID gi_ui 、h(PWD gi_ui ) and other information are stored in the database. After the client receives the sixth message, the registration is successful.

[0154] It should be noted that the registration process on the member side is the same as the registration process on the client side.

[0155] The registration of the group administrator may be understood as, on the terminal side, after the client is registered according to the registration process of the client, the method further includes:

[0156] Sending a seventh message to the network device; the seventh message at least includes corresponding identification information; the seventh message is used by the network device to decrypt the seventh message using its own second secret key to obtain seventh authentication information; verifying the identity information of the administrator terminal based on the seventh authentication information;

[0157] After the identity information of the management terminal is successfully verified, an eighth message sent by the network device is received; the eighth message indicates that the registration is successful.

[0158] It should be noted that first, the group administrator terminal registers the client in accordance with the above-mentioned client registration method, and then performs designated settings of the group administrator in the background according to the client type and offline communication information according to the deployment method, and notifies the AS to identify and record the client group information.

[0159] In this embodiment, the seventh message is encrypted using the public key of the AS; the seventh message includes the identity information, time information and group information of the administrator terminal. The seventh message can be recorded as pub as [ID gm_i ,G i ,h(PWD gm_i ),T]. Among them, ID gm_i G is the unique identifier of the group administrator. i is the group number, h(PWD gm_i ) is the hash value of the client login password.

[0160] The second secret key of the user can be understood as the private key of the AS or the private key of the message server. In this embodiment, the second secret key can be the private key of the AS. The seventh authentication information can be understood as the identity information, time information and group information contained in the sixth message, which can be recorded as ID gm_i 、h(PWD gm_i ), G i and T. The seventh message is decrypted using its own second secret key to obtain the seventh authentication information; it can be understood that after receiving the message, AS uses its own private key to decrypt and obtain ID gm_i 、h(PWD gm_i ), G i and T.

[0161] The identity information of the administrator terminal is verified based on the seventh authentication information; after the identity information of the administrator terminal is successfully verified, an eighth message is sent to the administrator terminal; it can be understood that AS verifies the timestamp T and the group number G i , and based on their user ID gm_i Verify the hash value of the password h(PWD gm_i ), after successful verification, a public-private key pair corresponding to the administrator terminal is generated. The public key of the administrator terminal can be recorded as pub gm_i , the private key of the administrator terminal can be recorded as priv gm_i The public-private key pair is sent to the group administrator terminal using the session key. The session key can be h(PWD gm_i ). The eighth message can be recorded as E key_gmi [ID gm_i ,pub gm_i ,priv gm_i ,priv as (priv gm_i ),G i ,T], where key_gmi=h(PWD gm_i ).

[0162] When the first terminal is an administrator terminal, in step S201, a first message is sent to a network device, the first message at least including first authentication information encrypted by a first key; the first key is generated based on the role of the terminal; the first authentication information is used by the network device to decrypt the first authentication information by using its own second key to obtain second authentication information; based on the second authentication information, it is determined whether the first terminal among the terminals belongs to a first group; the first group is any group of at least one group established based on the identity information of the terminal; it can be understood that the terminal corresponding to the administrator sends a first message to the server; the first message can be recorded as pub msg [IDgmi ,G i ,key_gm_msg,priv gmi (key_gm_msg),T]; the first authentication information can be recorded as ID gmi , G i 、key_gm_msg、priv gmi (key_gm_msg) and T; where ID gmi The second key can be understood as the private key of the network device. The first authentication information is decrypted using its own second key to obtain the second authentication information; it can be understood that the message server uses the private key to decrypt after receiving the message to obtain the second authentication information; the second authentication information is ID gmi , G i 、key_gm_msg、priv gmi (key_gm_msg) and T. It should be noted that the first authentication information and the second authentication information contain the same content. The determining whether the first terminal belongs to the first group based on the second authentication information; the first group is any group in the at least one group, can be understood as the message server verifying the received message.

[0163] Before step S202, the method further includes: receiving a ninth message sent by the network device; encrypting the ninth message using a temporary session key; and the ninth message indicates that the message server has established a long link with the administrator terminal, which can be recorded as E key_gm_msg [ID gmi ,G i ,T]; The temporary session key is a temporary session key between the message server and the terminal corresponding to the administrator, which can be recorded as key_gm_msg.

[0164] The tenth message is sent to the network; the tenth message is used by the network device to decrypt the tenth message to obtain the eighth authentication information; and the target message encrypted by the third key is stored. The tenth message at least includes the target message encrypted by the third key; the tenth message can be recorded as, the third key can be recorded as; the target message can be recorded as Msg. The eighth authentication information can be recorded as ID gmi , G i 、E key_data (Msg) and T; the third encrypted target message can be recorded as E key_data (Msg). It should be noted that the message server will key_data After (Msg) is stored in the message queue, query the first group (which can be recorded as G i ) and store the user IDs that need to pull messages into the list.

