Information processing methods, devices, user terminals and storage media

Abstract

This invention relates to the field of information processing technology and provides an information processing method, apparatus, terminal, and storage medium. The information processing method includes: if an operation triggered by a first user to communicate with a peer device is detected, determining an encryption key corresponding to the operation type; encrypting authentication information generated by the user terminal based on the operation using the encryption key to obtain first ciphertext; generating a communication request based on the first ciphertext, the communication request including an identifier of the operation type; and sending the communication request to the peer device. This embodiment enhances the security of each communication process, enabling more secure communication information transmission.

Description

Technical Field

[0001] This invention relates to the field of information processing technology, and in particular to an information processing method, apparatus, user terminal, and storage medium. Background Technology

[0002] Currently, communication software uses plaintext transmission or simple encryption methods to transmit information, resulting in low communication security and making it easy for user information to be leaked. Summary of the Invention

[0003] To address the aforementioned problems, embodiments of the present invention provide an information processing method, apparatus, user terminal, and storage medium, to at least resolve the issue of low communication security in communication software in related technologies.

[0004] The technical solution of this invention is implemented as follows:

[0005] On one hand, embodiments of the present invention provide an information processing method for a user terminal, the method comprising:

[0006] If an operation triggered by the first user to communicate with the peer device is detected, determine the encryption key corresponding to the operation type of the operation;

[0007] The authentication information generated by the user terminal based on the operation is encrypted using the encryption key to obtain the first ciphertext;

[0008] A communication request is generated based on the first ciphertext, and the communication request includes an identifier of the operation type;

[0009] The communication request is sent to the peer device.

[0010] In the above scheme, if the operation type is user registration, then the peer device is a key server, and the encryption key corresponding to the operation type is the public key of the key server.

[0011] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes:

[0012] The password of the first user is encrypted using a hash function to generate a shared key between the first user and the communication server;

[0013] The authentication information is encrypted using the public key of the key server; the authentication information includes the username of the first user, the shared key, the first temporary session key generated by the user terminal and the key server, the first sending time of the communication request, and the first random number generated by the user terminal; the user terminal inserts a newly generated random number into each generated communication request, and the peer device includes a random number sequence that stores the random number in the communication request.

[0014] In the above scheme, the method further includes:

[0015] The system receives a response from the key server based on the communication request. The response includes a second ciphertext encrypted with the first temporary session key. The second ciphertext includes a second sending time of the response and a first verification information encrypted with a hash. The first verification information includes the username, first sending time, and first random number of the first user obtained by the key server decrypting the first ciphertext.

[0016] Decrypt the second ciphertext based on the first temporary session key;

[0017] Determine whether the difference between the current time and the second transmission time is less than or equal to a set value;

[0018] If the difference is less than or equal to the set value, then the first verification information is subjected to consistency verification.

[0019] If the consistency verification is successful, the first user is confirmed to have registered successfully.

[0020] In the above scheme, if the operation type is user login, then the peer device is the key server, and the encryption key corresponding to the operation type is the shared key;

[0021] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes:

[0022] The authentication information is encrypted based on the shared key; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request; the communication request includes the first ciphertext and the username of the first user.

[0023] In the above scheme, the method further includes:

[0024] The system receives a response from the key server based on the communication request. The response includes a third ciphertext encrypted with the shared key. The third ciphertext includes a fourth sending time of the response, hash-encrypted second verification information, a second temporary session key generated by the key server between the user terminal and the communication server, and a ticket generated by the key server for the first user to access the communication server. The second verification information includes the username of the first user obtained by decrypting the first ciphertext, a second random number, and a third sending time. The ticket includes the second temporary session key, the identity identifier of the communication server, and the username of the first user.

[0025] Decrypt the third ciphertext based on the shared key;

[0026] Determine whether the difference between the current time and the fourth transmission time is less than or equal to the set value;

[0027] If the difference is less than or equal to the set value, then the second verification information is subjected to consistency verification.

[0028] If the consistency verification is successful, the user login is confirmed to be successful, and the ticket and the second temporary session key are saved.

[0029] In the above scheme, if the operation type is to establish a connection, then the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0030] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes:

[0031] The authentication information is encrypted based on the second temporary session key; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request; the communication request includes the first ciphertext and the ticket.

[0032] In the above scheme, the method further includes:

[0033] The system receives a response from the key server based on the communication request. The response includes a fourth ciphertext encrypted with the second temporary session key. The fourth ciphertext includes a third verification message encrypted with a hash and a sixth sending time of the response. The third verification message includes a third random number and a fifth sending time obtained by the communication server from decrypting the first ciphertext, and the username of the first user obtained based on the ticket.

[0034] Decrypt the fourth ciphertext based on the second temporary session key;

[0035] Determine whether the difference between the current time and the sixth transmission time is less than or equal to the set value;

[0036] If the difference is less than or equal to the set value, then the third verification information is subjected to consistency verification.

[0037] If the consistency verification is successful, it is determined that the connection between the user terminal and the communication server has been successfully established.

[0038] In the above scheme, if the operation type is sending a session message, then the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0039] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes:

[0040] The authentication information is encrypted based on the second temporary session key; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal, the seventh sending time of the communication request, and the first hash value; the first hash value is obtained by hashing the username of the first user, the identity identifier of the communication server, and the user identifier of the target user; the communication request includes the first ciphertext and the username of the first user.

[0041] In the above scheme, if the target user of the session information is a second user, the method further includes:

[0042] The second user's user terminal receives response information sent by the communication server based on the communication request of the first user; the response information includes the username of the first user and a fifth ciphertext encrypted based on the second temporary session key of the first user, the fifth ciphertext includes the seventh sending time of the communication request of the first user, the eighth sending time of the response information, the first session information input by the first user, and the second hash value; the second hash value is obtained by hash calculation based on the username of the first user, the username of the second user, and the seventh sending time.

[0043] Decrypt the fifth ciphertext based on the second temporary session key;

[0044] Determine whether the difference between the current time and the eighth transmission time is less than or equal to the set value;

[0045] If the difference is less than or equal to the set value, the second hash value is subjected to consistency verification;

[0046] If the consistency verification passes, the first session information will be displayed in the dialog box between the first user and the second user.

[0047] In the above scheme, if the target user of the session information is a user group, the user group includes a second user, and the username of the target user is the identifier of the user group, the method further includes:

[0048] The second user's user terminal receives a response message sent by the communication server based on the communication request of the first user; the response message includes the identity identifier of the user group, the username of the first user, and a sixth ciphertext encrypted based on the second temporary session key corresponding to the second user; the sixth ciphertext includes a seventh sending time generated by the first user's user terminal, an eighth sending time of the response message, first session information input by the first user, and a third hash value; the third hash value is obtained by hash calculation based on the identity identifier of the user group, the username of the first user, and the seventh sending time;

[0049] Decrypt the sixth ciphertext based on the second temporary session key;

[0050] Determine whether the difference between the current time and the eighth transmission time is less than or equal to the set value;

[0051] If the difference is less than or equal to the set value, a consistency verification is performed on the third hash value;

[0052] If the consistency verification passes, the first user's first session information will be displayed in the dialog box of the user group.

[0053] In the above scheme, if the operation type is to obtain chat history, then the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0054] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes:

[0055] The authentication information is encrypted based on the second temporary session key; the authentication information includes the time period of the chat history between the first user and the second user selected by the first user, the username of the second user, the fifth random number generated by the user terminal, the ninth sending time of the communication request, and the fourth hash value, the fourth hash value being obtained by hashing the username of the first user, the username of the second user, and the identity identifier of the communication server; the communication request includes the username of the first user and the first ciphertext.

[0056] In the above scheme, the method further includes:

[0057] The system receives a response message sent by the communication server based on the communication request. The response message includes a seventh ciphertext encrypted based on the second temporary session key. The seventh ciphertext includes the third session information between the first user and the second user within the time period queried by the communication server, the username of the second user, the tenth sending time of the third session information, the eleventh sending information of the response message, and a fifth hash value. The fifth hash value is obtained by hashing the username of the second user, the fifth random number, the ninth sending time, and the username of the first user, which are decrypted by the communication server.

[0058] Decrypt the seventh ciphertext based on the second temporary session key;

[0059] Determine whether the difference between the current time and the eleventh transmission time is less than or equal to the set value;

[0060] If the difference is less than or equal to the set value, a consistency verification is performed on the fifth hash value;

[0061] If the consistency verification passes, the third session information will be displayed in the dialog box between the first user and the second user.

[0062] In the above scheme, if the operation type is password update, then the peer device is the key server, and the encryption key corresponding to the operation type is the shared key;

[0063] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes:

[0064] The authentication information is encrypted based on the shared key; the authentication information includes a new shared key obtained by hashing the new password of the first user, the username of the first user, the twelfth sending time of the communication request, and the sixth random number generated by the user terminal; the communication request includes the first ciphertext and the username of the first user.

[0065] In the above scheme, the method further includes:

[0066] The system receives a response message sent by the key server based on the communication request. The response message includes an eighth ciphertext encrypted with the new shared key. The eighth ciphertext includes the thirteenth sending time and the sixth hash value of the response message. The sixth hash value is obtained by hashing the username of the first user, the twelfth sending time, and the sixth random number obtained by the key server after decryption.

[0067] Decrypt the eighth ciphertext based on the new shared key;

[0068] Determine whether the difference between the current time and the thirteenth transmission time is less than or equal to the set value;

[0069] If the difference is less than or equal to the set value, a consistency verification is performed on the sixth hash value;

[0070] If the consistency verification passes, the password update for the first user is confirmed to be successful.

[0071] On the other hand, embodiments of the present invention also provide an information processing method applied to a key server, the method comprising:

[0072] The system receives a communication request sent by a user terminal. The communication request includes a first ciphertext and an identifier of an operation type. The first ciphertext includes authentication information generated by the user terminal based on the operation of a first user. The authentication information is obtained by encrypting the first ciphertext with an encryption key corresponding to the operation type of the operation.

[0073] Determine the decryption key corresponding to the operation type based on the identifier;

[0074] The first ciphertext is decrypted using the decryption key corresponding to the operation type to obtain the authentication information;

[0075] Based on the authentication information, determine whether a replay attack exists;

[0076] If no replay attack is detected, a response message is generated and sent to the user terminal based on the authentication information.

[0077] In the above scheme, if the operation type is user registration, then the decryption key corresponding to the operation type is the private key of the key server;

[0078] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0079] The authentication information is obtained by decrypting the first ciphertext based on the private key; the authentication information includes the username of the first user, the shared key between the first user and the communication server, the first temporary session key generated by the user terminal and the key server, the first sending time and the first random number of the communication request; the shared key represents the password of the first user encrypted by the hash function.

[0080] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0081] Determine whether the difference between the current time and the first sending time is less than or equal to a set value;

[0082] If the difference is less than or equal to the set value, then in the first random number sequence corresponding to the key server, it is queried whether the time period corresponding to the difference includes the first random number; the first random number sequence stores the random number received by the key server;

[0083] If the first random number is not included, then it is determined that there is no replay attack;

[0084] Correspondingly, the step of generating response information based on the authentication information and sending it to the user terminal includes:

[0085] The first user's username, first sending time, and first random number obtained through decryption are hashed and encrypted to generate the first verification information;

[0086] The first verification information and the second sending time are encrypted based on the first temporary session key to obtain the second ciphertext; the second sending time represents the sending time of the response information.

[0087] A response message is generated based on the second ciphertext and sent to the user terminal of the first user.

[0088] In the above scheme, if there is no replay attack, the method further includes:

[0089] The shared key is encrypted based on the first preset key to obtain the first encryption key;

[0090] The username of the first user and the first encryption key are stored in the local database.

[0091] In the above scheme, if the operation type is user login, then the decryption key corresponding to the operation type is the shared key; the communication request includes the first ciphertext and the username of the first user;

[0092] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0093] Determine the first encryption key corresponding to the username of the first user;

[0094] The shared key is obtained by decrypting the first encryption key based on the first preset key.

[0095] The first ciphertext is decrypted based on the shared key to obtain the authentication information; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request;

[0096] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0097] Determine whether the difference between the current time and the third transmission time is less than or equal to the set value;

[0098] If the difference is less than or equal to the set value, then in the first random number sequence corresponding to the key server, query whether the second random number is included in the time period corresponding to the difference;

[0099] If the second random number is not included, then it is determined that there is no replay attack;

[0100] Correspondingly, the step of generating response information based on the authentication information and sending it to the user terminal includes:

[0101] Generate a second temporary session key between the user terminal and the communication server;

[0102] The second verification information is obtained by hashing and encrypting the username of the first user obtained through decryption, the second random number, and the third sending time.

[0103] Based on the second temporary session key, the identity identifier of the communication server, and the username of the first user, a ticket for the first user to access the communication server is generated;

[0104] The third ciphertext is obtained by encrypting the ticket, the second verification information, the second temporary session key, and the fourth sending time based on the shared key; the fourth sending time represents the sending time of the response information.

[0105] Based on the third ciphertext, a response message is generated and sent to the user terminal of the first user.

[0106] In the above scheme, if the operation type is password update, then the decryption key corresponding to the operation type is the shared key, and the communication request includes the first ciphertext and the username of the first user;

[0107] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0108] Query the shared key based on the username of the first user;

[0109] The first ciphertext is decrypted based on the shared key to obtain the authentication information; the authentication information includes the new shared key obtained by the user terminal hashing the new password of the first user, the username of the first user, the twelfth sending time of the communication request, and the sixth random number.

[0110] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0111] Determine whether the difference between the current time and the twelfth transmission time is less than or equal to the set value;

[0112] If the difference is less than or equal to the set value, then query the random number sequence corresponding to the key server to see if the sixth random number is included in the time period corresponding to the difference;

[0113] If the sixth random number is not included, then it is determined that there is no replay attack;

[0114] Correspondingly, the step of generating and sending response information to the user terminal based on the authentication information includes:

[0115] Based on the username of the first user obtained through decryption, the twelfth sending time, and the sixth random number, a hash encryption is performed to obtain the sixth hash value;

[0116] The sixth hash value and the thirteenth sending time are encrypted based on the new shared key to obtain the eighth ciphertext; the thirteenth sending time represents the sending time of the response information.

[0117] Based on the eighth ciphertext, a response message is generated and sent to the user terminal of the first user.

[0118] In the above scheme, the method further includes:

[0119] The system receives a registration request sent by the communication server. The registration request includes a ninth ciphertext, which is obtained by encrypting a third temporary session key, a seventh random number generated by the communication server, the identity identifier of the communication server, and a fourteenth sending time based on the public key of the key server. The third temporary session key is a temporary session key generated by the communication server for communication with the key server. The fourteenth sending time represents the sending time of the registration request.

[0120] Decrypt the ninth ciphertext based on the private key corresponding to the public key;

[0121] Based on the seventh random number and the fourteenth sending time, determine whether the registration request is subject to a replay attack;

[0122] If no replay attack is detected, a shared symmetric key and an eighth random number are generated for communication with the communication server.

[0123] The shared symmetric key, the eighth random number, the fifteenth sending time, and the fourth verification information are encrypted based on the third temporary session key to obtain the tenth ciphertext; the fourth verification information is obtained by hashing and encrypting the eighth random number, the fifteenth sending time, the seventh random number, and the identity identifier of the communication server; the fifteenth sending time represents the sending time of the tenth ciphertext;

[0124] The tenth ciphertext is sent to the communication server.

[0125] In the above scheme, the method further includes:

[0126] The shared symmetric key is encrypted based on the first preset key to obtain the second encryption key;

[0127] The identity identifier of the communication server and the second encryption key are stored in a local database.

[0128] On the other hand, embodiments of the present invention also provide an information processing method applied to a communication server, the method comprising:

[0129] The system receives a communication request sent by a user terminal. The communication request includes a first ciphertext and an identifier of an operation type. The first ciphertext includes authentication information generated by the user terminal based on the operation of a first user. The authentication information is obtained by encrypting the first ciphertext with an encryption key corresponding to the operation type of the operation.

[0130] Determine the decryption key corresponding to the operation type based on the identifier;

[0131] The first ciphertext is decrypted using the decryption key corresponding to the operation type to obtain the authentication information;

[0132] Based on the authentication information, determine whether a replay attack exists;

[0133] If no replay attack is detected, a response message is generated and sent to the user terminal based on the authentication information.

[0134] In the above scheme, the method further includes:

[0135] Generate a third temporary session key for communication with the key server;

[0136] The registration request is sent to the key server; the registration request includes a ninth ciphertext encrypted based on the public key of the key server, the ninth ciphertext including the third temporary session key, the seventh random number generated by the communication server, the identity identifier of the communication server, and the fourteenth sending time; the fourteenth sending time represents the sending time of the registration request;

[0137] The system receives a tenth ciphertext sent by the key server based on the registration request. The tenth ciphertext includes a shared symmetric key generated by the key server for communication with the communication server, an eighth random number generated by the key server, a fifteenth sending time, and fourth verification information. The tenth ciphertext is encrypted based on the third temporary session key, the fifteenth sending time represents the sending time of the tenth ciphertext, and the fourth verification information is obtained by hashing and encrypting the eighth random number, the fifteenth sending time, the seventh random number, and the identity identifier of the communication server.

[0138] Based on the third temporary session key, the tenth ciphertext is decrypted to obtain the shared symmetric key, the eighth random number, the fifteenth sending time, and the fourth verification information;

[0139] Based on the eighth random number and the fifteenth sending time, it is determined whether the tenth ciphertext is susceptible to a replay attack; the communication server includes a second random number sequence that stores random numbers;

[0140] If no replay attack exists, perform consistency verification on the fourth verification information;

[0141] If the consistency verification passes, the shared symmetric key is encrypted based on the second preset key of the communication server to obtain the third encryption key;

[0142] The third encryption key is stored in a local database.

[0143] In the above scheme, if the operation type is to establish a connection, the decryption key corresponding to the operation type is the second temporary session key generated by the key server for communication between the user terminal and the communication server; the communication request includes the first ciphertext and the ticket for the first user to access the communication server; the ticket includes the second temporary session key, the identity identifier of the communication server, and the username of the first user;

[0144] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0145] The second temporary session key is determined based on the ticket;

[0146] The authentication information is obtained by decrypting the first ciphertext based on the second temporary session key; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request.

[0147] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0148] Determine whether the difference between the current time and the fifth transmission time is less than or equal to the set value;

[0149] If the difference is less than or equal to the set value, then in the second random number sequence corresponding to the communication server, query whether the time period corresponding to the difference includes the third random number;

[0150] If the third random number is not included, then it is determined that there is no replay attack;

[0151] Correspondingly, the step of generating and sending response information to the user terminal based on the authentication information includes:

[0152] The third verification information is obtained by hashing the third random number obtained through decryption, the fifth sending time, and the username of the first user.

[0153] The third verification information and the sixth sending time are encrypted based on the second temporary session key to obtain the fourth ciphertext; the sixth sending time represents the sending time of the response information.

[0154] Based on the fourth ciphertext, a response message is generated and sent to the user terminal of the first user.

[0155] In the above scheme, if the operation type is sending a session message, then the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the username of the first user;

[0156] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0157] Query the second temporary session key based on the username of the first user;

[0158] The authentication information is obtained by decrypting the first ciphertext based on the second temporary session key; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal and the seventh sending time of the communication request, and the first hash value obtained by hashing and encrypting the username of the first user, the identity identifier of the communication server and the user identifier of the target user.

[0159] In the above scheme, if the target user of the session information is the second user, the step of generating response information based on the authentication information and sending it to the user terminal includes:

[0160] A second hash value is obtained by hashing the username of the first user, the username of the second user, and the seventh sending time.

[0161] The second hash value, the first session information input by the first user, the seventh sending time, and the eighth sending time are encrypted based on the second temporary session key to obtain the fifth ciphertext; the eighth sending time represents the sending time of the response information.

