Key generation method and device, equipment and storage medium

Abstract

The invention provides a key generation method and device, equipment and a storage medium, and relates to the technical field of network security encryption. The method comprises the following steps: receiving key request information from terminal equipment; the key request information comprises an identity label and a session parameter of the terminal equipment requesting to generate the key; under the condition that the identity information of the terminal equipment is valid and the communication session is legal, generating a key corresponding to the terminal equipment according to the identity label and / or session parameter of the terminal equipment; the key is used to encrypt the communication session. Therefore, only legal and authorized terminal equipment can participate in communication, access of illegal terminal equipment and potential security threats are prevented, the secret key corresponding to the communication terminal is generated according to the identity label and / or the session parameter of the communication terminal, high randomness and unpredictability are achieved, and the safety of the communication terminal is improved. Therefore, an attacker cannot accurately predict or copy the generated key, and the communication security is improved.

Description

Technical Field

[0001] The present application relates to the field of network security encryption technology, and in particular to a key generation method, device, equipment and storage medium. Background Art

[0002] Key distribution is a secure way to transmit keys, which can be used to send keys between two communication terminals that are far apart. In the process of confidential communication, keys are needed to encrypt and decrypt information, and the security of the keys ensures the security of the information.

[0003] With the advancement of encryption communication technology, keys are combined with existing software architecture and networks and applied to application scenarios such as wireless network communication. Keys can be generated based on VoLTE (Voice over Long-Term Evolution) wireless networks to achieve secure encrypted communication.

[0004] However, illegal and criminal cases such as online telecommunications fraud occur frequently. Currently, some criminals use various means to disguise their identity information and obtain keys, posing a serious threat to the security of encrypted communications. Summary of the invention

[0005] The present application provides a key generation method, apparatus, device and storage medium, which can effectively improve the security of encrypted communications.

[0006] In order to achieve the above objectives, this application adopts the following technical solutions:

[0007] In a first aspect, the present application provides a key generation method, the method comprising: receiving key request information from a terminal device; the key request information includes an identity identifier and session parameters of the terminal device requesting key generation; when the identity information of the terminal device is valid and the communication session is legal, generating a key corresponding to the terminal device according to the identity identifier and / or session parameters of the terminal device; the key is used to encrypt the communication session.

[0008] According to the above technical means, after receiving the key request information from the terminal device, it is possible to detect whether the identity information of the terminal device is valid and whether the communication session is legal. When the identity information of the terminal device is valid and the communication session is legal, a key corresponding to the terminal device is generated according to the identity identification and / or session parameters of the terminal device. Therefore, only legal and authorized terminal devices can participate in the communication, thereby preventing the access of illegal terminal devices and potential security threats, and the key corresponding to the communication terminal generated according to the identity identification and / or session parameters of the communication terminal has a high degree of randomness and unpredictability, so that attackers cannot accurately predict or copy the generated key, thereby improving the security of communication.

[0009] In a possible implementation, the above-mentioned "generating a key corresponding to the terminal device based on the identity identification and / or session parameters of the terminal device" includes: determining a first key corresponding to the identity identification and / or session parameters of the terminal device through a preset algorithm; the session parameters include one or more of a session identifier and a session protocol; concatenating the first key and the second key to obtain a key corresponding to the terminal device; wherein the second key is a preset key.

[0010] According to the above technical means, the first key corresponding to the identity identification and / or session parameters of the terminal device can be determined by a preset algorithm, and the first key and the second key can be spliced ​​to obtain the key corresponding to the terminal device. The splicing method of the first key and the second key can be direct series connection, staggered splicing or any other splicing method that can ensure the strength and security of the key. The preset algorithm and the preset key can ensure that the generated key has sufficient randomness and complexity, can resist various password cracking attacks, and ensure the security of communication.

[0011] In a possible implementation, the method further includes: encapsulating the key corresponding to the terminal device, and sending the encapsulated key to the terminal device.