[0165] When the first terminal is a member terminal, in step S201, the first message is sent to the network device, the first message at least including first authentication information encrypted by using a first key; the first key is generated based on the role of the terminal; the first authentication information is used by the network device to decrypt the first authentication information using its own second key to obtain second authentication information; based on the second authentication information, it is determined whether the first terminal among the terminals belongs to the first group; the first group is any group of at least one group established based on the identity information of the terminal; it can be understood that the terminal corresponding to the member sends the first message to the message server; the first message can be recorded as pub msg [ID gi_ui ,G i ,key_gui_msg,T]; the first key can be recorded as a temporary session key between the message server and the client, which can be recorded as key_gui_msg; the first authentication information may include ID gi_ui , G i , key_gui_msg and T. The first authentication information is used by the network device to decrypt the first authentication information using its own second secret key to obtain the second authentication information. It can be understood that after receiving the message, the message server can use its own private key to decrypt and obtain the second authentication information; the second authentication information contains the same content as the first authentication.

[0166] In step S202, when the first terminal belongs to the first group, a second message sent by the network device is received; the second message includes a third secret key; it can be understood that when the message server passes the verification, the message server obtains the message from the memory and returns it to the terminal corresponding to the member, and the second message can be recorded as E key_gui_msg [ID gi_ui ,G i ,E key_data (Msg),T]; the third secret key can be recorded as key_data.

[0167] In step S203, a key session is established between the first terminal and other terminals in the first group using the third key; the third key can be understood as a data encryption key.

[0168] Using the technical solution of the embodiment of the present application, the terminal sends a first message to the network device; the first message includes at least first authentication information encrypted by using a first key, and the network device sends a second message to the terminal; the second message includes a third key, that is, during the communication process, the communication between the network device (for example, the server) and the terminal (for example, the client) is fully encrypted; and the first message sent by the terminal includes the first authentication information encrypted by using the first key, and the first key is generated based on the role of the terminal, that is, when the network device receives the message from the terminal, it can verify the identity of the terminal through the first key to ensure the source and authenticity of the message.

[0169] In an optional embodiment of the present application, the terminal at least includes a terminal corresponding to an administrator, and the method also includes: sending a third message to the network device; the third message at least includes third authentication information encrypted using a fourth key; the fourth key is the key of the terminal corresponding to the administrator; the third authentication information is used by the network device to decrypt using the second key to obtain fourth authentication information; verifying the identity information of the terminal corresponding to the administrator based on the fourth authentication information; generating the third key after the identity information of the terminal corresponding to the administrator is successfully verified; and receiving the third key sent by the network device.

[0170] In this embodiment, the fourth key is the key of the terminal corresponding to the administrator, which can be understood as the private key of the terminal corresponding to the administrator. The third message is the message of the administrator terminal applying for group communication data from the AS, which can be recorded as pub as [ID gm_i ,G i ,priv gm_i (ID gm_i ‖T),T], where ID gm_i For GM i Unique identifier, cascade ID gm_i ‖T and sign.

[0171] The third authentication information is used by the network device to decrypt using the second secret key to obtain the fourth authentication information. It can be understood that the AS uses the private key to decrypt. The fourth authentication information can be recorded as ID gm_i , G i ,priv gm_i (ID gm_i ||T) and T; the fourth authentication information and the third authentication information contain the same content.

[0172] The identity information of the terminal corresponding to the administrator is verified based on the fourth authentication information; after the identity information of the terminal corresponding to the administrator is successfully verified, the third secret key is generated; receiving the third secret key sent by the network device can be understood as AS using the public key of the terminal corresponding to the administrator to verify its identity, and if the verification is successful, a data encryption key is generated and stored in the local encryption database, and sent to the terminal corresponding to the administrator; the message sent can be recorded as pub gm_i [ID gm_i ,G i ,G key_data ,priv as (key_data), T]. The third key is a data encryption key, which is a symmetric key used to encrypt data and is shared within the group.

[0173] By adopting the technical solution of the embodiment of the present application, the data encryption key can only be applied for by the group administrator to ensure the security of the data, wherein the data encryption key is a symmetric key generated by the AS, which not only ensures data security but also improves data acquisition efficiency, and is transmitted and shared within the group on a group basis.

[0174] In an optional embodiment of the present application, the terminal includes at least a second terminal; the second terminal is other terminals in the first group except the terminal corresponding to the administrator; the method also includes: sending a fourth message to the network device; the fourth message includes at least identification information of the second terminal; the fourth message is used by the network device to decrypt using the second key to obtain fifth authentication information; based on the fifth authentication information, it is determined whether the terminal corresponding to the administrator has applied for the third key; if the terminal corresponding to the administrator has applied for the third key, receiving the third key sent by the network device.

[0175] In this embodiment, the second terminal can be understood as other terminals in a group except the terminal corresponding to the administrator, and can also be a member terminal. The fourth message is a message for the member terminal to apply for a data encryption key from the AS, which can be recorded as pub as [ID gi_ui ,G i ,h(PWD gm_i ),T]. The identification information includes ID gi_ui , G i and h(PWD gm_i ), where ID gi_ui The fourth message is encrypted using the public key of the AS. The second secret key can be understood as the private key of the AS. The fifth authentication information can be recorded as ID gi_ui , G i 、h(PWD gm_i) and T. The use of the second secret key to decrypt the fourth message to obtain the fifth authentication information can be understood as that after the AS obtains the message, it uses the private key to decrypt and obtain the fifth authentication information.

