Information processing method and device, user terminal and storage medium

Abstract

The embodiment of the invention is applicable to the technical field of information processing, and provides an information processing method and device, a terminal and a storage medium, and the information processing method comprises the steps: determining an encryption key corresponding to the operation type of an operation if the operation triggered by a first user for communicating with opposite-end equipment is detected; encrypting authentication information generated by the user terminal based on the operation based on an encryption key to obtain a first ciphertext; generating a communication request based on the first ciphertext, wherein the communication request comprises an identifier of the operation type; and sending the communication request to the opposite terminal equipment. According to the embodiment of the invention, the security of each communication process is enhanced, and safer communication information transmission can be realized.

Description

Technical Field

[0001] The present invention relates to the field of information processing technology, and in particular to an information processing method, device, user terminal and storage medium. Background Art

[0002] Currently, communication software uses plain text transmission or simple encryption methods to encrypt and transmit information. The communication security is low and it is easy to cause user information leakage. Summary of the invention

[0003] In order to solve the above problems, the embodiments of the present invention provide an information processing method, device, user terminal and storage medium to at least solve the problem of low communication security of communication software in the related art.

[0004] The technical solution of the present invention is achieved in this way:

[0005] On the one hand, an embodiment of the present invention provides an information processing method for a user terminal, the method comprising:

[0006] If an operation of communicating with a peer device triggered by the first user is detected, determining an encryption key corresponding to an operation type of the operation;

[0007] Encrypting the authentication information generated by the user terminal based on the operation based on the encryption key to obtain a first ciphertext;

[0008] generating a communication request based on the first ciphertext, wherein the communication request includes an identifier of the operation type;

[0009] The communication request is sent to the opposite device.

[0010] In the above scheme, if the operation type is user registration, the peer device is a key server, and the encryption key corresponding to the operation type is the public key of the key server;

[0011] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes:

[0012] Encrypting the password of the first user based on a hash function to generate a shared key between the first user and the communication server;

[0013] The authentication information is encrypted based on the public key of the key server; the authentication information includes the user name of the first user, the shared key, the first temporary session key generated by the user terminal and the key server, the first sending time of the communication request and the first random number generated by the user terminal; the user terminal inserts a newly generated random number in each communication request generated, and the peer device includes a random number sequence for storing the random number in the communication request.

[0014] In the above solution, the method further includes:

[0015] receiving a response message sent by the key server based on the communication request, the response message including a second ciphertext encrypted based on the first temporary session key, the second ciphertext including a second sending time of the response message and first verification information encrypted by hash; the first verification information including a user name of the first user, a first sending time, and a first random number obtained by decrypting the first ciphertext by the key server;

[0016] decrypting the second ciphertext based on the first temporary session key;

[0017] Determine whether the difference between the current time and the second sending time is less than or equal to a set value;

[0018] If the difference is less than or equal to the set value, performing consistency verification on the first verification information;

[0019] If the consistency verification is successful, it is determined that the first user has been successfully registered.

[0020] In the above scheme, if the operation type is user login, the peer device is the key server, and the encryption key corresponding to the operation type is the shared key;

[0021] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes:

[0022] The authentication information is encrypted based on the shared key; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request; and the communication request includes the first ciphertext and a user name of the first user.

[0023] In the above solution, the method further includes:

[0024] Receive response information sent by the key server based on the communication request, the response information including a third ciphertext encrypted based on the shared key, the third ciphertext including a fourth sending time of the response information, second verification information encrypted by hash, a second temporary session key between the user terminal and the communication server generated by the key server, and a ticket for the first user to access the communication server generated by the key server; the second verification information includes a user name of the first user obtained by decrypting the first ciphertext by the key server, a second random number, and a third sending time; the ticket includes the second temporary session key, an identity identifier of the communication server, and a user name of the first user;

[0025] decrypting the third ciphertext based on the shared key;

[0026] Determine whether the difference between the current time and the fourth sending time is less than or equal to the set value;

[0027] If the difference is less than or equal to the set value, performing consistency verification on the second verification information;

[0028] If the consistency verification is successful, it is determined that the user has logged in successfully, and the ticket and the second temporary session key are saved.

[0029] In the above solution, if the operation type is to establish a connection, the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0030] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes:

[0031] The authentication information is encrypted based on the second temporary session key; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request; and the communication request includes the first ciphertext and the ticket.

[0032] In the above solution, the method further includes:

[0033] receiving response information sent by the key server based on the communication request, the response information including a fourth ciphertext encrypted based on the second temporary session key, the fourth ciphertext including third verification information encrypted by hash and a sixth sending time of the response information; the third verification information including a third random number and a fifth sending time obtained by the communication server decrypting the first ciphertext, and a user name of the first user obtained based on the ticket;

[0034] decrypting the fourth ciphertext based on the second temporary session key;

[0035] Determine whether the difference between the current time and the sixth sending time is less than or equal to the set value;

[0036] If the difference is less than or equal to the set value, performing consistency verification on the third verification information;

[0037] If the consistency verification is successful, it is determined that the connection between the user terminal and the communication server is successfully established.

[0038] In the above scheme, if the operation type is sending a session message, the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0039] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes:

[0040] The authentication information is encrypted based on the second temporary session key; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal, the seventh sending time of the communication request and the first hash value; the first hash value is obtained by hash calculation based on the user name of the first user, the identity identifier of the communication server and the user identifier of the target user; the communication request includes the first ciphertext and the user name of the first user.

[0041] In the above solution, if the target user of the session information is the second user, the method further includes:

[0042] The user terminal of the second user receives the response information sent by the communication server based on the communication request of the first user; the response information includes the user name of the first user and the fifth ciphertext encrypted based on the second temporary session key of the first user, the fifth ciphertext includes the seventh sending time of the communication request of the first user, the eighth sending time of the response information, the first session information input by the first user and the second hash value; the second hash value is obtained by hashing the user name of the first user, the user name of the second user and the seventh sending time;

[0043] decrypting the fifth ciphertext based on the second temporary session key;

[0044] Determine whether the difference between the current time and the eighth sending time is less than or equal to the set value;

[0045] If the difference is less than or equal to the set value, performing consistency verification on the second Hash value;

[0046] If the consistency verification passes, the first session information is displayed in a dialog box between the first user and the second user.

[0047] In the above solution, if the target user of the session information is a user group, the user group includes the second user, and the user name of the target user is the identity identifier of the user group, the method further includes:

[0048] The user terminal of the second user receives the response information sent by the communication server based on the communication request of the first user; the response information includes the identity of the user group, the user name of the first user and the sixth ciphertext encrypted based on the second temporary session key corresponding to the second user; the sixth ciphertext includes the seventh sending time generated by the user terminal of the first user, the eighth sending time of the response information, the first session information input by the first user and the third hash value; the third hash value is obtained by hashing based on the identity of the user group, the user name of the first user and the seventh sending time;

[0049] decrypting the sixth ciphertext based on the second temporary session key;

[0050] Determine whether the difference between the current time and the eighth sending time is less than or equal to the set value;

[0051] If the difference is less than or equal to the set value, performing consistency verification on the third Hash value;

[0052] If the consistency verification passes, the first session information of the first user is displayed in the dialog box of the user group.

[0053] In the above scheme, if the operation type is to obtain chat records, the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0054] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes:

[0055] The authentication information is encrypted based on the second temporary session key; the authentication information includes the time period of the chat record between the first user and the second user, the user name of the second user, the fifth random number generated by the user terminal, the ninth sending time of the communication request and the fourth hash value, and the fourth hash value is obtained by hash calculation based on the user name of the first user, the user name of the second user and the identity of the communication server; the communication request includes the user name of the first user and the first ciphertext.

[0056] In the above solution, the method further includes:

[0057] receiving response information sent by the communication server based on the communication request, the response information including a seventh ciphertext encrypted based on the second temporary session key, the seventh ciphertext including a third session information between the first user and the second user within the time period queried by the communication server, a user name of the second user, a tenth sending time of the third session information, an eleventh sending information of the response information, and a fifth hash value; the fifth hash value is obtained by hashing the user name of the second user decrypted by the communication server, a fifth random number, the ninth sending time, and the user name of the first user;

[0058] decrypting the seventh ciphertext based on the second temporary session key;

[0059] Determine whether the difference between the current time and the eleventh sending time is less than or equal to the set value;

[0060] If the difference is less than or equal to the set value, performing consistency verification on the fifth Hash value;

[0061] If the consistency verification passes, the third session information is displayed in a dialog box between the first user and the second user.

[0062] In the above scheme, if the operation type is password update, the peer device is the key server, and the encryption key corresponding to the operation type is the shared key;

[0063] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes:

[0064] The authentication information is encrypted based on the shared key; the authentication information includes a new shared key obtained by hashing the new password of the first user, the user name of the first user, the twelfth sending time of the communication request and the sixth random number generated by the user terminal; the communication request includes the first ciphertext and the user name of the first user.

[0065] In the above solution, the method further includes:

[0066] receiving response information sent by the key server based on the communication request, the response information including an eighth ciphertext encrypted based on the new shared key, the eighth ciphertext including a thirteenth sending time and a sixth hash value of the response information; the sixth hash value is obtained by hashing the user name of the first user decrypted by the key server, the twelfth sending time and the sixth random number;

[0067] decrypting the eighth ciphertext based on the new shared key;

[0068] Determine whether the difference between the current time and the thirteenth sending time is less than or equal to the set value;

[0069] If the difference is less than or equal to the set value, performing consistency verification on the sixth Hash value;

[0070] If the consistency verification passes, it is determined that the password of the first user is updated successfully.

[0071] On the other hand, an embodiment of the present invention further provides an information processing method, which is applied to a key server, and the method includes:

[0072] Receiving a communication request sent by a user terminal; the communication request includes a first ciphertext and an identifier of an operation type, the first ciphertext includes authentication information generated by the user terminal based on an operation of the first user, and the first ciphertext is obtained by encrypting the authentication information based on an encryption key corresponding to the operation type of the operation;

[0073] Determine a decryption key corresponding to the operation type based on the identifier;

[0074] decrypting the first ciphertext based on the decryption key corresponding to the operation type to obtain the authentication information;

[0075] Determining whether a replay attack exists based on the authentication information;

[0076] If there is no replay attack, response information is generated based on the authentication information and sent to the user terminal.

[0077] In the above scheme, if the operation type is user registration, the decryption key corresponding to the operation type is the private key of the key server;

[0078] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0079] Decrypting the first ciphertext based on the private key to obtain the authentication information; the authentication information includes the user name of the first user, the shared key between the first user and the communication server, the first temporary session key generated by the user terminal and the key server, the first sending time of the communication request and a first random number; the shared key represents the password of the first user encrypted by a hash function;

[0080] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0081] Determine whether the difference between the current time and the first sending time is less than or equal to a set value;

[0082] If the difference is less than or equal to the set value, querying whether the time period corresponding to the difference includes the first random number in the first random number sequence corresponding to the key server; the first random number sequence stores the random numbers received by the key server;

[0083] If the first random number is not included, it is determined that there is no replay attack;

[0084] Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes:

[0085] Perform hash encryption based on the first user's username, first sending time, and first random number obtained by decryption to generate first verification information;

[0086] Encrypting the first verification information and the second sending time based on the first temporary session key to obtain a second ciphertext; the second sending time represents the sending time of the response information;

[0087] Response information is generated based on the second ciphertext and sent to the user terminal of the first user.

[0088] In the above scheme, if there is no replay attack, the method further includes:

[0089] Encrypt the shared key based on a first preset key to obtain a first encryption key;

[0090] The user name of the first user and the first encryption key are stored in a local database in correspondence.

[0091] In the above scheme, if the operation type is user login, the decryption key corresponding to the operation type is the shared key; the communication request includes the first ciphertext and the username of the first user;

[0092] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0093] Determining the first encryption key corresponding to the username of the first user;

[0094] Decrypting the first encryption key based on the first preset key to obtain the shared key;

[0095] decrypting the first ciphertext based on the shared key to obtain the authentication information; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request;

[0096] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0097] Determine whether the difference between the current time and the third sending time is less than or equal to the set value;

[0098] If the difference is less than or equal to the set value, querying in the first random number sequence corresponding to the key server whether the time period corresponding to the difference includes the second random number;

[0099] If the second random number is not included, it is determined that there is no replay attack;

[0100] Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes:

[0101] generating a second temporary session key between the user terminal and the communication server;

[0102] Perform hash encryption based on the first user's username, the second random number, and the third sending time obtained by decryption to obtain second verification information;

[0103] generating a ticket for the first user to access the communication server based on the second temporary session key, the identity of the communication server and the user name of the first user;

[0104] Encrypting the ticket, the second verification information, the second temporary session key and the fourth sending time based on the shared key to obtain a third ciphertext; the fourth sending time represents the sending time of the response information;

[0105] Response information is generated based on the third ciphertext and sent to the user terminal of the first user.

[0106] In the above scheme, if the operation type is password update, the decryption key corresponding to the operation type is the shared key, and the communication request includes the first ciphertext and the user name of the first user;

[0107] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0108] querying the shared key based on the username of the first user;

[0109] decrypting the first ciphertext based on the shared key to obtain the authentication information; the authentication information includes a new shared key obtained by the user terminal by hashing the new password of the first user, the user name of the first user, the twelfth sending time of the communication request and the sixth random number;

[0110] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0111] Determine whether the difference between the current time and the twelfth sending time is less than or equal to the set value;

[0112] If the difference is less than or equal to the set value, querying in the random number sequence corresponding to the key server whether the time period corresponding to the difference includes the sixth random number;

[0113] If the sixth random number is not included, it is determined that there is no replay attack;

[0114] Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes:

[0115] Perform hash encryption based on the decrypted user name of the first user, the twelfth sending time, and the sixth random number to obtain a sixth hash value;

[0116] Encrypting the sixth hash value and the thirteenth sending time based on the new shared key to obtain an eighth ciphertext; the thirteenth sending time represents the sending time of the response information;

[0117] Response information is generated based on the eighth ciphertext and sent to the user terminal of the first user.

[0118] In the above solution, the method further includes:

[0119] receiving a registration request sent by the communication server; the registration request comprising a ninth ciphertext, the ninth ciphertext being obtained by encrypting a third temporary session key based on the public key of the key server, a seventh random number generated by the communication server, an identity of the communication server, and a fourteenth sending time; the third temporary session key being a temporary session key generated by the communication server for communicating with the key server; the fourteenth sending time representing a sending time of the registration request;

[0120] Decrypting the ninth ciphertext based on the private key corresponding to the public key;

[0121] Based on the seventh random number and the fourteenth sending time, determining whether the registration request has been subjected to a replay attack;

[0122] If there is no replay attack, generating a shared symmetric key and an eighth random number for communicating with the communication server;

[0123] Encrypting the shared symmetric key, the eighth random number, the fifteenth sending time and the fourth verification information based on the third temporary session key to obtain a tenth ciphertext; the fourth verification information is obtained by performing hash encryption based on the eighth random number, the fifteenth sending time, the seventh random number and the identity of the communication server; the fifteenth sending time represents the sending time of the tenth ciphertext;

[0124] The tenth ciphertext is sent to the communication server.

[0125] In the above solution, the method further includes:

[0126] Encrypting the shared symmetric key based on the first preset key to obtain a second encryption key;

[0127] The identity identifier of the communication server and the second encryption key are stored in a local database correspondingly.

[0128] On the other hand, an embodiment of the present invention further provides an information processing method, which is applied to a communication server, and the method includes:

[0129] Receiving a communication request sent by a user terminal; the communication request includes a first ciphertext and an identifier of an operation type, the first ciphertext includes authentication information generated by the user terminal based on an operation of the first user, and the first ciphertext is obtained by encrypting the authentication information based on an encryption key corresponding to the operation type of the operation;

[0130] Determine a decryption key corresponding to the operation type based on the identifier;

[0131] decrypting the first ciphertext based on the decryption key corresponding to the operation type to obtain the authentication information;

[0132] Determining whether a replay attack exists based on the authentication information;

[0133] If there is no replay attack, response information is generated based on the authentication information and sent to the user terminal.

[0134] In the above solution, the method further includes:

[0135] generating a third temporary session key for communicating with the key server;

[0136] Sending the registration request to the key server; the registration request includes a ninth ciphertext encrypted based on the public key of the key server, the ninth ciphertext includes the third temporary session key, the seventh random number generated by the communication server, the identity of the communication server and a fourteenth sending time; the fourteenth sending time represents the sending time of the registration request;

[0137] receiving a tenth ciphertext sent by the key server based on the registration request; the tenth ciphertext includes a shared symmetric key generated by the key server for communicating with the communication server, an eighth random number generated by the key server, a fifteenth sending time, and fourth verification information; the tenth ciphertext is encrypted based on the third temporary session key, the fifteenth sending time represents the sending time of the tenth ciphertext, and the fourth verification information is obtained by performing hash encryption based on the eighth random number, the fifteenth sending time, the seventh random number, and the identity of the communication server;

[0138] decrypting the tenth ciphertext based on the third temporary session key to obtain the shared symmetric key, the eighth random number, the fifteenth sending time and the fourth verification information;

[0139] Based on the eighth random number and the fifteenth sending time, determining whether the tenth ciphertext is under a replay attack; the communication server includes a second random number sequence for storing random numbers;

[0140] If there is no replay attack, performing consistency verification on the fourth verification information;

[0141] If the consistency verification passes, encrypting the shared symmetric key based on the second preset key of the communication server to obtain a third encryption key;

[0142] The third encryption key is stored in a local database.

[0143] In the above scheme, if the operation type is to establish a connection, the decryption key corresponding to the operation type is a second temporary session key generated by the key server for the communication between the user terminal and the communication server; the communication request includes the first ciphertext and a ticket for the first user to access the communication server; the ticket includes the second temporary session key, the identity of the communication server and the user name of the first user;

[0144] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0145] determining the second temporary session key based on the ticket;

[0146] decrypting the first ciphertext based on the second temporary session key to obtain the authentication information; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request;

[0147] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0148] Determine whether the difference between the current time and the fifth sending time is less than or equal to the set value;

[0149] If the difference is less than or equal to the set value, querying in the second random number sequence corresponding to the communication server whether the time period corresponding to the difference includes the third random number;

[0150] If the third random number is not included, it is determined that there is no replay attack;

[0151] Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes:

[0152] Perform hash encryption based on the third random number obtained by decryption, the fifth sending time, and the user name of the first user to obtain third verification information;

[0153] Encrypting the third verification information and the sixth sending time based on the second temporary session key to obtain a fourth ciphertext; the sixth sending time represents the sending time of the response information;

[0154] Response information is generated based on the fourth ciphertext and sent to the user terminal of the first user.

[0155] In the above scheme, if the operation type is sending a session message, the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the user name of the first user;

[0156] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0157] querying the second temporary session key based on the username of the first user;

[0158] The first ciphertext is decrypted based on the second temporary session key to obtain the authentication information; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal and the seventh sending time of the communication request, and a first hash value obtained by hashing the user name of the first user, the identity identifier of the communication server and the user identifier of the target user.

[0159] In the above solution, if the target user of the session information is the second user, the generating of the response information sent to the user terminal based on the authentication information includes:

[0160] Perform hash encryption based on the user name of the first user, the user name of the second user, and the seventh sending time to obtain a second hash value;

[0161] Encrypting the second hash value, the first session information input by the first user, the seventh sending time and the eighth sending time based on the second temporary session key to obtain the fifth ciphertext; the eighth sending time represents the sending time of the response information;

[0162] Based on the fifth ciphertext and the user name of the first user, response information is generated and sent to the user terminal of the second user.