[0012] According to the above technical means, the key corresponding to the terminal device can be encapsulated and the encapsulated key can be sent to the terminal device. Encapsulating and transmitting the key can ensure the integrity and authenticity of the key during the transmission process.

[0013] In a possible implementation, the method further includes: when the identity information of the terminal device is invalid and / or the communication session is illegal, interrupting the communication session of the terminal device.

[0014] According to the above technical means, the communication session of the terminal device can be interrupted when the identity information of the terminal device is invalid and / or the communication session is illegal. Therefore, it is possible to timely discover that the identity information of the communication terminal is invalid and / or the communication session is illegal, and interrupt the current communication session to prevent potential security risks.

[0015] In a possible implementation manner, whether the identity information of the terminal device is valid includes: comparing and verifying the received identity information of the terminal device according to a pre-stored terminal device identity information database to determine whether the terminal device is a registered legal terminal device.

[0016] According to the above technical means, it is possible to accurately determine whether the terminal device is a registered legal terminal device by comparing the received identity information of the terminal device with the information in the pre-stored terminal device identity information database.

[0017] In a possible implementation manner, determining whether the communication session of the terminal device is legal includes: performing a legality check on the communication session according to a communication protocol and a security policy to determine whether the communication session is legal.

[0018] According to the above technical means, the legitimacy of the communication session can be checked according to the communication protocol and security policy, so as to more accurately determine whether the communication session is legal.

[0019] In a possible implementation, the above-mentioned legitimacy check includes at least one of the following: checking whether the sending terminal of the communication session is legal; checking whether the receiving terminal of the communication session is legal; checking whether the session type of the communication session is legal; and checking whether the session parameters of the communication session are legal.

[0020] According to the above technical means, the legitimacy of the communication session can be accurately checked by checking the sending terminal, receiving terminal, session type and session parameters of the communication session.

[0021] In a second aspect, the present application provides a key generation device, which includes: a receiving unit for receiving key request information from a terminal device; the key request information includes an identity identifier and session parameters of the terminal device requesting key generation; a generating unit for generating a key corresponding to the terminal device according to the identity identifier and / or session parameters of the terminal device when the identity information of the terminal device is valid and the communication session is legal; the key is used to encrypt the communication session.

[0022] In a possible implementation, the generation unit is specifically used to determine the first key corresponding to the identity identification and / or session parameters of the terminal device through a preset algorithm; the session parameters include one or more of the session identifier and the session protocol; the first key and the second key are concatenated to obtain the key corresponding to the terminal device; wherein the second key is a preset key.

[0023] In a possible implementation manner, the generating unit is further configured to encapsulate the key corresponding to the terminal device, and send the encapsulated key to the terminal device.

[0024] In a possible implementation manner, the generating unit is further configured to interrupt the communication session of the terminal device when the identity information of the terminal device is invalid and / or the communication session is illegal.

[0025] In a possible implementation manner, the generating unit is further configured to compare and verify the received identity information of the terminal device according to a pre-stored terminal device identity information database to determine whether the terminal device is a registered legal terminal device.

[0026] In a possible implementation manner, the generating unit is further configured to perform a validity check on the communication session according to the communication protocol and the security policy to determine whether the communication session is legal.

[0027] In a possible implementation, the generation unit is also specifically used for legitimacy checking, wherein the legitimacy checking includes at least one of the following: detecting whether a sending terminal of a communication session is legal; checking whether a receiving terminal of a communication session is legal; checking whether a session type of a communication session is legal; and checking whether session parameters of a communication session are legal.

[0028] In a third aspect, the present application provides an electronic device comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement the method of the above-mentioned first aspect and any possible implementation manner thereof.

[0029] In a fourth aspect, the present application provides a computer-readable storage medium. When instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device can execute the method in the above-mentioned first aspect and any possible implementation method thereof.