[0176] The method determines whether the terminal corresponding to the administrator has applied for the third key based on the fifth authentication information; if the terminal corresponding to the administrator has applied for the third key, sends the third key to the second terminal; it can be understood as verifying the user's identification and password hash value, checking the timestamp and grouping information, checking whether the group has applied for the data encryption key by the terminal corresponding to the administrator, and if the verification is successful, returning the data encryption key to the member terminal; the message sent can be recorded as E key_gui [ID gi_ui ,G i ,key_data,priv as (key_data),T],key_gui=h(PWD gi_ui ).

[0177] By adopting the technical solution of the embodiment of the present invention, the data encryption key is a symmetric key generated by the AS, which ensures data security while improving data acquisition efficiency, and is transmitted and shared within the group on a group basis.

[0178] In order to better understand the present application, an actual application scenario is exemplified here, in which the secure communication method is a group-controlled secure communication method in teaching; the network device includes an AS and a message server, the terminal includes a client, and the client includes a member terminal and an administrator terminal.

[0179] This application mainly solves the problem that the client and server do not implement full-link encryption of the communication link from the client to the server during the communication process; for the teacher-side user with management authority, his identity is not verified, and the source and authenticity of the instructions and messages cannot be determined. The specific solution is as follows.

[0180] Designed for classroom teaching and group teaching scenarios in teaching application scenarios. Figure 3 A schematic diagram of a message communication process provided by an embodiment of the present application, such as Figure 3As shown, the component units include authentication server, message server, group management terminal, and client terminal, and digital signature, public key cryptography, symmetric key and other technologies are used in the process. The communication between servers and between groups and servers is guaranteed to be secure, and attacks such as message replay, message forgery, and unauthorized operation during the communication process are avoided; in this application, multiple keys will be used and hierarchical management will be performed on the keys, in which the master key is used to encrypt the keys stored on the AS; the session key is generated by the AS or negotiated by both parties according to different roles; the data key is used to encrypt information between groups and is generated by the AS.

[0181] 1. Initialization and registration.

[0182] The entire communication scheme includes a message server, AS, group administrator, and group members to form a communication system, where AS is the authentication center, that is, a trusted third party (TTP), which generates some session keys and group data encryption keys. The following will describe in detail the initialization and registration process of AS, message server, group administrator, and group members.

[0183] 1.1 Initialization:

[0184] AS is the authentication center. As a trusted third party of the entire system, it has the highest security level. Its master key is set manually or imported through an IC card. The master key is used to protect the data security of the AS authentication center.

[0185] 1.2 Message server registration. Figure 4 A schematic diagram of a message server registration provided in an embodiment of the present application, such as Figure 4 As shown, first, the server side of the system includes the AS authentication center and the message server. When a new message server is added, it first registers with the AS and records the server information; negotiates the temporary session key of both parties; generates the public and private key pair of the message server; and encrypts the public and private keys with the temporary session key and sends them to the message server.

[0186] (1) Newly added message server S msg First, obtain the public key pub of the AS certification center as , calculate the following message and send it to AS: pub as [ID msg ,g,g p ,T]; where ID msg is the unique identifier of the message server, g is the generator selected by the message server, and a random number p is generated. The generator g and g p Sent to AS, T is the timestamp;

[0187] (2) After receiving the message, AS uses its private key to decrypt and obtain the ID msg ,g,g p, T; first verify the ID msg Is it registered? If not, generate a random number q, store the server information in the local database, and calculate g pq As a temporary session key for communication between the two parties, send a message to the message server S msg ; The message sent can be recorded as priv as [ID msg ,q,T],q,T; where q is the random number selected by AS for private key negotiation, T is the current time, and the private key is used for signing to prevent message forgery;

[0188] (3) Message Server S msg After receiving the message, the signature is first decrypted using the public key of the AS to verify the source priv as [ID msg ,q,T] is credible. If credible, calculate g pq As a temporary session key for communication between the two parties, apply for the public key from AS and calculate the message, which can be recorded as key_pq = g pq ; E key_pq [ID msg ,T]; where ID msg is the unique identifier of the message server, and T is the timestamp;

[0189] (4) After receiving the message, AS uses the negotiated session key key_pq = g pq Decrypt and obtain the ID msg and T, check the unique ID msg Has it been registered? If not, no processing is done; if it has been registered, check whether the timestamp T is within the allowed time range; if it is within the allowed range, AS generates the public-private key pair pub of the message server msg ,priv msg ;Storage ID msg With the public key pub msg The corresponding relationship is stored in the local database, and the private key priv msg Use the negotiated session key key_pq = g pq Encrypted and sent to the message server, the message sent can be recorded as E key_pq [ID msg ,pub msg ,priv msg ,T]; where pub msg is the public key of the message server; priv msg is the private key of the message server; T is the current timestamp;

[0190] (5) Message Server S msgAfter receiving the message, use the temporary session key to decrypt and obtain the ID msg ,pub msg ,priv msg and T; check whether the timestamp T is within the allowed range, and the ID msg Whether the message receiver is this server, if all the conditions are met, the private key priv of this server is kept confidential msg .