[0163] In the above solution, if the target user of the session information is a user group, the user group includes a second user, and the user name of the target user is the identity identifier of the user group, the generating of the response information sent to the user terminal based on the authentication information includes:

[0164] Performing hash encryption based on the user name of the first user, the identity identifier of the user group, and the seventh sending time to obtain a third hash value;

[0165] Encrypt the third Hash value, the first session information, the seventh sending time, and the eighth sending time based on the second temporary session key of the second user to obtain the sixth ciphertext;

[0166] Based on the sixth ciphertext, the user name of the first user and the identity identifier of the user group, response information is generated and sent to the user terminal of the second user.

[0167] In the above scheme, if the operation type is to obtain chat records, the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the username of the first user;

[0168] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0169] querying the second temporary session key based on the username of the first user;

[0170] decrypting the first ciphertext based on the second temporary session key to obtain the authentication information; the authentication information includes a time period of the chat record between the first user and the second user, a user name of the second user, a fifth random number generated by the user terminal, a ninth sending time of the communication request, and a fourth hash value; the fourth hash value is obtained by performing a hash calculation based on the user name of the first user, the user name of the second user, and an identity identifier of the communication server;

[0171] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0172] Determine whether the difference between the current time and the ninth sending time is less than or equal to the set value;

[0173] If the difference is less than or equal to the set value, querying in the random number sequence corresponding to the key server whether the time period corresponding to the difference includes the fifth random number;

[0174] If the fifth random number is not included, it is determined that there is no replay attack;

[0175] Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes:

[0176] Based on the user name of the first user, the user name of the second user, and the time period, querying third session information between the first user and the second user within the time period;

[0177] Performing hash encryption on the user name of the first user, the decrypted user name of the second user, the fifth random number, and the ninth sending time to obtain the fifth hash value;

[0178] Encrypt the third session information, the fifth Hash value, the user name of the second user, the tenth sending time of the third session information, and the eleventh sending information based on the second temporary session key to obtain a seventh ciphertext; the eleventh sending information represents the sending time of the response information;

[0179] Response information is generated based on the seventh ciphertext and sent to the user terminal of the first user.

[0180] On the other hand, an embodiment of the present invention provides an information processing device, the device comprising:

[0181] A first determination module is used to determine an encryption key corresponding to an operation type of the operation if an operation of communicating with a peer device triggered by a first user is detected;

[0182] A first encryption module, used to encrypt the authentication information generated by the user terminal based on the operation based on the encryption key to obtain a first ciphertext;

[0183] A first generating module, configured to generate a communication request based on the first ciphertext, wherein the communication request includes an identifier of the operation type;

[0184] The sending module is used to send the communication request to the opposite device.

[0185] On the other hand, an embodiment of the present invention further provides an information processing device, the device comprising:

[0186] A first receiving module is configured to receive a communication request sent by a user terminal; the communication request includes a first ciphertext and an identification of an operation type, the first ciphertext includes authentication information generated by the user terminal based on an operation of the first user, and the first ciphertext is obtained by encrypting the authentication information based on an encryption key corresponding to the operation type of the operation;

[0187] A first determination module, configured to determine a decryption key corresponding to the operation type based on the identifier;

[0188] A first decryption module, configured to decrypt the first ciphertext based on a decryption key corresponding to the operation type to obtain the authentication information;

[0189] A second determination module, used to determine whether there is a replay attack based on the authentication information;

[0190] The second generating module is used to generate response information sent to the user terminal based on the authentication information if there is no replay attack.

[0191] On the other hand, an embodiment of the present invention further provides an information processing device, the device comprising:

[0192] A second receiving module is configured to receive a communication request sent by a user terminal; the communication request includes a first ciphertext and an identification of an operation type, the first ciphertext includes authentication information generated by the user terminal based on an operation of the first user, and the first ciphertext is obtained by encrypting the authentication information based on an encryption key corresponding to the operation type of the operation;

[0193] A third determination module, used to determine a decryption key corresponding to the operation type based on the identifier;

[0194] A second decryption module, configured to decrypt the first ciphertext based on a decryption key corresponding to the operation type to obtain the authentication information;

[0195] A fourth determination module, configured to determine whether a replay attack occurs based on the authentication information;

[0196] The third generating module is used to generate response information sent to the user terminal based on the authentication information if there is no replay attack.

[0197] On the other hand, an embodiment of the present invention provides a user terminal, including a processor and a memory, which are interconnected, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the steps of the information processing method provided by the embodiment of the present invention.

[0198] On the other hand, an embodiment of the present invention provides a communication server, including a processor and a memory, which are interconnected, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the steps of the information processing method provided by the embodiment of the present invention.

[0199] On the other hand, an embodiment of the present invention provides a key server, including a processor and a memory, which are interconnected, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the steps of the information processing method provided by the embodiment of the present invention.

[0200] On the other hand, an embodiment of the present invention provides a computer-readable storage medium, including: the computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the steps of the information processing method provided by the embodiment of the present invention are implemented.

[0201] If the user terminal of the embodiment of the present invention detects an operation of communicating with the peer device triggered by the first user, it determines the key corresponding to the operation type of the operation, encrypts the authentication information generated by the user terminal based on the user operation based on the encryption key corresponding to the operation type, and obtains the first ciphertext. A communication request is generated based on the first ciphertext, and the communication request is sent to the peer device. This embodiment obtains the encryption key based on the operation type of the first user. The encryption key is not fixed, and it is difficult for hackers to know the user's operation type. It is difficult for hackers to crack the communication request through a fixed key, which strengthens the security of each communication process and can achieve more secure communication information transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0202] Figure 1 is a schematic diagram of a communication model provided by an embodiment of the present invention;

[0203] Figure 2 is a schematic diagram of an IM server registration process provided by an embodiment of the present invention;

[0204] Figure 3 is a schematic diagram of a user registration process provided by an embodiment of the present invention;

[0205] Figure 4 is a schematic diagram of a user login process provided by an embodiment of the present invention;

[0206] Figure 5 is a schematic diagram of a process for establishing a long connection provided by an embodiment of the present invention;

[0207] Figure 6 is a schematic diagram of a single chat session process provided by an embodiment of the present invention;

[0208] Figure 7 is a schematic diagram of a group chat session process provided by an embodiment of the present invention;

[0209] Figure 8 It is a schematic diagram of a process of pulling chat records from a server provided by an embodiment of the present invention;

[0210] Fig. 9 It is a schematic diagram of a user password update process provided by an embodiment of the present invention;

[0211] Fig.10 It is a schematic diagram of an implementation flow of an information processing method provided by an embodiment of the present invention;

[0212] Fig.11 It is a schematic diagram of an implementation flow of another information processing method provided by an embodiment of the present invention;

[0213] Fig.12 It is a schematic diagram of an implementation flow of another information processing method provided by an embodiment of the present invention;

[0214] Fig.13 is a schematic diagram of an information processing device provided by an embodiment of the present invention;

[0215] Fig.14 is a schematic diagram of another information processing device provided by an embodiment of the present invention;

[0216] Fig.15 is a schematic diagram of another information processing device provided by an embodiment of the present invention;

[0217] Fig.16 is a schematic diagram of a user terminal provided by an embodiment of the present invention;

[0218] Fig.17 is a schematic diagram of a key server provided by an embodiment of the present invention;

[0219] Fig.18 It is a schematic diagram of a communication server provided in one embodiment of the present invention. DETAILED DESCRIPTION

[0220] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0221] With the continuous development of the Internet, instant messaging software has become extremely popular, and people use various instant messaging software almost every day. The industry has shown great interest in instant messaging and regards it as one of the core areas of competition in the current mobile Internet industry.

[0222] However, the instant messaging software in the related art has the following security issues:

[0223] (1) Information is transmitted in plain text or in a simple encryption manner, and the communication relies solely on common network security protocols without achieving end-to-end encryption of the communication content;

[0224] (2) Lack of secure key management, critical keys are stored in plain text, and there is a lack of multi-level encryption of keys;

[0225] (3) The server does not encrypt and store communication messages. Once the server is hacked, it is easy to cause user information leakage;

[0226] (4) During identity authentication, the client transmits the password hash value to the server for comparison, which can easily lead to password leakage and spoofing replay attacks;

[0227] (5) Lack of means to prevent replay attacks, which can easily lead to man-in-the-middle attacks.

[0228] Therefore, in today's world where data security is of great concern, how to ensure end-to-end encryption of information in instant messaging, secure management of keys, secure and efficient identity authentication, anti-replay attack, and secure storage of instant messaging information are issues with high research value.

[0229] In view of the shortcomings of the above-mentioned related technologies, an embodiment of the present invention provides an information processing method, which can enhance the security of communication and realize safer communication information transmission. In order to illustrate the technical solution of the present invention, a specific embodiment is used for description below.

[0230] Figure 1 It is a schematic diagram of a communication model provided by an embodiment of the present invention, which communication model includes a mobile communication (Radio Communication, RC) authentication center, a communication (IM, Instant Messaging) server and a client (the example includes client A and client B, and is not limited to the number of clients).

[0231] Among them, the RC authentication center is responsible for identity authentication, distribution and management of session keys and tickets (IM Token). The client accesses the IM server through the ticket and sends encrypted instant messages to the IM server. The IM server encrypts and stores the received instant messages and pushes them to the receiving end in an encrypted manner.

[0232] First, initialize the RC authentication center and IM server.

[0233] 1. RC key initialization

[0234] RC certification center initializes the master key P rc , generate the encryption key (password) key K rc_enkey , generate RC's public key K rc_pub and the corresponding private key K rc_priv , where K rc_enkey and K rc_priv Use P rc Encrypted and stored on the RC server, K rc_pub Announced to the entire network. Master key P rc Stored in a specific secure storage device (such as a USBKEY with a PIN code), when the system starts, K rc_enkey and K rc_priv Enter the memory for easy program access.

[0235] 2. IM server key initialization

[0236] IM Server im Initialize the system master key P im , generate the encryption key (password) key K im_enkey and the encryption key K for storing instant message data im_enmsg . Where K im_enkey Use P im Encrypted and stored on the IM server, K im_enmsg Use K im_enkey Encrypted and stored on the IM server. Master key P im Stored in a specific secure storage device (such as a USBKEY with a PIN code), when the system starts, K im_enkey and K im_enmsg Enter the memory for quick access by the program.

[0237] 3. Random number sequence initialization

[0238] RC and S im Each has its own random number sequence N array (N rc_array and N im_array ), they will receive a random number N each time c Deposit N array , and regularly clear N array The random numbers whose storage time exceeds ΔT are stored in , where ΔT is the minimum system delay.

[0239] 4. Anti-replay attack function

[0240] Replay attacks, also known as replay attacks or playback attacks, refer to an attacker sending a packet that has already been received by the destination host to deceive the system. It is mainly used in the identity authentication process to undermine the correctness of the authentication. Replay attacks can be carried out by the initiator or by the enemy who intercepts and resends the data.

[0241] To prevent the server from being attacked by replay, the system introduces an anti-replay attack function f(T b ,T c ,ΔT,N c ,N array ), where T b is the message sending time, T c is the message arrival time, ΔT is the minimum system delay, N c N is the random number received by the server from the sender. array is the random number sequence of the server. The function first calculates T c -T b ? ≤ΔT, if it fails, it returns false; if it passes, the server will array Check whether N exists within ΔT time. c If it exists, it returns false and the verification fails; otherwise it returns true and the verification passes.

[0242] This embodiment implements the instant communication process from key management, registration, login authentication, key negotiation, connection establishment, secure instant session, session communication record pulling, password update, key update, etc., to achieve more secure, efficient and convenient instant communication.

[0243] 1. Registration Phase

[0244] 1.1, IM server registration:

[0245] refer to Figure 2 , the IM server registration process includes:

[0246] (1) IM Server S im When joining a communication network, you first need to register. im Generate a temporary symmetric session key KS rc,im and random number N1, using K pub Perform encryption calculations:

[0247] A im =E(K pub ,[SID im ,KS rc,im ,T1,N1])

[0248] Among them, SID im YesS imunique identity, T1 is the current sending time, h(·) is the hash function, and A im Send to RC.

[0249] (2) RC receives A im Afterwards, through K priv Decryption A im , get the SID im ,KS rc,im ,T1,N1, first query SID im Is it already registered? If not, call the anti-replay attack function f(T1,T c ,ΔT,N1,N rc_array ), if it returns false, the conversation ends. Otherwise, RC writes N1 to N rc_array and generate the same im The shared symmetric key K rc,im and a random number N2, then calculate:

[0250] HRA im =h(SID im ||T2||N1||N2)

[0251] RA im =E(KS rc,im ,[HRA im ,K rc,im ,T2,N2])

[0252] Among them, || is a cascade operation, E(K,[m]) is the encryption function, the key is K, and the plaintext is m.

[0253] RA im Send to S im , where T2 is the current sending time. Then calculate and will Store in the database and publish S im SID im .

[0254] (3)S im RA received im Then, use KS rc,im Decrypting RA im , get HRA im ,K rc,im ,T2,N2, and then call the anti-replay attack function f(T2,T c ,ΔT,N2,N im_array ), if it returns false, the conversation ends. Otherwise, calculate judge If equal, S im Write N2 to N im_arrayThen calculate and will Store it in the database and K rc,im Write to memory for quick access by programs (K im_enkey Decryption Get K rc,im , written into memory). In this way, RC and S im The session key K is shared between rc,im , used for encrypted communications.

[0255] 1.2, User Registration:

[0256] refer to Figure 3 , the user registration process includes:

[0257] (1) User U a On the client side C a (Mobile or PC) Enter your login ID a and password PW a Submit registration, C a Generate a temporary session key K c,rc_t , and calculate:

[0258] K a =h(PW a )

[0259] A a =E(K pub ,[ID a ,K a ,K c,rc_t ,T3,N3])

[0260] Where T3 is the current sending time, N3 is a random number, C a K a Store it in memory and write A a Send to RC.

[0261] (2) After receiving RC, through K priv Decryption A a , get the ID a ,K a ,K c,rc_t ,T3,N3, first query ID a Is it registered? If not, call the anti-replay attack function f(T3,T c ,ΔT,N3,N rc_array ), if it returns false, the conversation ends. Otherwise, RC writes N3 to N rc_array and calculate Will It exists in the RC database. Then RC calculates:

[0262] HRA a =h(ID a ||T3||N3)

[0263] RA a =E(K c,rc_t ,[HRA a ,T4])

[0264] RA a Send to C a , where T4 is the current sending time.

[0265] (3)C a RA received a Then, use K c,rc_t Decrypting RA a , get HRA a ,T4, and then use the current time T c , calculate T c -T4? ≤ΔT, if not, end the conversation. Otherwise, calculate judge If they are equal, prompt the user U a Registration is successful, so U a The key K is actually shared between RC a .

[0266] 2. Landing Stage

[0267] refer to Figure 4 , the user login process includes:

[0268] (1) User U a On the client side C a Enter your login ID a and password PW a Submit login, C a calculate:

[0269] K a =h(PW a )

[0270] L a =E(K a ,[T5,N4])

[0271] Among them, T5 is the current sending time, N4 is the newly generated random number, and then {ID a , L a}Sent to RC.

[0272] (2) RC receives {ID a , L a}, first pass IDa Find the corresponding Then use K rc_enkey Decryption Get K a , and then use K a Decryption L a Then call the anti-replay attack function f(T5,T c ,ΔT,N4,N rc_array ), if it returns false, the conversation ends. Otherwise, RC writes N4 to N rc_array and generate C a and S im Communication temporary session key K a,im_t , and calculate:

[0273] HRL a =h(ID a ||T5||N4)

[0274] Token a,im =E(K rc,im ,[ID a ,SID im ,K a,im_t ,T6,Lifetime])

[0275] RL a =E(K a ,[HRL a ,T6,Token a,im ,K a,im_t ])

[0276] Among them, T6 is the current sending time, Token a,im It is C a Visit S im The access ticket, Lifetime is Token a,im The validity period of the bill. RC will be RL a Return to C a , and confirm that the login is successful.

[0277] (3)C a Receive RL a Then, use K a Demystifying RL a Get HRL a ,T6,Token a,im ,K a,im_t , using the current time T c , calculate T c -T6? ≤ΔT is true, if not, then end the conversation. If the time verification passes, calculate judge If they are equal, prompt the user U a Login successful. C a Save Token a,im , and the temporary session key K a,im_t Use K a Encrypt local storage.

[0278] 3. Establishing a long connection

[0279] refer to Figure 5 , the process of establishing a long connection includes:

[0280] After logging in, the client needs to access the IM server S im , and establish a secure communication connection. Similarly, in scenarios such as 5G messaging and confidential private network communications, the client needs to establish a persistent connection with the corresponding message server.

[0281] The details are as follows:

[0282] (1) Client C a calculate:

[0283] CON a,im =E(K a,im_t ,[T7,N5])

[0284] Where T7 is the current sending time, N5 is the newly generated random number, and then {Token a,im , CON a,im}Send to S im .

[0285] (2)S im After receiving the message, first use K im_enkey Decryption Get K rc,im Then use K rc,im Decrypting the Token a,im , get the ID a ,SID im ,K a,im_t ,T6,Lifetime,Confirm SID im Correct, use K again a,im_t Decryption CON a,im Get T7 and N5. Call the anti-replay attack function f(T7, T c ,ΔT,N5,N im_array ), if it returns false, the conversation ends. Otherwise, calculate T c -T6? ≤Lifetime. If not, the conversation ends. Otherwise, it is considered that C a Token a,im Valid, legal access, S im Write N5 to Nim_array and replace {ID a , K a,im_t}The key-value pairs are written to memory for quick access, and then the calculation begins:

[0286] HRCON a,im =h(ID a ||T7||N5)

[0287] RCON a,im =E(K a,im_t ,[HRCON a,im ,T8])

[0288] Among them, T8 is the current sending time, and then S im {HRCON a,im , RCON a,im}Send to C a .

[0289] (3)C a After receiving the message, use K a,im_t Decrypting RCON a,im Get HRCON a,im ,T8, using the current time T c , calculate T c -T8? ≤ΔT is true, if not, then end the conversation. If the time verification passes, calculate judge If they are equal, prompt the user U a The long connection is established successfully. a and S im The temporary session key K is shared between a,im_t .

[0290] (4) If client C a After the process is killed or restarted, there is no need to log in to RC, only the user needs to enter the password PW a Get K a , decrypted to get K a,im_t , and through Token a,im Reconnect with S im Communication can be achieved by establishing a long connection.

[0291] (5) If client C a Token a,im Expired, the user will be prompted when establishing a long connection a Token a,im Expired, Client C a Will return to the login interface and force the user to a Re-enter the password to log in (5.3 Login Phase Process) and obtain a new Tokena,im , and update the temporary session key K a,im_t .

[0292] 4. Instant Messaging Session Phase

[0293] 4.1. Single chat session

[0294] refer to Figure 6 , the single chat session process includes:

[0295] UserU a To user U b Send an instant message a,b (5G short messages, etc.), the process is as follows:

[0296] (1)U a On the client side C a Terminal input M a,b , and click Send to U b , C a Start calculation:

[0297] HID a,im,b =h(ID a ||SID im ||ID b )

[0298] S a,im,b =E(K a,im_t ,[HID a,im,b ,ID b ,M a,b ,T9,N6])

[0299] Among them, T9 is the current sending time, N6 is the newly generated random number, and then {ID a , S a,im,b}Send to S im .