[0162] Based on the fifth ciphertext and the username of the first user, a response message is generated and sent to the user terminal of the second user.

[0163] In the above scheme, if the target user of the session information is a user group, the user group includes a second user, and the username of the target user is the identity identifier of the user group, the step of generating response information based on the authentication information and sending it to the user terminal includes:

[0164] The third hash value is obtained by hashing the username of the first user, the identity identifier of the user group, and the seventh sending time.

[0165] The third hash value, the first session information, the seventh sending time, and the eighth sending time are encrypted based on the second user's second temporary session key to obtain the sixth ciphertext;

[0166] Based on the sixth ciphertext, the username of the first user, and the identity identifier of the user group, a response message is generated and sent to the user terminal of the second user.

[0167] In the above scheme, if the operation type is to obtain chat history, then the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the username of the first user;

[0168] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0169] Query the second temporary session key based on the username of the first user;

[0170] The authentication information is obtained by decrypting the first ciphertext based on the second temporary session key; the authentication information includes the time period of the chat history between the first user and the second user, the username of the second user, the fifth random number generated by the user terminal, the ninth sending time of the communication request, and the fourth hash value; the fourth hash value is obtained by hashing the username of the first user, the username of the second user, and the identity identifier of the communication server.

[0171] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0172] Determine whether the difference between the current time and the ninth transmission time is less than or equal to the set value;

[0173] If the difference is less than or equal to the set value, then query the random number sequence corresponding to the key server to see if the fifth random number is included in the time period corresponding to the difference;

[0174] If the fifth random number is not included, then it is determined that there is no replay attack;

[0175] Correspondingly, the step of generating and sending response information to the user terminal based on the authentication information includes:

[0176] Based on the username of the first user, the username of the second user, and the time period, query the third session information between the first user and the second user within the time period;

[0177] The username of the first user, the decrypted username of the second user, the fifth random number, and the ninth sending time are hashed and encrypted to obtain the fifth hash value;

[0178] The third session information, the fifth hash value, the username of the second user, the tenth and eleventh sending information of the third session information are encrypted based on the second temporary session key to obtain the seventh ciphertext; the eleventh sending information represents the sending time of the response information.

[0179] Based on the seventh ciphertext, a response message is generated and sent to the user terminal of the first user.

[0180] On the other hand, embodiments of the present invention provide an information processing apparatus, the apparatus comprising:

[0181] The first determining module is used to determine the encryption key corresponding to the operation type of the operation if an operation triggered by the first user to communicate with the peer device is detected.

[0182] The first encryption module is used to encrypt the authentication information generated by the user terminal based on the operation based on the encryption key, to obtain the first ciphertext;

[0183] A first generation module is configured to generate a communication request based on the first ciphertext, wherein the communication request includes an identifier of the operation type;

[0184] The sending module is used to send the communication request to the peer device.

[0185] On the other hand, embodiments of the present invention also provide an information processing apparatus, the apparatus comprising:

[0186] The first receiving module is configured to receive a communication request sent by a user terminal; the communication request includes a first ciphertext and an identifier of an operation type, the first ciphertext includes authentication information generated by the user terminal based on the operation of a first user, and the first ciphertext is obtained by encrypting the authentication information based on the encryption key corresponding to the operation type of the operation;

[0187] The first determining module is used to determine the decryption key corresponding to the operation type based on the identifier;

[0188] The first decryption module is used to decrypt the first ciphertext based on the decryption key corresponding to the operation type to obtain the authentication information;

[0189] The second determining module is used to determine whether a replay attack exists based on the authentication information;

[0190] The second generation module is used to generate response information to be sent to the user terminal based on the authentication information if no replay attack exists.

[0191] On the other hand, embodiments of the present invention also provide an information processing apparatus, the apparatus comprising:

[0192] The second receiving module is used to receive a communication request sent by a user terminal; the communication request includes a first ciphertext and an identifier of an operation type, the first ciphertext includes authentication information generated by the user terminal based on the operation of the first user, and the first ciphertext is obtained by encrypting the authentication information based on the encryption key corresponding to the operation type of the operation;

[0193] The third determining module is used to determine the decryption key corresponding to the operation type based on the identifier;

[0194] The second decryption module is used to decrypt the first ciphertext based on the decryption key corresponding to the operation type to obtain the authentication information;

[0195] The fourth determining module is used to determine whether a replay attack exists based on the authentication information;

[0196] The third generation module is used to generate response information to be sent to the user terminal based on the authentication information if no replay attack exists.

[0197] On the other hand, embodiments of the present invention provide a user terminal, including a processor and a memory, which are interconnected. The memory is used to store a computer program, which includes program instructions. The processor is configured to invoke the program instructions to execute the steps of the information processing method provided in the embodiments of the present invention.

[0198] On the other hand, embodiments of the present invention provide a communication server, including a processor and a memory, which are interconnected. The memory is used to store a computer program, which includes program instructions. The processor is configured to invoke the program instructions to execute the steps of the information processing method provided in the embodiments of the present invention.

[0199] On the other hand, embodiments of the present invention provide a key server, including a processor and a memory, which are interconnected. The memory is used to store a computer program, which includes program instructions. The processor is configured to invoke the program instructions to execute the steps of the information processing method provided in the embodiments of the present invention.

[0200] On the other hand, embodiments of the present invention provide a computer-readable storage medium, comprising: the computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the steps of the information processing method provided in the embodiments of the present invention.

[0201] In this embodiment of the invention, if the user terminal detects an operation triggered by a first user to communicate with a peer device, it determines the key corresponding to the operation type. Based on the encryption key corresponding to the operation type, it encrypts the authentication information generated by the user terminal based on the user's operation, obtaining first ciphertext. A communication request is generated based on the first ciphertext and sent to the peer device. This embodiment obtains the encryption key based on the first user's operation type. Since the encryption key is not fixed, it is difficult for hackers to know the user's operation type and to crack the communication request using a fixed key. This strengthens the security of each communication process and enables more secure communication information transmission. Attached Figure Description

[0202] Figure 1 This is a schematic diagram of a communication model provided in an embodiment of the present invention;

[0203] Figure 2 This is a schematic diagram of an IM server registration process provided in an embodiment of the present invention;

[0204] Figure 3 This is a schematic diagram of a user registration process provided by an embodiment of the present invention;

[0205] Figure 4 This is a schematic diagram of a user login process provided in an embodiment of the present invention;

[0206] Figure 5 This is a schematic diagram of a long-connection establishment process provided by an embodiment of the present invention;

[0207] Figure 6 This is a schematic diagram of a one-on-one chat session flow provided by an embodiment of the present invention;

[0208] Figure 7 This is a schematic diagram of a group chat session flow provided in an embodiment of the present invention;

[0209] Figure 8 This is a schematic diagram illustrating a process for retrieving chat history from a server, as provided in an embodiment of the present invention.

[0210] Figure 9 This is a schematic diagram of a user password update process provided in an embodiment of the present invention;

[0211] Figure 10 This is a schematic diagram illustrating the implementation flow of an information processing method provided in an embodiment of the present invention;

[0212] Figure 11 This is a schematic diagram illustrating the implementation flow of another information processing method provided in an embodiment of the present invention;

[0213] Figure 12 This is a schematic diagram illustrating the implementation flow of another information processing method provided in an embodiment of the present invention;

[0214] Figure 13 This is a schematic diagram of an information processing device provided in an embodiment of the present invention;

[0215] Figure 14 This is a schematic diagram of another information processing device provided in an embodiment of the present invention;

[0216] Figure 15 This is a schematic diagram of another information processing device provided in an embodiment of the present invention;

[0217] Figure 16 This is a schematic diagram of a user terminal provided in an embodiment of the present invention;

[0218] Figure 17 This is a schematic diagram of a key server provided in an embodiment of the present invention;

[0219] Figure 18 This is a schematic diagram of a communication server provided in an embodiment of the present invention. Detailed Implementation

[0220] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0221] With the continuous development of the internet, instant messaging software has become extremely popular, and people use various instant messaging software almost every day. The industry has shown great interest in instant messaging, regarding it as one of the core areas of competition in the current mobile internet industry.

[0222] However, instant messaging software in related technologies has the following security issues:

[0223] (1) Information is transmitted in plaintext or by simple encryption. Communication relies only on ordinary network security protocols and does not achieve end-to-end encryption of communication content.

[0224] (2) Lack of secure key management; key keys are stored in plaintext and lack multi-level encryption.

[0225] (3) The server does not encrypt and store communication messages. Once the server is compromised, it is easy to cause leakage of user information.

[0226] (4) When the client is authenticating, it transmits the password hash value to the server for comparison, which can easily lead to password leakage and spoofing replay attacks;

[0227] (5) The lack of means to prevent replay attacks makes it easy to cause man-in-the-middle attacks.

[0228] Therefore, in today's world where data security is of great concern, issues such as ensuring end-to-end encryption of information in instant messaging, secure key management, secure and efficient identity authentication, prevention of replay attacks, and secure storage of instant messaging information have high research value.

[0229] To address the shortcomings of the aforementioned related technologies, embodiments of the present invention provide an information processing method that enhances communication security and achieves more secure communication information transmission. To illustrate the technical solution of the present invention, specific embodiments are described below.

[0230] Figure 1 This is a schematic diagram of a communication model provided by an embodiment of the present invention. The communication model includes a mobile communication (Radio Communication, RC) authentication center, an instant messaging (IM, Instant Messaging) server, and clients (examples include client A and client B, and are not a limitation on the number of clients).

[0231] The RC certification center is responsible for identity authentication, session keys and ticket (IM Token) allocation and management. The client accesses the IM server through the ticket and sends encrypted instant messages to the IM server. The IM server stores the received instant information in encrypted form and pushes it to the receiving end in encrypted form.

[0232] First, initialize the RC certification center and IM server.

[0233] 1. RC Key Initialization

[0234] RC Certification Center Initializes Master Key P rc The key K for generating the encryption key (cipher). rc_enkey Generate the public key K of the RC rc_pub and the corresponding private key K rc_priv K rc_enkey and K rc_priv Use P rc The encryption is stored on the RC server, K rc_pub Released to the entire network. Master key P rc Stored in a secure storage device (such as a USB key with a PIN code), K is accessed upon system startup. rc_enkey and K rc_priv It is loaded into memory for easy access by the program.

[0235] 2. IM server key initialization

[0236] IM Server S im Initialize system master key P im The key K for generating the encryption key (cipher). im_enkey and the key K for encrypting and storing instant message data im_enmsg K im_enkey Use P im Encrypted and stored on the IM server, K im_enmsg Use K im_enkey The encrypted data is stored on the IM server. Master key P im Stored in a secure storage device (such as a USB key with a PIN code), K is accessed upon system startup. im_enkey and K im_enmsg It is loaded into memory for quick access by the program.

[0237] 3. Initialization of the random number sequence

[0238] RC and S im Each has its own random number sequence N array (respectively N) rc_array and N im_array They will receive a random number N each time. c Store N array and regularly clear N array The system stores random numbers whose storage time exceeds ΔT, where ΔT is the minimum system latency.

[0239] 4. Anti-replay attack function

[0240] Replay attacks, also known as replay attacks or replay attacks, refer to an attacker sending a packet that the target host has already received in order to deceive the system. This is primarily used in the authentication process to compromise the integrity of the authentication. Replay attacks can be launched by the attacker or by an adversary that intercepts and retransmits the data.

[0241] To prevent replay attacks on the server, the system introduces an anti-replay attack function f(T) b ,T c ,ΔT,N c N array ), where T b T represents the message sending time. c Let N be the message arrival time, ΔT be the system minimum latency, and N be the latency of the message arrival time. c N is the random number received by the server from the sender. array This is a random number sequence from the server. The function first calculates T. c -T b If the value is less than or equal to ΔT, return false if the condition is not met; otherwise, return false if the condition is met. array In the query, does N exist within the time interval ΔT? c If it exists, return false, indicating verification failure; otherwise, return true, indicating verification success.

[0242] This embodiment implements an instant communication process including key management, registration, login authentication, key negotiation, connection establishment, secure instant session, session communication record retrieval, password update, and key update, achieving more secure, efficient, and convenient instant communication.

[0243] I. Registration Phase

[0244] 1.1 IM Server Registration:

[0245] refer to Figure 2 The IM server registration process includes:

[0246] (1) IM Server im Registration is required first when joining a communication network. im Generate temporary symmetric session key KS rc,im And random number N1, using K pub Perform encrypted calculations:

[0247] A im =E(K) pub [SID] im KS rc,im ,T1,N1])

[0248] Among them, SID im It is S imA unique identity, T1 is the current sending time, h(·) is the hash function, and A is... im Send to RC.

[0249] (2) RC received A im Then, through K priv Decrypt A im , obtain SID im KS rc,im T1, N1, First query SID im Check if it has been registered. If not, call the anti-replay attack function f(T1,T) c ,ΔT,N1,N rc_array If the response returns false, the conversation ends. Otherwise, RC writes N1 into N. rc_array In, and generate with S im Shared symmetric key K rc,im And a random number N2, then calculate:

[0250] HRA im =h(SID) im ||T2||N1||N2)

[0251] RA im =E(KS) rc,im HRA im ,K rc,im [,T2,N2])

[0252] Where || represents the concatenation operation, E(K,[m]) is the encryption function, K is the key, and m is the plaintext.

[0253] RA im Send to S im Where T2 is the current sending time. Then calculate... And Store in the database and publish S im SID im .

[0254] (3)S im Received RA im Then, use KS rc,im Decrypting RA im Receive HRA im ,K rc,im Then, the anti-replay attack function f(T2,T2,N2) is called. c ,ΔT,N2,N im_array If the function returns false, the dialogue ends. Otherwise, the function is evaluated. judge If they are equal, S im Write N2 into N im_arrayIn the middle, then calculate And Store it in the database, and at the same time, store K rc,im Write to memory for quick program access (the server will use KB after each restart). im_enkey Decryption Get K rc,im (Write to memory). This is how RC and S... im They shared the session key K. rc,im Used for encrypted communication.

[0255] 1.2 User Registration:

[0256] refer to Figure 3 The user registration process includes:

[0257] (1) User U a In client C a (Mobile or PC) Enter your login ID a and password PW a Submit registration, C a Generate temporary session key K c,rc_t And calculate:

[0258] K a =h(PW a )

[0259] A a =E(K) pub ,[ID a ,K a ,K c,rc_t ,T3,N3])

[0260] Where T3 is the current sending time, N3 is a random number, and C... a K a Store it in memory, and put A a Send to RC.

[0261] (2) After RC receives it, it will be processed through K priv Decrypt A a Get ID a ,K a ,K c,rc_t T3, N3, first query the ID. a Check if it has been registered. If not, call the anti-replay attack function f(T3,T) c ,ΔT,N3,N rc_array If the response returns false, the conversation ends. Otherwise, RC writes N3 into N. rc_array In, and calculate Will It exists in RC's database. Then RC calculates:

[0262] HRA a =h(ID) a ||T3||N3)

[0263] RA a =E(K) c,rc_t HRA a ,T4])

[0264] RA a Send to C a T4 is the current sending time.

[0265] (3)C a Received RA a Then, use K c,rc_t Decrypting RA a Receive HRA a T4, then use the current time T c Calculate T c Check if -T4 ≤ ΔT is true. If not, end the dialogue. Otherwise, calculate. judge If they are equal, then prompt the user U. a Registration successful, U a In effect, the key K is shared between the RC and the RC. a .

[0266] II. Landing Phase

[0267] refer to Figure 4 The user login process includes:

[0268] (1) User U a In client C a Enter login ID a and password PW a Submit login, C a calculate:

[0269] K a =h(PW a )

[0270] L a =E(K) a [T5,N4])

[0271] Where T5 is the current sending time, N4 is the newly generated random number, and then {ID} a L a Send to RC.

[0272] (2) RC receives {ID} a L a After that, first by IDa Find the corresponding Then use K rc_enkey Decryption Get K a Then use K a Decrypting L a T5, N4 are obtained. Then the anti-replay attack function f(T5, T c ,ΔT,N4,N rc_array If the response returns false, the conversation ends. Otherwise, RC writes N4 into N. rc_array In, and generate C a and S im Communication Temporary Session Key K a,im_t And calculate:

[0273] HRL a =h(ID) a ||T5||N4)

[0274] Token a,im =E(K) rc,im ,[ID a SID im ,K a,im_t ,T6,Lifetime])

[0275] RL a =E(K) a ,[HRL a ,T6,Token a,im ,K a,im_t ])

[0276] Where T6 is the current sending time, and Token is... a,im It is C a Visit S im Access ticket, Lifetime is a token a,im The validity period of the instrument. RC will transfer the RL. a Return to C a And confirm successful login.

[0277] (3)C a Received RL a Then, use K a Decrypting RL a Get HRL a ,T6,Token a,im ,K a,im_t Using the current time T c Calculate T c -T6? ≤ΔT ? Check if this condition is true. If not, end the dialogue. If the time verification passes, calculate... judge If they are equal, then prompt the user U. a Login successful. a Save Token a,im and the temporary session key K a,im_t Use K a Encrypt local storage.

[0278] III. Establishing Long-Term Connections

[0279] refer to Figure 5 The process of establishing a long connection includes:

[0280] After logging in as a client, you need to access the IM server S. im And establish a secure communication connection. Similarly, in scenarios such as 5G messaging and secure private network communication, the client needs to establish a long connection with the corresponding message server.

[0281] Specifically as follows:

[0282] (1) Client C a calculate:

[0283] CON a,im =E(K) a,im_t [T7,N5])

[0284] Where T7 is the current sending time, N5 is the newly generated random number, and then {Token} a,im CON a,im}Sent to S im .

[0285] (2)S im After receiving the message, first use K im_enkey Decryption Get K rc,im Then use K rc,im Decrypt Token a,im Get ID a SID im ,K a,im_t T6, Lifetime, Confirm SID im Correct, then use K. a,im_t Decrypt CON a,im Obtain T7 and N5. Call the anti-replay attack function f(T7, T c ,ΔT,N5,N im_array If the function returns false, the dialogue ends. Otherwise, calculate T. c -T6? ≤Lifetime. If true, end the conversation. Otherwise, assume C is true. a Token a,im Valid, access is legitimate, S im Write N5 into Nim_array In, and will {ID a K a,im_t The key-value pairs are written to memory for quick access, and then the calculation begins.

[0286] HRCON a,im =h(ID) a ||T7||N5)

[0287] RCON a,im =E(K) a,im_t ,[HRCON a,im ,T8])

[0288] Where T8 is the current sending time, and then S... im {HRCON a,im RCON a,im}Sent to C a .

[0289] (3)C a After receiving the message, use K a,im_t Decrypting RCON a,im Get HRCON a,im T8, using the current time T c Calculate T c -T8? ≤ΔT ? Check if this condition is true. If not, end the dialogue. If the time verification passes, calculate... judge If they are equal, then prompt the user U. a The persistent connection was successfully established. Thus, C... a and S im They shared the temporary session key K. a,im_t .

[0290] (4) If client C a After the process is killed or restarted, there is no need to log in to RC; the user only needs to enter the password PW. a Get K a Decryption yields K a,im_t and through Token a,im Reconnect with S im Communication can be achieved by establishing a persistent connection.

[0291] (5) If client C a Token a,im If the connection expires, the user will be prompted with a "U" message when establishing a persistent connection. a Token a,im Expired, Client C a This will redirect you to the login screen and force the user to use their U key. a Re-enter your password to log in (5.3 Login Phase Process) and obtain a new token.a,im and update the temporary session key K a,im_t .