[0191] The above process completes the message server S msg Register with AS, negotiate temporary session keys with AS, and generate and transfer public and private key pairs.

[0192] 1.3 Client registration, first create group G on the system management end i The system only allows communication between users within a group. In this scenario, the group management end performs unified control and communication on the clients within the group (a typical scenario is the teacher and student ends in a classroom), so cross-group communication is not allowed; the client needs to be in a group to be used in the system, and the client needs to register as a user. When registering, it needs to select a group according to actual needs.

[0193] (1) First, create group G in the system backend management terminal (the backend management terminal is set in AS) i ,A group is a unit that communicates with each other;

[0194] (2) The client user registers on the system registration page and enters the user name ID when registering gi_ui , password PWD gi_ui etc., select group G i , and use the AS public key to encrypt the message and send it to AS. The message sent can be recorded as: hpwd = h(PWD gi_ui );pub as [ID gi_ui ,hpwd,T,G i ]; where ID gi_ui Is the user's unique identifier, PWD gi_ui is the password set by the user, T is the timestamp, G is i is the group number, h(PWD gi_ui ) is the hash value of the client login password;

[0195] (3) After receiving the message, AS uses the private key to decrypt and obtain the ID gi_ui 、h(PWD gi_ui ), T, G i , first check group G i Whether it exists, whether the timestamp T is within the allowed range. If it is satisfied, then bind the relationship between the user and the group, and set the IDgi_ui 、h(PWD gi_ui ) and other information are stored in the database, and a successful registration message is returned. The returned message can be recorded as E hpwd [ID gi_ui ,G i ,T].

[0196] 1.4 Group administrator registration, Figure 5 A schematic diagram of an administrator terminal registration provided in an embodiment of the present application, such as Figure 5 As shown in the figure, the group administrator manages the clients of group members in the group. At the same time, it is also a client. At the beginning, it is specified according to the deployment method. The registration process is to register as a client first, then register the identity with the AS, and apply for the public-private key pair pub of the group administrator. gm_i ,priv gm_i .

[0197] (1) First, the group administrator registers the client according to the client registration method described in 1.3;

[0198] (2) According to the deployment method, the group administrator is specified in the background according to the client type and offline communication information, and the AS is notified to identify and record the client group information;

[0199] (3) When used for the first time, the group management end will apply for a public-private key pair from the AS authentication center and send a message to the AS. The message sent can be recorded as pub as [ID gm_i ,G i ,h(PWD gm_i ),T]; where ID gm_i G is the unique identifier of the group administrator. i is the group number, h(PWD gm_i ) is the hash value of the client login password;

[0200] (4) After receiving the message, AS verifies the timestamp T and group number G i , and based on their user ID gm_i Verify the hash value of the password h(PWD gm_i ), to ensure the reliability of the message source and prevent information forgery by different group members. After receiving the message, AS generates a pub gm_i ,priv gm_i Public-private key pair, and use h(PWD gm_i ) as the session key, encrypt the private key and other information and send it to the group administrator. The message is: key_gmi = h(PWD gm_i );E key_gmi [ID gm_i ,pubgm_i ,priv gm_i ,priv as (priv gm_i ),G i ,T]; where pub gm_i is the public key of the group administrator, priv gm_i The private key of the group administrator;

[0201] (5) After receiving the message, the group administrator uses h(PWD gm_i ) to decrypt and obtain the ID gm_i ,pub gm_i ,priv gm_i ,priv as (priv gm_i ), G i After confirming the source of the message and T value, verify and save your own public and private key pair pub gm_i ,priv gm_i to complete the registration.

[0202] 2Group messaging.

[0203] 2.1 Group data encryption key generation. In this solution, to ensure the security of messages, the transmitted messages are encrypted using the group message data key, which is the group shared key. Figure 6 A schematic diagram of generating a group data encryption key provided in an embodiment of the present application is shown in FIG. Figure 6 As shown,

[0204] (1) Group Manager GM i Apply for the data encryption key of group communication data from AS and send a message to AS. The message is pub as [ID gm_i ,G i ,priv gm_i (ID gm_i ||T),T], where ID gm_i For GM i Unique identifier, cascade ID gm_i ||T and sign to ensure the source and freshness of the message, and prevent the communication from being stolen and forged after being used in other processes;

[0205] (2) After receiving the message, AS uses the private key to decrypt and obtain the ID gm_i , G i ,priv gm_i (ID gm_i||T) and T, check whether the timestamp is within the permissible range, and use the group administrator's public key to decrypt and verify his identity. If it is credible, generate a data encryption key key_data and store it in the local encryption database. This key is a symmetric key used to encrypt data, shared within the group, and sent to the group administrator after generation. The message sent can be recorded as pub gm_i [ID gm_i ,G i ,G key_data ,priv as (key_data),T]; complete the generation and transmission of group data encryption key;

