End-to-end encryption communication method and device and storage medium

Abstract

The invention discloses an end-to-end encryption communication method and device and a storage medium, the method is applied to a communication request end, the communication request end is in communication connection with a communication response end through a communication server end, and the method comprises the following steps: sending an encryption communication request to the communication response end through the communication server end, the communication server side generates current password information after receiving the encrypted communication response sent by the communication response side, and sends the current password information to the communication request side and the communication response side respectively; generating a first secret key according to the received current password information and the target timestamp; performing encryption processing on the to-be-encrypted content according to the first key to obtain a communication ciphertext; and sending the communication ciphertext to a communication response end, so that the communication response end decrypts the communication ciphertext by using a second key to obtain a communication plaintext, the second key being generated by the communication response end based on the received current password information and the target timestamp. According to the scheme, safe end-to-end encryption communication can be realized.

Description

Technical Field

[0001] The present application relates to the field of encrypted communication technology, and in particular to an end-to-end encrypted communication method, device and storage medium. Background Art

[0002] In modern network communications, symmetric encryption, asymmetric encryption and other technologies are usually used to ensure the security of communication content.

[0003] End-to-end encrypted communication is an encryption communication technology solution that performs encryption and decryption at both ends of the communication, which provides a higher level of data protection. In end-to-end encrypted communication, after the data is encrypted by the sender of the communication terminal, it can only be decrypted by the receiver of the communication terminal. This means that during the data transmission process, even if a third party intervenes, the plaintext content of the data cannot be accessed or read. This encryption scheme is very powerful in protecting user privacy and data confidentiality, which is particularly important for sensitive information and private communications.

[0004] However, in current encryption communication schemes, key exchange is required between the data sender and the data receiver, and the process is highly complex and has large computational overhead, and may also lead to key leakage during the key exchange process. Summary of the invention

[0005] The present application at least provides an end-to-end encrypted communication method, apparatus, device, and computer-readable storage medium.

[0006] The first aspect of the present application provides an end-to-end encrypted communication method, which is applied to a communication request end, and the communication request end is connected to a communication response end through a communication server end, comprising: sending an encrypted communication request to the communication response end through the communication server end, so that the communication server end generates current password information after receiving the encrypted communication response sent by the communication response end, and sends the current password information to the communication request end and the communication response end respectively; generating a first key according to the received current password information and the obtained target timestamp; encrypting the encrypted content according to the first key to obtain a communication ciphertext; sending the communication ciphertext to the communication response end, so that the communication response end uses a second key to decrypt the communication ciphertext to obtain a communication plaintext, and the second key is generated by the communication response end based on the received current password information and the obtained target timestamp.

[0007] In one embodiment, generating a first key based on the received current password information and the obtained target timestamp includes: performing key generation processing based on the current password information, the target timestamp and a preset asymmetric key algorithm to obtain the first key, the first key including a first public key and a first private key; encrypting the content to be encrypted based on the first key to obtain a communication ciphertext includes: encrypting the content to be encrypted based on the first public key.

[0008] In one embodiment, the generation of the first key based on the received current password information and the obtained target timestamp includes: obtaining the current timestamp in response to the received current password information; and determining the target timestamp based on the time information corresponding to the preset delay period according to the preset delay period in which the current timestamp is located.

[0009] In one embodiment, the encrypted communication request includes first identification information of the communication request end, and the sending of the encrypted communication request to the communication response end through the communication server end so that the communication server end generates current password information after receiving the encrypted communication response sent by the communication response end, and sends the current password information to the communication request end and the communication response end respectively, includes: sending the encrypted communication request to the communication response end through the communication server end so that the communication server end generates current password information after receiving the encrypted communication response sent by the communication response end, encrypting the current password information based on the first identification information to obtain an encrypted password, and sending the encrypted password to the communication request end; after sending the encrypted communication request to the communication response end through the communication server end, the method also includes: in response to the received encrypted password, decrypting the encrypted password according to the first identification information to obtain the current password information.

[0010] In one embodiment, generating a first key based on the received current password information and the obtained target timestamp includes: determining the key validity period of the first key based on the target timestamp and a preset validity period; after determining the key validity period of the first key based on the target timestamp and the preset validity period, the method also includes: obtaining a real-time timestamp; in response to the real-time timestamp exceeding the key validity period, invalidating the first key.

[0011] In one embodiment, determining the key validity period of the first key according to the target timestamp and the preset validity period includes: obtaining the importance level of the content to be encrypted; adjusting the key validity period according to the importance level, and the importance level and the key validity period are positively correlated or negatively correlated.

[0012] The second aspect of the present application provides an end-to-end encrypted communication method, which is applied to a communication responder end in a communication terminal, and the communication responder end is connected to a communication requester end through a communication server end. The method includes: in response to a received encrypted communication request, generating an encrypted communication response of the encrypted communication request and sending it to the communication server end, so that after the communication server end determines that the communication responder end agrees to the encrypted communication request based on the encrypted communication response, it generates current password information and sends the current password information to the communication requester end and the communication responder end respectively; generating a second key based on the received current password information and the acquired target timestamp; in response to the received communication ciphertext, decrypting the communication ciphertext according to the second key to obtain communication plaintext.

[0013] In one embodiment, generating a second key based on the received current password information and the acquired target timestamp includes: performing key generation processing based on the current password information, the target timestamp and a preset asymmetric key algorithm to obtain the second key, the second key including a second public key and a second private key; decrypting the communication ciphertext based on the second key to obtain communication plaintext includes: decrypting the communication ciphertext based on the second private key to obtain the communication plaintext.