[0300] (2)S im After receiving the message, a Find K a,im_t Then use K a,im_t Decrypt S a,im,b , get HID a,b ,ID b ,M a,im,b ,T9,N6, and then call the anti-replay attack function f(T9,T c ,ΔT,N6,N im_array ), if it returns false, the conversation ends. Otherwise, S im Write N6 to N im_array and calculate judge If they are not equal, the conversation ends. Otherwise, calculate:

[0301] HID a,b =h(ID a ||ID b ||T9)

[0302] SIM a,b =E(K im_enmsg ,[HID a,b ,M a,b ])

[0303] And {ID a , ID b , T9, SIM a,b , state} is stored in the database as a chat record, where state is the current status of whether it is sent, and the default status is not sent.

[0304] Then, S im Query judgment C b Is it online (whether it is connected to S im Establish a long connection), if it is not online, do not process (or push offline notification), wait for C b Online. If C b Online, then calculate:

[0305] S b,im,a =E(K b,im_t ,[HID a,b ,M a,b ,T9,T 10 ])

[0306] Among them, K b,im_t YesS im and C b The temporary session key, T 10 is the current sending time, and then {ID a , S b,im,a}Send to C b .

[0307] (3)C b After receiving the message, use K b,im_t Decrypt S b,im,a , get the ID a ,HID a,b ,M a,b ,T9,T 10 , and then use the current time T c , calculate T c -T 10 ? ≤ΔT is true, if not, then end the conversation. If the time verification passes, then calculate judge If they are equal, then in C b Local database storage {ID a , ID b , M a,b , T9}, and on the terminal screen U b and U a The instant message is displayed in a dialog box.

[0308] 4.2 Group Chat Session

[0309] refer to Figure 7 , the group chat session process includes:

[0310] UserU a In group G a,b,c,d Send an instant message a,G , where G a,b,c,d Indicates that the member is U a , U b , U c , U d The process is as follows:

[0311] (1)U a On the client side C a End Group G a,b,c,d Enter M a,G , and click Send, C a Start calculation:

[0312] HID a,im,G =h(ID a ||SID im ||ID G )

[0313] S a,im,G =E(K a,im_t ,[HID a,im,G ,ID G ,M a,G ,T 11 ,N7])

[0314] Where T 11 is the current sending time, N7 is a newly generated random number, ID G It is group G a,b,c,d unique identifier, and then {ID a , S a,im,G}Send to S im .

[0315] (2)S im After receiving the message, a Find K a,im_t Then use K a,im_t Decrypt S a,im,G, get HID a,im,G ,ID G ,M a,G ,T 11 ,N7, and then call the anti-replay attack function f(T 11 ,T c ,ΔT,N7,N im_array ), if it returns false, the conversation ends. Otherwise, S im Write N7 to N im_array and calculate judge If they are not equal, the conversation ends. Otherwise, calculate:

[0316] HID a,G =h(ID a ||ID G ||T 11 )

[0317] SIM a,G =E(K im_enmsg ,[HID a,G ,M a,G ])

[0318] And {ID a , ID G , T 11 , SIM a,G , state} is stored in the database as a chat record, where state is the current status of whether it is sent, and the default status is not sent.

[0319] Then, S im By ID G The members of the group found are U a , U b , U c , U d , first determine C b , C c , C d Is it online (whether it is connected to S im Establish a long connection), if it is not online, do not process it (or push offline notification) and wait for it to come online. b Online, then calculate:

[0320] S b,im,a,G =E(K b,im_t ,[HID a,G ,M a,G ,T 11 ,T 12 ])

[0321] Among them, K b,im_t YesS imand C b The temporary session key, T 12 is the current sending time, and then {ID a , ID G , S b,im,a,G}Send to C b .

[0322] (3)C b After receiving the message, use K b,im_t Decrypt S b,im,a,G , get HID a,G ,M a,G ,T 11 ,T 12 , and then use the current time T c , calculate T c -T 12 ? ≤ΔT is true, if not, then end the conversation. If the time verification passes, then calculate judge If they are equal, then in C b Local database storage {ID a , ID G , M a,G , T 11}, and it will be displayed in the group message on the terminal screen. c and C d The message will be received in the same way.

[0323] 5. Pull chat history from the server

[0324] The client can synchronize historical chat records from the IM server to ensure that chat records can be presented even if the client's local messages are deleted or the client program is reinstalled. Similarly, this is also applicable in 5G messaging and confidential private network scenarios.

[0325] refer to Figure 8 , the process of pulling chat records from the server includes:

[0326] (1) Client C a With IM server S im Establish a long connection and share the temporary session key K a,im_t The specific steps are shown in Section 5.4.

[0327] (2)U a In with U b Pull down the chat interface to get new U b Chat records of client C a calculate:

[0328] HID a,im,b =h(ID a||SID im ||ID b )

[0329] RM a,im,b =E(K a,im_t ,[HID a,im,b ,ID b ,TQ,T 13 ,N8])

[0330] Where T 13 is the current sending time, N8 is the newly generated random number, TQ is the time period for which the chat records need to be obtained, and then {ID a , R.M. a,im,b}Send to S im .

[0331] (3)S im After receiving the message, a Find K a,im_t Then use K a,im_t Decrypting RM a,im,b , get HID a,im,b ,ID b ,TQ,T 13 ,N8, then call the anti-replay attack function f(T 13 ,T c ,ΔT,N8,N im_array ), if it returns false, the conversation ends. Otherwise, S im calculate judge If they are not equal, the conversation ends. Otherwise, S im Write N8 to N im_array and pass {ID a , ID b , TQ} condition, query the U in this time period a and U b Instant messaging records {ID a , ID b , T r , SIM a,b , state} (assuming there is only one record), where T r is the time when the message is sent, state is the message status, and K im_enmsg Decrypt the chat record to get the plaintext M a,b , and then start calculating:

[0332] HRID a,b =h(ID a ||ID b ||T 13 ||N8)

[0333] IMR a,b =E(K a,im_t ,[HRID a,b ,ID b ,M a,b ,T r ,TQ,T 14 ])

[0334] Among them, T 14 is the current sending time, then IMR a,b Send to C a .

[0335] (4)C a After receiving the message, use K a,im_t Decrypting IMR a,b , get HRID a,b ,ID b ,M a,b ,T r ,TQ,T 14 , and then use the current time T c , calculate T c -T 14 ? ≤ΔT is true, if not, then end the conversation. If the time verification passes, then calculate judge If they are equal, then in the storage instant messaging record {ID a , ID b , M a,b , T r}, then in C a The conversation screen is displayed.

[0336] 6. User Password Update

[0337] refer to Fig. 9 , the user password update process includes:

[0338] (1) User U a On the client side C a (Mobile or PC) Enter your login ID a 、Old password PW a and new password PW a * , and calculate:

[0339] K a =h(PW a )

[0340]

[0341]

[0342] Among them, T 15 is the current sending time, N9 is a random number, and {ID a ,UA a}Sent to RC.

[0343] (2) After receiving the RC, a Query the shared key K a , and through K a Decrypting UA a , get the ID a , T 15 ,N9, determine ID a Whether to decrypt UA a After getting the ID a If they are equal, the anti-replay attack function f(T 15 ,T c ,ΔT,N9,N rc_array ), if it returns false, the conversation ends. Otherwise, RC writes N9 to N rc_array and calculate Will Exists in RC's database, replacing the original key Then RC is calculated:

[0344] HUA a =h(ID a ||T 15 ||N9)

[0345]

[0346] Then RUA a Send to C a , where T 16 is the current sending time.

[0347] (3)C a Receive RUA a After that, use Decrypting RA a , get HUA a ,T 16 , and then use the current time T c , calculate T c -T 16 ? ≤ΔT is true, if not, then end the conversation. Otherwise calculate judge If equal, C a Will Store into memory, replace K a , and prompt the user U aThe password has been updated successfully. a The new key is also shared between RC

[0348] 7. Key Update

[0349] 7.1. Update of RC key

[0350] (1) Master Key P rc renew

[0351] P rc When updating, you need to use P rc Decrypt K rc_enkey and K rc_priv Then use the new master key Encryption K rc_enkey and K rc_priv And save, and finally Write to the secure storage device, overwriting the original P rc .

[0352] (2) Update of public-private key pair

[0353] First generate a new public-private key pair and Then use Replace the original public key K rc_pub , and publish it on the entire network; use P rc encryption Replace the original private key K rc_priv .

[0354] (3) Encryption key (password) K rc_enkey renew

[0355] First generate a new key Then use K rc_enkey Decrypt K rc,im , and then use Encryption K rc,im , and finally use Replace the original key K rc_enkey .

[0356] 7.2. IM Server Key Update

[0357] (1) Master Key P im renew

[0358] P im When updating, you need to use P im Decrypt K im_enkey Then use the new master key Encryption K im_enkey , and finally Write to the secure storage device, overwriting the original P im .

[0359] (2) Encryption key (cipher) key K im_enkey renew

[0360] First generate a new key Then use K im_enkey Decrypt K rc,im and K im_enmsg , and then use Encryption K rc,im and K im_enmsg , and finally use Replace the original key K im_enkey .

[0361] (3) The key K for encrypting instant messages im_enmsg renew

[0362] K im_enmsg The encryption key for message data is usually updated at a longer interval. First generate a new key Then the IM server starts using K im_enmsg Decrypt instant messaging records and then use Encrypt instant messaging records and then use Replace K im_enmsg , until the message re-encryption is completed.

[0363] 7.3 Shared Key K rc,im renew

[0364] First, the IM server initiates an update request, and the RC regenerates a new shared key and will By K rc,im After encryption, it is sent to the IM server (similar to the IM server registration process), and then RC uses A new Token for accessing the IM server is reissued to each client, and the client is notified to log in again to obtain a new Token; if the client uses the original Token to access the IM server, it will be prompted that the connection failed, and the client will also log in again to obtain a new Token.

[0365] In the above embodiments, symmetric encryption can adopt the SM4 national secret algorithm, and the temporary session key and shared key in the system are both symmetric encryption keys; the asymmetric algorithm can adopt the SM2 national secret algorithm, and the hash algorithm can adopt the SM3 national secret algorithm.

[0366] This embodiment is also applicable to other scenarios with message communication, such as 5G message communication, confidential private network message communication, and other situations with client and server message communication modes. At the same time, the key management, identity authentication, encryption token and other modules in this embodiment have universality and middle-end capabilities, and can be called and reused by other applications.

[0367] This embodiment has the following advantages:

[0368] 1. This embodiment realizes a complete secure instant messaging process, involving various communication nodes of instant messaging, and designs instant messaging full-process nodes such as server initialization, server registration, client registration, client login, communication long connection establishment, instant messaging single chat session, group chat session, instant messaging pull synchronization, key update, etc. Compared with the instant messaging solutions of related technologies, this embodiment not only focuses on the key security exchange and negotiation links, but also carries out a more systematic and complete security design of the entire instant messaging process.

[0369] 2. This embodiment implements end-to-end information security encryption for instant messaging, which is mainly reflected in the following aspects:

[0370] (1) IM server registration phase

[0371] IM Server im Through RC's public key K pub Encrypted authentication information A im , sent to RC, RC after verification, through the session key K rc,im Encrypted authentication information RA im Return to S im , the entire communication is achieved through secure encryption.

[0372] (2) User registration stage

[0373] Client C a Through RC's public key K pub Encrypted authentication information A a , sent to RC, RC after verification, through the temporary session key K c,rc_t Encrypted authentication information RA a Return to C a , the entire communication is achieved through secure encryption.

[0374] (3) Login stage

[0375] Client C a Through the shared key K with RC a Encrypted authentication information L a , sent to RC, RC after verification, through K a Encrypted Tokens a,im and the temporary session key K a,im_t , return to C a , the entire communication is achieved through secure encryption.

[0376] (4) The client and IM server establish a long connection

[0377] Client C a By using the temporary session key K a,im_t With S im Encrypted communication, Token a,im Also through RC and S im The shared key K rc,im Encryption, so the entire communication is achieved through secure encryption.

[0378] (5) Instant messaging session

[0379] Whether it is a single chat or a group chat session, client C a All through the IM server S im The temporary session key K a,im_t Carry out encrypted communication to ensure the encrypted transmission of the entire communication message.

[0380] (6) Pulling instant messages from the server

[0381] Client C a By connecting with S im The temporary session key K a,im_t Encrypted transmission of instant messages ensures encrypted transmission of the entire communication message.

[0382] (7) User password update phase

[0383] Client C a The session key K generated by the password a (old key) and (new key), conduct encrypted communication with RC to ensure the encrypted transmission of the entire communication message.

[0384] 3. This embodiment implements secure storage of server and client keys, as follows:

[0385] (1) Hierarchical secure storage of server-side keys

[0386] Certification Center RC and IM Server S im All of them are stored securely through a multi-level key storage solution.

[0387] First, the server master key P rc and P im They are all stored in a specific secure storage device (such as a USB KEY with a PIN code) and have high security.

[0388] Secondly, the RC private key K rc_priv , the encryption key K rc_enkey and K im_enkey All are encrypted and stored using the master key.

[0389] Finally, the other key K used to encrypt the communication data im_enmsg , K a , K rc,im etc. are all encrypted with the key K rc_enkey or K im_enkey Encrypted storage.

[0390] Hierarchical encrypted storage of keys is conducive to protecting the security of the master key. If the underlying data encryption key is cracked or leaked, you only need to directly replace the original data encryption key, which will not pose a threat to the master key or encryption key.

[0391] (2) Secure storage of client keys

[0392] On the client side C a , and the session key K of RC a It is obtained by the hash value of the password and does not need to be stored. a Encryption K a,im_t (with S im The temporary session key) is stored on the client.

[0393] The client only stores one key, which reduces the risk of system key leakage. a,im_t Leakage only affects C a With S im The security of a session will not affect S im Communicate securely with other users.

[0394] 4. This embodiment implements efficient key negotiation and management. This embodiment optimizes the number of key negotiations and reduces the complexity of client key management. The details are as follows:

[0395] (1) The client only needs to communicate with the IM server S im Perform key negotiation

[0396] Client C a When initiating communication, you only need to pass Token a,im With S im A long connection is established, and the session key is shared. There is no need to negotiate multiple session keys. a,im During the validity period, the session key remains unchanged and no re-negotiation is required, which greatly improves the efficiency of key negotiation.

[0397] (2) The client only stores one session key

[0398] Client C a Just save with S im The session key K for encrypted communication a,im_t , each communication is with S imThis greatly reduces the difficulty of client key management and improves communication efficiency.

[0399] 5. This embodiment realizes a more secure and efficient identity authentication. Traditional identity authentication requires the hash value of the user's password to be transmitted to the authentication server. The authentication server determines whether the user's login is legal by comparing the hash value. Transmitting password-related information on the Internet is an unsafe behavior, regardless of whether the information is encrypted. If the attacker Z intercepts the hash value of the password, then he can bypass the password to log in and directly send the hash value to the server to log in, thus performing a disguised attack. Therefore, it is necessary to avoid transmitting the hash value of the user's password for identity authentication.

[0400] Compared with traditional identity authentication, this embodiment has the following advantages:

[0401] (1) No need to transmit password hash value for identity authentication

[0402] In this solution, client C a After successful registration, the password hash value K is shared with RC a =h(PW a ). During identity authentication, the server uses K a Encrypted verification information RL a Send to C a , as long as C a Able to generate K through the password entered by the user a Demystifying RL a , it means that the identity authentication is successful. In this way, the hash value of the password is not transmitted on the network, preventing theft and spoofing attacks.

[0403] (2)Token a,im You only need to log in once during the validity period

[0404] in Token a,im During the validity period, client C a Each time with IM server S im To establish a communication connection, just send a Token a,im The connection and encrypted session communication can be established without logging into RC for identity authentication every time, which improves the efficiency of system identity authentication.

[0405] 6. This embodiment can resist replay attacks. In this embodiment, each message transmission uses the anti-replay attack function f(T b ,T c ,ΔT,N c ,N array ), by comparing the system's minimum delay and the status of the sent random numbers, it is determined whether the message has been replayed, thereby improving the security of the system.

[0406] 7. This embodiment can resist spoofing attacks. In this embodiment, each message transmitted, except for the user ID, is encrypted using the RC public key and the shared session key K. a , KS rc,im , K a,im_t Even if the attacker intercepts the message, he cannot obtain the plaintext information. In addition, the anti-replay attack function f(T b ,T c ,ΔT,N c ,N array ) can resist the attacker's disguised attack.

[0407] 8. This embodiment implements the secure storage and retrieval of instant messages. Client C a and C b Instant messaging via K im_enmsg Encrypted and stored on the IM server im , ensuring the security of message storage. At the same time, even if the client is reinstalled or local messages are deleted, previous chat records can be obtained by pulling messages. This also complies with the relevant requirements of the "Internet Information Service Management Measures" on instant messaging message storage and information traceability.

[0408] 9. This embodiment can realize all key updates. This embodiment realizes RC and S im The update of all keys on the server side also enables the update of client passwords, improving the security of the system.

[0409] 10. This embodiment can adapt to distributed environments. The authentication center RC is responsible for the client and IM server S im Registration and authentication of clients and S im The session key is sent and the token is issued. If the system adds other servers, the client can also access S im Similarly, apply to RC for a new server token to achieve multi-server access and adapt to the distributed environment.

[0410] Fig.10 1 is a schematic diagram of an implementation flow of an information processing method provided by an embodiment of the present invention. The execution subject of the information processing method may be a user terminal, and the user terminal may be a mobile phone, a desktop computer or a laptop computer, etc. Fig.10 , the information processing method includes:

[0411] S1001: If an operation of communicating with a peer device triggered by a first user is detected, an encryption key corresponding to an operation type of the operation is determined.

[0412] Here, the peer device includes a key server and a communication server. The key server corresponds to the above-mentioned RC authentication center, and the communication server corresponds to the IM server.

[0413] The operation types of the user's operation include user registration, user login, establishing connection, sending session messages, obtaining chat records, and password update.

[0414] If the operation type is user registration, the peer device is a key server, and the key corresponding to the operation type is the public key of the key server; the public key corresponds to K rc_pub .

[0415] If the operation type is user login, and the peer device is a key server, the key corresponding to the operation type is a shared key between the first user and the communication server generated by the user terminal; the shared key is the password of the first user encrypted based on a hash function; the shared key corresponds to K a , K a =h(PW a ), PW a The password for the first user.

[0416] If the operation type is establishing a connection, the peer device is the communication server, and the key corresponding to the operation type is the second temporary session key between the user terminal and the communication server generated by the key server; the second temporary session key corresponds to K a,im_t .

[0417] If the operation type is sending a session message, the peer device is the communication server, and the key corresponding to the operation type is the second temporary session key;

[0418] If the operation type is obtaining chat records, the peer device is the communication server, and the key corresponding to the operation type is the second temporary session key;

[0419] If the operation type is the password update, the peer device is the key server, and the key corresponding to the operation type is the shared key.

[0420] S1002: Encrypt the authentication information generated by the user terminal based on the operation based on the encryption key to obtain a first ciphertext.