[0030] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on a communication device, enables the communication device to execute the method in the first aspect and any possible implementation manner thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A schematic diagram of a key generation system provided in an embodiment of the present application;

[0032] Figure 2 A schematic diagram of a key generation method provided in an embodiment of the present application;

[0033] Figure 3 A schematic diagram of a flow chart of a method for switching communication types between terminal devices provided in an embodiment of the present application;

[0034] Figure 4 A schematic diagram of a process of communication between terminal devices provided in an embodiment of the present application;

[0035] Figure 5 A schematic diagram of the structure of a key generation device provided in an embodiment of the present application;

[0036] Figure 6 A block diagram of an electronic device of a key generation device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] The following is a detailed description of a key generation method, apparatus, device and storage medium provided in an embodiment of the present application in conjunction with the accompanying drawings.

[0038] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0039] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0040] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0041] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0042] The key uses the "unclonable and indivisible" characteristics to encrypt information, which is one of the currently known ways of distributing keys that cannot be eavesdropped or cracked. This method not only continues the existing software architecture, but also improves security and demonstrates the wide application potential of encryption technology.

[0043] With the advancement of encryption communication technology, keys are combined with existing software architecture and networks and applied to application scenarios such as wireless network communication. Keys can be generated based on wireless networks to achieve secure encrypted communication.

[0044] Currently, there are two main ways to determine whether a communication terminal supports encrypted communication:

[0045] (I) Determine whether encrypted communication is supported based on the business contract:

[0046] A key end-to-end encrypted communication and authentication method is proposed to achieve prior verification of encrypted communication, which mainly includes the following steps:

[0047] The communication initiator sends an encrypted communication invitation: The communication initiator sends an invitation message to establish encrypted communication. After receiving the invitation message, the communication receiver returns a confirmation message based on the invitation message. The two communicating parties apply to the dedicated control center to determine the business contract information.

[0048] The dedicated control center determines whether encrypted communication is supported: a dedicated control center is introduced to verify whether encrypted communication is supported based on the business contract information of both parties (such as number, mobile phone hardware information, phone card information, etc.); when both parties meet the conditions, an encryption identifier is inserted into the voice call invitation message of the initiator, and the voice call invitation message with the inserted encryption identifier is sent to the recipient to establish voice communication based on key encryption and decryption; when one of the two parties does not meet the conditions, a response of encrypted communication failure is returned respectively.

[0049] The key management platform negotiates the key: If both communicating parties support encrypted communication, the sender or receiver sends a key negotiation request, and the key management platform returns the key negotiation response result, which is the encryption and decryption key; this facilitates the communicating parties to use the key for encrypted communication.

[0050] (II) Whether the terminal equipment security value verification of the qualification review system supports encrypted communication:

[0051] A VoLTE encrypted communication implementation method combined with a qualification review system is proposed, which introduces a security value for pre-verification of encrypted communication. It mainly includes the following steps:

[0052] The terminal device initiates an encrypted communication request: the communication initiator sends and generates an encrypted communication request instruction to the communication receiver, transmits communication information data, and after receiving the invitation, the communication receiver returns a response to the qualification review of both parties.

[0053] Encryption qualification review: Introduce a qualification review system. The terminals of both communicating parties and the communication request data transmission are reviewed for terminal security values ​​through the qualification review system. The qualification review maintains a complete set of qualification verification standards, and substitutes user data, terminal data, etc. into the qualification review formula to determine the security value of the personnel.

[0054] Comparison between the terminal device security value and the set security threshold: For terminal devices that have passed the qualification review, the qualification review system issues a pass instruction to the request data processing module to initiate encrypted communication; for terminal devices that have failed the qualification review and the reasons for failure, the qualification review module issues a fail instruction to the request data processing module, prohibiting encrypted communication of the IP address of the communicating terminal device.

[0055] However, illegal and criminal cases such as online telecommunications fraud occur frequently. Currently, some criminals can disguise their identity information and obtain keys through various means, posing a serious threat to the security of encrypted communications.

[0056] In order to effectively improve the security of encrypted communications, the present application provides a key generation method. The method includes: receiving key request information from a terminal device; the key request information includes the identity of the terminal device requesting key generation and session parameters; if the identity of the terminal device is valid and the communication session is legal, generating a key corresponding to the terminal device according to the identity of the terminal device and / or the session parameters; the key is used to encrypt the communication session.