[0014] The third aspect of the present application provides an end-to-end encrypted communication device, including: a request sending module, used to send an encrypted communication request to the communication response end through the communication server end, so that the communication server end generates current password information after receiving the encrypted communication response sent by the communication response end, and sends the current password information to the communication request end and the communication response end respectively; a first key generation module, used to generate a first key according to the received current password information and the obtained target timestamp; a content encryption module, used to encrypt the encrypted content according to the first key to obtain a communication ciphertext; a ciphertext sending module, used to send the communication ciphertext to the communication response end, so that the communication response end uses a second key to decrypt the communication ciphertext to obtain a communication plaintext, and the second key is generated by the communication response end based on the received current password information and the obtained target timestamp.

[0015] The fourth aspect of the present application provides an end-to-end encrypted communication device, including: a response sending module, which is used to respond to a received encrypted communication request, generate an encrypted communication response to the encrypted communication request and send it to the communication server end, so that the communication server end generates current password information after determining that the communication response end agrees to the encrypted communication request based on the encrypted communication response, and sends the current password information to the communication request end and the communication response end respectively; a second key generation module, which is used to generate a second key based on the received current password information and the acquired target timestamp; a content decryption module, which is used to respond to the received communication ciphertext, and decrypt the communication ciphertext according to the second key to obtain communication plaintext.

[0016] The fifth aspect of the present application provides an electronic device, including a memory and a processor, the processor being used to execute program instructions stored in the memory to implement the above-mentioned end-to-end encrypted communication method.

[0017] In a sixth aspect, the present application provides a computer-readable storage medium having program instructions stored thereon, which implement the above-mentioned end-to-end encrypted communication method when executed by a processor.

[0018] The above scheme sends an encrypted communication request to the communication response end through the communication server end, so that the communication server end generates the current password information after receiving the encrypted communication response sent by the communication response end, and sends the current password information to the communication request end and the communication response end respectively; the communication request end generates a first key according to the received current password information and the obtained target timestamp; and encrypts the encrypted content according to the first key to obtain the communication ciphertext; and then sends the communication ciphertext to the communication response end, so that the communication response end uses the second key to decrypt the communication ciphertext to obtain the communication plaintext, and the second key is generated by the communication response end based on the received current password information and the obtained target timestamp. In this way, the data interaction efficiency in the encrypted communication process can be improved, the key transfer process in the encrypted communication process can be reduced, the security of the encrypted communication process can be improved, and secure end-to-end encrypted communication can be realized.

[0019] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application.

[0021] Figure 1 It is a flowchart of an exemplary embodiment of the end-to-end encrypted communication method of the present application;

[0022] Figure 2 This is a schematic diagram of an application scenario of the end-to-end encrypted communication method of the present application;

[0023] Figure 3 This is an exemplary process sequence diagram of the end-to-end encrypted communication method of the present application;

[0024] Figure 4 is a block diagram of an end-to-end encrypted communication device shown in an exemplary embodiment of the present application;

[0025] Figure 5 It is a structural schematic diagram of an embodiment of the electronic device of the present application;

[0026] Figure 6 It is a structural diagram of an embodiment of a computer-readable storage medium of the present application. DETAILED DESCRIPTION

[0027] The scheme of the embodiment of the present application is described in detail below in conjunction with the drawings of the specification.

[0028] In the following description, for the purpose of explanation rather than limitation, specific details such as specific system structures, interfaces, and technologies are provided to facilitate a thorough understanding of the present application.

[0029] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the objects associated before and after are in an "or" relationship. In addition, "many" in this article means two or more than two. In addition, the term "at least one" in this article means any combination of at least two of any one or more of a plurality of, for example, including at least one of A, B, and C, can mean including any one or more elements selected from the set consisting of A, B, and C.

[0030] For ease of understanding, one of the applicable scenarios of the present application is now exemplarily described.

[0031] End-to-end encrypted communication is an encryption communication technology solution that performs encryption and decryption at both ends of the communication, which provides a higher level of data protection. In end-to-end encrypted communication, after the data is encrypted by the sender of the communication terminal, it can only be decrypted by the receiver of the communication terminal. This means that during the data transmission process, even if a third party intervenes, the plaintext content of the data cannot be accessed or read. This encryption scheme is very powerful in protecting user privacy and data confidentiality, which is particularly important for sensitive information and private communications.

[0032] Common encryption methods include but are not limited to:

[0033] 1. Symmetric encryption.

[0034] Symmetric encryption uses the same key to encrypt and decrypt data at each communication end. Common symmetric encryption algorithms include AES (Advanced Encryption Standard), which provides efficient and secure data encryption. The sender uses a key to encrypt the data, and the receiver uses the same key to decrypt it. Symmetric encryption algorithms are often used to encrypt large amounts of data because of their fast encryption and decryption speed.

[0035] However, one of the main challenges of symmetric encryption is the distribution of secure keys. The sender and receiver need to securely share the key to ensure the confidentiality of the data. This can be achieved by using key exchange protocols (such as Diffie-Hellman key exchange) or pre-shared keys.

[0036] 2. Asymmetric encryption.

[0037] Asymmetric encryption uses a pair of keys: a public key and a private key. The public key is used to encrypt data, while the private key is used to decrypt data. Common algorithms based on asymmetric encryption include RSA (Rivest-Shamir-Adleman) and ECC (Elliptic Curve Cryptography). Asymmetric encryption can effectively solve the challenge of key distribution in symmetric encryption, because the communication end only needs to keep the private key confidential, while the public key can be publicly disseminated.