[0421] Different operation types correspond to different authentication information, which mainly includes the user name of the first user, the sending time of the communication request and a random number. The peer device verifies the authentication information to determine whether there is an attack behavior.

[0422] Each data packet sent by the user terminal carries a newly generated random number. The peer device includes a random number sequence that stores the random number in the communication request. Each random number received is stored in the random number sequence. If the random number in the data packet currently received by the peer device is in the random number sequence corresponding to the time between the current time and the sending time of the communication request, it indicates that there is a replay attack and the access is unsafe.

[0423] S1003: Generate a communication request based on the first ciphertext, where the communication request includes an identifier of the operation type.

[0424] The communication request includes an identification of the operation type, which is mainly used to inform the peer device what the communication request is for. The peer device can also obtain a corresponding decryption key to decrypt the first ciphertext according to the operation type.

[0425] S1004: Send the communication request to the opposite device.

[0426] If the user terminal of the embodiment of the present invention detects an operation of communicating with the opposite device triggered by the first user, it determines the key corresponding to the operation type of the operation, and encrypts the authentication information generated by the user terminal based on the user operation based on the encryption key corresponding to the operation type to obtain the first ciphertext. A communication request is generated based on the first ciphertext, and the communication request is sent to the opposite device. This embodiment obtains the encryption key based on the operation type of the first user. The encryption key is not fixed, and it is difficult for hackers to know the user's operation type. In addition, the encryption key of the communication request corresponds to the operation type, and it is difficult for hackers to crack the communication request through a fixed key. This strengthens the security of each communication process and can achieve more secure communication information transmission.

[0427] In one embodiment, if the operation type is user registration, the peer device is a key server, and the encryption key corresponding to the operation type is a public key of the key server;

[0428] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes:

[0429] Encrypting the password of the first user based on a hash function to generate a shared key between the first user and the communication server;

[0430] The authentication information is encrypted based on the public key of the key server; the authentication information includes the user name of the first user, the shared key, the first temporary session key generated by the user terminal and the key server, the first sending time of the communication request and the first random number generated by the user terminal; the user terminal inserts a newly generated random number in each communication request generated, and the peer device includes a random number sequence for storing the random number in the communication request.

[0431] Here, symmetric encryption can adopt the SM4 national secret algorithm, the temporary session key and the shared key are both symmetric encryption keys, the asymmetric algorithm can adopt the SM2 national secret algorithm, and the hash function can adopt the national secret SM 3 algorithm.

[0432] First user U a On the client side C a (Mobile or PC) Enter your login ID a and password PW a Submit a registration request, C a Generate the first temporary session key K c,rc_t , and calculate:

[0433] K a =h(PW a )

[0434] A a =E(K pub ,[ID a ,K a ,K c,rc_t ,T3,N3])

[0435] Among them, the first ciphertext is A a , authentication information corresponds to [ID a ,K a ,K c,rc_t ,T3,N3], where the first sending time is T3, the first random number is N3, and the shared key is K a .

[0436] A a Sent to the key server, the key server receives A a After that, through the private key K priv Decryption A a , get the ID a ,K a ,K c,rc_t ,T3,N3, first query ID a Is it already registered? If not, call function f(T3,T c ,ΔT,N3,N rc_array), if it returns false, the session ends. Otherwise, the key server writes N3 to N rc_array and calculate Will The key server then calculates the first verification information HRA a and the second ciphertext RA a :

[0437] HRA a =h(ID a ||T3||N3)

[0438] RA a =E(K c,rc_t ,[HRA a ,T4])

[0439] Then the second ciphertext RA a Sent to the user terminal of the first user, where T4 is the current sending time.

[0440] In one embodiment, the method further comprises:

[0441] receiving a response message sent by the key server based on the communication request, the response message including a second ciphertext encrypted based on the first temporary session key, the second ciphertext including a second sending time of the response message and first verification information encrypted by hash; the first verification information including a user name of the first user, a first sending time, and a first random number obtained by decrypting the first ciphertext by the key server;

[0442] decrypting the second ciphertext based on the first temporary session key;

[0443] Determine whether the difference between the current time and the second sending time is less than or equal to a set value;

[0444] If the difference is less than or equal to the set value, performing consistency verification on the first verification information;

[0445] If the consistency verification is successful, it is determined that the first user has been successfully registered.

[0446] The user terminal of the first user receives the response information and uses K c,rc_t Decrypting RA a , get HRA a and T4, and then use the current time T c , calculate T c -T4? ≤ΔT, if not, end the conversation. Otherwise, calculate judge If they are equal, prompt the user U aRegistration is successful. a The key K is actually shared between the key server and the a .

[0447] Among them, the second ciphertext corresponds to RA a , the first verification information corresponds to HRA a , the second sending time is T4, and the set value is ΔT.

[0448] The consistency verification of the first verification information is to calculate judge If they are equal, consistency verification succeeds.

[0449] In one embodiment, if the operation type is user login, the peer device is the key server, and the encryption key corresponding to the operation type is the shared key;

[0450] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes:

[0451] The authentication information is encrypted based on the shared key; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request; and the communication request includes the first ciphertext and a user name of the first user.

[0452] First, the first user U a On the client side C a Enter your login ID a and password PW a Submit login, C a calculate:

[0453] K a =h(PW a )

[0454] L a =E(K a ,[T5,N4])

[0455] The authentication information includes the second random number N4 and the third sending time T5, and then {ID a , L a}Sent to the key server, L a is the first ciphertext.

[0456] The key server receives {ID a , L a}, first pass ID a Find the corresponding first encryption key Then use the first preset key K rc_enkey Decryption Get the shared key K a , and then use K a Decryption L a Get T5, N4. Then call the function f(T5, T c ,ΔT,N4,N rc_array ), if it returns false, the conversation ends. Otherwise, RC writes N4 into the random number sequence N rc_array and generate C a and S im The second temporary session key K a,im_t , and calculate:

[0457] HRL a =h(ID a ||T5||N4)

[0458] Token a,im =E(K rc,im ,[ID a ,SID im ,K a,im_t ,T6,Lifetime])

[0459] RL a =E(K a ,[HRL a ,T6,Token a,im ,K a,im_t ])

[0460] Among them, T6 is the fourth sending time, Token a,im It is C a Visit S im The access ticket, Lifetime is Token a,im The validity period of the ticket. a is the third ciphertext, HRL a is the second verification information, and the key server will send the third ciphertext RL a Return to C a , and confirm that the user has logged in successfully.

[0461] In one embodiment, the method further comprises:

[0462] Receive response information sent by the key server based on the communication request, the response information including a third ciphertext encrypted based on the shared key, the third ciphertext including a fourth sending time of the response information, second verification information encrypted by hash, a second temporary session key between the user terminal and the communication server generated by the key server, and a ticket for the first user to access the communication server generated by the key server; the second verification information includes a user name of the first user obtained by decrypting the first ciphertext by the key server, a second random number, and a third sending time; the ticket includes the second temporary session key, an identity identifier of the communication server, and a user name of the first user;

[0463] decrypting the third ciphertext based on the shared key;

[0464] Determine whether the difference between the current time and the fourth sending time is less than or equal to the set value;

[0465] If the difference is less than or equal to the set value, performing consistency verification on the second verification information;

[0466] If the consistency verification is successful, it is determined that the user has logged in successfully, and the ticket and the second temporary session key are saved.

[0467] For example, C a After receiving the response information, use K a Decrypt the third ciphertext RL a get

[0468] HRL a ,T6,Token a,im ,K a,im_t , where HRL a is the second verification information, using the current time T c , calculate T c -T6? ≤ΔT is true, if not, then end the conversation. If the time verification passes, calculate judge If they are equal, prompt the user U a Login successful. C a Save Token a,im , and the temporary session key K a,im_t Use K a Encrypt local storage.

[0469] Among them, the consistency verification of the second verification information is to calculate judge If they are equal, consistency verification succeeds.

[0470] In one embodiment, if the operation type is establishing a connection, the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0471] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes:

[0472] The authentication information is encrypted based on the second temporary session key; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request; and the communication request includes the first ciphertext and the ticket.

[0473] After logging in, the client needs to access the communication server and establish a secure communication connection with it. Similarly, in scenarios such as 5G messaging and confidential private network communications, the client needs to establish a persistent connection with the corresponding message server.

[0474] For example, client C a Calculate the first ciphertext:

[0475] CON a,im =E(K a,im_t ,[T7,N5])

[0476] The authentication information includes the third random number N5 and the fifth sending time T7. a,im , CON a,im}Sent to the communication server.

[0477] After receiving the message, the communication server first uses the second preset key K im_enkey Decrypt the third encryption key Get the shared symmetric key K rc,im Then use K rc,im Decrypting the Token a,im , get the ID a ,SID im ,K a,im_t ,T6,Lifetime,Confirm SID im Correct, use the second temporary session key K a,im_t Decryption CON a,im Get T7 and N5. Call function f(T7, T c ,ΔT,N5,N im_array ), if it returns false, the conversation ends. Otherwise, calculate T c -T6? ≤Lifetime. If not, the conversation ends. Otherwise, it is considered that C a Token a,im Valid, legal access, S im Write N5 to Nim_array and replace {ID a , K a,im_t}The key-value pairs are written to memory for quick access, and then the calculation begins:

[0478] HRCON a,im =h(ID a ||T7||N5)

[0479] RCON a,im =E(K a,im_t ,[HRCON a,im ,T8])

[0480] Among them, HRCON a,im is the third verification message, T8 is the sixth sending time, RCON a,im It is the fourth ciphertext.

[0481] Then S im {HRCON a,im , RCON a,im}Send to C a .

[0482] In one embodiment, the method further comprises:

[0483] receiving response information sent by the key server based on the communication request, the response information including a fourth ciphertext encrypted based on the second temporary session key, the fourth ciphertext including third verification information encrypted by hash and a sixth sending time of the response information; the third verification information including a third random number and a fifth sending time obtained by the communication server decrypting the first ciphertext, and a user name of the first user obtained based on the ticket;

[0484] decrypting the fourth ciphertext based on the second temporary session key;

[0485] Determine whether the difference between the current time and the sixth sending time is less than or equal to the set value;

[0486] If the difference is less than or equal to the set value, performing consistency verification on the third verification information;

[0487] If the consistency verification is successful, it is determined that the connection between the user terminal and the communication server is successfully established.

[0488] For example, C a After receiving the message, use the second temporary session key K a,im_t Decrypting RCON a,im Get HRCON a,im and T8, using the current time T c , calculate T c-T8? ≤ΔT is true, if not, then end the conversation. If the time verification passes, calculate judge If they are equal, prompt the user U a The long connection is established successfully. a and S im The second temporary session key K is shared between a,im_t .

[0489] If client C a After the process is killed or restarted, there is no need to log in to the key server, only the user needs to enter the password PW a Get K a , decrypted to get K a,im_t , and through Token a,im Reconnect with S im Communication can be achieved by establishing a long connection.

[0490] If client C a Token a,im Expired, the user will be prompted when establishing a long connection a Token a,im Expired, Client C a Will return to the login interface and force the user to a Re-enter the password to log in and obtain a new Token a,im , and update the second temporary session key K a,im_t .

[0491] Among them, the consistency verification of the third verification information is to calculate judge If they are equal, the consistency verification succeeds.

[0492] In one embodiment, if the operation type is sending a session message, the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0493] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes:

[0494] The authentication information is encrypted based on the second temporary session key; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal, the seventh sending time of the communication request and the first hash value; the first hash value is obtained by hash calculation based on the user name of the first user, the identity identifier of the communication server and the user identifier of the target user; the communication request includes the first ciphertext and the user name of the first user.

[0495] Exemplarily, if the target user of the session information is the second user, the method further includes:

[0496] The user terminal of the second user receives the response information sent by the communication server based on the communication request of the first user; the response information includes the user name of the first user and the fifth ciphertext encrypted based on the second temporary session key of the first user, the fifth ciphertext includes the seventh sending time of the communication request of the first user, the eighth sending time of the response information, the first session information input by the first user and the second hash value; the second hash value is obtained by hashing the user name of the first user, the user name of the second user and the seventh sending time;

[0497] decrypting the fifth ciphertext based on the second temporary session key;

[0498] Determine whether the difference between the current time and the eighth sending time is less than or equal to the set value;

[0499] If the difference is less than or equal to the set value, performing consistency verification on the second Hash value;

[0500] If the consistency verification passes, the first session information is displayed in a dialog box between the first user and the second user.

[0501] For example, the first user U a To the second user U b Send the first session information M a,b , the process is as follows:

[0502] (1)U a On the client side C a Terminal input M a,b , and click Send to U b , C a Start calculating the first hash value HID a,im,b and the first ciphertext S a,im,b :

[0503] HID a,im,b =h(ID a ||SID im ||ID b )

[0504] S a,im,b =E(K a,im_t ,[HID a,im,b ,ID b ,M a,b ,T9,N6])

[0505] Where T9 is the seventh sending time, N6 is the newly generated fourth random number, and then {ID a , S a,im,b}Sent to the communication server S im .

[0506] (2) Communication Server S im By ID a Find the second temporary session key K a,im_t Then use K a,im_t Decrypt S a,im,b , get HID a,b ,ID b ,M a,im,b ,T9,N6, and then call the function f(T9,T c ,ΔT,N6,N im_array ), if it returns false, the conversation ends. Otherwise, S im Write N6 into the random number sequence N im_array and calculate judge If they are not equal, end the conversation. If they are equal, calculate:

[0507] HID a,b =h(ID a ||ID b ||T9)

[0508] SIM a,b =E(K im_enmsg ,[HID a,b ,M a,b ])

[0509] And {ID a , ID b , T9, SIM a,b , state} is stored in the database as a chat record, where state is the current status of whether it is sent, and the default status is not sent.

[0510] Then, S im Query judgment C b Is it online (whether it is connected to S im Establish a long connection), if it is not online, do not process (or push offline notification), wait for C b Online. If C b Online, calculate the fifth ciphertext S b,im,a :

[0511] S b,im,a =E(K b,im_t ,[HID a,b ,M a,b ,T9,T10 ])

[0512] Among them, HID a,b is the second hash value, K b,im_t YesS im and C b The corresponding second temporary session key, T 10 is the eighth sending time, then {ID a , S b,im,a}Send to C b .

[0513] (3)C b After receiving the message, use K b,im_t Decrypt the fifth ciphertext S b,im,a , get the ID a ,HID a,b ,M a,b ,T9,T 10 , and then use the current time T c , calculate T c -T 10 ? ≤ΔT is true, if not, then end the conversation. If the time verification passes, then calculate judge If they are equal, then in C b Local database storage {ID a , ID b , M a,b , T9}, and on the terminal screen U b and U a An instant message is displayed in a dialog box.

[0514] The consistency verification of the second hash value is to calculate judge If they are equal, the consistency verification passes.

[0515] Exemplarily, if the target user of the session information is a user group, the user group includes a second user, and the user name of the target user is an identity identifier of the user group, the method further includes:

[0516] The user terminal of the second user receives the response information sent by the communication server based on the communication request of the first user; the response information includes the identity of the user group, the user name of the first user and the sixth ciphertext encrypted based on the second temporary session key corresponding to the second user; the sixth ciphertext includes the seventh sending time generated by the user terminal of the first user, the eighth sending time of the response information, the first session information input by the first user and the third hash value; the third hash value is obtained by hashing based on the identity of the user group, the user name of the first user and the seventh sending time;

[0517] decrypting the sixth ciphertext based on the second temporary session key;

[0518] Determine whether the difference between the current time and the eighth sending time is less than or equal to the set value;

[0519] If the difference is less than or equal to the set value, performing consistency verification on the third Hash value;

[0520] If the consistency verification passes, the first session information of the first user is displayed in the dialog box of the user group.

[0521] For example, user U a In group G a,b,c,d Send the first session information M a,G , where G a,b,c,d Indicates that the member is U a , U b , U c , U d The process is as follows:

[0522] (1)U a On the client side C a End Group G a,b,c,d Enter M a,G , and click Send, C a Start calculation:

[0523] HID a,im,G =h(ID a ||SID im ||ID G )

[0524] S a,im,G =E(K a,im_t ,[HID a,im,G ,ID G ,M a,G ,T 11 ,N7])

[0525] Among them, HID a,im,G is the first hash value, Sa,im,G is the first ciphertext, T 11 is the seventh sending time, N7 is the newly generated fourth random number, ID G It is group G a,b,c,d unique identifier, and then {ID a , S a,im,G}Send to S im .

[0526] (2)S im After receiving the message, a Find K a,im_t Then use K a,im_t Decrypt S a,im,G , get HID a,im,G ,ID G ,M a,G ,T 11 ,N7, then call the function f(T 11 ,T c ,ΔT,N7,N im_array ), if it returns false, the conversation ends. Otherwise, S im Write N7 to N im_array and calculate judge If they are not equal, end the conversation. If they are equal, calculate:

[0527] HID a,G =h(ID a ||ID G ||T 11 )

[0528] SIM a,G =E(K im_enmsg ,[HID a,G ,M a,G ])

[0529] And {ID a , ID G , T 11 , SIM a,G , state} is stored in the database as a chat record, where state is the current state of whether it is sent, the default state is not sent, HID a,G is the third hash value.

[0530] Then, S im By ID G The members of the group found are U a , U b , U c , U d , first determine C b , Cc , C d Is it online (whether it is connected to S im Establish a long connection), if it is not online, do not process it (or push offline notification) and wait for it to come online. b Online, calculate the sixth ciphertext S b,im,a,G :

[0531] S b,im,a,G =E(K b,im_t ,[HID a,G ,M a,G ,T 11 ,T 12 ])

[0532] Where K b,im_t YesS im and C b The second temporary session key, T 12 It is the eighth sending time, HID a,G is the third hash value. Then replace {ID a , ID G , S b,im,a,G}Send to C b .

[0533] (3)C b After receiving the message, use K b,im_t Decrypt S b,im,a,G , get HID a,G ,M a,G ,T 11 ,T 12 , and then use the current time T c , calculate T c -T 12 ? ≤ΔT is true, if not, then end the conversation. If the time verification passes, then calculate judge If they are equal, then in C b Local database storage {ID a , ID G , M a,G , T 11}, and displayed in the group message dialog box on the terminal screen. c and C d The message will be received in the same way.

[0534] The consistency verification of the third hash value is to calculate judge If they are equal, the consistency verification succeeds.

[0535] In one embodiment, if the operation type is obtaining a chat record, the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0536] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes:

[0537] The authentication information is encrypted based on the second temporary session key; the authentication information includes the time period of the chat record between the first user and the second user, the user name of the second user, the fifth random number generated by the user terminal, the ninth sending time of the communication request and the fourth hash value, and the fourth hash value is obtained by hash calculation based on the user name of the first user, the user name of the second user and the identity of the communication server; the communication request includes the user name of the first user and the first ciphertext.

[0538] The client can synchronize the latest instant messages from the communication server to ensure that chat records are present even if the client's local messages are deleted or the client program is reinstalled. Similarly, this is also applicable in 5G messaging and confidential private network scenarios.

[0539] For example, client C a With IM server S im Establish a long connection and share the temporary session key K a,im_t .

[0540] First user U a In the conversation with the second user U b Pull down to refresh the chat interface to get the same as U b Chat records of client C a calculate:

[0541] HID a,im,b =h(ID a ||SID im ||ID b )

[0542] RM a,im,b =E(K a,im_t ,[HID a,im,b ,ID b ,TQ,T 13 ,N8])

[0543] Where T 13 Ninth sending time, HID a,im,b is the fourth hash value, RM a,im,b is the first ciphertext, N8 is the newly generated fifth random number, TQ is the time period for which the chat records need to be obtained, and then {ID a , R.M.a,im,b}Send to S im .