[0292] IV. Instant Messaging Session Phase

[0293] 4.1 One-on-one chat

[0294] refer to Figure 6 The one-on-one chat process includes:

[0295] User U a To user U b Send instant message M a,b (5G SMS, etc.), the process is as follows:

[0296] (1)U a In client C a Terminal input M a,b And click Send to U b C a Start calculation:

[0297] HID a,im,b =h(ID) a ||SID im ||ID b )

[0298] S a,im,b =E(K) a,im_t [HID] a,im,b ID b M a,b ,T9,N6])

[0299] Where T9 is the current sending time, N6 is the newly generated random number, and then {ID} a S a,im,b}Sent to S im .

[0300] (2)S im After receiving the message, via ID a Find K a,im_t Then use K a,im_t Decrypt S a,im,b Get HID a,b ID b M a,im,b Then, the anti-replay attack function f(T9,T6) is called. c ,ΔT,N6,N im_array If the function returns false, the conversation ends. Otherwise, S... im Write N6 into N im_array In, and calculate judge If they are not equal, end the conversation. Otherwise, calculate:

[0301] HID a,b =h(ID) a ||ID b ||T9)

[0302] SIM a,b =E(K) im_enmsg [HID] a,b M a,b ])

[0303] and {ID a ID b T9, SIM a,b The chat log is stored in the database, where state indicates whether the message has been sent. The default state is "not sent".

[0304] Then, S im Query and determine C b Is online (with or without S) im Establish a long-lived connection; if offline, do not process (or push an offline notification), and wait for C. b Go online. If C b If online, then calculate:

[0305] S b,im,a =E(K) b,im_t [HID] a,b M a,b ,T9,T 10 ])

[0306] Among them, K b,im_t It is S im and C b Temporary session key, T 10 It is the current sending time, then {ID a S b,im,a}Sent to C b .

[0307] (3)C b After receiving the message, use K b,im_t Decrypt S b,im,a Get ID a HID a,b M a,b ,T9,T 10 Then use the current time T c Calculate T c -T 10 Check if ≤ΔT is true. If not, end the dialogue. If the time verification passes, then calculate... judge If they are equal, then in C b Local database stores {ID a ID b M a,b ,T9}, and on the terminal screen U b and U a The dialog box displays instant messages.

[0308] 4.2 Group Chat Sessions

[0309] refer to Figure 7 The group chat session flow includes:

[0310] User U a In Group G a,b,c,d Send instant message M a,G G a,b,c,d Indicates member U a U b U c U d The process for joining the group is as follows:

[0311] (1)U a In client C a Terminal Group G a,b,c,d Enter M a,G And click send, C a Start calculation:

[0312] HID a,im,G =h(ID) a ||SID im ||ID G )

[0313] S a,im,G =E(K) a,im_t [HID] a,im,G ID G M a,G ,T 11 ,N7])

[0314] Where T 11 N7 is the current sending time, N7 is the newly generated random number, and ID is the current sending time. G It's a group of G a,b,c,d The unique identifier, then {ID a S a,im,G}Sent to S im .

[0315] (2)S im After receiving the message, via ID a Find K a,im_t Then use K a,im_t Decrypt S a,im,GGet HID a,im,G ID G M a,G ,T 11 N7, then call the anti-replay attack function f(T) 11 ,T c ,ΔT,N7,N im_array If the function returns false, the conversation ends. Otherwise, S... im Write N7 into N im_array In, and calculate judge If they are not equal, end the conversation. Otherwise, calculate:

[0316] HID a,G =h(ID) a ||ID G ||T 11 )

[0317] SIM a,G =E(K) im_enmsg [HID] a,G M a,G ])

[0318] and {ID a ID G T 11 SIM a,G The chat log is stored in the database, where state indicates whether the message has been sent. The default state is "not sent".

[0319] Then, S im According to ID G The group member found is U a U b U c U d First, determine C b C c C d Is online (with or without S) im Establish a persistent connection; if the user is offline, do not process the request (or send an offline notification) and wait for them to come back online. For example, if C... b If online, then calculate:

[0320] S b,im,a,G =E(K) b,im_t [HID] a,G M a,G ,T 11 ,T 12 ])

[0321] Among them, K b,im_t It is S imand C b Temporary session key, T 12 It is the current sending time, then {ID a ID G S b,im,a,G}Sent to C b .

[0322] (3)C b After receiving the message, use K b,im_t Decrypt S b,im,a,G Get HID a,G M a,G ,T 11 ,T 12 Then use the current time T c Calculate T c -T 12 Check if ≤ΔT is true. If not, end the dialogue. If the time verification passes, then calculate... judge If they are equal, then in C b Local database stores {ID a ID G M a,G T 11} and display it in the group message on the terminal screen. Similarly, C c and C d You will receive the message in the same way.

[0323] 5. Retrieve chat history from the server

[0324] The client can synchronize historical chat history from the IM server, ensuring that chat history is displayed even if local messages on the client are deleted or the client program is reinstalled. Similarly, this also applies to 5G messaging and secure private network scenarios.

[0325] refer to Figure 8 The process of retrieving chat history from the server includes:

[0326] (1) Client C a With IM server S im Establish a long-lived connection and share the temporary session key K. a,im_t The specific steps are shown in section 5.4.

[0327] (2)U a In relation to U b Pull down the chat interface to get new data and U b Chat history, client C a calculate:

[0328] HID a,im,b =h(ID) a||SID im ||ID b )

[0329] RM a,im,b =E(K) a,im_t [HID] a,im,b ID b ,TQ,T 13 ,N8])

[0330] Where T 13 This is the current sending time, N8 is the newly generated random number, TQ is the time period for which the chat history needs to be retrieved, and then {ID} a RM a,im,b}Sent to S im .

[0331] (3)S im After receiving the message, via ID a Find K a,im_t Then use K a,im_t Decrypting RM a,im,b Get HID a,im,b ID b ,TQ,T 13 N8, then call the anti-replay attack function f(T) 13 ,T c ,ΔT,N8,N im_array If the response is false, the dialogue ends. Otherwise, S... im calculate judge If they are not equal, end the conversation. Otherwise, S im Write N8 into N im_array In, and through {ID a ID b Given the condition TQ, query U for this time period. a and U b Instant messaging records {ID a ID b T r SIM a,b , state} (assuming there is only one record), where T r It represents the message sending time, and `state` represents the message status, determined by K. im_enmsg Decryption yields plaintext chat log M a,b Then start the calculation:

[0332] HRID a,b =h(ID) a ||ID b ||T 13 ||N8)

[0333] IMR a,b =E(K) a,im_t ,[HRID a,b ID b M a,b ,T r ,TQ,T 14 ])

[0334] Among them, T 14 It is the current sending time, then IMR a,b Send to C a .

[0335] (4)C a After receiving the message, use K a,im_t Decrypting IMR a,b Receive HRID a,b ID b M a,b ,T r ,TQ,T 14 Then use the current time T c Calculate T c -T 14 Check if ≤ΔT is true. If not, end the dialogue. If the time verification passes, then calculate... judge If they are equal, then store the instant messaging record {ID}. a ID b M a,b T r}, then in C a The chat screen is displayed.

[0336] VI. User Password Update

[0337] refer to Figure 9 The user password update process includes:

[0338] (1) User U a In client C a (Mobile or PC) Enter your login ID a Old password PW a And the new password PW a * And calculate:

[0339] K a =h(PW a )

[0340]

[0341]

[0342] Among them, T 15 The current sending time is N9, which is a random number, and {ID} is used to send the data. a UA a Send to RC.

[0343] (2) After the RC receives it, it will use the ID a Shared key K was found a And through K a Decrypting UA a Get ID a , T 15 N9, Determine ID a Is it related to decrypting UA? a Later I got the ID a If they are equal, then the anti-replay attack function f(T) is called. 15 ,T c ,ΔT,N9,N rc_array If the response returns false, the conversation ends. Otherwise, RC writes N9 into N. rc_array In, and calculate Will Existing in the RC database, replacing the original key. Then RC is calculated:

[0344] HUA a =h(ID) a ||T 15 ||N9)

[0345]

[0346] Then RUA a Send to C a T 16 This is the current sending time.

[0347] (3)C a Received RUA a Afterwards, use Decrypting RA a Get HUA a ,T 16 Then use the current time T c Calculate T c -T 16 Check if ≤ΔT is true. If not, end the dialogue. Otherwise, calculate. judge If they are equal, C a Will Store in memory, replace K a And prompt user U aPassword updated successfully. That's it for U. a The new key was also shared with RC.

[0348] VII. Key Update

[0349] 7.1 RC Key Update

[0350] (1) Master key P rc renew

[0351] P rc During the update, you need to use P first. rc Decrypting K rc_enkey and K rc_priv Then use the new master key Encryption K rc_enkey and K rc_priv And save it, and finally... Write to secure storage device, overwriting the original P rc .

[0352] (2) Public-private key pair update

[0353] First, generate a new public-private key pair. and Then use Replace the original public key K rc_pub And publish it across the entire internet; use P rc encryption Replace the original private key K rc_priv .

[0354] (3) The key K of the encryption key (cryptography) rc_enkey renew

[0355] First, generate a new key. Then use K rc_enkey Decrypting K rc,im Then use Encryption K rc,im And finally used Replace the original key K rc_enkey .

[0356] 7.2 IM Server Key Update

[0357] (1) Master key P im renew

[0358] P im During the update, you need to use P first. im Decrypting K im_enkey Then use the new master key Encryption K im_enkey Finally Write to secure storage device, overwriting the original P im .

[0359] (2) The key K of the encryption key (cryptography) im_enkey renew

[0360] First, generate a new key. Then use K im_enkey Decrypting K rc,im and K im_enmsg Then use Encryption K rc,im and K im_enmsg And finally used Replace the original key K im_enkey .

[0361] (3) The key K for encrypting instant messages im_enmsg renew

[0362] K im_enmsg The encryption key for message data is typically updated at long intervals. First, a new key is generated. Then the IM server started using K. im_enmsg Decrypt the instant messaging logs, and then use... Encrypt instant messaging records, and then use Replace K im_enmsg Until the message is re-encrypted.

[0363] 7.3 Shared Key K rc,im renew

[0364] First, the IM server initiates an update request, and the RC regenerates a new shared key. And Through K rc,im After encryption, it is sent to the IM server (similar to the IM server registration process), and then RC uses... A new token for accessing the IM server is reissued for each client, and the client is notified to log in again to obtain the new token. If a client tries to access the IM server with the original token, it will be prompted that the connection failed, and the client will also have to log in again to obtain the new token.

[0365] In the above embodiments, symmetric encryption can use the SM4 national cryptographic algorithm, and the temporary session key and shared key in the system are both symmetric encryption keys; asymmetric algorithms can use the SM2 national cryptographic algorithm, and hash algorithms can use the SM3 national cryptographic algorithm.

[0366] This embodiment is also applicable to other scenarios involving message communication, such as 5G message communication and secure private network message communication, which have client and server message communication modes. Furthermore, the key management, authentication, and encryption token modules in this embodiment possess versatility and middleware capabilities, allowing them to be invoked and reused by other applications.

[0367] This embodiment has the following advantages:

[0368] 1. This embodiment implements a complete secure instant messaging process, involving all communication nodes of instant messaging. It designs nodes for the entire instant messaging process, including server initialization, server registration, client registration, client login, establishment of long communication connections, one-on-one instant messaging sessions, group chat sessions, instant message retrieval and synchronization, and key updates. Compared with related instant messaging solutions, this embodiment not only focuses on the secure key exchange and negotiation process, but also provides a more systematic and complete security design for the entire instant messaging process.

[0369] 2. This embodiment achieves end-to-end information security encryption for instant messaging, mainly in the following aspects:

[0370] (1) IM server registration phase

[0371] IM Server S im Through RC's public key K pub Encrypted authentication information A im It is sent to the RC, and after successful verification, the RC uses the session key K. rc,im Encrypted Verification Message (RA) im Return to S im The entire communication is achieved through secure encryption.

[0372] (2) User registration stage

[0373] Client C a Through RC's public key K pub Encrypted authentication information A a The message is sent to the RC, which, after successful verification, uses the temporary session key K. c,rc_t Encrypted Verification Message (RA) a Return to C a The entire communication is achieved through secure encryption.

[0374] (3) Login phase

[0375] Client C a Through the shared key K with RC a Encrypted authentication information L a It is sent to the RC, and after the RC verifies it, it sends it via K. a Crypto Token a,im and temporary session key K a,im_t Return to C a The entire communication is achieved through secure encryption.

[0376] (4) The long connection establishment phase between the client and the IM server

[0377] Client C a via temporary session key K a,im_t With S im Encrypted communication, Token a,im It is also through RC and S im Shared key K rc,im Encryption is used, so the entire communication is achieved through secure encryption.

[0378] (5) Instant Messaging Session Stage

[0379] Whether it's a one-on-one chat or a group chat, client C a All through IM server S im Temporary session key K a,im_t Encrypted communication is implemented to ensure the encrypted transmission of all communication messages.

[0380] (6) Stage of fetching instant messages from the server

[0381] Client C a Through S im Temporary session key K a,im_t Encrypted transmission of instant messages ensures the encrypted transmission of all communication messages.

[0382] (7) User password update stage

[0383] Client C a Session key K generated from password a (Old Key) and (New key) is used for encrypted communication with RC to ensure the encrypted transmission of all communication messages.

[0384] 3. This embodiment implements secure storage of server and client keys, as detailed below:

[0385] (1) Server-side key hierarchical secure storage

[0386] Authentication Center (RC) and IM Server (S) im All use a multi-level key secure storage scheme.

[0387] First, the server master key P rc and P im All are stored in specific secure storage devices (such as USB keys with PIN codes), which provide a high level of security.

[0388] Secondly, RC private key K rc_priv The key K of the encryption key rc_enkey and K im_enkey All data are encrypted and stored using a master key.

[0389] Finally, other keys K used for encrypting communication data im_enmsg K a K rc,im All are encrypted using the key K. rc_enkey or K im_enkey Encrypt the storage.

[0390] Layered encrypted storage of keys helps protect the security of the master key. If the underlying data encryption key is cracked or leaked, the original data encryption key can be directly replaced without threatening the master key or the encryption key itself.

[0391] (2) Secure storage of client keys

[0392] In client C a , and the session key K with RC a It is obtained from the hash value of the password and does not require storage. It can be obtained simply through K. a Encryption K a,im_t (with S) im The temporary session key is stored on the client.

[0393] The client stores only one key, reducing the risk of system key leakage, and K a,im_t The leak only affects C. a With S im The security of a particular session will not affect S im Secure communication with other users.

[0394] 4. This embodiment achieves efficient key negotiation and management. It optimizes the number of key negotiation iterations and reduces the complexity of key management on the client side, as detailed below:

[0395] (1) The client only needs to communicate with the IM server S im Perform key negotiation

[0396] Client C a When initiating communication, you only need to use a Token. a,im With S im Establish a single long-lived connection, share the session key, and avoid multiple session key negotiations, and in the token... a,im During the validity period, the session key remains unchanged and there is no need to renegotiate, which greatly improves the efficiency of key negotiation.

[0397] (2) The client only stores one session key.

[0398] Client C a Simply save with S im Session key K for encrypted communication a,im_t Each communication is with S imThis greatly reduces the difficulty of client key management and improves communication efficiency.

[0399] 5. This embodiment achieves more secure and efficient identity authentication. Traditional identity authentication requires sending the hash value of the user's password to the authentication server, which then compares the hash value to determine the legitimacy of the user's login. Transmitting password-related information over the internet is insecure, regardless of whether the information is encrypted. If an attacker intercepts the password hash value, they can bypass the password and log in directly by sending the hash value to the server, thus launching a spoofing attack. Therefore, identity authentication should avoid transmitting the hash value of the user's password.

[0400] Compared with traditional identity authentication, this embodiment has the following main advantages:

[0401] (1) No need to transmit password hash values ​​for authentication

[0402] In this solution, client C a After successful registration, the password hash value K is shared with RC. a =h(PW a During authentication, the server uses K. a Encrypted verification information RL a Send to C a As long as C a Able to generate K from user-input password a Decrypting RL a This indicates successful identity authentication. This avoids transmitting the hash value of the password over the network, preventing theft and spoofing attacks.

[0403] (2) Token a,im Only one login is required during the validity period.

[0404] in Token a,im During the validity period, client C a Each time with IM server S im To establish a communication connection, simply send a token. a,im This allows for the establishment of connections and encrypted session communication, eliminating the need for authentication upon each login to the RC, thus improving the efficiency of system authentication.

[0405] 6. This embodiment can resist replay attacks. In this embodiment, the anti-replay attack function f(T) is used for each message transmission. b ,T c ,ΔT,N c N array By comparing the minimum system latency and the status of the sent random number, the system can determine whether a message has been replayed, thus improving system security.

[0406] 7. This embodiment can resist spoofing attacks. In this embodiment, each transmitted message, except for the user ID, uses the RC public key and the shared session key K. a KS rc,im K a,im_t Encryption ensures that even if an attacker intercepts the message, they cannot obtain the plaintext information. Furthermore, the anti-replay attack function f(T) further enhances this protection. b ,T c ,ΔT,N c N array The use of ) can resist attackers' spoofing attacks.

[0407] 8. This embodiment implements secure storage and retrieval of instant messages. Client C a and C b Instant messaging via K im_enmsg Encrypted storage on IM server S im This ensures the security of message storage. Furthermore, even if the client is reinstalled or local messages are deleted, previous chat logs can be retrieved through message retrieval. This also complies with the relevant requirements of the "Internet Information Service Management Measures" regarding instant messaging message storage and information traceability.

[0408] 9. This embodiment can realize all key updates. This embodiment implements RC and S im The update of all keys on the server side also enabled the update of client passwords, thus improving system security.

[0409] 10. This embodiment can adapt to a distributed environment, with the Authentication Center (RC) responsible for the client and the IM server (S). im Registration and authentication, responsible for client and S im Session key distribution and token issuance between servers are handled by the client. If additional servers are added to the system, the client will also be able to access the server as if it were a private server. im Similarly, request tokens from the RC to add servers, enabling multi-server access and adapting to a distributed environment.

[0410] Figure 10 This is a schematic diagram illustrating the implementation flow of an information processing method provided in an embodiment of the present invention. The executing entity of the information processing method can be a user terminal, such as a mobile phone, desktop computer, or laptop computer. (Reference) Figure 10 Information processing methods include:

[0411] S1001, if an operation triggered by the first user to communicate with the peer device is detected, determine the encryption key corresponding to the operation type of the operation.

[0412] Here, the peer device includes a key server and a communication server. The key server corresponds to the aforementioned RC authentication center, and the communication server corresponds to the IM server.

[0413] User actions include user registration, user login, establishing a connection, sending session messages, retrieving chat history, and password updates.

[0414] If the operation type is user registration, the peer device is a key server, and the key corresponding to the operation type is the public key of the key server; the public key corresponds to K. rc_pub .

[0415] If the operation type is user login, the peer device is a key server, and the key corresponding to the operation type is the shared key generated by the user terminal between the first user and the communication server; the shared key is the password of the first user encrypted based on a hash function; the shared key corresponds to K. a K a =h(PW a ), PW a This is the password for the first user.

[0416] If the operation type is "establishing a connection", the peer device is the communication server, and the key corresponding to the operation type is the second temporary session key generated by the key server between the user terminal and the communication server; the second temporary session key corresponds to K. a,im_t .

[0417] If the operation type is sending a session message, the peer device is the communication server, and the key corresponding to the operation type is the second temporary session key;

[0418] If the operation type is "acquiring chat history", the peer device is the communication server, and the key corresponding to the operation type is the second temporary session key;

[0419] If the operation type is the password update, the peer device is the key server, and the key corresponding to the operation type is the shared key.

[0420] S1002, encrypt the authentication information generated by the user terminal based on the operation using the encryption key to obtain the first ciphertext.

[0421] Different operation types require different authentication information, which mainly includes the first user's username, the time the communication request was sent, and a random number. The peer device verifies the authentication information to determine if any attack has occurred.