[0038] Asymmetric encryption is usually used for key exchange rather than directly encrypting large amounts of data. It is computationally expensive and suitable for processing small amounts of data. For example, the TLS (Transport Layer Security) protocol uses asymmetric encryption to exchange symmetric session keys, and then uses symmetric encryption to protect the privacy and integrity of the communication.

[0039] 3. End-to-end encryption.

[0040] End-to-end encryption is a method of encryption that protects data between two ends of a communication. This means that the data remains encrypted during transmission between the sender and the receiver, and the plaintext can only be seen after the receiver decrypts it. Typically, end-to-end encryption requires each end of the communication to hold its own public and private keys.

[0041] End-to-end encryption is often used to protect user privacy and data confidentiality, especially in communication applications. For example, instant messaging applications such as WhatsApp and Signal use end-to-end encryption to ensure the confidentiality of user messages, and even operators or application providers cannot view or access plaintext messages.

[0042] See also Figure 1 , Figure 11 is a flow chart of an exemplary embodiment of the end-to-end encrypted communication method of the present application. The method can be applied to the communication request end, which is connected to the communication response end through the communication server end. For details, please refer to Figure 2 As shown, Figure 2 This is a schematic diagram of an application scenario of the end-to-end encrypted communication method of the present application. Specifically, it may include the following steps:

[0043] Step S110, sending an encrypted communication request to the communication responder through the communication server, so that the communication server generates current password information after receiving the encrypted communication response sent by the communication responder, and sends the current password information to the communication requester and the communication responder respectively.

[0044] Among them, the communication request end and the communication response end may include but are not limited to mobile phones, computers, smart watches, smart glasses and other devices with communication capabilities. For the sake of convenience, the communication request end will be referred to as the request end, the communication response end will be referred to as the response end, and the communication server end will be referred to as the server end. Exemplarily, for the first terminal and the second terminal in the communication scenario, the first terminal is connected to the second terminal through the server end. The first terminal can be the communication request end and / or the communication response end. Similarly, the second terminal can also be the communication request end and / or the communication response end. It depends on which end sends the request and which end responds, which will not be elaborated here.

[0045] The encrypted communication request is created and sent by the requesting end, and is mainly used to inform the responding end through the server side that "the requesting end wants to establish encrypted communication with the responding end". Therefore, under normal circumstances, the responding end will create and return an encrypted communication response based on the received encrypted communication request, to inform the requesting end "whether the responding end agrees to this encrypted communication request". Among them, the encrypted communication response may include an approval response or a rejection response. Since the method of the present application aims to establish end-to-end encrypted communication, the following text mainly uses the example of the responding end sending an approval response. But in fact, the responding end can also send a rejection response or not respond to the encrypted communication request to end the encrypted communication process. The details are not elaborated here.

[0046] Specifically, if the server determines that the requester and the responder agree to perform encrypted communication through the communication interaction between the requester and the responder (encrypted communication request and encrypted communication response), the server generates the current password information and sends it to the requester and the responder respectively. Among them, the server can generate the current OTP password (for example: 12s325st354da2s256d) based on the one-time password (OTP) technology. Or it is based on the acquired requester information and responder information (for example, the IP address, MAC address, ID logged on the requester and responder, the reference characters carried by the requester and responder in the communication request and communication response, etc., which are not limited here), and generates the current password information according to the preset algorithm. The following mainly takes the OTP password as an example for explanation.

[0047] Step S120: Generate a first key according to the received current password information and the acquired target timestamp.

[0048] Combining the above steps for example, after receiving the OTP password sent by the server, the requesting end can obtain the target timestamp corresponding to the time when the OTP password is received. The OTP password and the target timestamp are used as calculation factors, and then the key generation process is performed according to the preset key generation algorithm to obtain the first key of the requesting end.

[0049] Among them, the preset key generation algorithm of the present application may include but is not limited to a key generation algorithm based on symmetric encryption or a key generation algorithm based on asymmetric encryption, etc., which is not limited here. At least two key generation algorithms can be set in the request end, and one of the key generation algorithms is selected for execution during the specific implementation process of the request end. It should be noted that the responding end also needs to pre-set the same preset key generation algorithm as the requesting end (which can be set before executing this method, or it can be sent to both ends by the server after determining that the requesting end and the responding end have established an encrypted communication connection, or it can be carried by the requesting end when sending an encrypted communication request (for example, carrying information such as the algorithm or the acquisition path of the algorithm), which is not limited here), so that the responding end can generate the second key of the responding end according to the above-mentioned example method after receiving the OTP password sent by the server end.

[0050] It should also be noted that in the specific application scenario of the present application, the key can be generated at least according to the current password information and the obtained target timestamp. Specifically, in addition to generating the key according to the current password information and the obtained target timestamp, more reference data can be added on this basis for generating the key. The reference data needs to be held and identical by the requesting end and the responding end. The reference data can be obtained directly from a known path by the requesting end and the responding end, or the character data carried in the request and / or response when the requesting end sends an encrypted communication request and / or the responding end sends an encrypted communication response, etc., which is not limited here. Among them, optionally, for example, the requesting end carries the first reference data when sending the encrypted communication request, and the responding end carries the second reference data when sending the encrypted communication response. If the server determines that both ends agree to establish an encrypted communication connection according to the communication interaction process between the two ends, it can verify whether the first reference data and the second reference data are the same. If they are the same, the two ends establish an encrypted communication connection, and the server generates an OTP password; if they are not the same, the establishment of the encrypted communication connection between the two ends fails.

[0051] Step S130, encrypt the content to be encrypted according to the first key to obtain a communication ciphertext.