[0544] (3) Communication Server S im After receiving the message, a Find K a,im_t Then use K a,im_t Decrypting RM a,im,b , get HID a,im,b ,ID b ,TQ,T 13 ,N8, then call the function f(T 13 ,T c ,ΔT,N8,N im_array ), if it returns false, the conversation ends. Otherwise, S im calculate judge If they are not equal, the conversation ends. Otherwise, S im Write N8 to N im_array and pass {ID a , ID b , TQ} condition, query the U in this time period a and U b Chat record of {ID a , ID b , T r , SIM a,b , state} (assuming there is only one record), where T r is the tenth sending time of the third session message, state is the message state, through K im_enmsg Decrypted to obtain the third session information M a,b , and then start calculating:

[0545] HRID a,b =h(ID a ||ID b ||T 13 ||N8)

[0546] IMR a,b =E(K a,im_t ,[HRID a,b ,ID b ,M a,b ,T r ,TQ,T 14 ])

[0547] Among them, HRID a,b is the fifth hash value, T 14 It is the eleventh sending time of the response information, and then the seventh ciphertext IMR a,b Send to C a.

[0548] In one embodiment, the method further comprises:

[0549] receiving response information sent by the communication server based on the communication request, the response information including a seventh ciphertext encrypted based on the second temporary session key, the seventh ciphertext including a third session information between the first user and the second user within the time period queried by the communication server, a user name of the second user, a tenth sending time of the third session information, an eleventh sending information of the response information, and a fifth hash value; the fifth hash value is obtained by hashing the user name of the second user decrypted by the communication server, a fifth random number, the ninth sending time, and the user name of the first user;

[0550] decrypting the seventh ciphertext based on the second temporary session key;

[0551] Determine whether the difference between the current time and the eleventh sending time is less than or equal to the set value;

[0552] If the difference is less than or equal to the set value, performing consistency verification on the fifth Hash value;

[0553] If the consistency verification passes, the third session information is displayed in a dialog box between the first user and the second user.

[0554] For example, C a After receiving the message, use K a,im_t Decrypt the seventh ciphertext IMR a,b , get HRID a,b ,ID b ,M a,b ,T r ,TQ,T 14 , and then use the current time T c , calculate T c -T 14 ? ≤ΔT is true, if not, then end the conversation. If the time verification passes, then calculate judge If they are equal, then in the storage instant messaging record {ID a , ID b , M a,b , T r}, then in C a The Conversation screen displays the found chat records.

[0555] The consistency verification of the fifth hash value is to calculate judge If they are equal, the consistency verification is passed. The purpose of consistency verification is to ensure that the call message is not forged by a hacker.

[0556] In one embodiment, if the operation type is password update, the peer device is the key server, and the encryption key corresponding to the operation type is the shared key;

[0557] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes:

[0558] The authentication information is encrypted based on the shared key; the authentication information includes a new shared key obtained by hashing the new password of the first user, the user name of the first user, the twelfth sending time of the communication request and the sixth random number generated by the user terminal; the communication request includes the first ciphertext and the user name of the first user.

[0559] For example, the first user U a On the client side C a (Mobile or PC) Enter your login ID a 、Old password PW a and new password And calculate:

[0560] K a =h(PW a )

[0561]

[0562]

[0563] Among them, UA a is the first ciphertext, T 15 is the twelfth sending time, N9 is the sixth random number, and {ID a ,UA a}Sent to RC.

[0564] After receiving the key server RC, a Query the shared key K a , and through K a Decrypting UA a , get the ID a , T 15 ,N9, determine ID a Whether to decrypt UA a After getting the ID a If they are equal, call the function f(T 15 ,T c ,ΔT,N9,N rc_array), if it returns false, the conversation ends. Otherwise, RC writes N9 to N rc_array and calculate Will Exists in the key server's database, replacing the original key The key server then calculates:

[0565] HUA a =h(ID a ||T 15 ||N9)

[0566]

[0567] Among them, HUA a is the sixth hash value, and then the eighth ciphertext RUA a Send to C a , where T 16 It is the thirteenth sending time of the response information.

[0568] Correspondingly, the method further includes:

[0569] receiving response information sent by the key server based on the communication request, the response information including an eighth ciphertext encrypted based on the new shared key, the eighth ciphertext including a thirteenth sending time and a sixth hash value of the response information; the sixth hash value is obtained by hashing the user name of the first user decrypted by the key server, the twelfth sending time and the sixth random number;

[0570] decrypting the eighth ciphertext based on the new shared key;

[0571] Determine whether the difference between the current time and the thirteenth sending time is less than or equal to the set value;

[0572] If the difference is less than or equal to the set value, performing consistency verification on the sixth Hash value;

[0573] If the consistency verification passes, it is determined that the password of the first user is updated successfully.

[0574] For example, C a Receive RUA a After that, use Decrypted to get HUA a ,T 16 , and then use the current time T c , calculate T c -T 16 ? ≤ΔT is true, if not, then end the conversation. Otherwise calculate judge If equal, C aWill Store into memory, replace K a , and prompt the user U a The password has been updated successfully. a The new key is also shared between RC

[0575] The consistency verification of the sixth hash value is to calculate judge If they are equal, the consistency verification passes.

[0576] Fig.11 1 is a schematic diagram of an implementation flow of another information processing method provided by an embodiment of the present invention. The execution subject of the information processing method is a key server, and the key server and the communication server can be deployed on the same user terminal. Fig.11 , the information processing method includes:

[0577] S1101, receiving a communication request sent by a user terminal; the communication request includes a first ciphertext and an identifier of an operation type, the first ciphertext includes authentication information generated by the user terminal based on an operation of a first user, and the first ciphertext is obtained by encrypting the authentication information based on an encryption key corresponding to the operation type of the operation;

[0578] S1102, determining a decryption key corresponding to the operation type based on the identifier;

[0579] S1103, decrypting the first ciphertext based on the decryption key corresponding to the operation type to obtain the authentication information;

[0580] S1104, determining whether there is a replay attack based on the authentication information;

[0581] S1105: If there is no replay attack, generate response information based on the authentication information and send it to the user terminal.

[0582] Wherein, if the operation type is user registration, the decryption key corresponding to the operation type is the private key of the key server;

[0583] If the operation type is user login, the key corresponding to the operation type is a shared key between the first user and the communication server generated by the user terminal; the shared key is the password of the first user encrypted based on a hash function;

[0584] If the operation type is the password update, the decryption key corresponding to the operation type is the shared key.

[0585] The private key is encrypted and stored in the key server based on the master key of the key server;

[0586] The shared key is encrypted based on the first preset key and stored in the key server;

[0587] The first preset key is encrypted and stored in the key server based on the master key of the key server.

[0588] The authentication information includes the sending time of the communication request and the random number. To prevent the server from being replayed, an anti-replay attack function f(T b ,T c ,ΔT,N c ,N array ), where T b is the message sending time, T c is the message arrival time, ΔT is the minimum system delay, N c N is the random number received by the server from the sender. array is the random number sequence of the server. The function first calculates T c -T b ? ≤ΔT, if it fails, it returns false; if it passes, the server will array Check whether N exists within ΔT time. c If it exists, it returns false and the verification fails; otherwise it returns true and the verification passes.

[0589] In one embodiment, if the operation type is user registration, the decryption key corresponding to the operation type is the private key of the key server;

[0590] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0591] Decrypting the first ciphertext based on the private key to obtain the authentication information; the authentication information includes the user name of the first user, the shared key between the first user and the communication server, the first temporary session key generated by the user terminal and the key server, the first sending time of the communication request and a first random number; the shared key represents the password of the first user encrypted by a hash function;

[0592] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0593] Determine whether the difference between the current time and the first sending time is less than or equal to a set value;

[0594] If the difference is less than or equal to the set value, querying whether the time period corresponding to the difference includes the first random number in the first random number sequence corresponding to the key server; the first random number sequence stores the random numbers received by the key server;

[0595] If the first random number is not included, it is determined that there is no replay attack;

[0596] Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes:

[0597] Perform hash encryption based on the first user's username, first sending time, and first random number obtained by decryption to generate first verification information;

[0598] Encrypting the first verification information and the second sending time based on the first temporary session key to obtain a second ciphertext; the second sending time represents the sending time of the response information;

[0599] Response information is generated based on the second ciphertext and sent to the user terminal of the first user.

[0600] Among them, based on the function f(T3,T c ,ΔT,N3,N rc_array )Determine if a replay attack exists.

[0601] The specific implementation process of other steps is detailed in the above method embodiment and will not be repeated here.

[0602] In one embodiment, if there is no replay attack, the method further includes:

[0603] Encrypt the shared key based on a first preset key to obtain a first encryption key;

[0604] The user name of the first user and the first encryption key are stored in a local database in correspondence.

[0605] calculate Will Exists in the RC database.

[0606] Among them, the first preset key is K rc_enkey , the first encryption key is

[0607] In one embodiment, if the operation type is user login, the decryption key corresponding to the operation type is the shared key; the communication request includes the first ciphertext and the username of the first user;

[0608] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0609] Determining the first encryption key corresponding to the username of the first user;

[0610] Decrypting the first encryption key based on the first preset key to obtain the shared key;

[0611] decrypting the first ciphertext based on the shared key to obtain the authentication information; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request;

[0612] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0613] Determine whether the difference between the current time and the third sending time is less than or equal to the set value;

[0614] If the difference is less than or equal to the set value, querying in the first random number sequence corresponding to the key server whether the time period corresponding to the difference includes the second random number;

[0615] If the second random number is not included, it is determined that there is no replay attack;

[0616] Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes:

[0617] generating a second temporary session key between the user terminal and the communication server;

[0618] Perform hash encryption based on the first user's username, the second random number, and the third sending time obtained by decryption to obtain second verification information;

[0619] generating a ticket for the first user to access the communication server based on the second temporary session key, the identity of the communication server and the user name of the first user;

[0620] Encrypting the ticket, the second verification information, the second temporary session key and the fourth sending time based on the shared key to obtain a third ciphertext; the fourth sending time represents the sending time of the response information;

[0621] Response information is generated based on the third ciphertext and sent to the user terminal of the first user.

[0622] Among them, based on the function f(T5,T c ,ΔT,N4,N rc_array )Determine if a replay attack exists.

[0623] In one embodiment, the ticket Token a,im=E(K rc,im ,[ID a ,SID im ,K a,im_t ,T6,Lifetime]), the third ciphertext RL a =E(K a ,[HRL a ,T6,Token a,im ,K a,im_t ]).

[0624] In one embodiment, if the operation type is password update, the decryption key corresponding to the operation type is the shared key, and the communication request includes the first ciphertext and the user name of the first user;

[0625] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0626] querying the shared key based on the username of the first user;

[0627] decrypting the first ciphertext based on the shared key to obtain the authentication information; the authentication information includes a new shared key obtained by the user terminal by hashing the new password of the first user, the user name of the first user, the twelfth sending time of the communication request and the sixth random number;

[0628] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0629] Determine whether the difference between the current time and the twelfth sending time is less than or equal to the set value;

[0630] If the difference is less than or equal to the set value, querying in the random number sequence corresponding to the key server whether the time period corresponding to the difference includes the sixth random number;

[0631] If the sixth random number is not included, it is determined that there is no replay attack;

[0632] Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes:

[0633] Perform hash encryption based on the decrypted user name of the first user, the twelfth sending time, and the sixth random number to obtain a sixth hash value;

[0634] Encrypting the sixth hash value and the thirteenth sending time based on the new shared key to obtain an eighth ciphertext; the thirteenth sending time represents the sending time of the response information;

[0635] Response information is generated based on the eighth ciphertext and sent to the user terminal of the first user.

[0636] Among them, the function f(T 15 ,T c ,ΔT,N9,N rc_array )Determine if a replay attack exists.

[0637] The specific implementation process of other steps is detailed in the above method embodiment and will not be repeated here.

[0638] In one embodiment, the method further comprises:

[0639] receiving a registration request sent by the communication server; the registration request comprising a ninth ciphertext, the ninth ciphertext being obtained by encrypting a third temporary session key based on the public key of the key server, a seventh random number generated by the communication server, an identity of the communication server, and a fourteenth sending time; the third temporary session key being a temporary session key generated by the communication server for communicating with the key server; the fourteenth sending time representing a sending time of the registration request;

[0640] Decrypting the ninth ciphertext based on the private key corresponding to the public key;

[0641] Based on the seventh random number and the fourteenth sending time, determining whether the registration request has been subjected to a replay attack;

[0642] If there is no replay attack, generating a shared symmetric key and an eighth random number for communicating with the communication server;

[0643] Encrypting the shared symmetric key, the eighth random number, the fifteenth sending time and the fourth verification information based on the third temporary session key to obtain a tenth ciphertext; the fourth verification information is obtained by performing hash encryption based on the eighth random number, the fifteenth sending time, the seventh random number and the identity of the communication server; the fifteenth sending time represents the sending time of the tenth ciphertext;

[0644] The tenth ciphertext is sent to the communication server.

[0645] Among them, the communication server S im When joining the network, you first need to register and generate the third temporary session key KS rc,im and the seventh random number N1, with the public key K pub Perform encryption calculations:

[0646] A im =E(K pub ,[SID im ,KS rc,im ,T1,N1])

[0647] Among them, SID im YesS im The unique identity of the ciphertext A is T1, T2 is the fourteenth sending time, h(·) is the SM3 hash function, and the ninth ciphertext A im Sent to the key server.

[0648] The key server receives A im After that, through the private key K priv Decryption A im , get the SID im ,KS rc,im ,T1,N1, first query SID im Is it already registered? If not, call the anti-replay attack function f(T1,T c ,ΔT,N1,N rc_array ), if it returns false, the conversation ends. Otherwise, RC writes N1 to N rc_array and generate a communication server S im The shared symmetric key K rc,im And the eighth random number N2, then calculate:

[0649] HRA im =h(SID im ||T2||N1||N2)

[0650] RA im =E(KS rc,im ,[HRA im ,K rc,im ,T2,N2])

[0651] The tenth ciphertext RA im Sent to the communication server S im , where T2 is the fifteenth transmission time. Then calculate and will Stored in the database and published to the communication server S im SID im .

[0652] Communication Server im RA received im Then, use KS rc,im Decrypting RA im , get HRA im ,K rc,im ,T2,N2, and then call f(T2,T c ,ΔT,N2,N im_array ), if it returns false, the conversation ends. Otherwise, calculate judge If equal, Sim Write N2 to N im_array Then calculate and will Store it in the database and K rc,im Write to memory for quick access by programs (K im_enkey Decryption Get K rc,im , written into memory). In this way, RC and S im The session key K is shared between rc,im , used for encrypted communications.

[0653] In one embodiment, the method further comprises:

[0654] Encrypting the shared symmetric key based on the first preset key to obtain a second encryption key;

[0655] The identity identifier of the communication server and the second encryption key are stored in a local database correspondingly.

[0656] Calculate the second encryption key and will and communication server S im SID im The corresponding data are stored in the database.

[0657] Fig.12 1 is a schematic diagram of an implementation flow of another information processing method provided by an embodiment of the present invention. The execution subject of the information processing method is a communication server, and the key server and the communication server can be deployed on the same user terminal. Fig.12 , the information processing method includes:

[0658] S1201, receiving a communication request sent by a user terminal; the communication request includes a first ciphertext and an identifier of an operation type, the first ciphertext includes authentication information generated by the user terminal based on an operation of a first user, and the first ciphertext is obtained by encrypting the authentication information based on an encryption key corresponding to the operation type of the operation;

[0659] S1202, determining a decryption key corresponding to the operation type based on the identifier;

[0660] S1203, decrypting the first ciphertext based on the decryption key corresponding to the operation type to obtain the authentication information;

[0661] S1204, determining whether there is a replay attack based on the authentication information;

[0662] S1205: If there is no replay attack, generate response information based on the authentication information and send it to the user terminal.

[0663] The authentication information includes the sending time of the communication request and the random number. To prevent the server from being replayed, an anti-replay attack function f(T b ,T c ,ΔT,N c ,N array ), where T b is the message sending time, T c is the message arrival time, ΔT is the minimum system delay, N c N is the random number received by the server from the sender. array is the random number sequence of the server. The function first calculates T c -T b ? ≤ΔT, if it fails, it returns false; if it passes, the server will array Check whether N exists within ΔT time. c If it exists, it returns false and the verification fails; otherwise it returns true and the verification passes.

[0664] Wherein, if the operation type is the establishment of a connection, the decryption key corresponding to the operation type is the second temporary session key between the user terminal and the communication server generated by the key server;

[0665] If the operation type is sending a session message, the key corresponding to the operation type is the second temporary session key;

[0666] If the operation type is obtaining chat records, the decryption key corresponding to the operation type is the second temporary session key.

[0667] The second temporary session key is stored in the communication server.

[0668] In one embodiment, the method further comprises:

[0669] generating a third temporary session key for communicating with the key server;

[0670] Sending the registration request to the key server; the registration request includes a ninth ciphertext encrypted based on the public key of the key server, the ninth ciphertext includes the third temporary session key, the seventh random number generated by the communication server, the identity of the communication server and a fourteenth sending time; the fourteenth sending time represents the sending time of the registration request;

[0671] receiving a tenth ciphertext sent by the key server based on the registration request; the tenth ciphertext includes a shared symmetric key generated by the key server for communicating with the communication server, an eighth random number generated by the key server, a fifteenth sending time, and fourth verification information; the tenth ciphertext is encrypted based on the third temporary session key, the fifteenth sending time represents the sending time of the tenth ciphertext, and the fourth verification information is obtained by performing hash encryption based on the eighth random number, the fifteenth sending time, the seventh random number, and the identity of the communication server;

[0672] decrypting the tenth ciphertext based on the third temporary session key to obtain the shared symmetric key, the eighth random number, the fifteenth sending time and the fourth verification information;

[0673] Based on the eighth random number and the fifteenth sending time, determining whether the tenth ciphertext is under a replay attack; the communication server includes a second random number sequence for storing random numbers;

[0674] If there is no replay attack, performing consistency verification on the fourth verification information;

[0675] If the consistency verification passes, encrypting the shared symmetric key based on the second preset key of the communication server to obtain a third encryption key;

[0676] The third encryption key is stored in a local database.

[0677] Among them, the communication server S im When joining the network, you first need to register and generate the third temporary session key KS rc,im and the seventh random number N1, with the public key K pub Perform encryption calculations:

[0678] A im =E(K pub ,[SID im ,KS rc,im ,T1,N1])

[0679] Among them, SID im YesS im The unique identity of the ciphertext A is T1, T2 is the fourteenth sending time, h(·) is the SM3 hash function, and the ninth ciphertext A im Sent to the key server.

[0680] The key server receives A im After that, through the private key K priv Decryption A im , get the SID im ,KS rc,im ,T1,N1, first query SIDim Is it already registered? If not, call the anti-replay attack function f(T1,T c ,ΔT,N1,N rc_array ), if it returns false, the conversation ends. Otherwise, RC writes N1 to N rc_array and generate a communication server S im The shared symmetric key K rc,im And the eighth random number N2, then calculate:

[0681] HRA im =h(SID im ||T2||N1||N2)

[0682] RA im =E(KS rc,im ,[HRA im ,K rc,im ,T2,N2])

[0683] The tenth ciphertext RA im Sent to the communication server S im , where T2 is the fifteenth transmission time. Then calculate and will Stored in the database and published to the communication server S im SID im .