[0057] It should be noted that the key generation method provided in the embodiment of the present application can be executed by a server or by a terminal device. The following takes a server as an example to describe the key generation method provided in the embodiment of the present application in detail.

[0058] For ease of understanding, the key generation method provided in this application is specifically introduced below with reference to the accompanying drawings.

[0059] Figure 1 A schematic diagram of a key generation system provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the framework diagram includes a server 101 and multiple terminal devices 102.

[0060] It should be noted that the server 101 in the present application may be connected to multiple terminal devices 102. The server 101 may manage the multiple terminal devices 102 according to the identifier corresponding to each terminal device.

[0061] In an embodiment of the present application, the server 101 includes an encrypted communication management module, a cryptographic service module, a security monitoring service module and multiple storage service modules.

[0062] Among them, the encrypted communication management module is used to manage operations such as the activation of the encrypted communication function, the verification of user identities, and the distribution of configuration files.

[0063] The cryptographic service module is used to negotiate with the encryption communication module to generate business keys, and through the algorithm's hash message authentication code authentication mechanism, ensure the integrity and authenticity of key distribution, ensure the security of business key transmission between the mobile terminal and the platform, and prevent data from being tampered with or forged.

[0064] The security monitoring service module is used to interact with the cryptographic service module, obtain business keys, and support communication security monitoring in different scenarios, identifying and responding to abnormal behaviors.

[0065] The storage service module is used to store key information, terminal device information and user data during the communication process, and supports data management and query to ensure the secure storage and integrity of data during communication.

[0066] The terminal device 102 is used to send an encryption request message to the server 101 and receive a key generated by the server 101, and perform encrypted transmission according to the key. In the embodiment of the present application, the terminal device 102 may include a computer, a mobile phone, a tablet, etc., which is not limited in the embodiment of the present application.

[0067] Among them, the terminal device 102 includes an encryption communication module, which is used for the negotiation and destruction of encryption keys, negotiation of call signaling, initiation, answering, and hanging up of calls, as well as encryption and decryption of media data, and clear text exchange to avoid plain text transmission of business data in the network.

[0068] Figure 2 A flowchart of a key generation method provided in an embodiment of the present application, the method includes the following S201-S202.

[0069] S201. Receive key request information from a terminal device.

[0070] The key request information includes the identity of the terminal device requesting key generation and session parameters. The session parameters include one or more of a session identifier and a session protocol. For example, the key request information may be: terminal device A requests to obtain a key for communicating with terminal device B.

[0071] In one possible implementation, in response to a user requesting encrypted communication on a terminal device, the terminal device generates key request information including its own identity and session parameters, and then sends the key request information to a server. Correspondingly, the server receives the key request information from the terminal device.

[0072] S202: When the identity information of the terminal device is valid and the communication session is legal, a key corresponding to the terminal device is generated according to the identity identification and / or session parameters of the terminal device.

[0073] The key is used to encrypt the communication session of the terminal device. For example, the key may be FJGCP-4DFJD-GJY49-VJBQ7-HYRR2, which is composed of numbers and letters.

[0074] In one possible implementation, the server can determine the first key corresponding to the identity identification and / or session parameters of the terminal device through a preset algorithm when the identity information of the terminal device is valid and the communication session is legitimate. After determining the first key, the server concatenates the first key and the second key to obtain the key corresponding to the terminal device. The second key is a preset key.

[0075] In the embodiment of the present application, the preset algorithm may include but is not limited to the BB84 encryption algorithm, the BBM92 encryption algorithm, the national encryption SM3 algorithm, etc., and the preset algorithm is not limited in the embodiment of the present application. The following is a detailed description of the national encryption SM3 algorithm as an example.

[0076] In some scenarios, the server pads the data after the combination of the identity identifier and the session parameters to a length that is a multiple of a fixed number of bits (for example, 512 bits), usually adding several "1"s or several "0"s at the end of the data until the fixed number of bits of data is met.