[0052] In conjunction with the above steps, after generating the first key, the requesting end can encrypt the content to be encrypted that needs to be sent to the responding end according to the first key to obtain a communication ciphertext.

[0053] It should be noted that when the requesting end and the responding end communicate, there may be a part of the communication content that needs to be encrypted, and another part of the communication content that does not need to be encrypted. Therefore, the communication content that needs to be encrypted in the communication content of both ends can be determined as the content to be encrypted, and then the key is used to encrypt the content to be encrypted to obtain the communication ciphertext. As for the communication content that does not need to be encrypted, it can still be sent in plain text.

[0054] It is understandable that if the first key is generated based on a symmetric encryption algorithm, the encrypted content is encrypted based on the first key. If the first key is generated based on an asymmetric encryption algorithm, the first key includes a first public key and a first private key, so the first public key is used to encrypt the encrypted content. Similarly, the second key of the responding end can also refer to the above description, which is not repeated here.

[0055] Step S140, sending the communication ciphertext to the communication responder, so that the communication responder decrypts the communication ciphertext using the second key to obtain the communication plaintext, where the second key is generated by the communication responder based on the received current password information and the acquired target timestamp.

[0056] In conjunction with the above steps, the requesting end may directly send the communication ciphertext to the communication responding end, or the requesting end may send the communication ciphertext to the responding end through the server end, which is not limited here.

[0057] After the responder receives the communication ciphertext, the responder can decrypt the communication ciphertext according to the second key generated by itself to obtain the communication plaintext, thus completing the encrypted communication process. The second key is generated by the responder based on the current password information received from the server and the target timestamp obtained when the current password information is received. The specific key generation method can refer to the description of the first key generation process in the aforementioned embodiment, which will not be repeated here.

[0058] In summary, the overall process of the end-to-end encrypted communication method of the present application can be obtained. Figure 3 As shown, Figure 3 It is an exemplary process sequence diagram in the end-to-end encrypted communication method of the present application, which exemplarily shows the execution sequence of each step in the aforementioned embodiment. It is also shown that the responding end can also use the second key to encrypt the content to be encrypted that it needs to send, obtain the communication ciphertext and send it to the requesting end, so that the requesting end can use the first key to decrypt the communication ciphertext sent by the responding end. If both ends use an asymmetric encryption mechanism, the two ends use their respective public keys to encrypt the communication content and use their respective private keys to decrypt the communication ciphertext. In addition, after the encrypted communication connection is established between the requesting end and the responding end, it is also possible to negotiate whether to change the encrypted communication mode between the two ends (for example, switching the asymmetric encryption mechanism to a symmetric encryption mechanism, etc.), which will not be repeated here.

[0059] It can be seen that in this application, an encrypted communication request is sent from the communication server to the communication response end, so that the communication server generates the current password information after receiving the encrypted communication response sent by the communication response end, and sends the current password information to the communication request end and the communication response end respectively; the communication request end generates a first key according to the received current password information and the obtained target timestamp; and encrypts the encrypted content according to the first key to obtain the communication ciphertext; and then sends the communication ciphertext to the communication response end, so that the communication response end uses the second key to decrypt the communication ciphertext to obtain the communication plaintext, and the second key is generated by the communication response end based on the received current password information and the obtained target timestamp. In this way, the data interaction efficiency in the encrypted communication process can be improved, the key transfer process in the encrypted communication process can be reduced, the security of the encrypted communication process can be improved, and secure end-to-end encrypted communication can be realized.

[0060] Based on the above embodiment, the embodiment of the present application describes the steps of generating a first key according to the received current password information and the obtained target timestamp, and encrypting the content to be encrypted according to the first key to obtain the communication ciphertext. Specifically, the method of this embodiment includes the following steps:

[0061] A key generation process is performed according to the current password information, the target timestamp and a preset asymmetric key algorithm to obtain a first key, the first key including a first public key and a first private key; and the encrypted content is encrypted according to the first public key.

[0062] With reference to the foregoing embodiments, the method for generating a key in the present application may include but is not limited to a method based on a symmetric encryption mechanism and a method based on an asymmetric encryption mechanism.

[0063] In this embodiment, an asymmetric encryption mechanism is taken as an example. For example, the OTP password and the target timestamp are used as calculation factors to perform key generation calculation according to the RSA algorithm to obtain a key (including a public key and a private key).

[0064] Specifically, the requesting end generates a first key (including a first public key and a first private key), and the requesting end uses the first public key to encrypt the content to be encrypted, and uses the first private key to decrypt the received communication ciphertext. The responding end generates a second key (including a second public key and a second private key), and the responding end uses the second public key to encrypt the content to be encrypted, and uses the second private key to decrypt the received communication ciphertext.

[0065] It should be noted that in this application, the first terminal is mainly used as the requesting end and the second terminal is used as the responding end for example. However, in a specific application scenario, the first terminal may also have an encrypted communication connection with the third terminal, for example, the first terminal is the requesting end and the third terminal is the responding end. In this case, the server side will generate additional current password information for the encrypted communication between the first terminal and the third terminal, and the first terminal and the third terminal will also generate their own keys based on the password information. Therefore, when the first terminal encrypts the communication content, it can also select the corresponding key for encryption processing according to the responding end of the current encrypted communication. The decryption process is the same, which will not be repeated here.

[0066] Based on the above embodiment, the embodiment of the present application describes the steps of generating a first key according to the received current password information and the acquired target timestamp. Specifically, the method of this embodiment includes the following steps:

[0067] In response to the received current password information, a current timestamp is obtained; and according to the preset delay period in which the current timestamp is located, a target timestamp is determined by the time information corresponding to the preset delay period.