[0422] Each data packet sent by the user terminal carries a newly generated random number. The peer device includes a random number sequence storing the random numbers in the communication request. Each time a random number is received, it is stored in the random number sequence. If the random number in the data packet currently received by the peer device falls within the random number sequence corresponding to the time between the current time and the time the communication request was sent, it indicates a replay attack and insecure access.

[0423] S1003, Generate a communication request based on the first ciphertext, the communication request including an identifier of the operation type.

[0424] The communication request includes an operation type identifier, which is mainly to inform the peer device what the communication request is for. Based on the operation type, the peer device can also obtain the corresponding decryption key to decrypt the first ciphertext.

[0425] S1004, the communication request is sent to the peer device.

[0426] In this embodiment of the invention, if the user terminal detects an operation triggered by a first user to communicate with a peer device, it determines the key corresponding to the operation type. Based on the encryption key corresponding to the operation type, it encrypts the authentication information generated by the user terminal based on the user's operation, obtaining first ciphertext. A communication request is generated based on the first ciphertext and sent to the peer device. This embodiment obtains the encryption key based on the first user's operation type. The encryption key is not fixed, making it difficult for hackers to know the user's operation type. Furthermore, the encryption key for the communication request corresponds to the operation type, making it difficult for hackers to crack the communication request using a fixed key. This strengthens the security of each communication process and enables more secure communication information transmission.

[0427] In one embodiment, if the operation type is user registration, then the peer device is a key server, and the encryption key corresponding to the operation type is the public key of the key server;

[0428] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes:

[0429] The password of the first user is encrypted using a hash function to generate a shared key between the first user and the communication server;

[0430] The authentication information is encrypted using the public key of the key server; the authentication information includes the username of the first user, the shared key, the first temporary session key generated by the user terminal and the key server, the first sending time of the communication request, and the first random number generated by the user terminal; the user terminal inserts a newly generated random number into each generated communication request, and the peer device includes a random number sequence that stores the random number in the communication request.

[0431] Here, symmetric encryption can use the SM4 national cryptographic algorithm, the temporary session key and the shared key are both symmetric encryption keys, the asymmetric algorithm can use the SM2 national cryptographic algorithm, and the hash function can use the SM3 national cryptographic algorithm.

[0432] First User U a In client C a (Mobile or PC) Enter your login ID a and password PW a Submit a registration request, C a Generate the first temporary session key K c,rc_t And calculate:

[0433] K a =h(PW a )

[0434] A a =E(K) pub ,[ID a ,K a ,K c,rc_t ,T3,N3])

[0435] The first ciphertext is A. a The authentication information corresponds to [ID] a ,K a ,K c,rc_t [,T3,N3], where the first sending time is T3, the first random number is N3, and the shared key is K. a .

[0436] A a Send to the key server, the key server receives A a Then, via private key K priv Decrypt A a Get ID a ,K a ,K c,rc_t T3, N3, first query the ID. a Check if it has been registered. If not, call function f(T3,T) c ,ΔT,N3,N rc_arrayIf the key server returns false, the session ends. Otherwise, the key server writes N3 into N. rc_array In, and calculate Will It exists in the key server's database. Then the key server calculates the first verification information, HRA. a Second ciphertext RA a :

[0437] HRA a =h(ID) a ||T3||N3)

[0438] RA a =E(K) c,rc_t HRA a ,T4])

[0439] Then the second ciphertext RA a Send to the user terminal of the first user, where T4 is the current sending time.

[0440] In one embodiment, the method further includes:

[0441] The system receives a response from the key server based on the communication request. The response includes a second ciphertext encrypted with the first temporary session key. The second ciphertext includes a second sending time of the response and a first verification information encrypted with a hash. The first verification information includes the username, first sending time, and first random number of the first user obtained by the key server decrypting the first ciphertext.

[0442] Decrypt the second ciphertext based on the first temporary session key;

[0443] Determine whether the difference between the current time and the second transmission time is less than or equal to a set value;

[0444] If the difference is less than or equal to the set value, then the first verification information is subjected to consistency verification.

[0445] If the consistency verification is successful, the first user is confirmed to have registered successfully.

[0446] The first user's terminal receives the response information, using K. c,rc_t Decrypting RA a Receive HRA a And T4, then use the current time T c Calculate T c Check if -T4 ≤ ΔT is true. If not, end the dialogue. Otherwise, calculate. judge If they are equal, then prompt the user U. aRegistration successful. U a The key K is actually shared between the key server and the key. a .

[0447] The second ciphertext corresponds to RA. a The first verification information corresponds to HRA a The second transmission time is T4, and the set value is ΔT.

[0448] Among these steps, performing consistency verification on the first verification information involves calculating... judge If they are equal, the consistency verification is successful.

[0449] In one embodiment, if the operation type is user login, then the peer device is the key server, and the encryption key corresponding to the operation type is the shared key;

[0450] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes:

[0451] The authentication information is encrypted based on the shared key; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request; the communication request includes the first ciphertext and the username of the first user.

[0452] First, the first user U a In client C a Enter login ID a and password PW a Submit login, C a calculate:

[0453] K a =h(PW a )

[0454] L a =E(K) a [T5,N4])

[0455] The authentication information includes a second random number N4 and a third sending time T5, then {ID} a L a}Sent to the key server, L a This is the first ciphertext.

[0456] The key server received {ID a L a After that, first by ID a Find the corresponding first encryption key Then use the first preset key K rc_enkey Decryption Obtain the shared key K a Then use K a Decrypting L a We obtain T5 and N4. Then we call the function f(T5, T c ,ΔT,N4,N rc_array If the response returns false, the conversation ends. Otherwise, RC writes N4 into the random number sequence N. rc_array In, and generate C a and S im Second temporary session key K a,im_t And calculate:

[0457] HRL a =h(ID) a ||T5||N4)

[0458] Token a,im =E(K) rc,im ,[ID a SID im ,K a,im_t ,T6,Lifetime])

[0459] RL a =E(K) a ,[HRL a ,T6,Token a,im ,K a,im_t ])

[0460] T6 is the fourth sending time, Token a,im It is C a Visit S im Access ticket, Lifetime is a token a,im The validity period of the instrument. RL a It is the third ciphertext, HRL a This is the second verification information; the key server will then send the third ciphertext RL. a Return to C a And confirm that the user has successfully logged in.

[0461] In one embodiment, the method further includes:

[0462] The system receives a response from the key server based on the communication request. The response includes a third ciphertext encrypted with the shared key. The third ciphertext includes a fourth sending time of the response, hash-encrypted second verification information, a second temporary session key generated by the key server between the user terminal and the communication server, and a ticket generated by the key server for the first user to access the communication server. The second verification information includes the username of the first user obtained by decrypting the first ciphertext, a second random number, and a third sending time. The ticket includes the second temporary session key, the identity identifier of the communication server, and the username of the first user.

[0463] Decrypt the third ciphertext based on the shared key;

[0464] Determine whether the difference between the current time and the fourth transmission time is less than or equal to the set value;

[0465] If the difference is less than or equal to the set value, then the second verification information is subjected to consistency verification.

[0466] If the consistency verification is successful, the user login is confirmed to be successful, and the ticket and the second temporary session key are saved.

[0467] For example, C a After receiving the response information, use K a Decrypting the third ciphertext RL a get

[0468] HRL a ,T6,Token a,im ,K a,im_t HRL a This is the second verification information, using the current time T. c Calculate T c -T6? ≤ΔT ? Check if this condition is true. If not, end the dialogue. If the time verification passes, calculate... judge If they are equal, then prompt the user U. a Login successful. a Save Token a,im and the temporary session key K a,im_t Use K a Encrypt local storage.

[0469] Among these, performing consistency verification on the second verification information involves calculating... judge If they are equal, the consistency verification is successful.

[0470] In one embodiment, if the operation type is to establish a connection, then the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0471] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes:

[0472] The authentication information is encrypted based on the second temporary session key; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request; the communication request includes the first ciphertext and the ticket.

[0473] After logging in, the client needs to access the communication server and establish a secure communication connection with it. Similarly, in scenarios such as 5G messaging and secure private network communication, the client needs to establish a long-lived connection with the corresponding message server.

[0474] For example, client C a Calculate the first ciphertext:

[0475] CON a,im =E(K) a,im_t [T7,N5])

[0476] The authentication information includes a third random number N5 and a fifth sending time T7. Then, {Token} a,im CON a,im Send it to the communication server.

[0477] After receiving the message, the communication server first uses the second preset key K. im_enkey Decrypting the third encryption key Obtain the shared symmetric key K rc,im Then use K rc,im Decrypt Token a,im Get ID a SID im ,K a,im_t T6, Lifetime, Confirm SID im Correct, then use the second temporary session key K. a,im_t Decrypt CON a,im Obtain T7 and N5. Call the function f(T7, T c ,ΔT,N5,N im_array If the function returns false, the dialogue ends. Otherwise, calculate T. c -T6? ≤Lifetime. If true, end the conversation. Otherwise, assume C is true. a Token a,im Valid, access is legitimate, S im Write N5 into Nim_array In, and will {ID a K a,im_t The key-value pairs are written to memory for quick access, and then the calculation begins.

[0478] HRCON a,im =h(ID) a ||T7||N5)

[0479] RCON a,im =E(K) a,im_t ,[HRCON a,im ,T8])

[0480] Among them, HRCON a,im This is the third verification message; T8 is the sixth transmission time; RCON a,im This is the fourth ciphertext.

[0481] Then S im {HRCON a,im RCON a,im}Sent to C a .

[0482] In one embodiment, the method further includes:

[0483] The system receives a response from the key server based on the communication request. The response includes a fourth ciphertext encrypted with the second temporary session key. The fourth ciphertext includes a third verification message encrypted with a hash and a sixth sending time of the response. The third verification message includes a third random number and a fifth sending time obtained by the communication server from decrypting the first ciphertext, and the username of the first user obtained based on the ticket.

[0484] Decrypt the fourth ciphertext based on the second temporary session key;

[0485] Determine whether the difference between the current time and the sixth transmission time is less than or equal to the set value;

[0486] If the difference is less than or equal to the set value, then the third verification information is subjected to consistency verification.

[0487] If the consistency verification is successful, it is determined that the connection between the user terminal and the communication server has been successfully established.

[0488] For example, C a Upon receiving the message, use the second temporary session key K. a,im_t Decrypting RCON a,im Get HRCON a,im And T8, using the current time T c Calculate T c-T8? ≤ΔT ? Check if this condition is true. If not, end the dialogue. If the time verification passes, calculate... judge If they are equal, then prompt the user U. a The persistent connection was successfully established. Thus, C... a and S im They then shared the second temporary session key K. a,im_t .

[0489] If client C a After the process is killed or restarted, there is no need to log in to the key server; the user only needs to enter the password PW. a Get K a Decryption yields K a,im_t and through Token a,im Reconnect with S im Communication can be achieved by establishing a persistent connection.

[0490] If client C a Token a,im If the connection expires, the user will be prompted with a "U" message when establishing a persistent connection. a Token a,im Expired, Client C a This will redirect you to the login screen and force the user to use their U key. a Re-enter your password to log in and obtain a new token. a,im And update the second temporary session key K a,im_t .

[0491] Among these, performing consistency verification on the third verification information involves calculating... judge If they are equal, the consistency verification is successful.

[0492] In one embodiment, if the operation type is sending a session message, then the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0493] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes:

[0494] The authentication information is encrypted based on the second temporary session key; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal, the seventh sending time of the communication request, and the first hash value; the first hash value is obtained by hashing the username of the first user, the identity identifier of the communication server, and the user identifier of the target user; the communication request includes the first ciphertext and the username of the first user.

[0495] For example, if the target user of the session information is a second user, the method further includes:

[0496] The second user's user terminal receives response information sent by the communication server based on the communication request of the first user; the response information includes the username of the first user and a fifth ciphertext encrypted based on the second temporary session key of the first user, the fifth ciphertext includes the seventh sending time of the communication request of the first user, the eighth sending time of the response information, the first session information input by the first user, and the second hash value; the second hash value is obtained by hash calculation based on the username of the first user, the username of the second user, and the seventh sending time.

[0497] Decrypt the fifth ciphertext based on the second temporary session key;

[0498] Determine whether the difference between the current time and the eighth transmission time is less than or equal to the set value;

[0499] If the difference is less than or equal to the set value, the second hash value is subjected to consistency verification;

[0500] If the consistency verification passes, the first session information will be displayed in the dialog box between the first user and the second user.

[0501] For example, the first user U a To the second user U b Send first session information M a,b The process is as follows:

[0502] (1)U a In client C a Terminal input M a,b And click Send to U b C a Start calculating the first hash value HID a,im,b And the first ciphertext S a,im,b :

[0503] HID a,im,b =h(ID) a ||SID im ||ID b )

[0504] S a,im,b =E(K) a,im_t [HID] a,im,b ID b M a,b ,T9,N6])

[0505] Where T9 is the seventh sending time, N6 is the newly generated fourth random number, and then {ID a S a,im,b}Sent to communication server S im .

[0506] (2) Communication server S im By ID a Find the second temporary session key K a,im_t Then use K a,im_t Decrypt S a,im,b Get HID a,b ID b M a,im,b ,T9,N6, and then call the function f(T9,T c ,ΔT,N6,N im_array If the function returns false, the conversation ends. Otherwise, S... im Write N6 into the random number sequence N. im_array In, and calculate judge If they are not equal, end the conversation. If they are equal, calculate:

[0507] HID a,b =h(ID) a ||ID b ||T9)

[0508] SIM a,b =E(K) im_enmsg [HID] a,b M a,b ])

[0509] and {ID a ID b T9, SIM a,b The chat log is stored in the database, where state indicates whether the message has been sent. The default state is "not sent".

[0510] Then, S im Query and determine C b Is online (with or without S) im Establish a long-lived connection; if offline, do not process (or push an offline notification), and wait for C. b Go online. If C b If online, calculate the fifth ciphertext S. b,im,a :

[0511] S b,im,a =E(K) b,im_t [HID] a,b M a,b ,T9,T10 ])

[0512] Among them, HID a,b It is the second hash value, K b,im_t It is S im and C b The corresponding second temporary session key, T 10 It is the eighth sending time, then {ID} a S b,im,a}Sent to C b .

[0513] (3)C b After receiving the message, use K b,im_t Decrypting the fifth ciphertext S b,im,a Get ID a HID a,b M a,b ,T9,T 10 Then use the current time T c Calculate T c -T 10 Check if ≤ΔT is true. If not, end the dialogue. If the time verification passes, then calculate... judge If they are equal, then in C b Local database stores {ID a ID b M a,b ,T9}, and on the terminal screen U b and U a The dialog box displays an instant message.

[0514] Among these steps, performing consistency verification on the second hash value involves calculating... judge If they are equal, the consistency verification passes.

[0515] For example, if the target user of the session information is a user group, and the user group includes a second user, and the username of the target user is the identifier of the user group, the method further includes:

[0516] The second user's user terminal receives a response message sent by the communication server based on the communication request of the first user; the response message includes the identity identifier of the user group, the username of the first user, and a sixth ciphertext encrypted based on the second temporary session key corresponding to the second user; the sixth ciphertext includes a seventh sending time generated by the first user's user terminal, an eighth sending time of the response message, first session information input by the first user, and a third hash value; the third hash value is obtained by hash calculation based on the identity identifier of the user group, the username of the first user, and the seventh sending time;

[0517] Decrypt the sixth ciphertext based on the second temporary session key;

[0518] Determine whether the difference between the current time and the eighth transmission time is less than or equal to the set value;

[0519] If the difference is less than or equal to the set value, a consistency verification is performed on the third hash value;

[0520] If the consistency verification passes, the first user's first session information will be displayed in the dialog box of the user group.

[0521] For example, user U a In Group G a,b,c,d Send first session information M a,G G a,b,c,d Indicates member U a U b U c U d The process for joining the group is as follows:

[0522] (1)U a In client C a Terminal Group G a,b,c,d Enter M a,G And click send, C a Start calculation:

[0523] HID a,im,G =h(ID) a ||SID im ||ID G )

[0524] S a,im,G =E(K) a,im_t [HID] a,im,G ID G M a,G ,T 11 ,N7])

[0525] Among them, HID a,im,G It is the first hash value, Sa,im,G It is the first ciphertext, T 11 It is the seventh sending time, N7 is the newly generated fourth random number, and ID. G It's a group of G a,b,c,d The unique identifier, then {ID a S a,im,G}Sent to S im .

[0526] (2)S im After receiving the message, via ID a Find K a,im_t Then use K a,im_t Decrypt S a,im,G Get HID a,im,G ID G M a,G ,T 11 ,N7, then call function f(T) 11 ,T c ,ΔT,N7,N im_array If the function returns false, the conversation ends. Otherwise, S... im Write N7 into N im_array In, and calculate judge If they are not equal, end the conversation. If they are equal, calculate:

[0527] HID a,G =h(ID) a ||ID G ||T 11 )

[0528] SIM a,G =E(K) im_enmsg [HID] a,G M a,G ])

[0529] and {ID a ID G T 11 SIM a,G The chat log is stored in the database as a record of whether the message has been sent (the default state is "not sent"). The `HID` parameter represents the chat history. a,G This is the third hash value.

[0530] Then, S im According to ID G The group member found is U a U b U c U d First, determine C b Cc C d Is online (with or without S) im Establish a persistent connection; if the user is offline, do not process the request (or send an offline notification) and wait for them to come back online. For example, if C... b If online, calculate the sixth ciphertext S. b,im,a,G :

[0531] S b,im,a,G =E(K) b,im_t [HID] a,G M a,G ,T 11 ,T 12 ])

[0532] Where K b,im_t It is S im and C b The second temporary session key, T 12 It is the eighth transmission time, HID a,G It's the third hash value. Then, {ID} a ID G S b,im,a,G}Sent to C b .

[0533] (3)C b After receiving the message, use K b,im_t Decrypt S b,im,a,G Get HID a,G M a,G ,T 11 ,T 12 Then use the current time T c Calculate T c -T 12 Check if ≤ΔT is true. If not, end the dialogue. If the time verification passes, then calculate... judge If they are equal, then in C b Local database stores {ID a ID G M a,G T 11} and display it in the group message dialog box on the terminal screen. Similarly, C c and C d You will receive the message in the same way.

[0534] Among these steps, performing consistency verification on the third hash value involves calculating... judge If they are equal, then the consistency verification is successful.

[0535] In one embodiment, if the operation type is to obtain chat history, then the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0536] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes:

[0537] The authentication information is encrypted based on the second temporary session key; the authentication information includes the time period of the chat history between the first user and the second user selected by the first user, the username of the second user, the fifth random number generated by the user terminal, the ninth sending time of the communication request, and the fourth hash value, the fourth hash value being obtained by hashing the username of the first user, the username of the second user, and the identity identifier of the communication server; the communication request includes the username of the first user and the first ciphertext.

[0538] The client can synchronize the latest instant messages from the communication server, ensuring that chat history is displayed even if local messages on the client are deleted or the client program is reinstalled. Similarly, this also applies to 5G messaging and secure private network scenarios.

[0539] For example, client C a With IM server S im Establish a long-lived connection and share the temporary session key K. a,im_t .

[0540] First User U a In relation to the second user U b Pull-to-refresh in the chat interface to get U b Chat history, client C a calculate:

[0541] HID a,im,b =h(ID) a ||SID im ||ID b )

[0542] RM a,im,b =E(K) a,im_t [HID] a,im,b ID b ,TQ,T 13 ,N8])

[0543] Where T 13 Ninth transmission time, HID a,im,b It is the fourth hash value, RM a,im,b This is the first encrypted message, N8 is the newly generated fifth random number, TQ is the time period for which the chat history needs to be retrieved, and then {ID} a RMa,im,b}Sent to S im .