[0206] (3) After receiving the message, the group members need to decrypt the message, so they also need to apply for the data encryption key from the AS and send the application message to the AS. The message sent can be recorded as pub as [ID gi_ui ,G i ,h(PWD gm_i ),T], where ID gi_ui Unique identifier for the user;

[0207] (4) After AS receives the message, it decrypts it and obtains the ID gi_ui , G i 、h(PWD gm_i ) and T, verify the user's ID and password hash value, check the timestamp and group information, and check whether the group has applied for the group data encryption key key_data to be generated by the administrator; if the message is correct, return the data key to the client; the returned message can be recorded as E key_gui [ID gi_ui ,G i ,key_data,priv as (key_data),T],key_gui=h(PWD gi_ui ), where G data_key The data encryption key for group communication messages. The above process completes the generation and transmission of the shared data encryption key key_data between groups.

[0208] 2.2 Message transmission between group administrator and message server, Figure 7 A schematic diagram of message transmission between a group administrator and a message server provided in an embodiment of the present application, such as Figure 7 shown.

[0209] (1) The group administrator sends the generated session key key_gm_msg, signs it with the private key, and sends it to the message server. The message sent can be recorded as pub msg [ID gmi ,G i,key_gm_msg,priv gmi (key_gm_msg),T]; where ID gmi Is a unique identifier;

[0210] (2) After receiving the message, the message server uses the private key to decrypt and obtain the ID gmi , G i 、key_gm_msg、priv gmi (key_gm_msg) and T, verify the temporary session key key_gm_msg and its signature. If passed, a long link is established with the group administrator, and the temporary session key is used to encrypt the transmitted information during the communication process, and the message is returned. The returned message can be recorded as E key_gm_msg [ID gmi ,G i ,T];

[0211] (3) The group administrator sends a message Msg to the message server. The message sent can be recorded as E key_gm_msg [ID gmi ,G i ,E key_data (Msg),T]; where E key_data (Msg) is the message encrypted using the data encryption key;

[0212] (4) After receiving the message, the server decrypts it to obtain the ID gmi , G i 、E key_data (Msg) and T, and E key_data After (Msg) is stored in the message queue, query G i The users in the group store the user IDs that need to pull messages into the list; the above process completes the message sending of the group administrator.

[0213] 2.3 Message transmission between client and message server.

[0214] (1) The client subscribes to messages from the message server. First, it sends the following request to the message server to negotiate the session key and request to pull messages; the message can be recorded as pub msg [ID gi_ui ,G i ,key_gui_msg,T]; where key_gui_msg is the temporary session key selected by the client;

[0215] (2) After receiving the message, the message server uses its private key to decrypt it, completes the transfer of the session key, and queries whether the user is in G i If it is, then a long link is established with the client, the message server gets the message from the memory and returns it to the client. The returned message can be recorded as Ekey_gui_msg [ID gi_ui ,G i ,E key_data (Msg),T]; After receiving the message, the client uses the group shared data encryption key to decrypt and obtain the message.

[0216] By adopting the technical solution of the embodiment of the present application, in terms of session security, according to different identity roles in the system, temporary session keys for communication between AS, message server, group administrator, and group members are set according to different identities to ensure user communication security; in terms of data security, data security is ensured by data encryption keys, wherein the data encryption keys are symmetric keys generated by AS, which not only ensure data security but also improve data acquisition efficiency, and are transmitted and shared within the group on a group basis; in terms of user identity authentication, AS is a trusted third party in the system, and other communicating parties need to complete their identity authentication by registration; the group administrator specifies in the background after registration, and after the specification, the group administrator initiates a public-private key application to obtain its public-private key pair, and the subsequent identity authentication uses the private key to encrypt and sign the information; in terms of encryption and decryption efficiency, the data encryption keys used in the communication process use a symmetric key system to ensure the encryption and decryption efficiency of the message; the private key is used for signing only when the source of the message needs to be confirmed, and the rest is encrypted using the symmetric session key.

[0217] In order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a secure communication device, which is arranged on a network device. Figure 8 Schematic diagram of a secure communication device according to an embodiment of the present application; Figure 8 As shown, the device 800 includes:

[0218] A first establishing unit 801 is configured to establish at least one group based on the identity information of each terminal after at least one terminal is successfully registered;

[0219] A first receiving unit 802 is configured to receive a first message sent by a first terminal among the at least one terminal; the first message includes at least first authentication information encrypted using a first key; the first key is generated based on a role of each of the terminals;

[0220] A first decryption unit 803 is used to decrypt the first authentication information using its own second secret key to obtain second authentication information;

[0221] A first determination unit 804 is configured to determine whether the first terminal belongs to a first group based on the second authentication information; the first group is any group in the at least one group;

[0222] The first sending unit 805 is used to send a second message to the first terminal when the first terminal belongs to the first group; the second message includes a third key; the third key is used for the first terminal to conduct a key session with other terminals in the first group.