[0077] The server expands the padded data to form words with fixed values ​​(each word represents 32 bits) for subsequent iterative compression.

[0078] The server iteratively compresses the expanded data using the compression function of the National Encryption SM3 algorithm. Iterative compression involves allocating the combined data to multiple data registers and then iteratively calculating the data in each data register. Each round of iteration uses Boolean functions, permutation functions, and algorithm constants to calculate new data register values. After the iteration is completed, the values ​​of multiple data registers are concatenated to form a fixed-bit hash value, which represents the first key generated by the National Encryption SM3 algorithm.

[0079] After determining the first key, the server concatenates the first key and a second key generated according to the identity identifier of the terminal device.

[0080] Exemplarily, assuming that the first key is ABCDEFG (128 bits), and the second key (generated based on the identity of the terminal device) is: HIJKLMNO (128 bits), then the concatenated key is: ABCDEFG_HIJKLMNO (256 bits).

[0081] After determining the key corresponding to the terminal device, the server encapsulates the key and sends the encapsulated key to the terminal device.

[0082] Correspondingly, the terminal device receives the key sent by the server and performs encrypted transmission according to the key. For example, the sending terminal encrypts the transmitted communication data according to the key, and the receiving terminal decrypts the received communication data according to the key. Thus, communication between the sending terminal and the receiving terminal is established.

[0083] In an embodiment of the present application, a method for determining whether the identity information of a terminal device is valid includes: the server compares and verifies the identity information of the received terminal device according to a pre-stored terminal device identity information database to determine whether the terminal device is a registered legal terminal device.

[0084] The server preprocesses the received identity information, such as format conversion and data cleaning, to ensure that it is consistent with the information format stored in the database. Then, the server compares the preprocessed identity information with the legitimate terminal device identity information stored in the database. The server uses an exact matching algorithm, such as a hash algorithm or a string comparison algorithm, for comparison.

[0085] If the received identity information matches the information stored in the database, the server determines that the terminal device is a registered legal terminal device. If the received identity information does not match the information stored in the database, the server determines that the terminal device is an unregistered terminal device. As a result, the server can reject the access request of the terminal device and record relevant logs for subsequent analysis.

[0086] The method for determining whether a communication session of a terminal device is legal includes: performing a legality check on the communication session according to a communication protocol and a security policy to determine whether the communication session is legal. The legality check includes at least one of the following:

[0087] (1) Detect whether the sending terminal of the communication session is legitimate;

[0088] (2) Check whether the receiving terminal of the communication session is legitimate;

[0089] (3) Check whether the session type of the communication session is legal;

[0090] (4) Check whether the session parameters of the communication session are legal.

[0091] In an embodiment of the present application, the server can determine the type of communication session, such as file transfer, voice call, video call, etc., based on the communication protocol and security policy. And match the determined session type with the preset legal session type to confirm whether it is within the permitted range. When abnormal communication data such as the communication frequency, traffic, and geographic location of the communication session is detected, the server can trigger an alarm mechanism to prohibit key transmission between terminal devices, thereby avoiding potential communication security threats from the source. When no abnormality in the communication session is detected, the server determines that the communication session of the terminal device is legal.

[0092] In some other embodiments, the server may interrupt the communication session of the terminal device and display a prompt message when the identity information of the terminal device is invalid and / or the communication session is illegal. The prompt message is used to indicate that there is a security risk in the current communication session. For example, the prompt message may be: there is a security risk in the communication session between terminal device A and terminal device B.

[0093] based on Figure 2According to the technical solution shown, in the embodiment of the present application, the server can receive key request information from the terminal device, and generate a key corresponding to the terminal device according to the identity identification and / or session parameters of the terminal device when the identity information of the terminal device is valid and the communication session is legal. Therefore, only legal and authorized terminal devices can participate in the communication, thereby preventing the access of illegal terminal devices and potential security threats, and the key corresponding to the communication terminal is generated according to the identity identification and / or session parameters of the communication terminal, which has a high degree of randomness and unpredictability, so that attackers cannot accurately predict or copy the generated key, thereby improving the security of communication.