[0068] In conjunction with the above-mentioned embodiment, in the execution process of the present application, the server sends the OTP password to the requester and responder respectively, and then the requester and responder generate the key according to the OTP password received by each and the timestamp obtained by each. Therefore, it is more important to solve the delay between the timestamps used by the requester and responder to generate the key.

[0069] The format of the timestamp of the present application can be set as needed, for example, the timestamp is determined in the format of year / month / day; the timestamp is determined in the format of hour / minute / second; or the timestamp is determined in the format of year / month / day / hour / minute / second; it can also be accurate to the millisecond level, etc., which is not limited here. The preset delay period of the present application can be one or more, which is not limited here.

[0070] Exemplarily, the requesting end is taken as an example for explanation, and the responding end can still be referred to in the same way.

[0071] First, after receiving the OTP password, the requesting end may determine the timestamp when it receives the OTP password as the target timestamp.

[0072] Secondly, after receiving the OTP password, the requesting end can determine the timestamp when it receives the OTP password as the current timestamp, and then determine the target timestamp based on the preset delay period for providing time redundancy and the current timestamp. For example, if the preset delay period is 1 minute, the requesting end can round forward or backward at the "minute" level according to the time when the OTP password is received to obtain the target timestamp. For example, if the requesting end receives the OTP password at 12:30:09 (hour / minute / second), 12:30:00 (hour / minute / second) or 12:31:00 (hour / minute / second) can be determined as the target timestamp (the specific selection method can be adaptively set according to the actual application scenario, and is not limited here). That is, when the request end and the responder receive the OTP password within the time period of 12:30:00 (hour / minute / second) to 12:31:00 (hour / minute / second), 12:30:00 (hour / minute / second) or 12:31:00 (hour / minute / second) can be selected as the target timestamp. For other formats of timestamps and other preset delay periods, they can also be adjusted in the same way, which will not be elaborated here.

[0073] Therefore, when the requesting end and the responding end in the present application generate their own keys, redundancy can be provided for the time delay in the network communication process, so that the keys generated by both ends can be consistent.

[0074] Optionally, in the specific implementation process, the corresponding preset delay period and / or time format of the timestamp can also be selected according to the importance level of the encrypted communication connection or the importance level of the encrypted communication content. For example, for communications with high importance levels, if the communication delay of the communication network in which the requesting end and the responding end are located is too large, it is obviously not very reliable. That is, the preset delay period can be selected as 5s, and the timestamp format is hours / minutes / seconds. For example, if the requesting end receives the OTP password at 12:30:03 (hours / minutes / seconds), 12:30:00 (hours / minutes / seconds) or 12:30:05 (hours / minutes / seconds) can be selected as the target timestamp; and when the responding end receives the OTP password at 12:30:04 (hours / minutes / seconds), 12:30:00 (hours / minutes / seconds) or 12:30:05 (hours / minutes / seconds) can also be selected as the target timestamp, and the specific selection rules of the requesting end and the responding end remain consistent. If the network delay of the responding end is too large, resulting in the OTP password being received at 12:30:09 (hour / minute / second), and 12:30:05 (hour / minute / second) or 12:30:10 (hour / minute / second) is selected as the target timestamp, the responding end and the requesting end cannot successfully decrypt the received communication ciphertext.

[0075] Furthermore, if one end cannot successfully decrypt, the end can generate relevant prompt information to inform the other end and the server, and the server will resend the OTP password to the responding end and the requesting end respectively. The details are not repeated here.

[0076] On the basis of the above-mentioned embodiment, the embodiment of the present application describes the steps of sending an encrypted communication request from the communication server to the communication response end, so that the communication server generates current password information after receiving the encrypted communication response sent by the communication response end, and sends the current password information to the communication request end and the communication response end respectively, as well as the steps after sending the encrypted communication request from the communication server to the communication response end. Among them, the encrypted communication request includes the first identification information of the communication request end. Specifically, the method of this embodiment includes the following steps:

[0077] An encrypted communication request is sent to a communication response end through a communication server end, so that the communication server end generates current password information after receiving an encrypted communication response sent by the communication response end, encrypts the current password information based on the first identification information to obtain an encrypted password, and sends the encrypted password to the communication request end; in response to the received encrypted password, the encrypted password is decrypted according to the first identification information to obtain the current password information.

[0078] With reference to the foregoing embodiments, when the server of the present application sends the OTP password to the request end and the responder end respectively, the OTP password may be sent directly or the OTP password may be encrypted before being sent, which is not limited here.

[0079] Exemplarily, when the requesting end sends an encrypted communication request, the encrypted communication request may carry the first identification information of the requesting end. Similarly, when the responding end sends an encrypted communication response, the encrypted communication response may also carry the second identification information of the responding end. The identification information may refer to the description of the aforementioned embodiment, and may include but is not limited to the IP address, MAC address, ID logged on the requesting end and the responding end, and the specified characters or random characters generated by the requesting end and the responding end, respectively, etc., which are not limited here.

[0080] Taking the requesting end as an example, the requesting end sends an encrypted communication request to the responding end through the server end. The encrypted communication request can carry at least one of the above-mentioned first identification information, so that the server end generates the current password information after receiving the encrypted communication response sent by the responding end. Then the server end encrypts the current password information based on the first identification information to obtain the first encrypted password, and sends the first encrypted password to the requesting end. In addition, the current password information is encrypted based on the second identification information to obtain the second encrypted password, and the second encrypted password is sent to the responding end.