[0544] (3) Communication Server S im After receiving the message, via ID a Find K a,im_t Then use K a,im_t Decrypting RM a,im,b Get HID a,im,b ID b ,TQ,T 13 ,N8, then call function f(T) 13 ,T c ,ΔT,N8,N im_array If the function returns false, the conversation ends. Otherwise, S... im calculate judge If they are not equal, end the conversation. Otherwise, S im Write N8 into N im_array In, and through {ID a ID b Given the condition TQ, query U for this time period. a and U b Chat history {ID a ID b T r SIM a,b , state} (assuming there is only one record), where T r This is the tenth sending time of the third session message; state is the message state, determined by K. im_enmsg Decryption yields the third session information M a,b Then start the calculation:

[0545] HRID a,b =h(ID) a ||ID b ||T 13 ||N8)

[0546] IMR a,b =E(K) a,im_t ,[HRID a,b ID b M a,b ,T r ,TQ,T 14 ])

[0547] Among them, HRID a,b It is the fifth hash value, T 14 It is the eleventh time the response message is sent, and then the seventh ciphertext IMR is sent. a,b Send to C a.

[0548] In one embodiment, the method further includes:

[0549] The system receives a response message sent by the communication server based on the communication request. The response message includes a seventh ciphertext encrypted based on the second temporary session key. The seventh ciphertext includes the third session information between the first user and the second user within the time period queried by the communication server, the username of the second user, the tenth sending time of the third session information, the eleventh sending information of the response message, and a fifth hash value. The fifth hash value is obtained by hashing the username of the second user, the fifth random number, the ninth sending time, and the username of the first user, which are decrypted by the communication server.

[0550] Decrypt the seventh ciphertext based on the second temporary session key;

[0551] Determine whether the difference between the current time and the eleventh transmission time is less than or equal to the set value;

[0552] If the difference is less than or equal to the set value, a consistency verification is performed on the fifth hash value;

[0553] If the consistency verification passes, the third session information will be displayed in the dialog box between the first user and the second user.

[0554] For example, C a After receiving the message, use K a,im_t Decrypting the Seventh Cipher Text IMR a,b Receive HRID a,b ID b M a,b ,T r ,TQ,T 14 Then use the current time T c Calculate T c -T 14 Check if ≤ΔT is true. If not, end the dialogue. If the time verification passes, then calculate... judge If they are equal, then store the instant messaging record {ID}. a ID b M a,b T r}, then in C a The chat screen displays the found chat history.

[0555] Among these steps, performing consistency verification on the fifth hash value involves calculating... judge If they are equal, the consistency verification passes. The purpose of consistency verification is to ensure that the call messages were not forged by a hacker.

[0556] In one embodiment, if the operation type is a password update, then the peer device is the key server, and the encryption key corresponding to the operation type is the shared key;

[0557] Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes:

[0558] The authentication information is encrypted based on the shared key; the authentication information includes a new shared key obtained by hashing the new password of the first user, the username of the first user, the twelfth sending time of the communication request, and the sixth random number generated by the user terminal; the communication request includes the first ciphertext and the username of the first user.

[0559] For example, the first user U a In client C a (Mobile or PC) Enter your login ID a Old password PW a And new password And calculate:

[0560] K a =h(PW a )

[0561]

[0562]

[0563] Among them, UA a The first ciphertext, T 15 The twelfth sending time, N9 is the sixth random number, and {ID} a UA a Send to RC.

[0564] After receiving the key, the RC uses the ID. a Shared key K was found a And through K a Decrypting UA a Get ID a , T 15 N9, Determine ID a Is it related to decrypting UA? a Later I got the ID a If they are equal, then the function f(T) is called. 15 ,T c ,ΔT,N9,N rc_arrayIf the response returns false, the conversation ends. Otherwise, RC writes N9 into N. rc_array In, and calculate Will The key exists in the key server's database; replace the original key. Then the key server calculates:

[0565] HUA a =h(ID) a ||T 15 ||N9)

[0566]

[0567] Among them, HUA a It is the sixth hash value, then the eighth ciphertext RUA a Send to C a T 16 This is the thirteenth time the response message was sent.

[0568] Correspondingly, the method also includes:

[0569] The system receives a response message sent by the key server based on the communication request. The response message includes an eighth ciphertext encrypted with the new shared key. The eighth ciphertext includes the thirteenth sending time and the sixth hash value of the response message. The sixth hash value is obtained by hashing the username of the first user, the twelfth sending time, and the sixth random number obtained by the key server after decryption.

[0570] Decrypt the eighth ciphertext based on the new shared key;

[0571] Determine whether the difference between the current time and the thirteenth transmission time is less than or equal to the set value;

[0572] If the difference is less than or equal to the set value, a consistency verification is performed on the sixth hash value;

[0573] If the consistency verification passes, the password update for the first user is confirmed to be successful.

[0574] For example, C a Received RUA a Afterwards, use Decryption yields HUA a ,T 16 Then use the current time T c Calculate T c -T 16 Check if ≤ΔT is true. If not, end the dialogue. Otherwise, calculate. judge If they are equal, C aWill Store in memory, replace K a And prompt user U a Password updated successfully. That's it for U. a The new key was also shared with RC.

[0575] Among these steps, performing consistency verification on the sixth hash value involves calculating... judge If they are equal, the consistency verification passes.

[0576] Figure 11 This is a schematic diagram illustrating the implementation flow of another information processing method provided in an embodiment of the present invention. The execution entity of the information processing method is a key server, which can be deployed on the same user terminal as the communication server. (Reference) Figure 11 Information processing methods include:

[0577] S1101, Receive a communication request sent by a user terminal; the communication request includes a first ciphertext and an identifier of an operation type, the first ciphertext includes authentication information generated by the user terminal based on the operation of a first user, and the first ciphertext is obtained by encrypting the authentication information based on the encryption key corresponding to the operation type of the operation;

[0578] S1102, Determine the decryption key corresponding to the operation type based on the identifier;

[0579] S1103, decrypt the first ciphertext based on the decryption key corresponding to the operation type to obtain the authentication information;

[0580] S1104, Determine whether a replay attack exists based on the authentication information;

[0581] S1105, if there is no replay attack, generate response information based on the authentication information and send it to the user terminal.

[0582] Wherein, if the operation type is user registration, the decryption key corresponding to the operation type is the private key of the key server;

[0583] If the operation type is user login, the key corresponding to the operation type is the shared key generated by the user terminal between the first user and the communication server; the shared key is the password of the first user encrypted based on a hash function.

[0584] If the operation type is the password update, the decryption key corresponding to the operation type is the shared key.

[0585] The private key is encrypted and stored in the key server based on the master key of the key server;

[0586] The shared key is encrypted and stored in the key server based on a first preset key;

[0587] The first preset key is encrypted and stored in the key server based on the master key of the key server.

[0588] The authentication information includes the sending time of the communication request and a random number. To prevent replay attacks on the server, an anti-replay attack function f(T) is introduced. b ,T c ,ΔT,N c N array ), where T b T represents the message sending time. c Let N be the message arrival time, ΔT be the system minimum latency, and N be the latency of the message arrival time. c N is the random number received by the server from the sender. array This is a random number sequence from the server. The function first calculates T. c -T b If the value is less than or equal to ΔT, return false if the condition is not met; otherwise, return false if the condition is met. array In the query, does N exist within the time interval ΔT? c If it exists, return false, indicating verification failure; otherwise, return true, indicating verification success.

[0589] In one embodiment, if the operation type is user registration, then the decryption key corresponding to the operation type is the private key of the key server;

[0590] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0591] The authentication information is obtained by decrypting the first ciphertext based on the private key; the authentication information includes the username of the first user, the shared key between the first user and the communication server, the first temporary session key generated by the user terminal and the key server, the first sending time and the first random number of the communication request; the shared key represents the password of the first user encrypted by the hash function.

[0592] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0593] Determine whether the difference between the current time and the first sending time is less than or equal to a set value;

[0594] If the difference is less than or equal to the set value, then in the first random number sequence corresponding to the key server, it is queried whether the time period corresponding to the difference includes the first random number; the first random number sequence stores the random number received by the key server;

[0595] If the first random number is not included, then it is determined that there is no replay attack;

[0596] Correspondingly, the step of generating response information based on the authentication information and sending it to the user terminal includes:

[0597] The first user's username, first sending time, and first random number obtained through decryption are hashed and encrypted to generate the first verification information;

[0598] The first verification information and the second sending time are encrypted based on the first temporary session key to obtain the second ciphertext; the second sending time represents the sending time of the response information.

[0599] A response message is generated based on the second ciphertext and sent to the user terminal of the first user.

[0600] Among them, based on the function f(T3,T) c ,ΔT,N3,N rc_array Determine if a replay attack exists.

[0601] For details on the implementation of other steps, please refer to the above method embodiments, which will not be repeated here.

[0602] In one embodiment, if no replay attack exists, the method further includes:

[0603] The shared key is encrypted based on the first preset key to obtain the first encryption key;

[0604] The username of the first user and the first encryption key are stored in the local database.

[0605] calculate Will It exists in the RC database.

[0606] The first preset key is K. rc_enkey The first encryption key is

[0607] In one embodiment, if the operation type is user login, then the decryption key corresponding to the operation type is the shared key; the communication request includes the first ciphertext and the username of the first user;

[0608] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0609] Determine the first encryption key corresponding to the username of the first user;

[0610] The shared key is obtained by decrypting the first encryption key based on the first preset key.

[0611] The first ciphertext is decrypted based on the shared key to obtain the authentication information; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request;

[0612] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0613] Determine whether the difference between the current time and the third transmission time is less than or equal to the set value;

[0614] If the difference is less than or equal to the set value, then in the first random number sequence corresponding to the key server, query whether the second random number is included in the time period corresponding to the difference;

[0615] If the second random number is not included, then it is determined that there is no replay attack;

[0616] Correspondingly, the step of generating response information based on the authentication information and sending it to the user terminal includes:

[0617] Generate a second temporary session key between the user terminal and the communication server;

[0618] The second verification information is obtained by hashing and encrypting the username of the first user obtained through decryption, the second random number, and the third sending time.

[0619] Based on the second temporary session key, the identity identifier of the communication server, and the username of the first user, a ticket for the first user to access the communication server is generated;

[0620] The third ciphertext is obtained by encrypting the ticket, the second verification information, the second temporary session key, and the fourth sending time based on the shared key; the fourth sending time represents the sending time of the response information.

[0621] Based on the third ciphertext, a response message is generated and sent to the user terminal of the first user.

[0622] Among them, based on the function f(T5,T) c ,ΔT,N4,N rc_array Determine if a replay attack exists.

[0623] In one embodiment, the ticket token a,im=E(K) rc,im ,[ID a SID im ,K a,im_t ,T6,Lifetime]), the third ciphertext RL a =E(K) a ,[HRL a ,T6,Token a,im ,K a,im_t ]).

[0624] In one embodiment, if the operation type is a password update, then the decryption key corresponding to the operation type is the shared key, and the communication request includes the first ciphertext and the username of the first user;

[0625] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0626] Query the shared key based on the username of the first user;

[0627] The first ciphertext is decrypted based on the shared key to obtain the authentication information; the authentication information includes the new shared key obtained by the user terminal hashing the new password of the first user, the username of the first user, the twelfth sending time of the communication request, and the sixth random number.

[0628] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0629] Determine whether the difference between the current time and the twelfth transmission time is less than or equal to the set value;

[0630] If the difference is less than or equal to the set value, then query the random number sequence corresponding to the key server to see if the sixth random number is included in the time period corresponding to the difference;

[0631] If the sixth random number is not included, then it is determined that there is no replay attack;

[0632] Correspondingly, the step of generating and sending response information to the user terminal based on the authentication information includes:

[0633] Based on the username of the first user obtained through decryption, the twelfth sending time, and the sixth random number, a hash encryption is performed to obtain the sixth hash value;

[0634] The sixth hash value and the thirteenth sending time are encrypted based on the new shared key to obtain the eighth ciphertext; the thirteenth sending time represents the sending time of the response information.

[0635] Based on the eighth ciphertext, a response message is generated and sent to the user terminal of the first user.

[0636] Among them, the function f(T) can be called. 15 ,T c ,ΔT,N9,N rc_array Determine if a replay attack exists.

[0637] For details on the implementation of other steps, please refer to the above method embodiments, which will not be repeated here.

[0638] In one embodiment, the method further includes:

[0639] The system receives a registration request sent by the communication server. The registration request includes a ninth ciphertext, which is obtained by encrypting a third temporary session key, a seventh random number generated by the communication server, the identity identifier of the communication server, and a fourteenth sending time based on the public key of the key server. The third temporary session key is a temporary session key generated by the communication server for communication with the key server. The fourteenth sending time represents the sending time of the registration request.

[0640] Decrypt the ninth ciphertext based on the private key corresponding to the public key;

[0641] Based on the seventh random number and the fourteenth sending time, determine whether the registration request is subject to a replay attack;

[0642] If no replay attack is detected, a shared symmetric key and an eighth random number are generated for communication with the communication server.

[0643] The shared symmetric key, the eighth random number, the fifteenth sending time, and the fourth verification information are encrypted based on the third temporary session key to obtain the tenth ciphertext; the fourth verification information is obtained by hashing and encrypting the eighth random number, the fifteenth sending time, the seventh random number, and the identity identifier of the communication server; the fifteenth sending time represents the sending time of the tenth ciphertext;

[0644] The tenth ciphertext is sent to the communication server.

[0645] Among them, communication server S im When joining a network, you first need to register and generate a third temporary session key KS. rc,im And the seventh random number N1, using the public key K pub Perform encrypted calculations:

[0646] A im =E(K) pub [SID] im KS rc,im ,T1,N1])

[0647] Among them, SID im It is S im The unique identity, T1 is the fourteenth sending time, h(·) is the SM3 hash function, and the ninth ciphertext A is... im Send to the key server.

[0648] The key server received A im Then, via private key K priv Decrypt A im , obtain SID im KS rc,im T1, N1, First query SID im Check if it has been registered. If not, call the anti-replay attack function f(T1,T) c ,ΔT,N1,N rc_array If the response returns false, the conversation ends. Otherwise, RC writes N1 into N. rc_array In the middle, and generate communication with server S im Shared symmetric key K rc,im And the eighth random number N2, then calculate:

[0649] HRA im =h(SID) im ||T2||N1||N2)

[0650] RA im =E(KS) rc,im HRA im ,K rc,im [,T2,N2])

[0651] The tenth ciphertext RA im Send to communication server S im Where T2 is the fifteenth transmission time. Then calculate... And Store in the database and publish the communication server S. im SID im .

[0652] Communication server S im Received RA im Then, use KS rc,im Decrypting RA im Receive HRA im ,K rc,im ,T2,N2, and then call f(T2,T c ,ΔT,N2,N im_array If the function returns false, the dialogue ends. Otherwise, the function is evaluated. judge If they are equal, Sim Write N2 into N im_array In the middle, then calculate And Store it in the database, and at the same time, store K rc,im Write to memory for quick program access (the server will use KB after each restart). im_enkey Decryption Get K rc,im (Write to memory). This is how RC and S... im They shared the session key K. rc,im Used for encrypted communication.

[0653] In one embodiment, the method further includes:

[0654] The shared symmetric key is encrypted based on the first preset key to obtain the second encryption key;

[0655] The identity identifier of the communication server and the second encryption key are stored in a local database.

[0656] Calculate the second encryption key And and communication server S im SID im The corresponding data is stored in the database.

[0657] Figure 12 This is a schematic diagram illustrating the implementation flow of another information processing method provided in an embodiment of the present invention. The execution entity of the information processing method is a communication server, and the key server can be deployed on the same user terminal as the communication server. (Reference) Figure 12 Information processing methods include:

[0658] S1201, Receive a communication request sent by a user terminal; the communication request includes a first ciphertext and an identifier of an operation type, the first ciphertext includes authentication information generated by the user terminal based on the operation of a first user, and the first ciphertext is obtained by encrypting the authentication information based on the encryption key corresponding to the operation type of the operation;

[0659] S1202, Determine the decryption key corresponding to the operation type based on the identifier;

[0660] S1203, decrypt the first ciphertext based on the decryption key corresponding to the operation type to obtain the authentication information;

[0661] S1204, Determine whether a replay attack exists based on the authentication information;

[0662] S1205, if there is no replay attack, generate response information based on the authentication information and send it to the user terminal.

[0663] The authentication information includes the sending time of the communication request and a random number. To prevent replay attacks on the server, an anti-replay attack function f(T) is introduced. b ,T c ,ΔT,N c N array ), where T b T represents the message sending time. c Let N be the message arrival time, ΔT be the system minimum latency, and N be the latency of the message arrival time. c N is the random number received by the server from the sender. array This is a random number sequence from the server. The function first calculates T. c -T b If the value is less than or equal to ΔT, return false if the condition is not met; otherwise, return false if the condition is met. array In the query, does N exist within the time interval ΔT? c If it exists, return false, indicating verification failure; otherwise, return true, indicating verification success.

[0664] Wherein, if the operation type is the establishment of a connection, the decryption key corresponding to the operation type is the second temporary session key between the user terminal and the communication server generated by the key server;

[0665] If the operation type is sending a session message, the key corresponding to the operation type is the second temporary session key;

[0666] If the operation type is to obtain chat history, the decryption key corresponding to the operation type is the second temporary session key.

[0667] The second temporary session key is stored in the communication server.

[0668] In one embodiment, the method further includes:

[0669] Generate a third temporary session key for communication with the key server;

[0670] The registration request is sent to the key server; the registration request includes a ninth ciphertext encrypted based on the public key of the key server, the ninth ciphertext including the third temporary session key, the seventh random number generated by the communication server, the identity identifier of the communication server, and the fourteenth sending time; the fourteenth sending time represents the sending time of the registration request;

[0671] The system receives a tenth ciphertext sent by the key server based on the registration request. The tenth ciphertext includes a shared symmetric key generated by the key server for communication with the communication server, an eighth random number generated by the key server, a fifteenth sending time, and fourth verification information. The tenth ciphertext is encrypted based on the third temporary session key, the fifteenth sending time represents the sending time of the tenth ciphertext, and the fourth verification information is obtained by hashing and encrypting the eighth random number, the fifteenth sending time, the seventh random number, and the identity identifier of the communication server.

[0672] Based on the third temporary session key, the tenth ciphertext is decrypted to obtain the shared symmetric key, the eighth random number, the fifteenth sending time, and the fourth verification information;

[0673] Based on the eighth random number and the fifteenth sending time, it is determined whether the tenth ciphertext is susceptible to a replay attack; the communication server includes a second random number sequence that stores random numbers;

[0674] If no replay attack exists, perform consistency verification on the fourth verification information;

[0675] If the consistency verification passes, the shared symmetric key is encrypted based on the second preset key of the communication server to obtain the third encryption key;

[0676] The third encryption key is stored in a local database.

[0677] Among them, communication server S im When joining a network, you first need to register and generate a third temporary session key KS. rc,im And the seventh random number N1, using the public key K pub Perform encrypted calculations:

[0678] A im =E(K) pub [SID] im KS rc,im ,T1,N1])

[0679] Among them, SID im It is S im The unique identity, T1 is the fourteenth sending time, h(·) is the SM3 hash function, and the ninth ciphertext A is... im Send to the key server.

[0680] The key server received A im Then, via private key K priv Decrypt A im , obtain SID im KS rc,im T1, N1, First query SIDim Check if it has been registered. If not, call the anti-replay attack function f(T1,T) c ,ΔT,N1,N rc_array If the response returns false, the conversation ends. Otherwise, RC writes N1 into N. rc_array In the middle, and generate communication with server S im Shared symmetric key K rc,im And the eighth random number N2, then calculate:

[0681] HRA im =h(SID) im ||T2||N1||N2)

[0682] RA im =E(KS) rc,im HRA im ,K rc,im [,T2,N2])

[0683] The tenth ciphertext RA im Send to communication server S im Where T2 is the fifteenth transmission time. Then calculate... And Store in the database and publish the communication server S. im SID im .