[0684] Communication Server im RA received im Then, use KS rc,im Decrypting RA im , get HRA im ,K rc,im ,T2,N2, and then call the anti-replay attack function f(T2,T c ,ΔT,N2,N im_array ), if it returns false, the conversation ends. Otherwise, calculate judge If equal, S im Write N2 to N im_array Then calculate and will Store it in the database and K rc,im Write to memory for quick access by programs (K im_enkey Decryption Get K rc,im , written into memory). In this way, RC and S im The session key K is shared between rc,im , used for encrypted communications.

[0685] In one embodiment, if the operation type is to establish a connection, the decryption key corresponding to the operation type is a second temporary session key generated by the key server for the user terminal to communicate with the communication server; the communication request includes the first ciphertext and a ticket for the first user to access the communication server; the ticket includes the second temporary session key, the identity of the communication server and the user name of the first user;

[0686] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0687] determining the second temporary session key based on the ticket;

[0688] decrypting the first ciphertext based on the second temporary session key to obtain the authentication information; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request;

[0689] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0690] Determine whether the difference between the current time and the fifth sending time is less than or equal to the set value;

[0691] If the difference is less than or equal to the set value, querying in the second random number sequence corresponding to the communication server whether the time period corresponding to the difference includes the third random number;

[0692] If the third random number is not included, it is determined that there is no replay attack;

[0693] Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes:

[0694] Perform hash encryption based on the third random number obtained by decryption, the fifth sending time, and the user name of the first user to obtain third verification information;

[0695] Encrypting the third verification information and the sixth sending time based on the second temporary session key to obtain a fourth ciphertext; the sixth sending time represents the sending time of the response information;

[0696] Response information is generated based on the fourth ciphertext and sent to the user terminal of the first user.

[0697] Among them, the communication server calls the function f(T7,T c ,ΔT,N5,N im_array )Determine if a replay attack exists.

[0698] The specific implementation process of other steps is detailed in the above method embodiment and will not be repeated here.

[0699] In one embodiment, if the operation type is sending a session message, the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the user name of the first user;

[0700] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0701] querying the second temporary session key based on the username of the first user;

[0702] The first ciphertext is decrypted based on the second temporary session key to obtain the authentication information; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal and the seventh sending time of the communication request, and a first hash value obtained by hashing the user name of the first user, the identity identifier of the communication server and the user identifier of the target user.

[0703] In one example, if the target user of the session information is the second user, the generating of the response information sent to the user terminal based on the authentication information includes:

[0704] Perform hash encryption based on the user name of the first user, the user name of the second user, and the seventh sending time to obtain a second hash value;

[0705] Encrypting the second hash value, the first session information input by the first user, the seventh sending time and the eighth sending time based on the second temporary session key to obtain the fifth ciphertext; the eighth sending time represents the sending time of the response information;

[0706] Based on the fifth ciphertext and the user name of the first user, response information is generated and sent to the user terminal of the second user.

[0707] For example, the communication server S im After receiving the message sent by the first user, a Find K a,im_t Then use K a,im_t Decrypt S a,im,b , get HID a,b ,ID b ,M a,im,b ,T9,N6, and then call the function f(T9,T c ,ΔT,N6,N im_array), if it returns false, the conversation ends. Otherwise, S im Write N6 to N im_array and calculate judge If they are not equal, the conversation ends. Otherwise, calculate:

[0708] HID a,b =h(ID a ||ID b ||T9)

[0709] SIM a,b =E(K im_enmsg ,[HID a,b ,M a,b ])

[0710] And {ID a , ID b , T9, SIM a,b , state} is stored in the database as a chat record, where state is the current status of whether it is sent, and the default status is not sent.

[0711] Then, S im Query judgment C b Is it online (whether it is connected to S im Establish a long connection), if it is not online, do not process (or push offline notification), wait for C b Online. If C b Online, then calculate:

[0712] S b,im,a =E(K b,im_t ,[HID a,b ,M a,b ,T9,T 10 ])

[0713] Then the response information {ID a , S b,im,a}Send to C b .

[0714] In one example, if the target user of the session information is a user group, the user group includes a second user, and the user name of the target user is an identity identifier of the user group, the generating of the response information sent to the user terminal based on the authentication information includes:

[0715] Performing hash encryption based on the user name of the first user, the identity identifier of the user group, and the seventh sending time to obtain a third hash value;

[0716] Encrypt the third Hash value, the first session information, the seventh sending time, and the eighth sending time based on the second temporary session key of the second user to obtain the sixth ciphertext;

[0717] Based on the sixth ciphertext, the user name of the first user and the identity identifier of the user group, response information is generated and sent to the user terminal of the second user.

[0718] For example, the communication server S im After receiving the message sent by the first user, a Find K a,im_t Then use K a,im_t Decrypt S a,im,G , get HID a,im,G ,ID G ,M a,G ,T 11 ,N7, then call the function f(T 11 ,T c ,ΔT,N7,N im_array ), if it returns false, the conversation ends. Otherwise, S im Write N7 to N im_array and calculate judge If they are not equal, the conversation ends. Otherwise, calculate:

[0719] HID a,G =h(ID a ||ID G ||T 11 )

[0720] SIM a,G =E(K im_enmsg ,[HID a,G ,M a,G ])

[0721] And {ID a , ID G , T 11 , SIM a,G , state} is stored in the database as a chat record, where state is the current status of whether it is sent, and the default status is not sent.

[0722] Then, S im By ID G The members of the group found are U a , U b , U c , U d , first determine C b , C c , Cd Is it online (whether it is connected to S im Establish a long connection), if it is not online, do not process it (or push offline notification) and wait for it to come online. b Online, then calculate:

[0723] S b,im,a,G =E(K b,im_t ,[HID a,G ,M a,G ,T 11 ,T 12 ])

[0724] Then add {ID a , ID G , S b,im,a,G}Send to C b .

[0725] Here, the specific implementation process of each step is detailed in the above method embodiment and will not be repeated here.

[0726] In one embodiment, if the operation type is obtaining chat records, the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the username of the first user;

[0727] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0728] querying the second temporary session key based on the username of the first user;

[0729] decrypting the first ciphertext based on the second temporary session key to obtain the authentication information; the authentication information includes a time period of the chat record between the first user and the second user, a user name of the second user, a fifth random number generated by the user terminal, a ninth sending time of the communication request, and a fourth hash value; the fourth hash value is obtained by performing a hash calculation based on the user name of the first user, the user name of the second user, and an identity identifier of the communication server;

[0730] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0731] Determine whether the difference between the current time and the ninth sending time is less than or equal to the set value;

[0732] If the difference is less than or equal to the set value, querying in the random number sequence corresponding to the key server whether the time period corresponding to the difference includes the fifth random number;

[0733] If the fifth random number is not included, it is determined that there is no replay attack;

[0734] Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes:

[0735] Based on the user name of the first user, the user name of the second user, and the time period, querying third session information between the first user and the second user within the time period;

[0736] Performing hash encryption on the user name of the first user, the decrypted user name of the second user, the fifth random number, and the ninth sending time to obtain the fifth hash value;

[0737] Encrypt the third session information, the fifth Hash value, the user name of the second user, the tenth sending time of the third session information, and the eleventh sending information based on the second temporary session key to obtain a seventh ciphertext; the eleventh sending information represents the sending time of the response information;

[0738] Response information is generated based on the seventh ciphertext and sent to the user terminal of the first user.

[0739] Among them, the communication server calls the function f(T 13 ,T c ,ΔT,N8,N im_array )Determine if a replay attack exists.

[0740] The specific implementation process of each step is detailed in the above method embodiment and will not be repeated here.

[0741] The embodiment of the present application designs the entire instant communication process nodes such as server initialization, server registration, client registration, client login, communication long connection establishment, instant message single chat session, group chat session, instant message pull synchronization, key update, etc. Compared with other instant communication solutions, it not only focuses on the key security exchange and negotiation links, but also carries out a more systematic and complete security design for the entire instant communication process.

[0742] The embodiment of the present application implements a more secure instant messaging solution. Through security analysis, it realizes a complete secure instant messaging process, realizes end-to-end information security encryption of instant messaging, realizes secure storage of server and client keys, realizes efficient key negotiation and management, and realizes more secure and efficient identity authentication. It can resist replay attacks, resist spoofing attacks, resist known session key attacks, realize all key updates, and adapt to distributed environments.

[0743] The parameters in the claims have a corresponding relationship with the parameters in the above embodiments, as follows:

[0744] The RC authentication center corresponds to the key server, and the IM server corresponds to the communication server.

[0745] Public key K rc_pub , private key K rc_priv , shared key K a , the first temporary session key K c,rc_t , the second temporary session key K a,im_t , the first preset key K rc_enkey , the first encryption key Second encryption key The third temporary session key KS rc,im , share the symmetric key K rc,im , the second preset key K im_enkey , the third encryption key First sending time T3, first random number N3, second ciphertext RA a , first verification information HRA a , second sending time T4, third sending time T5, second random number N4, third ciphertext RL a , fourth sending time T6, second verification information HRL a , third random number N5 and fifth sending time T7, third verification information HRCON a,im , sixth sending time T8, fourth ciphertext RCON a,im .

[0746] Single chat session: first hash value HID a,im,b =h(ID a ||SID im ||ID b ), the fifth ciphertext S b,im,a , second hash value HID a,b =h(ID a ||ID b ||T9).

[0747] Group chat session: first hash value HID a,im,G =h(ID a ||SID im ||ID G ), the sixth ciphertext S b,im,a,G , the third hash value HID a,G =h(ID a ||ID G ||T 11 ).

[0748] Time period TQ, fifth random number N8, ninth sending time T 13 , the fourth hash value HID a,im,b , the fifth hash value HRIDa,b , the tenth sending time T r 、The seventh ciphertext IMR a,b 11. Sending information T 14 , the twelfth sending time and the sixth random number T 15 ,N9, the eighth ciphertext RUA a , Thirteenth sending time T 16 、The sixth hash value HUA a , the fourteenth sending time T1, the ninth ciphertext A im , the third temporary session key KS rc,im , seventh random number N1, eighth random number N2, shared symmetric key K rc,im 、The tenth ciphertext RA im , fifteenth sending time T2, second preset key K im_enkey .

[0749] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0750] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0751] It should be noted that the technical solutions described in the embodiments of the present invention can be arbitrarily combined without conflict.

[0752] In addition, in the embodiments of the present invention, "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0753] refer to Fig.13 , Fig.13 is a schematic diagram of an information processing device provided by an embodiment of the present invention, the device comprising:

[0754] A first determination module is used to determine an encryption key corresponding to an operation type of the operation if an operation of communicating with a peer device triggered by a first user is detected;

[0755] A first encryption module, used to encrypt the authentication information generated by the user terminal based on the operation based on the encryption key to obtain a first ciphertext;

[0756] A first generating module, configured to generate a communication request based on the first ciphertext, wherein the communication request includes an identifier of the operation type;

[0757] The sending module is used to send the communication request to the opposite device.

[0758] In one embodiment, if the operation type is user registration, the peer device is a key server, and the encryption key corresponding to the operation type is a public key of the key server;

[0759] Correspondingly, the first encryption module is specifically used for:

[0760] Encrypting the password of the first user based on a hash function to generate a shared key between the first user and the communication server;

[0761] The authentication information is encrypted based on the public key of the key server; the authentication information includes the user name of the first user, the shared key, the first temporary session key generated by the user terminal and the key server, the first sending time of the communication request and the first random number generated by the user terminal; the user terminal inserts a newly generated random number in each communication request generated, and the peer device includes a random number sequence for storing the random number in the communication request.

[0762] In one embodiment, the device further comprises:

[0763] an information receiving module, configured to receive response information sent by the key server based on the communication request, the response information comprising a second ciphertext encrypted based on the first temporary session key, the second ciphertext comprising a second sending time of the response information and first verification information encrypted by hash; the first verification information comprising a user name of a first user, a first sending time, and a first random number obtained by decrypting the first ciphertext by the key server;

[0764] a ciphertext decryption module, configured to decrypt the second ciphertext based on the first temporary session key;

[0765] A difference determination module, used to determine whether the difference between the current time and the second sending time is less than or equal to a set value;

[0766] A consistency verification module, configured to perform consistency verification on the first verification information if the difference is less than or equal to the set value;

[0767] The registration result determination module is used to determine that the first user's registration is successful if the consistency verification is successful.

[0768] In one embodiment, if the operation type is user login, the peer device is the key server, and the encryption key corresponding to the operation type is the shared key;

[0769] Correspondingly, the first encryption module is specifically used to: encrypt the authentication information based on the shared key; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request; the communication request includes the first ciphertext and the user name of the first user.

[0770] In one embodiment, the information receiving module is further used to receive response information sent by the key server based on the communication request, the response information includes a third ciphertext encrypted based on the shared key, the third ciphertext includes a fourth sending time of the response information, second verification information encrypted by hash, a second temporary session key between the user terminal and the communication server generated by the key server, and a ticket for the first user to access the communication server generated by the key server; the second verification information includes the user name of the first user obtained by the key server decrypting the first ciphertext, a second random number and a third sending time; the ticket includes the second temporary session key, the identity of the communication server and the user name of the first user;

[0771] A ciphertext decryption module, further used to decrypt the third ciphertext based on the shared key;

[0772] The difference determination module is further used to determine whether the difference between the current time and the fourth sending time is less than or equal to the set value;

[0773] The consistency verification module is further configured to perform consistency verification on the second verification information if the difference is less than or equal to the set value;

[0774] The saving module is used to determine that the user has successfully logged in if the consistency verification is successful, and save the ticket and the second temporary session key.

[0775] In one embodiment, if the operation type is establishing a connection, the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0776] Correspondingly, the first encryption module is specifically used for:

[0777] The authentication information is encrypted based on the second temporary session key; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request; and the communication request includes the first ciphertext and the ticket.

[0778] In one embodiment, the information receiving module is further used to receive response information sent by the key server based on the communication request, the response information includes a fourth ciphertext encrypted based on the second temporary session key, the fourth ciphertext includes hash-encrypted third verification information and a sixth sending time of the response information; the third verification information includes a third random number and a fifth sending time obtained by the communication server decrypting the first ciphertext, and a user name of the first user obtained based on the ticket;

[0779] a ciphertext decryption module, further configured to decrypt the fourth ciphertext based on the second temporary session key;

[0780] The difference determination module is further used to determine whether the difference between the current time and the sixth sending time is less than or equal to the set value;

[0781] The consistency verification module is further configured to perform consistency verification on the third verification information if the difference is less than or equal to the set value;

[0782] The connection establishment module is used to determine that the connection between the user terminal and the communication server is successfully established if the consistency verification is successful.

[0783] In one embodiment, if the operation type is sending a session message, the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0784] Correspondingly, the first encryption module is specifically used to encrypt the authentication information based on the second temporary session key; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal, the seventh sending time of the communication request and the first hash value; the first hash value is obtained by hash calculation based on the user name of the first user, the identity identifier of the communication server and the user identifier of the target user; the communication request includes the first ciphertext and the user name of the first user.

[0785] In one embodiment, if the target user of the session information is a second user, a user terminal of the second user receives response information sent by the communication server based on the communication request of the first user; the response information includes the user name of the first user and a fifth ciphertext encrypted based on the second temporary session key of the first user, the fifth ciphertext includes the seventh sending time of the communication request of the first user, the eighth sending time of the response information, the first session information input by the first user, and a second hash value; the second hash value is obtained by hashing the user name of the first user, the user name of the second user, and the seventh sending time;

[0786] decrypting the fifth ciphertext based on the second temporary session key;

[0787] Determine whether the difference between the current time and the eighth sending time is less than or equal to the set value;

[0788] If the difference is less than or equal to the set value, performing consistency verification on the second Hash value;

[0789] If the consistency verification passes, the first session information is displayed in a dialog box between the first user and the second user.

[0790] In one embodiment, if the target user of the session information is a user group, the user group includes a second user, and the user name of the target user is an identity identifier of the user group;

[0791] The information receiving module is further used for the user terminal of the second user to receive the response information sent by the communication server based on the communication request of the first user; the response information includes the identity identifier of the user group, the user name of the first user and the sixth ciphertext encrypted based on the second temporary session key corresponding to the second user; the sixth ciphertext includes the seventh sending time generated by the user terminal of the first user, the eighth sending time of the response information, the first session information input by the first user and the third hash value; the third hash value is obtained by hashing based on the identity identifier of the user group, the user name of the first user and the seventh sending time;

[0792] a ciphertext decryption module, further configured to decrypt the sixth ciphertext based on the second temporary session key;

[0793] The difference determination module is further used to determine whether the difference between the current time and the eighth sending time is less than or equal to the set value;

[0794] The consistency verification module is further configured to perform consistency verification on the third Hash value if the difference is less than or equal to the set value;

[0795] The display module is configured to display the first session information of the first user in a dialog box of the user group if the consistency verification passes.

[0796] In one embodiment, if the operation type is obtaining a chat record, the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0797] Correspondingly, the first encryption module is specifically used for:

[0798] The authentication information is encrypted based on the second temporary session key; the authentication information includes the time period of the chat record between the first user and the second user, the user name of the second user, the fifth random number generated by the user terminal, the ninth sending time of the communication request and the fourth hash value, and the fourth hash value is obtained by hash calculation based on the user name of the first user, the user name of the second user and the identity of the communication server; the communication request includes the user name of the first user and the first ciphertext.

[0799] In one embodiment, the information receiving module is further used to receive response information sent by the communication server based on the communication request, the response information includes a seventh ciphertext encrypted based on the second temporary session key, the seventh ciphertext includes the third session information between the first user and the second user within the time period queried by the communication server, the user name of the second user, the tenth sending time of the third session information, the eleventh sending information of the response information, and a fifth hash value; the fifth hash value is obtained by hashing the user name of the second user decrypted by the communication server, the fifth random number, the ninth sending time, and the user name of the first user;

[0800] a ciphertext decryption module, further configured to decrypt the seventh ciphertext based on the second temporary session key;

[0801] The difference determination module is further used to determine whether the difference between the current time and the eleventh sending time is less than or equal to the set value;

[0802] The consistency verification module is further configured to perform consistency verification on the fifth Hash value if the difference is less than or equal to the set value;

[0803] The display module is further configured to display the third session information in a dialog box between the first user and the second user if the consistency verification passes.

[0804] In one embodiment, if the operation type is password update, the peer device is the key server, and the encryption key corresponding to the operation type is the shared key;

[0805] Correspondingly, the first encryption module is specifically used for:

[0806] The authentication information is encrypted based on the shared key; the authentication information includes a new shared key obtained by hashing the new password of the first user, the user name of the first user, the twelfth sending time of the communication request and the sixth random number generated by the user terminal; the communication request includes the first ciphertext and the user name of the first user.