[0081] The requesting end responds to the encrypted password sent by the server and decrypts the encrypted password according to the first identification information, and then obtains the current password information. In addition, the responding end responds to the encrypted password sent by the server and decrypts the encrypted password according to the second identification information, and then obtains the current password information. This ensures the secure transmission process of the OTP password.

[0082] Based on the above embodiment, the embodiment of the present application describes the steps of generating a first key according to the received current password information and the acquired target timestamp. Specifically, the method of this embodiment includes the following steps:

[0083] Determine the key validity period of the first key according to the target timestamp and the preset validity period; after determining the key validity period of the first key according to the target timestamp and the preset validity period, the method also includes: obtaining a real-time timestamp; in response to the real-time timestamp exceeding the key validity period, invalidate the first key.

[0084] It should be noted that the key in this application can be stored for a long time or for a short time. For example, after the first terminal and the second terminal successfully establish an encrypted communication connection for the first time, each subsequent encrypted communication between the two ends can use the key generated by the first encrypted communication; or each encrypted communication between the two ends requires the server to re-issue the OTP password to the two ends and regenerate the key on the two ends, etc., which is not limited here.

[0085] In view of the consideration of key security, a corresponding validity period can also be adaptively set for each key. For example, the key validity period of the key is determined according to the target timestamp determined by both ends and the preset validity period. There can be one or more preset validity periods, and the preset validity period can also refer to the description of the preset delay period in the above embodiment. The corresponding preset validity period is selected according to the importance level of the encrypted communication, and the specific details are not repeated.

[0086] For the requesting end, the requesting end determines the validity period of the first key according to the target timestamp and the preset validity period. Similarly, for the responding end, the responding end determines the validity period of the second key according to the target timestamp and the preset validity period.

[0087] It should be noted that the requesting end and the responding end may have different importance level evaluation methods for the same encrypted communication connection or the same encrypted communication content (for example, different evaluation algorithms and evaluation rules, or different evaluation information (evaluation instructions) input by the user at both ends in response to the received information), which is not limited here. As a result, the preset effective time periods determined by the requesting end and the responding end are different, that is, the key validity periods of the keys held by each end are different. If the key of one end expires in advance, resulting in the inability of the end to successfully decrypt the received communication ciphertext, the description in the aforementioned embodiment can still be referred to, and the relevant prompt information can be generated and notified to the other end and the server end, and the server can re-send the OTP password to the responding end and the requesting end respectively, re-generate the key at both ends, and perform encryption and decryption processing with the new key. In this way, the different importance level evaluations and different encryption requirements of the same communication content at both ends can be adaptively met.

[0088] To further illustrate, the requesting end may also obtain a real-time timestamp periodically and / or when using the first key, and determine whether the first key has expired based on the real-time timestamp and the key validity period of the first key. In response to the real-time timestamp exceeding the key validity period, the first key may be invalidated (for example, the first key may be discarded). Similarly, the responding end may also refer to the aforementioned steps for implementation, which will not be described in detail here.

[0089] Optionally, after the requesting end invalidates the first key, it may also generate corresponding key invalidation information and send it to the responding end to inform the responding end that the key currently used is invalid. If it is necessary to continue encrypted communication, the OTP password issued by the server can still be obtained through the aforementioned embodiment based on the communication interaction between the two ends through the server, and the respective keys can be regenerated.

[0090] Based on the above embodiment, the embodiment of the present application describes the steps of determining the key validity period of the first key according to the target timestamp and the preset validity period. Specifically, the method of this embodiment includes the following steps:

[0091] Obtain the importance level of the content to be encrypted; adjust the key validity period according to the importance level, and the importance level and the key validity period are positively correlated or negatively correlated.

[0092] In conjunction with the above-mentioned embodiment, the key validity period of this embodiment can also be determined according to the importance level of the content to be encrypted in the above-mentioned embodiment. Among them, the importance level can be positively correlated or negatively correlated with the key validity period, that is, the higher the importance level, the longer or shorter the key validity period can be, which is not limited here.

[0093] For example, the key validity period may be set according to a preset key validity period when the key is generated, and then when the content to be encrypted is received, the set key validity period is adjusted according to the importance level of the content to be encrypted. The importance level of the content to be encrypted may be pre-specified by the user or the system when the content to be encrypted is input, or the importance level of the content to be encrypted may be determined by identifying the content to be encrypted.

[0094] It should be noted that in the process of generating keys, it is possible that both ends have not yet received the input content to be encrypted. Therefore, in this application, in addition to determining the importance level of the content to be encrypted based on its feature information (for example, analyzing whether there is target information such as privacy information, sensitive information, etc. in the format of text, images, videos, and audio in the content to be encrypted, for details, please refer to the prior art and will not be repeated here). It is also possible to set the importance level of this encrypted communication in advance (for example, when the requesting end initiates the request and when the responding end responds to the request). As a result, when both ends generate keys respectively, the importance level of this encrypted communication can be directly obtained.

[0095] On the basis of the above embodiment, the embodiment of the present application also needs to explain that: after the request end and the responder end successfully establish end-to-end encrypted communication, both ends can directly negotiate whether to replace the key based on the current encryption mechanism, or directly replace the encryption mechanism and replace the key, etc. In addition, both ends can also still negotiate through the server end whether to perform the above replacement operation, which is not limited here.