[0223] In one embodiment, the apparatus 800 further includes a first acquisition unit, configured to acquire the second secret key after the network device is successfully registered.

[0224] In one embodiment, the first establishing unit 801 is further configured to establish a terminal corresponding to an administrator of each of the groups based on the identity information of each of the terminals;

[0225] The first receiving unit 802 is further configured to receive a third message sent by the terminal corresponding to the administrator; the third message at least includes third authentication information encrypted using a fourth key; the fourth key is a key of the terminal corresponding to the administrator;

[0226] The first decryption unit 803 is further configured to decrypt the third authentication information using the second secret key to obtain fourth authentication information;

[0227] The device 800 further includes a verification unit, configured to verify the identity information of the terminal corresponding to the administrator based on the fourth authentication information;

[0228] The first sending unit 805 is further configured to generate the third secret key after the identity information of the terminal corresponding to the administrator is successfully verified; and send the third secret key to the terminal corresponding to the administrator.

[0229] In one embodiment, the first receiving unit 802 is further configured to receive a fourth message sent by a second terminal; the fourth message includes at least identification information of the second terminal; the second terminal is a terminal in the first group other than the terminal corresponding to the administrator;

[0230] The first decryption unit 803 is further configured to decrypt the fourth message using the second secret key to obtain fifth authentication information;

[0231] The first determination unit 804 is further configured to determine whether the terminal corresponding to the administrator applies for the third secret key based on the fifth authentication information;

[0232] The first sending unit 805 is further configured to send the third key to the second terminal when the terminal corresponding to the administrator has applied for the third key.

[0233] In order to implement the method on the terminal side of the embodiment of the present application, the embodiment of the present application also provides a secure communication device, which is arranged on the terminal. Fig. 9 Schematic diagram of another device for secure communication in an embodiment of the present application; Fig. 9 As shown, the device 900 includes:

[0234] The second sending unit 901 is used to send a first message to the network device; the first message at least includes first authentication information encrypted by using a first key; the first key is generated based on the role of the terminal; the first authentication information is used by the network device to decrypt the first authentication information by using its own second key to obtain second authentication information; based on the second authentication information, it is determined whether the first terminal among the terminals belongs to a first group; the first group is any group of at least one group established based on the identity information of the terminal;

[0235] A second receiving unit 902 is configured to receive a second message sent by the network device when the first terminal belongs to the first group; the second message includes a third key;

[0236] The second establishing unit 903 uses the third secret key to establish a secret key session between the first terminal and other terminals in the first group.

[0237] In one embodiment, the second sending unit 901 is further used to send a third message to the network device; the third message at least includes third authentication information encrypted using a fourth key; the fourth key is the key of the terminal corresponding to the administrator; the third authentication information is used by the network device to decrypt using the second key to obtain fourth authentication information; based on the fourth authentication information, the identity information of the terminal corresponding to the administrator is verified; after the identity information of the terminal corresponding to the administrator is successfully verified, the third key is generated;

[0238] The second receiving unit 902 is further configured to receive the third secret key sent by the network device.

[0239] In one embodiment, the second sending unit 901 is further used to send a fourth message to the network device; the fourth message includes at least identification information of the second terminal; the fourth message is used by the network device to decrypt using the second key to obtain fifth authentication information; based on the fifth authentication information, it is determined whether the terminal corresponding to the administrator applies for the third key;

[0240] The second receiving unit 902 is further configured to receive the third key sent by the network device when the terminal corresponding to the administrator has applied for the third key.

[0241] Based on the hardware implementation of the above program module, in order to implement the method on the network device side of the embodiment of the present application, the embodiment of the present application also provides a network device, Fig.10 This is a schematic diagram of the structure of the network device according to the embodiment of the present application. Fig.10 As shown, the network device 1000 includes:

[0242] The first communication interface 1001 is capable of exchanging information with the terminal;

[0243] The first processor 1002 is connected to the first communication interface 1001 to implement information interaction with the terminal, and is used to execute the method provided by one or more technical solutions on the network device side when running a computer program. The computer program is stored in the first memory 1003.

[0244] Specifically, the first communication interface 1001 is used to establish at least one group based on the identity information of each terminal after at least one terminal is successfully registered; receive a first message sent by a first terminal among the at least one terminal; the first message includes at least first authentication information encrypted using a first key; the first key is generated based on the role of each terminal; the first authentication information is decrypted using its own second key to obtain second authentication information; based on the second authentication information, determine whether the first terminal belongs to the first group; the first group is any group in the at least one group; if the first terminal belongs to the first group, send a second message to the first terminal; the second message includes a third key; the third key is used for the first terminal to conduct a key conversation with other terminals in the first group.

[0245] It should be noted that the specific processing process of the first processor 1002 and the first communication interface 1001 can be understood by referring to the above method.

[0246] Of course, in actual application, the various components in the network device 1000 are coupled together through the bus system 1004. It can be understood that the bus system 1004 is used to realize the connection and communication between these components. In addition to the information bus, the bus system 1004 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.10 Various buses are labeled as bus system 1004 .