[0684] Communication server S im Received RA im Then, use KS rc,im Decrypting RA im Receive HRA im ,K rc,im Then, the anti-replay attack function f(T2,T2,N2) is called. c ,ΔT,N2,N im_array If the function returns false, the dialogue ends. Otherwise, the function is evaluated. judge If they are equal, S im Write N2 into N im_array In the middle, then calculate And Store it in the database, and at the same time, store K rc,im Write to memory for quick program access (the server will use KB after each restart). im_enkey Decryption Get K rc,im (Write to memory). This is how RC and S... im They shared the session key K. rc,im Used for encrypted communication.

[0685] In one embodiment, if the operation type is establishing a connection, the decryption key corresponding to the operation type is the second temporary session key generated by the key server for communication between the user terminal and the communication server; the communication request includes the first ciphertext and the ticket for the first user to access the communication server; the ticket includes the second temporary session key, the identity identifier of the communication server, and the username of the first user;

[0686] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0687] The second temporary session key is determined based on the ticket;

[0688] The authentication information is obtained by decrypting the first ciphertext based on the second temporary session key; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request.

[0689] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0690] Determine whether the difference between the current time and the fifth transmission time is less than or equal to the set value;

[0691] If the difference is less than or equal to the set value, then in the second random number sequence corresponding to the communication server, query whether the time period corresponding to the difference includes the third random number;

[0692] If the third random number is not included, then it is determined that there is no replay attack;

[0693] Correspondingly, the step of generating and sending response information to the user terminal based on the authentication information includes:

[0694] The third verification information is obtained by hashing the third random number obtained through decryption, the fifth sending time, and the username of the first user.

[0695] The third verification information and the sixth sending time are encrypted based on the second temporary session key to obtain the fourth ciphertext; the sixth sending time represents the sending time of the response information.

[0696] Based on the fourth ciphertext, a response message is generated and sent to the user terminal of the first user.

[0697] Among them, the communication server calls the function f(T7,T) c ,ΔT,N5,N im_array Determine if a replay attack exists.

[0698] For details on the implementation of other steps, please refer to the above method embodiments, which will not be repeated here.

[0699] In one embodiment, if the operation type is sending a session message, then the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the username of the first user;

[0700] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0701] Query the second temporary session key based on the username of the first user;

[0702] The authentication information is obtained by decrypting the first ciphertext based on the second temporary session key; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal and the seventh sending time of the communication request, and the first hash value obtained by hashing and encrypting the username of the first user, the identity identifier of the communication server and the user identifier of the target user.

[0703] In one example, if the target user of the session information is the second user, the step of generating response information based on the authentication information and sending it to the user terminal includes:

[0704] A second hash value is obtained by hashing the username of the first user, the username of the second user, and the seventh sending time.

[0705] The second hash value, the first session information input by the first user, the seventh sending time, and the eighth sending time are encrypted based on the second temporary session key to obtain the fifth ciphertext; the eighth sending time represents the sending time of the response information.

[0706] Based on the fifth ciphertext and the username of the first user, a response message is generated and sent to the user terminal of the second user.

[0707] For example, communication server S im After receiving the message from the first user, via ID a Find K a,im_t Then use K a,im_t Decrypt S a,im,b Get HID a,b ID b M a,im,b ,T9,N6, and then call the function f(T9,T c ,ΔT,N6,N im_arrayIf the function returns false, the conversation ends. Otherwise, S... im Write N6 into N im_array In, and calculate judge If they are not equal, end the conversation. Otherwise, calculate:

[0708] HID a,b =h(ID) a ||ID b ||T9)

[0709] SIM a,b =E(K) im_enmsg [HID] a,b M a,b ])

[0710] and {ID a ID b T9, SIM a,b The chat log is stored in the database, where state indicates whether the message has been sent. The default state is "not sent".

[0711] Then, S im Query and determine C b Is online (with or without S) im Establish a long-lived connection; if offline, do not process (or push an offline notification), and wait for C. b Go online. If C b If online, then calculate:

[0712] S b,im,a =E(K) b,im_t [HID] a,b M a,b ,T9,T 10 ])

[0713] Then the response information {ID a S b,im,a}Sent to C b .

[0714] In one example, if the target user of the session information is a user group, and the user group includes a second user, and the username of the target user is the identifier of the user group, the step of generating response information based on the authentication information and sending it to the user terminal includes:

[0715] The third hash value is obtained by hashing the username of the first user, the identity identifier of the user group, and the seventh sending time.

[0716] The third hash value, the first session information, the seventh sending time, and the eighth sending time are encrypted based on the second user's second temporary session key to obtain the sixth ciphertext;

[0717] Based on the sixth ciphertext, the username of the first user, and the identity identifier of the user group, a response message is generated and sent to the user terminal of the second user.

[0718] For example, communication server S im After receiving the message from the first user, via ID a Find K a,im_t Then use K a,im_t Decrypt S a,im,G Get HID a,im,G ID G M a,G ,T 11 ,N7, then call function f(T) 11 ,T c ,ΔT,N7,N im_array If the function returns false, the conversation ends. Otherwise, S... im Write N7 into N im_array In, and calculate judge If they are not equal, end the conversation. Otherwise, calculate:

[0719] HID a,G =h(ID) a ||ID G ||T 11 )

[0720] SIM a,G =E(K) im_enmsg [HID] a,G M a,G ])

[0721] and {ID a ID G T 11 SIM a,G The chat log is stored in the database, where state indicates whether the message has been sent. The default state is "not sent".

[0722] Then, S im According to ID G The group member found is U a U b U c U d First, determine C b C c Cd Is online (with or without S) im Establish a persistent connection; if the user is offline, do not process the request (or send an offline notification) and wait for them to come back online. For example, if C... b If online, then calculate:

[0723] S b,im,a,G =E(K) b,im_t [HID] a,G M a,G ,T 11 ,T 12 ])

[0724] Then {ID a ID G S b,im,a,G}Sent to C b .

[0725] The specific implementation process of each step is detailed in the above method implementation examples, and will not be repeated here.

[0726] In one embodiment, if the operation type is to retrieve chat history, then the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the username of the first user;

[0727] Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes:

[0728] Query the second temporary session key based on the username of the first user;

[0729] The authentication information is obtained by decrypting the first ciphertext based on the second temporary session key; the authentication information includes the time period of the chat history between the first user and the second user, the username of the second user, the fifth random number generated by the user terminal, the ninth sending time of the communication request, and the fourth hash value; the fourth hash value is obtained by hashing the username of the first user, the username of the second user, and the identity identifier of the communication server.

[0730] Correspondingly, determining whether a replay attack exists based on the authentication information includes:

[0731] Determine whether the difference between the current time and the ninth transmission time is less than or equal to the set value;

[0732] If the difference is less than or equal to the set value, then query the random number sequence corresponding to the key server to see if the fifth random number is included in the time period corresponding to the difference;

[0733] If the fifth random number is not included, then it is determined that there is no replay attack;

[0734] Correspondingly, the step of generating and sending response information to the user terminal based on the authentication information includes:

[0735] Based on the username of the first user, the username of the second user, and the time period, query the third session information between the first user and the second user within the time period;

[0736] The username of the first user, the decrypted username of the second user, the fifth random number, and the ninth sending time are hashed and encrypted to obtain the fifth hash value;

[0737] The third session information, the fifth hash value, the username of the second user, the tenth and eleventh sending information of the third session information are encrypted based on the second temporary session key to obtain the seventh ciphertext; the eleventh sending information represents the sending time of the response information.

[0738] Based on the seventh ciphertext, a response message is generated and sent to the user terminal of the first user.

[0739] Among them, the communication server calls the function f(T) 13 ,T c ,ΔT,N8,N im_array Determine if a replay attack exists.

[0740] The specific implementation process of each step is detailed in the above method implementation examples, and will not be repeated here.

[0741] This application's embodiments design all nodes of the instant messaging process, including server initialization, server registration, client registration, client login, establishment of long communication connections, one-on-one instant messaging sessions, group chat sessions, instant messaging retrieval and synchronization, and key updates. Compared with other instant messaging solutions, it not only focuses on the key security exchange and negotiation process, but also provides a more systematic and complete security design for the entire instant messaging process.

[0742] This application implements a more secure instant messaging solution. Through security analysis, it achieves a complete secure instant messaging process, end-to-end information security encryption, secure storage of server and client keys, efficient key negotiation and management, more secure and efficient identity authentication, resistance to replay attacks, resistance to spoofing attacks, resistance to known session key attacks, all key updates, and adaptability to distributed environments.

[0743] The parameters in the claims correspond to the parameters in the above embodiments, as detailed below:

[0744] The RC certification center corresponds to the key server, and the IM server corresponds to the communication server.

[0745] Public key K rc_pub Private key K rc_priv Shared key K a First temporary session key K c,rc_t Second temporary session key K a,im_t First preset key K rc_enkey First encryption key Second encryption key Third temporary session key KS rc,im Shared symmetric key K rc,im The second preset key K im_enkey Third encryption key First transmission time T3, first random number N3, second ciphertext RA a First verification information HRA a Second transmission time T4, third transmission time T5, second random number N4, third ciphertext RL a Fourth transmission time T6, second verification information HRL a The third random number N5 and the fifth sending time T7, the third verification information HRCON a,im The sixth transmission time is T8, and the fourth ciphertext is RCON. a,im .

[0746] One-on-one chat session: First hash value (HID) a,im,b =h(ID) a ||SID im ||ID b Fifth ciphertext S b,im,a Second hash value HID a,b =h(ID) a ||ID b ||T9).

[0747] Group chat session: First hash value (HID) a,im,G =h(ID) a ||SID im ||ID G ), Sixth ciphertext S b,im,a,G Third hash value HID a,G =h(ID) a ||ID G ||T 11 ).

[0748] Time period TQ, fifth random number N8, ninth sending time T 13 Fourth hash value HID a,im,b Fifth hash value HRIDa,b 10th Sending Time T r The seventh ciphertext, IMR a,b Eleventh message T 14 The twelfth sending time and the sixth random number T 15 N9, Eighth Cipher Text RUA a Thirteenth sending time T 16 The sixth hash value HUA a Fourteenth transmission time T1, Ninth ciphertext A im Third temporary session key KS rc,im The seventh random number N1, the eighth random number N2, and the shared symmetric key K rc,im The tenth ciphertext RA im 15th transmission time T2, 2nd preset key K im_enkey .

[0749] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0750] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0751] It should be noted that the technical solutions described in the embodiments of the present invention can be combined arbitrarily without conflict.

[0752] In addition, in the embodiments of the present invention, "first," "second," etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0753] refer to Figure 13 , Figure 13 This is a schematic diagram of an information processing device provided in an embodiment of the present invention. The device includes:

[0754] The first determining module is used to determine the encryption key corresponding to the operation type of the operation if an operation triggered by the first user to communicate with the peer device is detected.

[0755] The first encryption module is used to encrypt the authentication information generated by the user terminal based on the operation based on the encryption key, to obtain the first ciphertext;

[0756] A first generation module is configured to generate a communication request based on the first ciphertext, wherein the communication request includes an identifier of the operation type;

[0757] The sending module is used to send the communication request to the peer device.

[0758] In one embodiment, if the operation type is user registration, then the peer device is a key server, and the encryption key corresponding to the operation type is the public key of the key server;

[0759] Correspondingly, the first encryption module is specifically used for:

[0760] The password of the first user is encrypted using a hash function to generate a shared key between the first user and the communication server;

[0761] The authentication information is encrypted using the public key of the key server; the authentication information includes the username of the first user, the shared key, the first temporary session key generated by the user terminal and the key server, the first sending time of the communication request, and the first random number generated by the user terminal; the user terminal inserts a newly generated random number into each generated communication request, and the peer device includes a random number sequence that stores the random number in the communication request.

[0762] In one embodiment, the device further includes:

[0763] The information receiving module is used to receive response information sent by the key server based on the communication request. The response information includes a second ciphertext encrypted based on the first temporary session key. The second ciphertext includes a second sending time of the response information and a first verification information encrypted by hash. The first verification information includes the username of the first user, the first sending time, and a first random number obtained by the key server decrypting the first ciphertext.

[0764] The ciphertext decryption module is used to decrypt the second ciphertext based on the first temporary session key;

[0765] The difference determination module is used to determine whether the difference between the current time and the second transmission time is less than or equal to a set value;

[0766] A consistency verification module is used to perform consistency verification on the first verification information if the difference is less than or equal to the set value.

[0767] The registration result determination module is used to determine that the first user has successfully registered if the consistency verification is successful.

[0768] In one embodiment, if the operation type is user login, then the peer device is the key server, and the encryption key corresponding to the operation type is the shared key;

[0769] Correspondingly, the first encryption module is specifically used to: encrypt the authentication information based on the shared key; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request; the communication request includes the first ciphertext and the username of the first user.

[0770] In one embodiment, the information receiving module is further configured to receive response information sent by the key server based on the communication request. The response information includes third ciphertext encrypted based on the shared key. The third ciphertext includes a fourth sending time of the response information, second verification information encrypted by hash, a second temporary session key generated by the key server between the user terminal and the communication server, and a ticket generated by the key server for the first user to access the communication server. The second verification information includes the username of the first user obtained by the key server decrypting the first ciphertext, a second random number, and a third sending time. The ticket includes the second temporary session key, the identity identifier of the communication server, and the username of the first user.

[0771] The ciphertext decryption module is also used to decrypt the third ciphertext based on the shared key;

[0772] The difference determination module is also used to determine whether the difference between the current time and the fourth transmission time is less than or equal to the set value;

[0773] The consistency verification module is further configured to perform consistency verification on the second verification information if the difference is less than or equal to the set value;

[0774] The storage module is used to determine that the user login is successful if the consistency verification is successful, and to save the ticket and the second temporary session key.

[0775] In one embodiment, if the operation type is to establish a connection, then the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0776] Correspondingly, the first encryption module is specifically used for:

[0777] The authentication information is encrypted based on the second temporary session key; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request; the communication request includes the first ciphertext and the ticket.

[0778] In one embodiment, the information receiving module is further configured to receive response information sent by the key server based on the communication request. The response information includes a fourth ciphertext encrypted based on the second temporary session key. The fourth ciphertext includes a third verification information encrypted with hash and a sixth sending time of the response information. The third verification information includes a third random number obtained by the communication server decrypting the first ciphertext and a fifth sending time, as well as the username of the first user obtained based on the ticket.

[0779] The ciphertext decryption module is also used to decrypt the fourth ciphertext based on the second temporary session key;

[0780] The difference determination module is also used to determine whether the difference between the current time and the sixth sending time is less than or equal to the set value;

[0781] The consistency verification module is also used to perform consistency verification on the third verification information if the difference is less than or equal to the set value;

[0782] The connection establishment module is used to determine that the connection between the user terminal and the communication server has been successfully established if the consistency verification is successful.

[0783] In one embodiment, if the operation type is sending a session message, then the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0784] Correspondingly, the first encryption module is specifically used to encrypt the authentication information based on the second temporary session key; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal, the seventh sending time of the communication request, and the first hash value; the first hash value is obtained by hash calculation based on the username of the first user, the identity identifier of the communication server, and the user identifier of the target user; the communication request includes the first ciphertext and the username of the first user.

[0785] In one embodiment, if the target user of the session information is a second user, the second user's user terminal receives response information sent by the communication server based on the communication request of the first user; the response information includes the username of the first user and a fifth ciphertext encrypted based on the second temporary session key of the first user, the fifth ciphertext includes the seventh sending time of the communication request of the first user, the eighth sending time of the response information, the first session information input by the first user, and a second hash value; the second hash value is obtained by hash calculation based on the username of the first user, the username of the second user, and the seventh sending time;

[0786] Decrypt the fifth ciphertext based on the second temporary session key;

[0787] Determine whether the difference between the current time and the eighth transmission time is less than or equal to the set value;

[0788] If the difference is less than or equal to the set value, the second hash value is subjected to consistency verification;

[0789] If the consistency verification passes, the first session information will be displayed in the dialog box between the first user and the second user.

[0790] In one embodiment, if the target user of the session information is a user group, the user group includes a second user, and the username of the target user is the identity identifier of the user group;

[0791] The information receiving module is further configured to receive, via the second user's user terminal, response information sent by the communication server based on the communication request of the first user; the response information includes the identity identifier of the user group, the username of the first user, and a sixth ciphertext encrypted based on the second temporary session key corresponding to the second user; the sixth ciphertext includes a seventh sending time generated by the first user's user terminal, an eighth sending time of the response information, first session information input by the first user, and a third hash value; the third hash value is obtained by hash calculation based on the identity identifier of the user group, the username of the first user, and the seventh sending time;

[0792] The ciphertext decryption module is also used to decrypt the sixth ciphertext based on the second temporary session key;

[0793] The difference determination module is also used to determine whether the difference between the current time and the eighth transmission time is less than or equal to the set value;

[0794] The consistency verification module is also used to perform consistency verification on the third hash value if the difference is less than or equal to the set value;

[0795] The display module is used to display the first session information of the first user in the dialog box of the user group if the consistency verification passes.

[0796] In one embodiment, if the operation type is to obtain chat history, then the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key;

[0797] Correspondingly, the first encryption module is specifically used for:

[0798] The authentication information is encrypted based on the second temporary session key; the authentication information includes the time period of the chat history between the first user and the second user selected by the first user, the username of the second user, the fifth random number generated by the user terminal, the ninth sending time of the communication request, and the fourth hash value, the fourth hash value being obtained by hashing the username of the first user, the username of the second user, and the identity identifier of the communication server; the communication request includes the username of the first user and the first ciphertext.

[0799] In one embodiment, the information receiving module is further configured to receive response information sent by the communication server based on the communication request. The response information includes a seventh ciphertext encrypted based on the second temporary session key. The seventh ciphertext includes the third session information between the first user and the second user within the time period queried by the communication server, the username of the second user, the tenth sending time of the third session information, the eleventh sending information of the response information, and a fifth hash value. The fifth hash value is obtained by hashing the username of the second user, the fifth random number, the ninth sending time, and the username of the first user obtained by the communication server through decryption.

[0800] The ciphertext decryption module is also used to decrypt the seventh ciphertext based on the second temporary session key;

[0801] The difference determination module is also used to determine whether the difference between the current time and the eleventh transmission time is less than or equal to the set value;

[0802] The consistency verification module is also used to perform consistency verification on the fifth hash value if the difference is less than or equal to the set value;

[0803] The display module is also used to display the third session information in the dialog box between the first user and the second user if the consistency verification passes.

[0804] In one embodiment, if the operation type is a password update, then the peer device is the key server, and the encryption key corresponding to the operation type is the shared key;

[0805] Correspondingly, the first encryption module is specifically used for:

[0806] The authentication information is encrypted based on the shared key; the authentication information includes a new shared key obtained by hashing the new password of the first user, the username of the first user, the twelfth sending time of the communication request, and the sixth random number generated by the user terminal; the communication request includes the first ciphertext and the username of the first user.

[0807] In one embodiment, the information receiving module is further configured to receive response information sent by the key server based on the communication request, the response information including an eighth ciphertext encrypted based on the new shared key, the eighth ciphertext including the thirteenth sending time and the sixth hash value of the response information; the sixth hash value is obtained by hashing the username of the first user obtained by the key server through decryption, the twelfth sending time, and the sixth random number.

[0808] The ciphertext decryption module is also used to decrypt the eighth ciphertext based on the new shared key;

[0809] The difference determination module is also used to determine whether the difference between the current time and the thirteenth transmission time is less than or equal to the set value;

[0810] The consistency verification module is also used to perform consistency verification on the sixth hash value if the difference is less than or equal to the set value;

[0811] The password update module is used to determine that the password update for the first user was successful if the consistency verification passes.