[0096] It should also be noted that the present application may also provide an end-to-end encrypted communication method, which is applied to a communication responder in a communication terminal, and the communication responder is connected to the communication requester through a communication server, and the method includes:

[0097] In response to the received encrypted communication request, an encrypted communication response of the encrypted communication request is generated and sent to the communication server end, so that after the communication server end determines that the communication response end agrees to the encrypted communication request based on the encrypted communication response, it generates current password information and sends the current password information to the communication request end and the communication response end respectively; a second key is generated based on the received current password information and the acquired target timestamp; in response to the received communication ciphertext, the communication ciphertext is decrypted according to the second key to obtain the communication plaintext.

[0098] Based on the above embodiment, this embodiment describes the steps of generating a second key according to the received current password information and the acquired target timestamp. Specifically, this embodiment includes:

[0099] A key generation process is performed according to the current password information, the target timestamp and a preset asymmetric key algorithm to obtain a second key, the second key including a second public key and a second private key; a communication ciphertext is decrypted according to the second key to obtain a communication plaintext, including: a communication ciphertext is decrypted according to the second private key to obtain a communication plaintext.

[0100] It should be noted that when the end-to-end encrypted communication method of the present application is applied to the responding end, there are more possible implementation methods. For details, reference can be made to the relevant description of the embodiment of the method applied to the requesting end in the aforementioned embodiment, which can be implemented in the responding end in the same way, and the details will not be repeated.

[0101] It should also be noted that the present application may also provide an end-to-end encrypted communication method, which is applied to a communication server end, and the communication server end is respectively connected to the communication request end and the communication response end for communication, and the method includes:

[0102] After determining that the communication responding end agrees to establish an encrypted communication connection with the communication requesting end, the current password information (such as an OTP password) is generated, and the current password information is sent to the communication requesting end and the communication responding end respectively, so that the communication requesting end and the communication responding end respectively perform key generation processing based on the current password information received by each.

[0103] It should be noted that when the end-to-end encrypted communication method of the present application is applied to the server side, there are more possible implementation methods. For details, please refer to the relevant description of the embodiment of the method applied to the request side in the aforementioned embodiment, and the details will not be repeated.

[0104] In summary, the end-to-end encrypted communication method of the present application avoids the complexity and computational overhead in the traditional encrypted communication process. This simple and efficient design can improve the efficiency and response speed of encrypted communication, and can also ensure the security of encrypted communication. And different asymmetric encryption public and private keys can be used when each two terminals perform end-to-end encrypted communication. It ensures that different asymmetric public and private keys are used for each encrypted communication channel, and the security of other communication channels can be guaranteed even if a private key is leaked. Use OTP to generate asymmetric encryption keys. Even if there is an abnormality in the OTP transmission or key generation process, a new request can be sent to the communication server to obtain a new OTP password without affecting subsequent communications.

[0105] It should be further explained that the execution subject of the end-to-end encrypted communication method may be an end-to-end encrypted communication device, for example, the end-to-end encrypted communication method may be executed by a terminal device or a server or other processing device, wherein the terminal device may be a user equipment (UE), a computer, a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a personal digital assistant (PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc. In some possible implementations, the end-to-end encrypted communication method may be implemented by a processor calling computer-readable instructions stored in a memory.

[0106] Figure 4 FIG. 1 is a block diagram of an end-to-end encrypted communication device according to an exemplary embodiment of the present application. Figure 4 As shown, the exemplary end-to-end encrypted communication device 400 includes: a request sending module 410, a first key generating module 420, a content encryption module 430 and a ciphertext sending module 440. The device can be applied to a communication request end. Specifically:

[0107] The request sending module 410 is used to send an encrypted communication request to the communication responder through the communication server, so that the communication server generates current password information after receiving the encrypted communication response sent by the communication responder, and sends the current password information to the communication requester and the communication responder respectively.

[0108] The first key generation module 420 is used to generate a first key according to the received current password information and the acquired target timestamp.

[0109] The content encryption module 430 is used to encrypt the content to be encrypted according to the first key to obtain a communication ciphertext.

[0110] The ciphertext sending module 440 is used to send the communication ciphertext to the communication responder so that the communication responder decrypts the communication ciphertext using the second key to obtain the communication plaintext. The second key is generated by the communication responder based on the received current password information and the obtained target timestamp.

[0111] In this exemplary end-to-end encrypted communication device, an encrypted communication request is sent from the communication server to the communication response end, so that the communication server generates current password information after receiving the encrypted communication response sent by the communication response end, and sends the current password information to the communication request end and the communication response end respectively; the communication request end generates a first key according to the received current password information and the obtained target timestamp; and encrypts the encrypted content according to the first key to obtain a communication ciphertext; and then sends the communication ciphertext to the communication response end, so that the communication response end uses the second key to decrypt the communication ciphertext to obtain a communication plaintext, and the second key is generated by the communication response end based on the received current password information and the obtained target timestamp. In this way, the data interaction efficiency in the encrypted communication process can be improved, the key transfer process in the encrypted communication process can be reduced, the security of the encrypted communication process can be improved, and secure end-to-end encrypted communication can be achieved.

[0112] The present application may also provide another exemplary end-to-end encrypted communication device, which is applied to the communication response end, including: a response sending module, which is used to generate an encrypted communication response of the encrypted communication request in response to the received encrypted communication request and send it to the communication server end, so that the communication server end generates current password information after determining that the communication response end agrees to the encrypted communication request based on the encrypted communication response, and sends the current password information to the communication request end and the communication response end respectively; a second key generation module, which is used to generate a second key based on the received current password information and the acquired target timestamp; a content decryption module, which is used to respond to the received communication ciphertext and decrypt the communication ciphertext according to the second key to obtain the communication plaintext.