[0247] The first memory 1003 in the embodiment of the present application is used to store various types of information to support the operation of the network device 1000. Examples of such information include: any computer program used to operate on the network device 1000.

[0248] The method disclosed in the above embodiment of the present application can be applied to the first processor 1002, or implemented by the first processor 1002. The first processor 1002 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the first processor 1002. The above-mentioned first processor 1002 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The first processor 1002 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the first memory 1003, and the first processor 1002 reads the information in the first memory 1003 and completes the steps of the above method in combination with its hardware.

[0249] In an exemplary embodiment, the network device 1000 may be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to execute the aforementioned method.

[0250] Based on the hardware implementation of the above program module, and in order to implement the method on the terminal side of the embodiment of the present application, the embodiment of the present application also provides a terminal, Fig.11 Schematic diagram of the structure of the terminal of the embodiment of the present application; Fig.11 As shown, the terminal 1100 includes:

[0251] The second communication interface 1101 is capable of exchanging information with a network device;

[0252] The second processor 1102 is connected to the second communication interface 1101 to implement information interaction with the network device, and is used to execute the method provided by one or more technical solutions of the terminal side when running the computer program. The computer program is stored in the second memory 1103.

[0253] It should be noted that the specific processing process of the second communication interface 1101 and the second processor 1102 can be understood by referring to the above method.

[0254] Of course, in actual application, the various components in the terminal 1100 are coupled together through the bus system 1104. It can be understood that the bus system 1104 is used to realize the connection and communication between these components. In addition to the information bus, the bus system 1104 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.11 Various buses are labeled as bus system 1104 .

[0255] The second memory 1103 in the embodiment of the present application is used to store various types of information to support the operation of the terminal 1100. Examples of such information include: any computer program used to operate on the terminal 1100.

[0256] The method disclosed in the above embodiment of the present application can be applied to the second processor 1102, or implemented by the second processor 1102. The second processor 1102 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the second processor 1102. The above-mentioned second processor 1102 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The second processor 1102 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the second memory 1103, and the second processor 1102 reads the information in the second memory 1103 and completes the steps of the above method in combination with its hardware.

[0257] In an exemplary embodiment, the terminal 1100 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general purpose processors, controllers, MCUs, Microprocessors, or other electronic components to perform the aforementioned methods.

[0258] It can be understood that the memory (first memory 1003, second memory 1103) of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a ferromagnetic random access memory, a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memories described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

[0259] In order to implement the method provided in the embodiment of the present application, the embodiment of the present application also provides a secure communication system, Fig.12 Schematic diagram of the structure of the secure communication system of the present application embodiment; Fig.12 As shown, the system includes: a network device 1201 and a terminal 1202.

[0260] Here, it should be noted that the specific processing process of the network device 1201 and the terminal 1202 has been described in detail above and will not be repeated here.

[0261] In an exemplary embodiment, the embodiment of the present application further provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, for example, including a first memory 1003 storing a computer program, and the computer program can be executed by the first processor 1002 of the network device 1001 to complete the steps of the aforementioned network device side method. For another example, a second memory 1103 storing a computer program can be executed by the second processor 1102 of the terminal 1100 to complete the steps of the aforementioned terminal side method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM.

[0262] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0263] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0264] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A secure communication method, characterized in that: The method is applied to a network device; the method comprises: After at least one terminal is successfully registered, establishing at least one group based on the identity information of each of the terminals; Receiving a first message sent by a first terminal among the at least one terminal; the first message at least includes first authentication information encrypted by using a first key; the first key is generated based on a role of each of the terminals; Decrypting the first authentication information using its own second secret key to obtain second authentication information; Determine whether the first terminal belongs to a first group based on the second authentication information; the first group is any group in the at least one group; In the case that the first terminal belongs to the first group, a second message is sent to the first terminal; the second message includes a third key; and the third key is used for the first terminal to conduct a key session with other terminals in the first group.

2. The method according to claim 1, characterized in that The method further comprises: After the network device is successfully registered, the second secret key is obtained.

3. The method according to claim 1, characterized in that The method further comprises: Establishing a terminal corresponding to an administrator of each group based on the identity information of each terminal; receiving a third message sent by the terminal corresponding to the administrator; the third message at least includes third authentication information encrypted by using a fourth key; the fourth key is a key of the terminal corresponding to the administrator; Decrypting the third authentication information using the second secret key to obtain fourth authentication information; Verifying the identity information of the terminal corresponding to the administrator based on the fourth authentication information; After the identity information of the terminal corresponding to the administrator is successfully verified, the third secret key is generated; and the third secret key is sent to the terminal corresponding to the administrator.

4. The method according to claim 3, characterized in that: The method further comprises: receiving a fourth message sent by a second terminal; the fourth message at least including identification information of the second terminal; the second terminal is a terminal in the first group other than the terminal corresponding to the administrator; decrypting the fourth message using the second secret key to obtain fifth authentication information; Determining whether the terminal corresponding to the administrator applies for the third key based on the fifth authentication information; In a case where the terminal corresponding to the administrator has applied for the third key, the third key is sent to the second terminal.