[0094] In the embodiment of the present application, the communication type can also be switched between the sending terminal and the receiving terminal, for example, from an encrypted communication type to a non-encrypted communication type or from a non-encrypted communication type to an encrypted communication type. Figure 3 A flowchart of a method for switching communication types between terminal devices provided in an embodiment of the present application, the method includes the following S301-S302.

[0095] S301: Determine the communication type of the terminal device.

[0096] The terminal device includes a receiving terminal device and a sending terminal device. The communication type includes an encrypted communication type and a non-encrypted communication type.

[0097] In one possible implementation, in response to a user's operation of requesting to establish a communication connection on a sending terminal device, the sending terminal device sends a request message for establishing a communication connection to a receiving terminal device through a server. The server determines the communication type of the terminal device based on the communication protocols supported by the receiving terminal device and the sending terminal device.

[0098] Exemplarily, when the communication protocol used by the terminal device is one or more of SSL / TLS, IPSec, HTTPS, and SHTTP, the server determines that the communication type of the terminal device is an encrypted communication type. When the communication protocol used by the terminal device is one or more of TCP / UDP, FTP, HTTP, and Telnet, the server determines that the communication type of the terminal device is a non-encrypted communication type.

[0099] S302: Adjust the communication mode between terminal devices according to the communication type of the terminal devices.

[0100] In a possible implementation, when the server determines the communication type between the receiving terminal and the sending terminal according to step S301, the server adjusts the communication mode between the terminal devices according to the communication type of the receiving terminal and the sending terminal. There are mainly four situations:

[0101] Case 1: The sending terminal is of encrypted communication type, and the receiving terminal is of encrypted communication type.

[0102] In the case that both the sending terminal and the receiving terminal are of the encrypted communication type, a key is generated according to step S201 and step S202, and communication between the sending terminal and the receiving terminal is established based on the key.

[0103] Case 2: The sending terminal is of encrypted communication type, and the receiving terminal is of non-encrypted communication type.

[0104] When the sending terminal is of encrypted communication type and the receiving terminal is of non-encrypted communication type, the server returns information that the receiving terminal does not support encrypted communication. When the sending terminal determines that the receiving terminal does not support encrypted communication, it can switch to non-encrypted communication mode or refuse to communicate with the receiving terminal.

[0105] Case 3: The sending terminal is of non-encrypted communication type, and the receiving terminal is of encrypted communication type.

[0106] When the sending terminal is a non-encrypted communication type and the receiving terminal is an encrypted communication type, the server returns information that the receiving terminal supports encrypted communication. When the sending terminal determines that the receiving terminal supports encrypted communication, it can switch to an encrypted communication mode or refuse to communicate with the receiving terminal.

[0107] Case 4: The sending terminal is of non-encrypted communication type, and the receiving terminal is of non-encrypted communication type.

[0108] In the case where both the sending terminal and the receiving terminal are of non-encrypted communication type, the sending terminal and the receiving terminal communicate in plain text.

[0109] In an embodiment of the present application, when the receiving terminal and the sending terminal perform encrypted communication but a failure occurs during the key negotiation process, the server can determine whether to re-initiate encrypted communication or switch to a non-encrypted communication mode based on the instruction information of the sending terminal device.

[0110] When the instruction information is to re-initiate encrypted communication, the sending terminal device re-initiates encrypted communication to the receiving terminal device. When the instruction information is to switch to non-encrypted communication mode, the sending terminal device switches to plain text mode to communicate with the receiving terminal device.

[0111] based on Figure 3 According to the technical solution shown in the embodiment of the present application, the server can dynamically adjust the communication mode between the sending terminal device and the receiving terminal device according to whether the sending terminal device and the receiving terminal device support encrypted communication, thereby improving the user experience and ensuring normal communication between the sending terminal device and the receiving terminal device.

[0112] Figure 4 A flow chart of communication between terminal devices provided in an embodiment of the present application, the method includes the following S401-S404.

[0113] S401. The sending terminal sends encrypted communication request information to the server.