[0807] In one embodiment, the information receiving module is further used to receive response information sent by the key server based on the communication request, the response information includes an eighth ciphertext encrypted based on the new shared key, the eighth ciphertext includes a thirteenth sending time and a sixth hash value of the response information; the sixth hash value is obtained by hashing the user name of the first user decrypted by the key server, the twelfth sending time and the sixth random number;

[0808] a ciphertext decryption module, further used to decrypt the eighth ciphertext based on the new shared key;

[0809] The difference determination module is further used to determine whether the difference between the current time and the thirteenth sending time is less than or equal to the set value;

[0810] The consistency verification module is further configured to perform consistency verification on the sixth Hash value if the difference is less than or equal to the set value;

[0811] The password update module is used to determine that the password of the first user is successfully updated if the consistency verification passes.

[0812] refer to Fig.14 , Fig.14 is a schematic diagram of an information processing device provided by an embodiment of the present invention, the device comprising:

[0813] A first receiving module is configured to receive a communication request sent by a user terminal; the communication request includes a first ciphertext and an identification of an operation type, the first ciphertext includes authentication information generated by the user terminal based on an operation of the first user, and the first ciphertext is obtained by encrypting the authentication information based on an encryption key corresponding to the operation type of the operation;

[0814] A second determination module, configured to determine a decryption key corresponding to the operation type based on the identifier;

[0815] A first decryption module, configured to decrypt the first ciphertext based on a decryption key corresponding to the operation type to obtain the authentication information;

[0816] A third determination module, used to determine whether there is a replay attack based on the authentication information;

[0817] The second generating module is used to generate response information sent to the user terminal based on the authentication information if there is no replay attack.

[0818] In one embodiment, if the operation type is user registration, the decryption key corresponding to the operation type is the private key of the key server;

[0819] Correspondingly, the first decryption module is specifically used for:

[0820] Decrypting the first ciphertext based on the private key to obtain the authentication information; the authentication information includes the user name of the first user, the shared key between the first user and the communication server, the first temporary session key generated by the user terminal and the key server, the first sending time of the communication request and a first random number; the shared key represents the password of the first user encrypted by a hash function;

[0821] Correspondingly, the third determination module is specifically used for:

[0822] Determine whether the difference between the current time and the first sending time is less than or equal to a set value;

[0823] If the difference is less than or equal to the set value, querying whether the time period corresponding to the difference includes the first random number in the first random number sequence corresponding to the key server; the first random number sequence stores the random numbers received by the key server;

[0824] If the first random number is not included, it is determined that there is no replay attack;

[0825] Correspondingly, the second generating module is specifically used for:

[0826] Perform hash encryption based on the first user's username, first sending time, and first random number obtained by decryption to generate first verification information;

[0827] Encrypting the first verification information and the second sending time based on the first temporary session key to obtain a second ciphertext; the second sending time represents the sending time of the response information;

[0828] Response information is generated based on the second ciphertext and sent to the user terminal of the first user.

[0829] In one embodiment, if there is no replay attack, the device further comprises:

[0830] A key encryption module, used to encrypt the shared key based on a first preset key to obtain a first encryption key;

[0831] The database module is used to store the username of the first user and the first encryption key in a local database in correspondence.

[0832] In one embodiment, if the operation type is user login, the decryption key corresponding to the operation type is the shared key; the communication request includes the first ciphertext and the username of the first user;

[0833] Correspondingly, the first decryption module is specifically used for:

[0834] Determining the first encryption key corresponding to the username of the first user;

[0835] Decrypting the first encryption key based on the first preset key to obtain the shared key;

[0836] decrypting the first ciphertext based on the shared key to obtain the authentication information; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request;

[0837] Correspondingly, the third determination module is specifically used for:

[0838] Determine whether the difference between the current time and the third sending time is less than or equal to the set value;

[0839] If the difference is less than or equal to the set value, querying in the first random number sequence corresponding to the key server whether the time period corresponding to the difference includes the second random number;

[0840] If the second random number is not included, it is determined that there is no replay attack;

[0841] Correspondingly, the second generating module is specifically used for:

[0842] generating a second temporary session key between the user terminal and the communication server;

[0843] Perform hash encryption based on the first user's username, the second random number, and the third sending time obtained by decryption to obtain second verification information;

[0844] generating a ticket for the first user to access the communication server based on the second temporary session key, the identity of the communication server and the user name of the first user;

[0845] Encrypting the ticket, the second verification information, the second temporary session key and the fourth sending time based on the shared key to obtain a third ciphertext; the fourth sending time represents the sending time of the response information;

[0846] Response information is generated based on the third ciphertext and sent to the user terminal of the first user.

[0847] In one embodiment, if the operation type is password update, the decryption key corresponding to the operation type is the shared key, and the communication request includes the first ciphertext and the user name of the first user;

[0848] Correspondingly, the first decryption module is specifically used for:

[0849] querying the shared key based on the username of the first user;

[0850] decrypting the first ciphertext based on the shared key to obtain the authentication information; the authentication information includes a new shared key obtained by the user terminal by hashing the new password of the first user, the user name of the first user, the twelfth sending time of the communication request and the sixth random number;

[0851] Correspondingly, the third determining module is specifically configured to:

[0852] Determine whether the difference between the current time and the twelfth sending time is less than or equal to the set value;

[0853] If the difference is less than or equal to the set value, querying in the random number sequence corresponding to the key server whether the time period corresponding to the difference includes the sixth random number;

[0854] If the sixth random number is not included, it is determined that there is no replay attack;

[0855] Correspondingly, the second generating module is specifically used for:

[0856] Perform hash encryption based on the decrypted user name of the first user, the twelfth sending time, and the sixth random number to obtain a sixth hash value;

[0857] Encrypting the sixth hash value and the thirteenth sending time based on the new shared key to obtain an eighth ciphertext; the thirteenth sending time represents the sending time of the response information;

[0858] Response information is generated based on the eighth ciphertext and sent to the user terminal of the first user.

[0859] In one embodiment, the apparatus further comprises a first registration module, configured to:

[0860] receiving a registration request sent by the communication server; the registration request comprising a ninth ciphertext, the ninth ciphertext being obtained by encrypting a third temporary session key based on the public key of the key server, a seventh random number generated by the communication server, an identity of the communication server, and a fourteenth sending time; the third temporary session key being a temporary session key generated by the communication server for communicating with the key server; the fourteenth sending time representing a sending time of the registration request;

[0861] Decrypting the ninth ciphertext based on the private key corresponding to the public key;

[0862] Based on the seventh random number and the fourteenth sending time, determining whether the registration request has been subjected to a replay attack;

[0863] If there is no replay attack, generating a shared symmetric key and an eighth random number for communicating with the communication server;

[0864] Encrypting the shared symmetric key, the eighth random number, the fifteenth sending time and the fourth verification information based on the third temporary session key to obtain a tenth ciphertext; the fourth verification information is obtained by performing hash encryption based on the eighth random number, the fifteenth sending time, the seventh random number and the identity of the communication server; the fifteenth sending time represents the sending time of the tenth ciphertext;

[0865] The tenth ciphertext is sent to the communication server.

[0866] In one embodiment, the key encryption module is further used to encrypt the shared symmetric key based on the first preset key to obtain a second encryption key;

[0867] The database module is also used to store the identity of the communication server and the second encryption key in a local database accordingly.

[0868] refer to Fig.15 , Fig.15 is a schematic diagram of an information processing device provided by an embodiment of the present invention, the device comprising:

[0869] A second receiving module is configured to receive a communication request sent by a user terminal; the communication request includes a first ciphertext and an identification of an operation type, the first ciphertext includes authentication information generated by the user terminal based on an operation of the first user, and the first ciphertext is obtained by encrypting the authentication information based on an encryption key corresponding to the operation type of the operation;

[0870] A fourth determination module, configured to determine a decryption key corresponding to the operation type based on the identifier;

[0871] A second decryption module, configured to decrypt the first ciphertext based on a decryption key corresponding to the operation type to obtain the authentication information;

[0872] A fifth determination module, configured to determine whether a replay attack occurs based on the authentication information;

[0873] The third generating module is used to generate response information sent to the user terminal based on the authentication information if there is no replay attack.

[0874] In one embodiment, the method further includes: a second registration module, configured to:

[0875] generating a third temporary session key for communicating with the key server;

[0876] Sending the registration request to the key server; the registration request includes a ninth ciphertext encrypted based on the public key of the key server, the ninth ciphertext includes the third temporary session key, the seventh random number generated by the communication server, the identity of the communication server and a fourteenth sending time; the fourteenth sending time represents the sending time of the registration request;

[0877] receiving a tenth ciphertext sent by the key server based on the registration request; the tenth ciphertext includes a shared symmetric key generated by the key server for communicating with the communication server, an eighth random number generated by the key server, a fifteenth sending time, and fourth verification information; the tenth ciphertext is encrypted based on the third temporary session key, the fifteenth sending time represents the sending time of the tenth ciphertext, and the fourth verification information is obtained by performing hash encryption based on the eighth random number, the fifteenth sending time, the seventh random number, and the identity of the communication server;

[0878] decrypting the tenth ciphertext based on the third temporary session key to obtain the shared symmetric key, the eighth random number, the fifteenth sending time and the fourth verification information;

[0879] Based on the eighth random number and the fifteenth sending time, determining whether the tenth ciphertext is under a replay attack; the communication server includes a second random number sequence for storing random numbers;

[0880] If there is no replay attack, performing consistency verification on the fourth verification information;

[0881] If the consistency verification passes, encrypting the shared symmetric key based on the second preset key of the communication server to obtain a third encryption key;

[0882] The third encryption key is stored in a local database.

[0883] In one embodiment, if the operation type is to establish a connection, the decryption key corresponding to the operation type is a second temporary session key generated by the key server for the user terminal to communicate with the communication server; the communication request includes the first ciphertext and a ticket for the first user to access the communication server; the ticket includes the second temporary session key, the identity of the communication server and the user name of the first user;

[0884] Correspondingly, the second decryption module is specifically used to:

[0885] determining the second temporary session key based on the ticket;

[0886] decrypting the first ciphertext based on the second temporary session key to obtain the authentication information; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request;

[0887] Correspondingly, the fifth determining module is specifically configured to:

[0888] Determine whether the difference between the current time and the fifth sending time is less than or equal to the set value;

[0889] If the difference is less than or equal to the set value, querying in the second random number sequence corresponding to the communication server whether the time period corresponding to the difference includes the third random number;

[0890] If the third random number is not included, it is determined that there is no replay attack;

[0891] Correspondingly, the third generating module is specifically used for:

[0892] Perform hash encryption based on the third random number obtained by decryption, the fifth sending time, and the user name of the first user to obtain third verification information;

[0893] Encrypting the third verification information and the sixth sending time based on the second temporary session key to obtain a fourth ciphertext; the sixth sending time represents the sending time of the response information;

[0894] Response information is generated based on the fourth ciphertext and sent to the user terminal of the first user.

[0895] In one embodiment, if the operation type is sending a session message, the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the user name of the first user;

[0896] Correspondingly, the second decryption module is specifically used for:

[0897] querying the second temporary session key based on the username of the first user;

[0898] The first ciphertext is decrypted based on the second temporary session key to obtain the authentication information; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal and the seventh sending time of the communication request, and a first hash value obtained by hashing the user name of the first user, the identity identifier of the communication server and the user identifier of the target user.

[0899] In one embodiment, if the target user of the session information is the second user, the third generating module is specifically configured to:

[0900] Perform hash encryption based on the user name of the first user, the user name of the second user, and the seventh sending time to obtain a second hash value;

[0901] Encrypting the second hash value, the first session information input by the first user, the seventh sending time and the eighth sending time based on the second temporary session key to obtain the fifth ciphertext; the eighth sending time represents the sending time of the response information;

[0902] Based on the fifth ciphertext and the user name of the first user, response information is generated and sent to the user terminal of the second user.

[0903] In one embodiment, if the target user of the session information is a user group, the user group includes a second user, and the user name of the target user is an identity identifier of the user group, the third generating module is specifically configured to:

[0904] Performing hash encryption based on the user name of the first user, the identity identifier of the user group, and the seventh sending time to obtain a third hash value;

[0905] Encrypt the third Hash value, the first session information, the seventh sending time, and the eighth sending time based on the second temporary session key of the second user to obtain the sixth ciphertext;

[0906] Based on the sixth ciphertext, the user name of the first user and the identity identifier of the user group, response information is generated and sent to the user terminal of the second user.

[0907] In one embodiment, if the operation type is obtaining chat records, the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the username of the first user;

[0908] Correspondingly, the second decryption module is specifically used for:

[0909] querying the second temporary session key based on the username of the first user;

[0910] decrypting the first ciphertext based on the second temporary session key to obtain the authentication information; the authentication information includes a time period of the chat record between the first user and the second user, a user name of the second user, a fifth random number generated by the user terminal, a ninth sending time of the communication request, and a fourth hash value; the fourth hash value is obtained by performing a hash calculation based on the user name of the first user, the user name of the second user, and an identity identifier of the communication server;

[0911] Correspondingly, the fifth determining module is specifically configured to:

[0912] Determine whether the difference between the current time and the ninth sending time is less than or equal to the set value;

[0913] If the difference is less than or equal to the set value, querying in the random number sequence corresponding to the key server whether the time period corresponding to the difference includes the fifth random number;

[0914] If the fifth random number is not included, it is determined that there is no replay attack;

[0915] Correspondingly, the third generating module is specifically used for:

[0916] Based on the user name of the first user, the user name of the second user, and the time period, querying third session information between the first user and the second user within the time period;

[0917] Performing hash encryption on the user name of the first user, the decrypted user name of the second user, the fifth random number, and the ninth sending time to obtain the fifth hash value;

[0918] Encrypt the third session information, the fifth Hash value, the user name of the second user, the tenth sending time of the third session information, and the eleventh sending information based on the second temporary session key to obtain a seventh ciphertext; the eleventh sending information represents the sending time of the response information;

[0919] Response information is generated based on the seventh ciphertext and sent to the user terminal of the first user.

[0920] In actual application, the sending module, the first encryption module, the first determination module and the first generation module can be implemented by a processor in the user terminal, such as a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU) or a programmable gate array (FPGA).

[0921] It should be noted that: when the information processing device provided in the above embodiment performs information processing, only the division of the above modules is used as an example. In actual applications, the above processing can be assigned to different modules as needed, that is, the internal structure of the device is divided into different modules to complete all or part of the processing described above. In addition, the information processing device provided in the above embodiment and the information processing method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0922] Based on the hardware implementation of the above program modules and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a user terminal. Fig.16 The hardware structure diagram of the user terminal of the embodiment of the present application is as follows: Fig.16 As shown, the user terminal includes:

[0923] Communication interface, which can exchange information with other devices such as network equipment;

[0924] The processor is connected to the communication interface to realize information interaction with other devices, and is used to execute the method provided by one or more technical solutions on the user terminal side when running the computer program. The computer program is stored in the memory.

[0925] Of course, in actual application, the various components in the user terminal are coupled together through the bus system. It can be understood that the bus system is used to realize the connection and communication between these components. In addition to the data bus, the bus system also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Fig.16 In the specification, various buses are labeled as bus systems.

[0926] The memory in the embodiment of the present application is used to store various types of data to support the operation of the user terminal. Examples of such data include: any computer program used to operate on the user terminal.

[0927] The embodiment of the present application also provides a key server. Fig.17This is a schematic diagram of the hardware structure of the key server of the embodiment of the present application, such as Fig.17 As shown, the key server includes:

[0928] Communication interface, which can exchange information with other devices such as network equipment;

[0929] The processor is connected to the communication interface to realize information exchange with other devices, and is used to execute the method provided by one or more technical solutions on the key server side when running the computer program. The computer program is stored in the memory.

[0930] Of course, in actual application, the various components in the key server are coupled together through a bus system. It is understandable that the bus system is used to realize the connection and communication between these components. In addition to the data bus, the bus system also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.17 In the specification, various buses are labeled as bus systems.

[0931] The embodiment of the present application also provides a communication server. Fig.18 The hardware structure diagram of the communication server of the present application embodiment is as follows: Fig.18 As shown, the key server includes:

[0932] Communication interface, which can exchange information with other devices such as network equipment;

[0933] The processor is connected to the communication interface to realize information exchange with other devices, and is used to execute the method provided by one or more technical solutions of the communication server side when running the computer program. The computer program is stored in the memory.

[0934] Of course, in actual application, the various components in the communication server are coupled together through the bus system. It can be understood that the bus system is used to realize the connection and communication between these components. In addition to the data bus, the bus system also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.18 In the specification, various buses are labeled as bus systems.

[0935] It can be understood that the memory can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a ferro magnetic random access memory, a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memories described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

[0936] The method disclosed in the above embodiment of the present application can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in a memory, and the processor reads the program in the memory and completes the steps of the above method in combination with its hardware.

[0937] Optionally, when the processor executes the program, it implements the corresponding processes implemented by the user terminal / communication server / key server in each method of the embodiments of the present application. For the sake of brevity, they are not repeated here.

[0938] In an exemplary embodiment, the present application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, for example, including a first memory storing a computer program, and the computer program can be executed by a processor of a user terminal / communication server / key server to complete the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPRO M, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0939] In the several embodiments provided in the present application, it should be understood that the disclosed apparatus, user terminal / communication server / key server and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0940] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0941] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0942] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium, which, when executed, executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, disks or optical disks.

[0943] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0944] It should be noted that the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0945] In addition, in the examples of the present application, "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0946] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An information processing method, applied to a user terminal, comprising: If an operation of communicating with a peer device triggered by the first user is detected, determining an encryption key corresponding to an operation type of the operation; Encrypting the authentication information generated by the user terminal based on the operation based on the encryption key to obtain a first ciphertext; generating a communication request based on the first ciphertext, wherein the communication request includes an identifier of the operation type; The communication request is sent to the opposite device.

2. The method according to claim 1, characterized in that If the operation type is user registration, the peer device is a key server, and the encryption key corresponding to the operation type is a public key of the key server; Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes: Encrypting the password of the first user based on a hash function to generate a shared key between the first user and the communication server; The authentication information is encrypted based on the public key of the key server; the authentication information includes the user name of the first user, the shared key, the first temporary session key generated by the user terminal and the key server, the first sending time of the communication request and the first random number generated by the user terminal; the user terminal inserts a newly generated random number in each communication request generated, and the peer device includes a random number sequence for storing the random number in the communication request.

3. The method according to claim 2, characterized in that The method further comprises: receiving a response message sent by the key server based on the communication request, the response message including a second ciphertext encrypted based on the first temporary session key, the second ciphertext including a second sending time of the response message and first verification information encrypted by hash; the first verification information including a user name of the first user, a first sending time, and a first random number obtained by decrypting the first ciphertext by the key server; decrypting the second ciphertext based on the first temporary session key; Determine whether the difference between the current time and the second sending time is less than or equal to a set value; If the difference is less than or equal to the set value, performing consistency verification on the first verification information; If the consistency verification is successful, it is determined that the first user has been successfully registered.

4. The method according to claim 3, characterized in that: If the operation type is user login, the peer device is the key server, and the encryption key corresponding to the operation type is the shared key; Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes: The authentication information is encrypted based on the shared key; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request; and the communication request includes the first ciphertext and a user name of the first user.