5. A secure communication method, characterized in that: The method is applied to a terminal; the method comprises: Sending a first message to a network device; the first message at least includes first authentication information encrypted by using a first key; the first key is generated based on the role of the terminal; the first authentication information is used by the network device to decrypt the first authentication information by using its own second key to obtain second authentication information; judging whether a first terminal among the terminals belongs to a first group based on the second authentication information; the first group is any group of at least one group established based on the identity information of the terminal; In a case where the first terminal belongs to the first group, receiving a second message sent by the network device; the second message includes a third secret key; The third secret key is used to establish a secret key session between the first terminal and other terminals in the first group.

6. The method according to claim 5, characterized in that The terminal at least includes a terminal corresponding to an administrator, and the method further includes: Sending a third message to the network device; the third message at least includes third authentication information encrypted using a fourth key; the fourth key is the key of the terminal corresponding to the administrator; the third authentication information is used by the network device to decrypt using the second key to obtain fourth authentication information; verifying the identity information of the terminal corresponding to the administrator based on the fourth authentication information; generating the third key after the identity information of the terminal corresponding to the administrator is successfully verified; Receive the third secret key sent by the network device.

7. The method according to claim 6, characterized in that The terminal includes at least a second terminal; the second terminal is other terminals in the first group except the terminal corresponding to the administrator; the method further includes: Sending a fourth message to the network device; the fourth message at least includes identification information of the second terminal; the fourth message is used by the network device to decrypt using the second secret key to obtain fifth authentication information; based on the fifth authentication information, determining whether the terminal corresponding to the administrator applies for the third secret key; In a case where the terminal corresponding to the administrator has applied for the third key, the third key sent by the network device is received.

8. A secure communication device, arranged on a network device, comprising: A first establishing unit, configured to establish at least one group based on the identity information of each terminal after at least one terminal is successfully registered; A first receiving unit, configured to receive a first message sent by a first terminal among the at least one terminal; the first message at least includes first authentication information encrypted using a first secret key; The first secret key is generated based on the role of each of the terminals; A first decryption unit, configured to decrypt the first authentication information using its own second secret key to obtain second authentication information; A first determination unit, configured to determine whether the first terminal belongs to a first group based on the second authentication information; the first group is any group of the at least one group; The first sending unit is used to send a second message to the first terminal when the first terminal belongs to the first group; the second message includes a third key; the third key is used for the first terminal to conduct a key session with other terminals in the first group.

9. A secure communication device, arranged on a terminal, comprising: A second sending unit, configured to send a first message to the network device; The first message includes at least first authentication information encrypted using a first secret key; The first secret key is generated based on the role of the terminal; the first authentication information is used by the network device to decrypt the first authentication information using its own second secret key to obtain second authentication information; Determine whether a first terminal among the terminals belongs to a first group based on the second authentication information; the first group is any group among at least one group established based on the identity information of the terminal; A second receiving unit, configured to receive a second message sent by the network device when the first terminal belongs to the first group; The second message includes a third secret key; The second establishing unit uses the third secret key to establish a secret key session between the first terminal and other terminals in the first group.

10. A network device, characterized in that: include: a first communication interface and a first processor; The first communication interface is used to establish at least one group based on the identity information of each terminal after at least one terminal is successfully registered; receive a first message sent by a first terminal among the at least one terminal; the first message at least includes first authentication information encrypted using a first secret key; The first secret key is generated based on the role of each of the terminals; The first processor is configured to decrypt the first authentication information using its own second secret key to obtain second authentication information; Determine whether the first terminal belongs to a first group based on the second authentication information; the first group is any group in the at least one group; The first communication interface is further used to send a second message to the first terminal when the first terminal belongs to the first group; the second message includes a third key; and the third key is used for the first terminal to conduct a key conversation with other terminals in the first group.

11. A terminal, characterized in that: include: a second communication interface and a second processor; The second communication interface is used to send a first message to the network device; the first message at least includes first authentication information encrypted using a first key; The first secret key is generated based on the role of the terminal; the first authentication information is used by the network device to decrypt the first authentication information using its own second secret key to obtain second authentication information; Determine whether a first terminal among the terminals belongs to a first group based on the second authentication information; the first group is any group among at least one group established based on the identity information of the terminal; and receiving a third secret key sent by the network device when the first terminal belongs to the first group; The second processor is configured to use the third secret key to establish a secret key session between the first terminal and other terminals in the first group.

12. A network device, characterized in that: include: a first processor and a first memory for storing a computer program executable on the processor, Wherein, when the first processor is used to run the computer program, the steps of the method described in any one of claims 1 to 4 are executed.

13. A terminal, characterized in that: include: a second processor and a second memory for storing a computer program executable on the processor, Wherein, when the second processor is used to run the computer program, the steps of the method described in any one of claims 5 to 7 are executed.

14. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the computer program implements the steps of the method according to any one of claims 1 to 4, or implements the steps of the method according to any one of claims 5 to 7.

Images