[0812] refer to Figure 14 , Figure 14 This is a schematic diagram of an information processing device provided in an embodiment of the present invention. The device includes:

[0813] The first receiving module is configured to receive a communication request sent by a user terminal; the communication request includes a first ciphertext and an identifier of an operation type, the first ciphertext includes authentication information generated by the user terminal based on the operation of a first user, and the first ciphertext is obtained by encrypting the authentication information based on the encryption key corresponding to the operation type of the operation;

[0814] The second determining module is used to determine the decryption key corresponding to the operation type based on the identifier;

[0815] The first decryption module is used to decrypt the first ciphertext based on the decryption key corresponding to the operation type to obtain the authentication information;

[0816] The third determining module is used to determine whether a replay attack exists based on the authentication information;

[0817] The second generation module is used to generate response information to be sent to the user terminal based on the authentication information if no replay attack exists.

[0818] In one embodiment, if the operation type is user registration, then the decryption key corresponding to the operation type is the private key of the key server;

[0819] Correspondingly, the first decryption module is specifically used for:

[0820] The authentication information is obtained by decrypting the first ciphertext based on the private key; the authentication information includes the username of the first user, the shared key between the first user and the communication server, the first temporary session key generated by the user terminal and the key server, the first sending time and the first random number of the communication request; the shared key represents the password of the first user encrypted by the hash function.

[0821] Correspondingly, the third determining module is specifically used for:

[0822] Determine whether the difference between the current time and the first sending time is less than or equal to a set value;

[0823] If the difference is less than or equal to the set value, then in the first random number sequence corresponding to the key server, it is queried whether the time period corresponding to the difference includes the first random number; the first random number sequence stores the random number received by the key server;

[0824] If the first random number is not included, then it is determined that there is no replay attack;

[0825] Correspondingly, the second generation module is specifically used for:

[0826] The first user's username, first sending time, and first random number obtained through decryption are hashed and encrypted to generate the first verification information;

[0827] The first verification information and the second sending time are encrypted based on the first temporary session key to obtain the second ciphertext; the second sending time represents the sending time of the response information.

[0828] A response message is generated based on the second ciphertext and sent to the user terminal of the first user.

[0829] In one embodiment, if no replay attack exists, the apparatus further includes:

[0830] A key encryption module is used to encrypt the shared key based on a first preset key to obtain a first encryption key;

[0831] The database module is used to store the username of the first user and the first encryption key in a local database.

[0832] In one embodiment, if the operation type is user login, then the decryption key corresponding to the operation type is the shared key; the communication request includes the first ciphertext and the username of the first user;

[0833] Correspondingly, the first decryption module is specifically used for:

[0834] Determine the first encryption key corresponding to the username of the first user;

[0835] The shared key is obtained by decrypting the first encryption key based on the first preset key.

[0836] The first ciphertext is decrypted based on the shared key to obtain the authentication information; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request;

[0837] Correspondingly, the third determining module is specifically used for:

[0838] Determine whether the difference between the current time and the third transmission time is less than or equal to the set value;

[0839] If the difference is less than or equal to the set value, then in the first random number sequence corresponding to the key server, query whether the second random number is included in the time period corresponding to the difference;

[0840] If the second random number is not included, then it is determined that there is no replay attack;

[0841] Correspondingly, the second generation module is specifically used for:

[0842] Generate a second temporary session key between the user terminal and the communication server;

[0843] The second verification information is obtained by hashing and encrypting the username of the first user obtained through decryption, the second random number, and the third sending time.

[0844] Based on the second temporary session key, the identity identifier of the communication server, and the username of the first user, a ticket for the first user to access the communication server is generated;

[0845] The third ciphertext is obtained by encrypting the ticket, the second verification information, the second temporary session key, and the fourth sending time based on the shared key; the fourth sending time represents the sending time of the response information.

[0846] Based on the third ciphertext, a response message is generated and sent to the user terminal of the first user.

[0847] In one embodiment, if the operation type is a password update, then the decryption key corresponding to the operation type is the shared key, and the communication request includes the first ciphertext and the username of the first user;

[0848] Correspondingly, the first decryption module is specifically used for:

[0849] Query the shared key based on the username of the first user;

[0850] The first ciphertext is decrypted based on the shared key to obtain the authentication information; the authentication information includes the new shared key obtained by the user terminal hashing the new password of the first user, the username of the first user, the twelfth sending time of the communication request, and the sixth random number.

[0851] Correspondingly, the third determining module is specifically used for:

[0852] Determine whether the difference between the current time and the twelfth transmission time is less than or equal to the set value;

[0853] If the difference is less than or equal to the set value, then query the random number sequence corresponding to the key server to see if the sixth random number is included in the time period corresponding to the difference;

[0854] If the sixth random number is not included, then it is determined that there is no replay attack;

[0855] Correspondingly, the second generation module is specifically used for:

[0856] Based on the username of the first user obtained through decryption, the twelfth sending time, and the sixth random number, a hash encryption is performed to obtain the sixth hash value;

[0857] The sixth hash value and the thirteenth sending time are encrypted based on the new shared key to obtain the eighth ciphertext; the thirteenth sending time represents the sending time of the response information.

[0858] Based on the eighth ciphertext, a response message is generated and sent to the user terminal of the first user.

[0859] In one embodiment, the apparatus further includes a first registration module, configured to:

[0860] The system receives a registration request sent by the communication server. The registration request includes a ninth ciphertext, which is obtained by encrypting a third temporary session key, a seventh random number generated by the communication server, the identity identifier of the communication server, and a fourteenth sending time based on the public key of the key server. The third temporary session key is a temporary session key generated by the communication server for communication with the key server. The fourteenth sending time represents the sending time of the registration request.

[0861] Decrypt the ninth ciphertext based on the private key corresponding to the public key;

[0862] Based on the seventh random number and the fourteenth sending time, determine whether the registration request is subject to a replay attack;

[0863] If no replay attack is detected, a shared symmetric key and an eighth random number are generated for communication with the communication server.

[0864] The shared symmetric key, the eighth random number, the fifteenth sending time, and the fourth verification information are encrypted based on the third temporary session key to obtain the tenth ciphertext; the fourth verification information is obtained by hashing and encrypting the eighth random number, the fifteenth sending time, the seventh random number, and the identity identifier of the communication server; the fifteenth sending time represents the sending time of the tenth ciphertext;

[0865] The tenth ciphertext is sent to the communication server.

[0866] In one embodiment, the key encryption module is further configured to encrypt the shared symmetric key based on a first preset key to obtain a second encryption key;

[0867] The database module is also used to store the identity identifier of the communication server and the second encryption key in a local database.

[0868] refer to Figure 15 , Figure 15 This is a schematic diagram of an information processing device provided in an embodiment of the present invention. The device includes:

[0869] The second receiving module is used to receive a communication request sent by a user terminal; the communication request includes a first ciphertext and an identifier of an operation type, the first ciphertext includes authentication information generated by the user terminal based on the operation of the first user, and the first ciphertext is obtained by encrypting the authentication information based on the encryption key corresponding to the operation type of the operation;

[0870] The fourth determining module is used to determine the decryption key corresponding to the operation type based on the identifier;

[0871] The second decryption module is used to decrypt the first ciphertext based on the decryption key corresponding to the operation type to obtain the authentication information;

[0872] The fifth determining module is used to determine whether a replay attack exists based on the authentication information;

[0873] The third generation module is used to generate response information to be sent to the user terminal based on the authentication information if no replay attack exists.

[0874] In one embodiment, the method further includes: a second registration module, configured to:

[0875] Generate a third temporary session key for communication with the key server;

[0876] The registration request is sent to the key server; the registration request includes a ninth ciphertext encrypted based on the public key of the key server, the ninth ciphertext including the third temporary session key, the seventh random number generated by the communication server, the identity identifier of the communication server, and the fourteenth sending time; the fourteenth sending time represents the sending time of the registration request;

[0877] The system receives a tenth ciphertext sent by the key server based on the registration request. The tenth ciphertext includes a shared symmetric key generated by the key server for communication with the communication server, an eighth random number generated by the key server, a fifteenth sending time, and fourth verification information. The tenth ciphertext is encrypted based on the third temporary session key, the fifteenth sending time represents the sending time of the tenth ciphertext, and the fourth verification information is obtained by hashing and encrypting the eighth random number, the fifteenth sending time, the seventh random number, and the identity identifier of the communication server.

[0878] Based on the third temporary session key, the tenth ciphertext is decrypted to obtain the shared symmetric key, the eighth random number, the fifteenth sending time, and the fourth verification information;

[0879] Based on the eighth random number and the fifteenth sending time, it is determined whether the tenth ciphertext is susceptible to a replay attack; the communication server includes a second random number sequence that stores random numbers;

[0880] If no replay attack exists, perform consistency verification on the fourth verification information;

[0881] If the consistency verification passes, the shared symmetric key is encrypted based on the second preset key of the communication server to obtain the third encryption key;

[0882] The third encryption key is stored in a local database.

[0883] In one embodiment, if the operation type is establishing a connection, the decryption key corresponding to the operation type is the second temporary session key generated by the key server for communication between the user terminal and the communication server; the communication request includes the first ciphertext and the ticket for the first user to access the communication server; the ticket includes the second temporary session key, the identity identifier of the communication server, and the username of the first user;

[0884] Correspondingly, the second decryption module is specifically used for:

[0885] The second temporary session key is determined based on the ticket;

[0886] The authentication information is obtained by decrypting the first ciphertext based on the second temporary session key; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request.

[0887] Correspondingly, the fifth determining module is specifically used for:

[0888] Determine whether the difference between the current time and the fifth transmission time is less than or equal to the set value;

[0889] If the difference is less than or equal to the set value, then in the second random number sequence corresponding to the communication server, query whether the time period corresponding to the difference includes the third random number;

[0890] If the third random number is not included, then it is determined that there is no replay attack;

[0891] Correspondingly, the third generation module is specifically used for:

[0892] The third verification information is obtained by hashing the third random number obtained through decryption, the fifth sending time, and the username of the first user.

[0893] The third verification information and the sixth sending time are encrypted based on the second temporary session key to obtain the fourth ciphertext; the sixth sending time represents the sending time of the response information.

[0894] Based on the fourth ciphertext, a response message is generated and sent to the user terminal of the first user.

[0895] In one embodiment, if the operation type is sending a session message, then the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the username of the first user;

[0896] Correspondingly, the second decryption module is specifically used for:

[0897] Query the second temporary session key based on the username of the first user;

[0898] The authentication information is obtained by decrypting the first ciphertext based on the second temporary session key; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal and the seventh sending time of the communication request, and the first hash value obtained by hashing and encrypting the username of the first user, the identity identifier of the communication server and the user identifier of the target user.

[0899] In one embodiment, if the target user of the session information is the second user, the third generation module is specifically used for:

[0900] A second hash value is obtained by hashing the username of the first user, the username of the second user, and the seventh sending time.

[0901] The second hash value, the first session information input by the first user, the seventh sending time, and the eighth sending time are encrypted based on the second temporary session key to obtain the fifth ciphertext; the eighth sending time represents the sending time of the response information.

[0902] Based on the fifth ciphertext and the username of the first user, a response message is generated and sent to the user terminal of the second user.

[0903] In one embodiment, if the target user of the session information is a user group, the user group includes a second user, and the username of the target user is the identifier of the user group, the third generation module is specifically used for:

[0904] The third hash value is obtained by hashing the username of the first user, the identity identifier of the user group, and the seventh sending time.

[0905] The third hash value, the first session information, the seventh sending time, and the eighth sending time are encrypted based on the second user's second temporary session key to obtain the sixth ciphertext;

[0906] Based on the sixth ciphertext, the username of the first user, and the identity identifier of the user group, a response message is generated and sent to the user terminal of the second user.

[0907] In one embodiment, if the operation type is to retrieve chat history, then the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the username of the first user;

[0908] Correspondingly, the second decryption module is specifically used for:

[0909] Query the second temporary session key based on the username of the first user;

[0910] The authentication information is obtained by decrypting the first ciphertext based on the second temporary session key; the authentication information includes the time period of the chat history between the first user and the second user, the username of the second user, the fifth random number generated by the user terminal, the ninth sending time of the communication request, and the fourth hash value; the fourth hash value is obtained by hashing the username of the first user, the username of the second user, and the identity identifier of the communication server.

[0911] Correspondingly, the fifth determining module is specifically used for:

[0912] Determine whether the difference between the current time and the ninth transmission time is less than or equal to the set value;

[0913] If the difference is less than or equal to the set value, then query the random number sequence corresponding to the key server to see if the fifth random number is included in the time period corresponding to the difference;

[0914] If the fifth random number is not included, then it is determined that there is no replay attack;

[0915] Correspondingly, the third generation module is specifically used for:

[0916] Based on the username of the first user, the username of the second user, and the time period, query the third session information between the first user and the second user within the time period;

[0917] The username of the first user, the decrypted username of the second user, the fifth random number, and the ninth sending time are hashed and encrypted to obtain the fifth hash value;

[0918] The third session information, the fifth hash value, the username of the second user, the tenth and eleventh sending information of the third session information are encrypted based on the second temporary session key to obtain the seventh ciphertext; the eleventh sending information represents the sending time of the response information.

[0919] Based on the seventh ciphertext, a response message is generated and sent to the user terminal of the first user.

[0920] In practical applications, the sending module, the first encryption module, the first determining module, and the first generating module can be implemented by a processor in the user terminal, such as a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU), or a field-programmable gate array (FPGA).

[0921] It should be noted that the information processing device provided in the above embodiments is only illustrated by the division of the above modules when performing information processing. In actual applications, the above processing can be assigned to different modules as needed, that is, the internal structure of the device can be divided into different modules to complete all or part of the processing described above. In addition, the information processing device and the information processing method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0922] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of this application, the embodiments of this application also provide a user terminal. Figure 16 This is a schematic diagram of the hardware structure of the user terminal in an embodiment of this application, as shown below. Figure 16 As shown, the user terminal includes:

[0923] A communication interface enables information exchange with other devices, such as network devices.

[0924] The processor, connected to the communication interface, enables information interaction with other devices and, when running a computer program, executes the methods provided by one or more technical solutions on the user terminal side. The computer program is stored in memory.

[0925] Of course, in practical applications, the various components in the user terminal are coupled together through a bus system. It can be understood that the bus system is used to implement communication between these components. In addition to the data bus, the bus system also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 16 The general will label all buses as bus systems.

[0926] The memory in this application embodiment is used to store various types of data to support the operation of the user terminal. Examples of such data include any computer program used for operation on the user terminal.

[0927] This application also provides a key server. Figure 17This is a schematic diagram of the hardware structure of the key server according to an embodiment of this application, as shown below. Figure 17 As shown, the key server includes:

[0928] A communication interface enables information exchange with other devices, such as network devices.

[0929] The processor, connected to the communication interface, enables information interaction with other devices and, when running a computer program, executes the methods provided by one or more technical solutions on the key server side. The computer program is stored in memory.

[0930] Of course, in practical applications, the various components of the key server are coupled together through a bus system. This bus system is understood to be used to enable communication and connection between these components. In addition to the data bus, the bus system also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 17 The general will label all buses as bus systems.

[0931] This application also provides a communication server. Figure 18 This is a schematic diagram of the hardware structure of the communication server in an embodiment of this application, as shown below. Figure 18 As shown, the key server includes:

[0932] A communication interface enables information exchange with other devices, such as network devices.

[0933] The processor, connected to the communication interface, enables information interaction with other devices and, when running a computer program, executes the methods provided by one or more technical solutions on the communication server side. The computer program is stored in memory.

[0934] Of course, in practical applications, the various components in a communication server are coupled together through a bus system. It can be understood that the bus system is used to implement communication between these components. In addition to the data bus, the bus system also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 18 The general will label all buses as bus systems.

[0935] It is understood that memory can be volatile or non-volatile, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0936] The methods disclosed in the embodiments of this application can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory. The processor reads the program from the memory and, in conjunction with its hardware, completes the steps of the aforementioned method.

[0937] Optionally, when the processor executes the program, it implements the corresponding processes implemented by the user terminal / communication server / key server in the various methods of the embodiments of this application. For the sake of brevity, these will not be described in detail here.

[0938] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a first memory storing a computer program, which can be executed by the processor of a user terminal / communication server / key server to complete the steps described in the foregoing method. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0939] In the several embodiments provided in this application, it should be understood that the disclosed apparatus, user terminal / communication server / key server, and method can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0940] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0941] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0942] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0943] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0944] It should be noted that the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0945] In addition, in this application example, terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0946] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An information processing method applied to a user terminal, the method comprising: If an operation triggered by the first user to communicate with the peer device is detected, determine the encryption key corresponding to the operation type of the operation; The authentication information generated by the user terminal based on the operation is encrypted using the encryption key to obtain the first ciphertext; A communication request is generated based on the first ciphertext, and the communication request includes an identifier of the operation type; Send the communication request to the peer device; The operation types include user registration, user login, establishing a connection, sending session messages, retrieving chat history, and password update.

2. The method according to claim 1, characterized in that, If the operation type is user registration, then the peer device is a key server, and the encryption key corresponding to the operation type is the public key of the key server; Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes: The password of the first user is encrypted using a hash function to generate a shared key between the first user and the communication server; The authentication information is encrypted using the public key of the key server; the authentication information includes the username of the first user, the shared key, the first temporary session key generated by the user terminal and the key server, the first sending time of the communication request, and the first random number generated by the user terminal; the user terminal inserts a newly generated random number into each generated communication request, and the peer device includes a random number sequence that stores the random number in the communication request.

3. The method according to claim 2, characterized in that, The method further includes: The system receives a response from the key server based on the communication request. The response includes a second ciphertext encrypted with the first temporary session key. The second ciphertext includes a second sending time of the response and a first verification information encrypted with a hash. The first verification information includes the username, first sending time, and first random number of the first user obtained by the key server decrypting the first ciphertext. Decrypt the second ciphertext based on the first temporary session key; Determine whether the difference between the current time and the second transmission time is less than or equal to a set value; If the difference is less than or equal to the set value, then the first verification information is subjected to consistency verification. If the consistency verification is successful, the first user is confirmed to have registered successfully.

4. The method according to claim 3, characterized in that, If the operation type is user login, then the peer device is the key server, and the encryption key corresponding to the operation type is the shared key; Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes: The authentication information is encrypted based on the shared key; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request; the communication request includes the first ciphertext and the username of the first user.

5. The method according to claim 4, characterized in that, The method further includes: The system receives a response from the key server based on the communication request. The response includes a third ciphertext encrypted with the shared key. The third ciphertext includes a fourth sending time of the response, hash-encrypted second verification information, a second temporary session key generated by the key server between the user terminal and the communication server, and a ticket generated by the key server for the first user to access the communication server. The second verification information includes the username of the first user obtained by decrypting the first ciphertext, a second random number, and a third sending time. The ticket includes the second temporary session key, the identity identifier of the communication server, and the username of the first user. Decrypt the third ciphertext based on the shared key; Determine whether the difference between the current time and the fourth transmission time is less than or equal to the set value; If the difference is less than or equal to the set value, then the second verification information is subjected to consistency verification. If the consistency verification is successful, the user login is confirmed to be successful, and the ticket and the second temporary session key are saved.

6. The method according to claim 5, characterized in that, If the operation type is to establish a connection, then the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key; Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes: The authentication information is encrypted based on the second temporary session key; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request; the communication request includes the first ciphertext and the ticket.

7. The method according to claim 6, characterized in that, The method further includes: The system receives a response from the key server based on the communication request. The response includes a fourth ciphertext encrypted with the second temporary session key. The fourth ciphertext includes a third verification message encrypted with a hash and a sixth sending time of the response. The third verification message includes a third random number and a fifth sending time obtained by the communication server from decrypting the first ciphertext, and the username of the first user obtained based on the ticket. Decrypt the fourth ciphertext based on the second temporary session key; Determine whether the difference between the current time and the sixth transmission time is less than or equal to the set value; If the difference is less than or equal to the set value, then the third verification information is subjected to consistency verification. If the consistency verification is successful, it is determined that the connection between the user terminal and the communication server has been successfully established.