5. The method according to claim 4, characterized in that The method further comprises: Receive response information sent by the key server based on the communication request, the response information including a third ciphertext encrypted based on the shared key, the third ciphertext including a fourth sending time of the response information, second verification information encrypted by hash, a second temporary session key between the user terminal and the communication server generated by the key server, and a ticket for the first user to access the communication server generated by the key server; the second verification information includes a user name of the first user obtained by decrypting the first ciphertext by the key server, a second random number, and a third sending time; the ticket includes the second temporary session key, an identity identifier of the communication server, and a user name of the first user; decrypting the third ciphertext based on the shared key; Determine whether the difference between the current time and the fourth sending time is less than or equal to the set value; If the difference is less than or equal to the set value, performing consistency verification on the second verification information; If the consistency verification is successful, it is determined that the user has logged in successfully, and the ticket and the second temporary session key are saved.

6. The method according to claim 5, characterized in that If the operation type is establishing a connection, the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key; Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes: The authentication information is encrypted based on the second temporary session key; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request; and the communication request includes the first ciphertext and the ticket.

7. The method according to claim 6, characterized in that The method further comprises: receiving response information sent by the key server based on the communication request, the response information including a fourth ciphertext encrypted based on the second temporary session key, the fourth ciphertext including third verification information encrypted by hash and a sixth sending time of the response information; the third verification information including a third random number and a fifth sending time obtained by the communication server decrypting the first ciphertext, and a user name of the first user obtained based on the ticket; decrypting the fourth ciphertext based on the second temporary session key; Determine whether the difference between the current time and the sixth sending time is less than or equal to the set value; If the difference is less than or equal to the set value, performing consistency verification on the third verification information; If the consistency verification is successful, it is determined that the connection between the user terminal and the communication server is successfully established.

8. The method according to claim 7, characterized in that If the operation type is sending a session message, the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key; Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes: The authentication information is encrypted based on the second temporary session key; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal, the seventh sending time of the communication request and the first hash value; the first hash value is obtained by hash calculation based on the user name of the first user, the identity identifier of the communication server and the user identifier of the target user; the communication request includes the first ciphertext and the user name of the first user.

9. The method according to claim 8, characterized in that If the target user of the session information is the second user, the method further includes: The user terminal of the second user receives the response information sent by the communication server based on the communication request of the first user; the response information includes the user name of the first user and the fifth ciphertext encrypted based on the second temporary session key of the first user, the fifth ciphertext includes the seventh sending time of the communication request of the first user, the eighth sending time of the response information, the first session information input by the first user and the second hash value; the second hash value is obtained by hashing the user name of the first user, the user name of the second user and the seventh sending time; decrypting the fifth ciphertext based on the second temporary session key; Determine whether the difference between the current time and the eighth sending time is less than or equal to the set value; If the difference is less than or equal to the set value, performing consistency verification on the second Hash value; If the consistency verification passes, the first session information is displayed in a dialog box between the first user and the second user.

10. The method according to claim 8, characterized in that If the target user of the session information is a user group, the user group includes a second user, and the user name of the target user is an identity identifier of the user group, the method further includes: The user terminal of the second user receives the response information sent by the communication server based on the communication request of the first user; the response information includes the identity of the user group, the user name of the first user and the sixth ciphertext encrypted based on the second temporary session key corresponding to the second user; the sixth ciphertext includes the seventh sending time generated by the user terminal of the first user, the eighth sending time of the response information, the first session information input by the first user and the third hash value; the third hash value is obtained by hashing based on the identity of the user group, the user name of the first user and the seventh sending time; decrypting the sixth ciphertext based on the second temporary session key; Determine whether the difference between the current time and the eighth sending time is less than or equal to the set value; If the difference is less than or equal to the set value, performing consistency verification on the third Hash value; If the consistency verification passes, the first session information of the first user is displayed in the dialog box of the user group.

11. The method according to claim 5, characterized in that If the operation type is obtaining chat records, the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key; Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes: encrypting the authentication information based on the second temporary session key; The authentication information includes the time period of the chat record selected by the first user with the second user, the username of the second user, the fifth random number generated by the user terminal, the ninth sending time of the communication request and the fourth hash value, and the fourth hash value is obtained by hash calculation based on the username of the first user, the username of the second user and the identity of the communication server; the communication request includes the username of the first user and the first ciphertext.

12. The method according to claim 11, characterized in that The method further comprises: receiving response information sent by the communication server based on the communication request, the response information including a seventh ciphertext encrypted based on the second temporary session key, the seventh ciphertext including a third session information between the first user and the second user within the time period queried by the communication server, a user name of the second user, a tenth sending time of the third session information, an eleventh sending information of the response information, and a fifth hash value; the fifth hash value is obtained by hashing the user name of the second user decrypted by the communication server, a fifth random number, the ninth sending time, and the user name of the first user; decrypting the seventh ciphertext based on the second temporary session key; Determine whether the difference between the current time and the eleventh sending time is less than or equal to the set value; If the difference is less than or equal to the set value, performing consistency verification on the fifth Hash value; If the consistency verification passes, the third session information is displayed in a dialog box between the first user and the second user.

13. The method according to claim 4, characterized in that If the operation type is password update, the peer device is the key server, and the encryption key corresponding to the operation type is the shared key; Correspondingly, encrypting the authentication information generated by the user terminal based on the operation based on the encryption key includes: The authentication information is encrypted based on the shared key; the authentication information includes a new shared key obtained by hashing the new password of the first user, the user name of the first user, the twelfth sending time of the communication request and the sixth random number generated by the user terminal; the communication request includes the first ciphertext and the user name of the first user.

14. The method according to claim 13, characterized in that The method further comprises: receiving response information sent by the key server based on the communication request, the response information including an eighth ciphertext encrypted based on the new shared key, the eighth ciphertext including a thirteenth sending time and a sixth hash value of the response information; the sixth hash value is obtained by hashing the user name of the first user decrypted by the key server, the twelfth sending time and the sixth random number; decrypting the eighth ciphertext based on the new shared key; Determine whether the difference between the current time and the thirteenth sending time is less than or equal to the set value; If the difference is less than or equal to the set value, performing consistency verification on the sixth Hash value; If the consistency verification passes, it is determined that the password of the first user is updated successfully.

15. An information processing method, applied to a key server, the method comprising: receiving a communication request sent by a user terminal; The communication request includes a first ciphertext and an identification of an operation type, the first ciphertext includes authentication information generated by the user terminal based on an operation of the first user, and the first ciphertext is obtained by encrypting the authentication information based on an encryption key corresponding to the operation type of the operation; Determine a decryption key corresponding to the operation type based on the identifier; decrypting the first ciphertext based on the decryption key corresponding to the operation type to obtain the authentication information; Determining whether a replay attack exists based on the authentication information; If there is no replay attack, response information is generated based on the authentication information and sent to the user terminal.

16. The method according to claim 15, characterized in that If the operation type is user registration, the decryption key corresponding to the operation type is the private key of the key server; Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes: Decrypting the first ciphertext based on the private key to obtain the authentication information; the authentication information includes the user name of the first user, the shared key between the first user and the communication server, the first temporary session key generated by the user terminal and the key server, the first sending time of the communication request and a first random number; the shared key represents the password of the first user encrypted by a hash function; Correspondingly, determining whether a replay attack exists based on the authentication information includes: Determine whether the difference between the current time and the first sending time is less than or equal to a set value; If the difference is less than or equal to the set value, querying whether the time period corresponding to the difference includes the first random number in the first random number sequence corresponding to the key server; the first random number sequence stores the random numbers received by the key server; If the first random number is not included, it is determined that there is no replay attack; Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes: Perform hash encryption based on the first user's username, first sending time, and first random number obtained by decryption to generate first verification information; Encrypting the first verification information and the second sending time based on the first temporary session key to obtain a second ciphertext; the second sending time represents the sending time of the response information; Response information is generated based on the second ciphertext and sent to the user terminal of the first user.

17. The method according to claim 16, characterized in that If there is no replay attack, the method further includes: Encrypt the shared key based on a first preset key to obtain a first encryption key; The user name of the first user and the first encryption key are stored in a local database in correspondence.

18. The method according to claim 17, characterized in that If the operation type is user login, the decryption key corresponding to the operation type is the shared key; the communication request includes the first ciphertext and the username of the first user; Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes: Determining the first encryption key corresponding to the username of the first user; Decrypting the first encryption key based on the first preset key to obtain the shared key; decrypting the first ciphertext based on the shared key to obtain the authentication information; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request; Correspondingly, determining whether a replay attack exists based on the authentication information includes: Determine whether the difference between the current time and the third sending time is less than or equal to the set value; If the difference is less than or equal to the set value, querying in the first random number sequence corresponding to the key server whether the time period corresponding to the difference includes the second random number; If the second random number is not included, it is determined that there is no replay attack; Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes: generating a second temporary session key between the user terminal and the communication server; Perform hash encryption based on the first user's username, the second random number, and the third sending time obtained by decryption to obtain second verification information; generating a ticket for the first user to access the communication server based on the second temporary session key, the identity of the communication server and the user name of the first user; Encrypting the ticket, the second verification information, the second temporary session key and the fourth sending time based on the shared key to obtain a third ciphertext; the fourth sending time represents the sending time of the response information; Response information is generated based on the third ciphertext and sent to the user terminal of the first user.

19. The method according to claim 18, characterized in that If the operation type is password update, the decryption key corresponding to the operation type is the shared key, and the communication request includes the first ciphertext and the user name of the first user; Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes: querying the shared key based on the username of the first user; decrypting the first ciphertext based on the shared key to obtain the authentication information; the authentication information includes a new shared key obtained by the user terminal by hashing the new password of the first user, the user name of the first user, the twelfth sending time of the communication request and the sixth random number; Correspondingly, determining whether a replay attack exists based on the authentication information includes: Determine whether the difference between the current time and the twelfth sending time is less than or equal to the set value; If the difference is less than or equal to the set value, querying in the random number sequence corresponding to the key server whether the time period corresponding to the difference includes the sixth random number; If the sixth random number is not included, it is determined that there is no replay attack; Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes: Perform hash encryption based on the decrypted user name of the first user, the twelfth sending time, and the sixth random number to obtain a sixth hash value; Encrypting the sixth hash value and the thirteenth sending time based on the new shared key to obtain an eighth ciphertext; the thirteenth sending time represents the sending time of the response information; Response information is generated based on the eighth ciphertext and sent to the user terminal of the first user.

20. The method according to claim 19, characterized in that The method further comprises: receiving a registration request sent by the communication server; the registration request comprising a ninth ciphertext, the ninth ciphertext being obtained by encrypting a third temporary session key based on the public key of the key server, a seventh random number generated by the communication server, an identity of the communication server, and a fourteenth sending time; the third temporary session key being a temporary session key generated by the communication server for communicating with the key server; the fourteenth sending time representing a sending time of the registration request; Decrypting the ninth ciphertext based on the private key corresponding to the public key; Determining whether a replay attack exists on the registration request based on the seventh random number and the fourteenth sending time; If there is no replay attack, generating a shared symmetric key and an eighth random number for communicating with the communication server; Encrypting the shared symmetric key, the eighth random number, the fifteenth sending time and the fourth verification information based on the third temporary session key to obtain a tenth ciphertext; the fourth verification information is obtained by performing hash encryption based on the eighth random number, the fifteenth sending time, the seventh random number and the identity of the communication server; the fifteenth sending time represents the sending time of the tenth ciphertext; The tenth ciphertext is sent to the communication server.

21. The method according to claim 20, characterized in that The method further comprises: Encrypting the shared symmetric key based on the first preset key to obtain a second encryption key; The identity identifier of the communication server and the second encryption key are stored in a local database correspondingly.

22. An information processing method, used in a communication server, characterized in that: include: receiving a communication request sent by a user terminal; The communication request includes a first ciphertext and an identification of an operation type, the first ciphertext includes authentication information generated by the user terminal based on an operation of the first user, and the first ciphertext is obtained by encrypting the authentication information based on an encryption key corresponding to the operation type of the operation; Determine a decryption key corresponding to the operation type based on the identifier; decrypting the first ciphertext based on the decryption key corresponding to the operation type to obtain the authentication information; Determining whether a replay attack exists based on the authentication information; If there is no replay attack, response information is generated based on the authentication information and sent to the user terminal.

23. The method according to claim 22, characterized in that The method further comprises: generating a third temporary session key for communicating with the key server; Sending the registration request to the key server; the registration request includes a ninth ciphertext encrypted based on the public key of the key server, the ninth ciphertext includes the third temporary session key, the seventh random number generated by the communication server, the identity of the communication server and a fourteenth sending time; the fourteenth sending time represents the sending time of the registration request; receiving a tenth ciphertext sent by the key server based on the registration request; the tenth ciphertext includes a shared symmetric key generated by the key server for communicating with the communication server, an eighth random number generated by the key server, a fifteenth sending time, and fourth verification information; the tenth ciphertext is encrypted based on the third temporary session key, the fifteenth sending time represents the sending time of the tenth ciphertext, and the fourth verification information is obtained by performing hash encryption based on the eighth random number, the fifteenth sending time, the seventh random number, and the identity of the communication server; decrypting the tenth ciphertext based on the third temporary session key to obtain the shared symmetric key, the eighth random number, the fifteenth sending time and the fourth verification information; Based on the eighth random number and the fifteenth sending time, determining whether the tenth ciphertext is under a replay attack; the communication server includes a second random number sequence for storing random numbers; If there is no replay attack, performing consistency verification on the fourth verification information; If the consistency verification passes, encrypting the shared symmetric key based on the second preset key of the communication server to obtain a third encryption key; The third encryption key is stored in a local database.

24. The method according to claim 23, characterized in that If the operation type is to establish a connection, the decryption key corresponding to the operation type is a second temporary session key generated by the key server for the communication between the user terminal and the communication server; the communication request includes the first ciphertext and a ticket for the first user to access the communication server; the ticket includes the second temporary session key, the identity of the communication server and the user name of the first user; Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes: determining the second temporary session key based on the ticket; decrypting the first ciphertext based on the second temporary session key to obtain the authentication information; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request; Correspondingly, determining whether a replay attack exists based on the authentication information includes: Determine whether the difference between the current time and the fifth sending time is less than or equal to the set value; If the difference is less than or equal to the set value, querying in the second random number sequence corresponding to the communication server whether the time period corresponding to the difference includes the third random number; If the third random number is not included, it is determined that there is no replay attack; Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes: Perform hash encryption based on the third random number obtained by decryption, the fifth sending time, and the user name of the first user to obtain third verification information; Encrypting the third verification information and the sixth sending time based on the second temporary session key to obtain a fourth ciphertext; the sixth sending time represents the sending time of the response information; Response information is generated based on the fourth ciphertext and sent to the user terminal of the first user.

25. The method according to claim 24, characterized in that If the operation type is sending a session message, the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the user name of the first user; Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes: querying the second temporary session key based on the username of the first user; The first ciphertext is decrypted based on the second temporary session key to obtain the authentication information; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal and the seventh sending time of the communication request, and a first hash value obtained by hashing the user name of the first user, the identity identifier of the communication server and the user identifier of the target user.

26. The method according to claim 25, characterized in that If the target user of the session information is the second user, generating response information sent to the user terminal based on the authentication information includes: Perform hash encryption based on the user name of the first user, the user name of the second user, and the seventh sending time to obtain a second hash value; Encrypting the second hash value, the first session information input by the first user, the seventh sending time and the eighth sending time based on the second temporary session key to obtain the fifth ciphertext; the eighth sending time represents the sending time of the response information; Based on the fifth ciphertext and the user name of the first user, response information is generated and sent to the user terminal of the second user.

27. The method according to claim 25, characterized in that If the target user of the session information is a user group, the user group includes a second user, and the user name of the target user is an identity identifier of the user group, the generating of the response information sent to the user terminal based on the authentication information includes: Performing hash encryption based on the user name of the first user, the identity identifier of the user group, and the seventh sending time to obtain a third hash value; Encrypt the third Hash value, the first session information, the seventh sending time, and the eighth sending time based on the second temporary session key of the second user to obtain the sixth ciphertext; Based on the sixth ciphertext, the user name of the first user and the identity identifier of the user group, response information is generated and sent to the user terminal of the second user.

28. The method according to claim 25, characterized in that If the operation type is obtaining chat records, the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the username of the first user; Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes: querying the second temporary session key based on the username of the first user; decrypting the first ciphertext based on the second temporary session key to obtain the authentication information; the authentication information includes a time period of the chat record between the first user and the second user, a user name of the second user, a fifth random number generated by the user terminal, a ninth sending time of the communication request, and a fourth hash value; the fourth hash value is obtained by performing a hash calculation based on the user name of the first user, the user name of the second user, and an identity identifier of the communication server; Correspondingly, determining whether a replay attack exists based on the authentication information includes: Determine whether the difference between the current time and the ninth sending time is less than or equal to the set value; If the difference is less than or equal to the set value, querying in the random number sequence corresponding to the key server whether the time period corresponding to the difference includes the fifth random number; If the fifth random number is not included, it is determined that there is no replay attack; Correspondingly, the generating, based on the authentication information, response information sent to the user terminal includes: Based on the user name of the first user, the user name of the second user, and the time period, querying the third session information between the first user and the second user within the time period; Performing hash encryption on the user name of the first user, the decrypted user name of the second user, the fifth random number, and the ninth sending time to obtain the fifth hash value; Encrypt the third session information, the fifth Hash value, the user name of the second user, the tenth sending time of the third session information, and the eleventh sending information based on the second temporary session key to obtain a seventh ciphertext; the eleventh sending information represents the sending time of the response information; Response information is generated based on the seventh ciphertext and sent to the user terminal of the first user.

29. An information processing device, characterized in that: include: A first determination module is used to determine an encryption key corresponding to an operation type of the operation if an operation of communicating with a peer device triggered by a first user is detected; A first encryption module, used to encrypt the authentication information generated by the user terminal based on the operation based on the encryption key to obtain a first ciphertext; A first generating module, configured to generate a communication request based on the first ciphertext, wherein the communication request includes an identifier of the operation type; The sending module is used to send the communication request to the opposite device.

30. An information processing device, characterized in that: include: A first receiving module, used to receive a communication request sent by a user terminal; The communication request includes a first ciphertext and an identification of an operation type, the first ciphertext includes authentication information generated by the user terminal based on an operation of the first user, and the first ciphertext is obtained by encrypting the authentication information based on an encryption key corresponding to the operation type of the operation; A second determination module, configured to determine a decryption key corresponding to the operation type based on the identifier; A first decryption module, configured to decrypt the first ciphertext based on a decryption key corresponding to the operation type to obtain the authentication information; A third determination module, used to determine whether there is a replay attack based on the authentication information; The second generating module is used to generate response information sent to the user terminal based on the authentication information if there is no replay attack.

31. An information processing device, characterized in that: include: A second receiving module, used to receive a communication request sent by a user terminal; The communication request includes a first ciphertext and an identification of an operation type, the first ciphertext includes authentication information generated by the user terminal based on an operation of the first user, and the first ciphertext is obtained by encrypting the authentication information based on an encryption key corresponding to the operation type of the operation; A fourth determination module, configured to determine a decryption key corresponding to the operation type based on the identifier; A second decryption module, configured to decrypt the first ciphertext based on a decryption key corresponding to the operation type to obtain the authentication information; A fifth determination module, configured to determine whether a replay attack occurs based on the authentication information; The third generating module is used to generate response information sent to the user terminal based on the authentication information if there is no replay attack.

32. A user terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the information processing method according to any one of claims 1 to 14 is implemented.

33. A key server, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the information processing method according to any one of claims 15 to 21 is implemented.

34. A communication server comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the information processing method according to any one of claims 16 to 28 is implemented.

35. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the information processing method according to any one of claims 1 to 28.

Images