[0114] In one possible implementation, in response to a user's operation of requesting encrypted communication on a sending terminal, the sending terminal generates encrypted communication request information and sends the encrypted communication request information to a server.

[0115] S402: The server determines the communication type between the sending terminal and the receiving terminal.

[0116] In a possible implementation manner, the server determines the receiving terminal and detects the communication types of the sending terminal and the receiving terminal according to the received request information.

[0117] The specific steps may refer to step S301 and will not be described in detail here.

[0118] S403: When the communication type of the sending terminal is an encrypted communication type and the communication type of the receiving terminal is an encrypted communication type, the server generates keys corresponding to the sending terminal and the receiving terminal, and sends the keys to the sending terminal and the receiving terminal.

[0119] In one possible implementation, the server extracts the communication session identifier, the sending terminal identifier, and the receiving terminal identifier in the encrypted communication request. The server generates a key using the national encryption SM3 algorithm and protects the key using the HMAC method. Then, the server sends the finalized key to the sending terminal and the receiving terminal.

[0120] The specific steps may refer to step S202 and will not be described in detail here.

[0121] S404: The sending terminal and the receiving terminal transmit data according to the received key.

[0122] In one possible implementation, the sending terminal and the receiving terminal encrypt and decrypt the transmitted media data using a key to ensure end-to-end encrypted transmission of the communication data.

[0123] based on Figure 4 The technical solution shown in the embodiment of the present application can send the generated key to the corresponding terminal to avoid exposing the key to the network and ensure the security of key transmission. The integrity and authenticity of the key are ensured through the hash message authentication code mechanism to ensure the security of key transmission between the terminal device and the server.

[0124] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to achieve the above functions, the key generation device or electronic device includes a hardware structure and / or software module corresponding to the execution of each function. It should be easily appreciated by those skilled in the art that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0125] The embodiment of the present application can divide the key generation device or electronic device into functional modules according to the above method. For example, the key generation device or electronic device can include various functional modules corresponding to the various functional divisions, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0126] Figure 5 A schematic diagram of a key generation device provided in an embodiment of the present application, the device comprising:

[0127] The receiving unit 501 is used to receive key request information from a terminal device; the key request information includes an identity identifier and session parameters of the terminal device requesting to generate a key.

[0128] The generating unit 502 is used to generate a key corresponding to the terminal device according to the identity identification and / or session parameters of the terminal device when the identity information of the terminal device is valid and the communication session is legal; the key is used to encrypt the communication session.

[0129] In one possible implementation, the generation unit 502 is specifically used to determine, through a preset algorithm, a first key corresponding to an identity identifier and / or session parameters of a terminal device; the session parameters include a session identifier, one or more of a session protocol; the first key and the second key are concatenated to obtain a key corresponding to the terminal device; wherein the second key is a preset key.

[0130] In a possible implementation, the generating unit 502 is further configured to encapsulate the key corresponding to the terminal device, and send the encapsulated key to the terminal device.

[0131] In a possible implementation manner, the generating unit 502 is further configured to interrupt the communication session of the terminal device when the identity information of the terminal device is invalid and / or the communication session is illegal.

[0132] In a possible implementation manner, the generation unit 502 is further configured to compare and verify the received identity information of the terminal device according to a pre-stored terminal device identity information database to determine whether the terminal device is a registered legal terminal device.

[0133] In a possible implementation manner, the generating unit 502 is further configured to perform a validity check on the communication session according to the communication protocol and the security policy to determine whether the communication session is legal.

[0134] In a possible implementation, the generation unit 502 is further specifically used to perform a legitimacy check, wherein the legitimacy check includes at least one of the following: checking whether the sending terminal of the communication session is legal; checking whether the receiving terminal of the communication session is legal; checking whether the session type of the communication session is legal; and checking whether the session parameters of the communication session are legal.