8. The method according to claim 7, characterized in that, If the operation type is sending a session message, then the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key; Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes: The authentication information is encrypted based on the second temporary session key; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal, the seventh sending time of the communication request, and the first hash value; the first hash value is obtained by hashing the username of the first user, the identity identifier of the communication server, and the user identifier of the target user; the communication request includes the first ciphertext and the username of the first user.

9. The method according to claim 8, characterized in that, If the target user of the session information is a second user, the method further includes: The second user's user terminal receives response information sent by the communication server based on the communication request of the first user; the response information includes the username of the first user and a fifth ciphertext encrypted based on the second temporary session key of the first user, the fifth ciphertext includes the seventh sending time of the communication request of the first user, the eighth sending time of the response information, the first session information input by the first user, and the second hash value; the second hash value is obtained by hash calculation based on the username of the first user, the username of the second user, and the seventh sending time. Decrypt the fifth ciphertext based on the second temporary session key; Determine whether the difference between the current time and the eighth transmission time is less than or equal to the set value; If the difference is less than or equal to the set value, the second hash value is subjected to consistency verification; If the consistency verification passes, the first session information will be displayed in the dialog box between the first user and the second user.

10. The method according to claim 8, characterized in that, If the target user of the session information is a user group, and the user group includes a second user, and the username of the target user is the identifier of the user group, the method further includes: The second user's user terminal receives a response message sent by the communication server based on the communication request of the first user; the response message includes the identity identifier of the user group, the username of the first user, and a sixth ciphertext encrypted based on the second temporary session key corresponding to the second user; the sixth ciphertext includes a seventh sending time generated by the first user's user terminal, an eighth sending time of the response message, first session information input by the first user, and a third hash value; the third hash value is obtained by hash calculation based on the identity identifier of the user group, the username of the first user, and the seventh sending time; Decrypt the sixth ciphertext based on the second temporary session key; Determine whether the difference between the current time and the eighth transmission time is less than or equal to the set value; If the difference is less than or equal to the set value, a consistency verification is performed on the third hash value; If the consistency verification passes, the first user's first session information will be displayed in the dialog box of the user group.

11. The method according to claim 5, characterized in that, If the operation type is to obtain chat history, then the peer device is the communication server, and the encryption key corresponding to the operation type is the second temporary session key; Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes: The authentication information is encrypted based on the second temporary session key; The authentication information includes the time period of the chat history between the first user and the second user selected by the first user, the username of the second user, the fifth random number generated by the user terminal, the ninth sending time of the communication request, and the fourth hash value. The fourth hash value is obtained by hashing the username of the first user, the username of the second user, and the identity identifier of the communication server. The communication request includes the username of the first user and the first ciphertext.

12. The method according to claim 11, characterized in that, The method further includes: The system receives a response message sent by the communication server based on the communication request. The response message includes a seventh ciphertext encrypted based on the second temporary session key. The seventh ciphertext includes the third session information between the first user and the second user within the time period queried by the communication server, the username of the second user, the tenth sending time of the third session information, the eleventh sending information of the response message, and a fifth hash value. The fifth hash value is obtained by hashing the username of the second user, the fifth random number, the ninth sending time, and the username of the first user, which are decrypted by the communication server. Decrypt the seventh ciphertext based on the second temporary session key; Determine whether the difference between the current time and the eleventh transmission time is less than or equal to the set value; If the difference is less than or equal to the set value, a consistency verification is performed on the fifth hash value; If the consistency verification passes, the third session information will be displayed in the dialog box between the first user and the second user.

13. The method according to claim 4, characterized in that, If the operation type is password update, then the peer device is the key server, and the encryption key corresponding to the operation type is the shared key; Correspondingly, encrypting the authentication information generated by the user terminal based on the operation using the encryption key includes: The authentication information is encrypted based on the shared key; the authentication information includes a new shared key obtained by hashing the new password of the first user, the username of the first user, the twelfth sending time of the communication request, and the sixth random number generated by the user terminal; the communication request includes the first ciphertext and the username of the first user.

14. The method according to claim 13, characterized in that, The method further includes: The system receives a response message sent by the key server based on the communication request. The response message includes an eighth ciphertext encrypted with the new shared key. The eighth ciphertext includes the thirteenth sending time and the sixth hash value of the response message. The sixth hash value is obtained by hashing the username of the first user, the twelfth sending time, and the sixth random number obtained by the key server after decryption. Decrypt the eighth ciphertext based on the new shared key; Determine whether the difference between the current time and the thirteenth transmission time is less than or equal to the set value; If the difference is less than or equal to the set value, a consistency verification is performed on the sixth hash value; If the consistency verification passes, the password update for the first user is confirmed to be successful.

15. An information processing method applied to a key server, the method comprising: Receive communication requests sent by user terminals; The communication request includes a first ciphertext and an identifier of the operation type. The first ciphertext includes authentication information generated by the user terminal based on the operation of the first user. The first ciphertext is obtained by encrypting the authentication information based on the encryption key corresponding to the operation type of the operation. Determine the decryption key corresponding to the operation type based on the identifier; The first ciphertext is decrypted using the decryption key corresponding to the operation type to obtain the authentication information; Based on the authentication information, determine whether a replay attack exists; If no replay attack is detected, a response message is generated and sent to the user terminal based on the authentication information. The operation types include user registration, user login, establishing a connection, sending session messages, retrieving chat history, and password update.

16. The method according to claim 15, characterized in that, If the operation type is user registration, then the decryption key corresponding to the operation type is the private key of the key server; Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes: The authentication information is obtained by decrypting the first ciphertext based on the private key; the authentication information includes the username of the first user, the shared key between the first user and the communication server, the first temporary session key generated by the user terminal and the key server, the first sending time and the first random number of the communication request; the shared key represents the password of the first user encrypted by the hash function. Correspondingly, determining whether a replay attack exists based on the authentication information includes: Determine whether the difference between the current time and the first sending time is less than or equal to a set value; If the difference is less than or equal to the set value, then in the first random number sequence corresponding to the key server, it is queried whether the time period corresponding to the difference includes the first random number; the first random number sequence stores the random number received by the key server; If the first random number is not included, then it is determined that there is no replay attack; Correspondingly, the step of generating response information based on the authentication information and sending it to the user terminal includes: The first user's username, first sending time, and first random number obtained through decryption are hashed and encrypted to generate the first verification information; The first verification information and the second sending time are encrypted based on the first temporary session key to obtain the second ciphertext; the second sending time represents the sending time of the response information. A response message is generated based on the second ciphertext and sent to the user terminal of the first user.

17. The method according to claim 16, characterized in that, If no replay attack exists, the method further includes: The shared key is encrypted based on the first preset key to obtain the first encryption key; The username of the first user and the first encryption key are stored in the local database.

18. The method according to claim 17, characterized in that, If the operation type is user login, then the decryption key corresponding to the operation type is the shared key; the communication request includes the first ciphertext and the username of the first user; Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes: Determine the first encryption key corresponding to the username of the first user; The shared key is obtained by decrypting the first encryption key based on the first preset key. The first ciphertext is decrypted based on the shared key to obtain the authentication information; the authentication information includes a second random number generated by the user terminal and a third sending time of the communication request; Correspondingly, determining whether a replay attack exists based on the authentication information includes: Determine whether the difference between the current time and the third transmission time is less than or equal to the set value; If the difference is less than or equal to the set value, then in the first random number sequence corresponding to the key server, query whether the second random number is included in the time period corresponding to the difference; If the second random number is not included, then it is determined that there is no replay attack; Correspondingly, the step of generating response information based on the authentication information and sending it to the user terminal includes: Generate a second temporary session key between the user terminal and the communication server; The second verification information is obtained by hashing and encrypting the username of the first user obtained through decryption, the second random number, and the third sending time. Based on the second temporary session key, the identity identifier of the communication server, and the username of the first user, a ticket for the first user to access the communication server is generated; The third ciphertext is obtained by encrypting the ticket, the second verification information, the second temporary session key, and the fourth sending time based on the shared key; the fourth sending time represents the sending time of the response information. Based on the third ciphertext, a response message is generated and sent to the user terminal of the first user.

19. The method according to claim 18, characterized in that, If the operation type is password update, then the decryption key corresponding to the operation type is the shared key, and the communication request includes the first ciphertext and the username of the first user; Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes: Query the shared key based on the username of the first user; The first ciphertext is decrypted based on the shared key to obtain the authentication information; the authentication information includes the new shared key obtained by the user terminal hashing the new password of the first user, the username of the first user, the twelfth sending time of the communication request, and the sixth random number. Correspondingly, determining whether a replay attack exists based on the authentication information includes: Determine whether the difference between the current time and the twelfth transmission time is less than or equal to the set value; If the difference is less than or equal to the set value, then query the random number sequence corresponding to the key server to see if the sixth random number is included in the time period corresponding to the difference; If the sixth random number is not included, then it is determined that there is no replay attack; Correspondingly, the step of generating response information based on the authentication information and sending it to the user terminal includes: Based on the username of the first user obtained through decryption, the twelfth sending time, and the sixth random number, a hash encryption is performed to obtain the sixth hash value; The sixth hash value and the thirteenth sending time are encrypted using the new shared key to obtain the eighth ciphertext; the thirteenth sending time represents the sending time of the response information. Based on the eighth ciphertext, a response message is generated and sent to the user terminal of the first user.

20. The method according to claim 19, characterized in that, The method further includes: The system receives a registration request sent by the communication server. The registration request includes a ninth ciphertext, which is obtained by encrypting a third temporary session key, a seventh random number generated by the communication server, the identity identifier of the communication server, and a fourteenth sending time based on the public key of the key server. The third temporary session key is a temporary session key generated by the communication server for communication with the key server. The fourteenth sending time represents the sending time of the registration request. Decrypt the ninth ciphertext based on the private key corresponding to the public key; Based on the seventh random number and the fourteenth sending time, determine whether the registration request is subject to a replay attack; If no replay attack is detected, generate a shared symmetric key and an eighth random number for communication with the communication server; The shared symmetric key, the eighth random number, the fifteenth sending time, and the fourth verification information are encrypted based on the third temporary session key to obtain the tenth ciphertext; the fourth verification information is obtained by hashing and encrypting the eighth random number, the fifteenth sending time, the seventh random number, and the identity identifier of the communication server; the fifteenth sending time represents the sending time of the tenth ciphertext; The tenth ciphertext is sent to the communication server.

21. The method according to claim 20, characterized in that, The method further includes: The shared symmetric key is encrypted based on the first preset key to obtain the second encryption key; The identity identifier of the communication server and the second encryption key are stored in a local database.

22. An information processing method for a communication server, characterized in that, include: Receive communication requests sent by user terminals; The communication request includes a first ciphertext and an identifier of the operation type. The first ciphertext includes authentication information generated by the user terminal based on the operation of the first user. The first ciphertext is obtained by encrypting the authentication information based on the encryption key corresponding to the operation type of the operation. Determine the decryption key corresponding to the operation type based on the identifier; The first ciphertext is decrypted using the decryption key corresponding to the operation type to obtain the authentication information; Based on the authentication information, determine whether a replay attack exists; If no replay attack is detected, a response message is generated and sent to the user terminal based on the authentication information. The operation types include user registration, user login, establishing a connection, sending session messages, retrieving chat history, and password update.

23. The method according to claim 22, characterized in that, The method further includes: Generate a third temporary session key for communication with the key server; A registration request is sent to the key server; the registration request includes a ninth ciphertext encrypted based on the public key of the key server, the ninth ciphertext including the third temporary session key, the seventh random number generated by the communication server, the identity identifier of the communication server, and the fourteenth sending time; the fourteenth sending time represents the sending time of the registration request; The system receives a tenth ciphertext sent by the key server based on the registration request. The tenth ciphertext includes a shared symmetric key generated by the key server for communication with the communication server, an eighth random number generated by the key server, a fifteenth sending time, and fourth verification information. The tenth ciphertext is encrypted based on the third temporary session key, the fifteenth sending time represents the sending time of the tenth ciphertext, and the fourth verification information is obtained by hashing and encrypting the eighth random number, the fifteenth sending time, the seventh random number, and the identity identifier of the communication server. Based on the third temporary session key, the tenth ciphertext is decrypted to obtain the shared symmetric key, the eighth random number, the fifteenth sending time, and the fourth verification information; Based on the eighth random number and the fifteenth sending time, it is determined whether the tenth ciphertext is susceptible to a replay attack; the communication server includes a second random number sequence that stores random numbers; If no replay attack exists, perform consistency verification on the fourth verification information; If the consistency verification passes, the shared symmetric key is encrypted based on the second preset key of the communication server to obtain the third encryption key; The third encryption key is stored in a local database.

24. The method according to claim 23, characterized in that, If the operation type is to establish a connection, then the decryption key corresponding to the operation type is the second temporary session key generated by the key server for communication between the user terminal and the communication server; the communication request includes the first ciphertext and the ticket for the first user to access the communication server; the ticket includes the second temporary session key, the identity identifier of the communication server, and the username of the first user; Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes: The second temporary session key is determined based on the ticket; The authentication information is obtained by decrypting the first ciphertext based on the second temporary session key; the authentication information includes a third random number generated by the user terminal and a fifth sending time of the communication request. Correspondingly, determining whether a replay attack exists based on the authentication information includes: Determine whether the difference between the current time and the fifth transmission time is less than or equal to a set value; If the difference is less than or equal to the set value, then in the second random number sequence corresponding to the communication server, query whether the time period corresponding to the difference includes the third random number; If the third random number is not included, then it is determined that there is no replay attack; Correspondingly, the step of generating response information based on the authentication information and sending it to the user terminal includes: The third verification information is obtained by hashing the third random number obtained through decryption, the fifth sending time, and the username of the first user. The third verification information and the sixth sending time are encrypted based on the second temporary session key to obtain the fourth ciphertext; the sixth sending time represents the sending time of the response information. Based on the fourth ciphertext, a response message is generated and sent to the user terminal of the first user.

25. The method according to claim 24, characterized in that, If the operation type is sending a session message, then the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the username of the first user; Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes: Query the second temporary session key based on the username of the first user; The authentication information is obtained by decrypting the first ciphertext based on the second temporary session key; the authentication information includes the first session information input by the first user, the user identifier of the target user of the session information, the fourth random number generated by the user terminal and the seventh sending time of the communication request, and the first hash value obtained by hashing and encrypting the username of the first user, the identity identifier of the communication server and the user identifier of the target user.

26. The method according to claim 25, characterized in that, If the target user of the session information is a second user, the step of generating response information based on the authentication information and sending it to the user terminal includes: A second hash value is obtained by hashing the username of the first user, the username of the second user, and the seventh sending time. The second hash value, the first session information input by the first user, the seventh sending time, and the eighth sending time are encrypted based on the second temporary session key to obtain the fifth ciphertext; the eighth sending time represents the sending time of the response information. Based on the fifth ciphertext and the username of the first user, a response message is generated and sent to the user terminal of the second user.

27. The method according to claim 25, characterized in that, If the target user of the session information is a user group, and the user group includes a second user, and the username of the target user is the identity identifier of the user group, the step of generating response information based on the authentication information and sending it to the user terminal includes: The third hash value is obtained by hashing the username of the first user, the identity identifier of the user group, and the seventh sending time. The third hash value, the first session information, the seventh transmission time, and the eighth transmission time are encrypted based on the second user's second temporary session key to obtain the sixth ciphertext; Based on the sixth ciphertext, the username of the first user, and the identity identifier of the user group, a response message is generated and sent to the user terminal of the second user.

28. The method according to claim 25, characterized in that, If the operation type is to retrieve chat history, then the decryption key corresponding to the operation type is the second temporary session key; the communication request includes the first ciphertext and the username of the first user; Correspondingly, decrypting the first ciphertext based on the decryption key corresponding to the operation type includes: Query the second temporary session key based on the username of the first user; The authentication information is obtained by decrypting the first ciphertext based on the second temporary session key; the authentication information includes the time period of the chat history between the first user and the second user, the username of the second user, the fifth random number generated by the user terminal, the ninth sending time of the communication request, and the fourth hash value; the fourth hash value is obtained by hashing the username of the first user, the username of the second user, and the identity identifier of the communication server. Correspondingly, determining whether a replay attack exists based on the authentication information includes: Determine whether the difference between the current time and the ninth transmission time is less than or equal to the set value; If the difference is less than or equal to the set value, then query the random number sequence corresponding to the key server to see if the fifth random number is included in the time period corresponding to the difference; If the fifth random number is not included, then it is determined that there is no replay attack; Correspondingly, the step of generating response information based on the authentication information and sending it to the user terminal includes: Based on the username of the first user, the username of the second user, and the time period, query the third session information between the first user and the second user within the time period; The username of the first user, the username of the second user obtained by decryption, the fifth random number, and the ninth sending time are hashed and encrypted to obtain the fifth hash value; The third session information, the fifth hash value, the username of the second user, the tenth and eleventh sending information of the third session information are encrypted based on the second temporary session key to obtain the seventh ciphertext; the eleventh sending information represents the sending time of the response information. Based on the seventh ciphertext, a response message is generated and sent to the user terminal of the first user.

29. An information processing device, characterized in that, include: The first determining module is used to determine the encryption key corresponding to the operation type of the operation if an operation triggered by the first user to communicate with the peer device is detected. The first encryption module is used to encrypt the authentication information generated by the user terminal based on the operation based on the encryption key, to obtain the first ciphertext; A first generation module is configured to generate a communication request based on the first ciphertext, wherein the communication request includes an identifier of the operation type; A sending module is used to send the communication request to the peer device; The operation types include user registration, user login, establishing a connection, sending session messages, retrieving chat history, and password update.

30. An information processing device, characterized in that, include: The first receiving module is used to receive communication requests sent by the user terminal; The communication request includes a first ciphertext and an identifier of the operation type. The first ciphertext includes authentication information generated by the user terminal based on the operation of the first user. The first ciphertext is obtained by encrypting the authentication information based on the encryption key corresponding to the operation type of the operation. The second determining module is used to determine the decryption key corresponding to the operation type based on the identifier; The first decryption module is used to decrypt the first ciphertext based on the decryption key corresponding to the operation type to obtain the authentication information; The third determining module is used to determine whether a replay attack exists based on the authentication information; The second generation module is used to generate response information to be sent to the user terminal based on the authentication information if there is no replay attack. The operation types include user registration, user login, establishing a connection, sending session messages, retrieving chat history, and password update.

31. An information processing device, characterized in that, include: The second receiving module is used to receive communication requests sent by the user terminal; The communication request includes a first ciphertext and an identifier of the operation type. The first ciphertext includes authentication information generated by the user terminal based on the operation of the first user. The first ciphertext is obtained by encrypting the authentication information based on the encryption key corresponding to the operation type of the operation. The fourth determining module is used to determine the decryption key corresponding to the operation type based on the identifier; The second decryption module is used to decrypt the first ciphertext based on the decryption key corresponding to the operation type to obtain the authentication information; The fifth determining module is used to determine whether a replay attack exists based on the authentication information; The third generation module is used to generate response information to be sent to the user terminal based on the authentication information if there is no replay attack. The operation types include user registration, user login, establishing a connection, sending session messages, retrieving chat history, and password update.

32. A user terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the information processing method as described in any one of claims 1 to 14.

33. A key server, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the information processing method as described in any one of claims 15 to 21.

34. A communication server, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the information processing method as described in any one of claims 16 to 28.

35. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, the computer program including program instructions that, when executed by a processor, cause the processor to perform the information processing method as described in any one of claims 1 to 28.

Images