[0135] Figure 6 A block diagram of an electronic device of a key generation device involved in the above embodiment is shown. The key generation device includes: a processor 601 and a communication interface 602. The processor 601 is used to generate a key corresponding to the terminal device according to the identity identification and / or session parameters of the terminal device, and the communication interface 602 is used for communication between the server and the terminal device. The key generation system may also include a memory 603 and a bus 604, and the memory 603 is used to store the identity information, session parameters and keys of the terminal device.

[0136] Among them, the memory 603 can be a memory in a key generating device, etc. The memory may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state drive; the memory may also include a combination of the above types of memory.

[0137] The processor 601 may be a processor that implements or executes various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the present application. The processor may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The processor may be a processor that implements or executes various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the present application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0138] The bus 604 may be an Extended Industry Standard Architecture (EISA) bus, etc. The bus 604 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0139] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0140] An embodiment of the present application provides a computer program product including instructions. When the computer program product is run on a computer, the computer is enabled to execute the key generation method in the above method embodiment.

[0141] An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a computer, the computer executes the key generation method in the method flow shown in the above method embodiment.

[0142] Among them, the computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a register, a hard disk, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above, or any other form of computer-readable storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read products from the storage medium and can write products to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application-specific integrated circuit (ASIC). In the embodiments of the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program, which may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0143] An embodiment of the present invention provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the key generation method of the embodiment of the present application.

[0144] Since the key generation device, computer-readable storage medium, and computer program product in the embodiments of the present invention can be applied to the above method, the technical effects that can be obtained can also refer to the above method embodiments, and the embodiments of the present invention will not be repeated here.

[0145] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0146] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0147] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0148] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A key generation method, characterized in that: The method comprises: Receiving key request information from a terminal device; the key request information includes an identity identifier and session parameters of the terminal device requesting key generation; When the identity information of the terminal device is valid and the communication session is legal, a key corresponding to the terminal device is generated according to the identity identification and / or session parameters of the terminal device; the key is used to encrypt the communication session.

2. The method according to claim 1, characterized in that The step of generating a key corresponding to the terminal device according to the identity identifier and / or session parameter of the terminal device includes: Determine, by a preset algorithm, a first key corresponding to an identity identifier and / or a session parameter of the terminal device; the session parameter includes one or more of a session identifier and a session protocol; The first key and the second key are concatenated to obtain a key corresponding to the terminal device; wherein the second key is a preset key.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: The key corresponding to the terminal device is encapsulated, and the encapsulated key is sent to the terminal device.

4. The method according to claim 1 or 2, characterized in that: The method further comprises: When the identity information of the terminal device is invalid and / or the communication session is illegal, the communication session of the terminal device is terminated.

5. The method according to claim 1, characterized in that Whether the identity information of the terminal device is valid includes: The received identity information of the terminal device is compared and verified according to the pre-stored terminal device identity information database to determine whether the terminal device is a registered legal terminal device.

6. The method according to claim 1, characterized in that Whether the communication session of the terminal device is legal, including: According to the communication protocol and security policy, the communication session is subjected to a legality check to determine whether the communication session is legal.

7. The method according to claim 6, characterized in that The legality check includes at least one of the following: Detecting whether the sending terminal of the communication session is legal; Checking whether the receiving terminal of the communication session is legitimate; Checking whether the session type of the communication session is legal; Check whether the session parameters of the communication session are legal.

8. A key generation device, characterized in that: The device comprises: A receiving unit, configured to receive key request information from a terminal device; the key request information includes an identity identifier and session parameters of the terminal device requesting key generation; A generating unit is used to generate a key corresponding to the terminal device according to the identity identification and / or session parameters of the terminal device when the identity information of the terminal device is valid and the communication session is legal; the key is used to encrypt the communication session.

9. An electronic device, characterized in that: The electronic device comprises: processor; a memory configured to store instructions executable by the processor; The processor is configured to execute the instructions to implement the key generation method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions in the computer-readable storage medium are executed by an electronic device, the electronic device is enabled to execute the key generation method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that The computer program product includes computer instructions; when part or all of the computer instructions are run on a computer, the key generation method according to any one of claims 1 to 7 is executed.

Images