[0113] The present application may also provide another exemplary end-to-end encrypted communication device, applied to a communication server, comprising: a password generation module, used to generate current password information (such as an OTP password) after determining that the communication response end agrees to establish an encrypted communication connection with the communication request end. A password sending module, used to send the current password information to the communication request end and the communication response end respectively, so that the communication request end and the communication response end respectively perform key generation processing based on the current password information received by each.

[0114] It should be noted that the device provided in the above embodiment and the method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs the operation has been described in detail in the method embodiment, and will not be repeated here. In practical applications, the device provided in the above embodiment can distribute the above functions to different functional modules as needed, that is, divide the internal structure of the device into different functional modules to complete all or part of the functions described above, and this is not limited here.

[0115] Among them, the functions of each module can be found in the end-to-end encryption communication method embodiment, which will not be repeated here.

[0116] See also Figure 5 , Figure 5 1 is a schematic diagram of the structure of an embodiment of an electronic device of the present application. The electronic device 100 includes a memory 101 and a processor 102, and the processor 102 is used to execute program instructions stored in the memory 101 to implement the steps in any of the above end-to-end encryption communication method embodiments. In a specific implementation scenario, the electronic device 100 may include but is not limited to: a microcomputer, a server, and in addition, the electronic device 100 may also include a mobile device such as a laptop computer and a tablet computer, which is not limited here.

[0117] Specifically, the processor 102 is used to control itself and the memory 101 to implement the steps in any of the above-mentioned end-to-end encryption communication method embodiments. The processor 102 can also be called a CPU (Central Processing Unit). The processor 102 may be an integrated circuit chip with signal processing capabilities. The processor 102 can also be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field-programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. In addition, the processor 102 can be implemented by an integrated circuit chip.

[0118] In this exemplary electronic device, an encrypted communication request is sent to a communication response end through a communication server end, so that the communication server end generates current password information after receiving the encrypted communication response sent by the communication response end, and sends the current password information to the communication request end and the communication response end respectively; the communication request end generates a first key according to the received current password information and the obtained target timestamp; and encrypts the encrypted content according to the first key to obtain a communication ciphertext; and then sends the communication ciphertext to the communication response end, so that the communication response end uses a second key to decrypt the communication ciphertext to obtain a communication plaintext, and the second key is generated by the communication response end based on the received current password information and the obtained target timestamp. In this way, the data interaction efficiency in the encrypted communication process can be improved, the key transfer process in the encrypted communication process can be reduced, the security of the encrypted communication process can be improved, and secure end-to-end encrypted communication can be achieved.

[0119] See also Figure 6 , Figure 6 The computer-readable storage medium 110 stores program instructions 111 that can be executed by a processor, and the program instructions 111 are used to implement the steps in any of the above end-to-end encryption communication method embodiments.

[0120] In this exemplary storage medium, by running the program instructions in the storage medium, an encrypted communication request is sent from the communication server to the communication response end, so that the communication server generates the current password information after receiving the encrypted communication response sent by the communication response end, and sends the current password information to the communication request end and the communication response end respectively; the communication request end generates a first key according to the received current password information and the obtained target timestamp; and encrypts the encrypted content according to the first key to obtain the communication ciphertext; and then sends the communication ciphertext to the communication response end, so that the communication response end uses the second key to decrypt the communication ciphertext to obtain the communication plaintext, and the second key is generated by the communication response end based on the received current password information and the obtained target timestamp. In this way, the data interaction efficiency in the encrypted communication process can be improved, the key transfer process in the encrypted communication process can be reduced, the security of the encrypted communication process can be improved, and secure end-to-end encrypted communication can be achieved.

[0121] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0122] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0123] In the several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation, such as units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0124] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform all or part of the steps of each implementation method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

Claims

1. An end-to-end encrypted communication method, characterized in that: The method is applied to a communication request end, the communication request end is connected to a communication response end through a communication server end, and the method includes: Sending an encrypted communication request to the communication responder through the communication server, so that the communication server generates current password information after receiving the encrypted communication response sent by the communication responder, and sends the current password information to the communication requester and the communication responder respectively; Generate a first key according to the received current password information and the acquired target timestamp; Encrypting the content to be encrypted according to the first key to obtain a communication ciphertext; The communication ciphertext is sent to the communication responder, so that the communication responder decrypts the communication ciphertext using a second key to obtain a communication plaintext, where the second key is generated by the communication responder based on the received current password information and the acquired target timestamp.

2. The method according to claim 1, characterized in that The step of generating a first key according to the received current password information and the acquired target timestamp includes: Perform key generation processing according to the current password information, the target timestamp, and a preset asymmetric key algorithm to obtain the first key, where the first key includes a first public key and a first private key; The encrypting the content to be encrypted according to the first key to obtain a communication ciphertext includes: The content to be encrypted is encrypted according to the first public key.

3. The method according to claim 1, characterized in that The step of generating a first key according to the received current password information and the acquired target timestamp includes: In response to the received current password information, obtaining a current timestamp; According to the preset delay period in which the current timestamp is located, the target timestamp is determined using time information corresponding to the preset delay period.

4. The method according to claim 1, characterized in that: The encrypted communication request includes the first identification information of the communication request end, and the encrypted communication request is sent to the communication response end through the communication server end, so that the communication server end generates current password information after receiving the encrypted communication response sent by the communication response end, and sends the current password information to the communication request end and the communication response end respectively, including: Sending the encrypted communication request to the communication responder through the communication server, so that the communication server generates current password information after receiving the encrypted communication response sent by the communication responder, encrypts the current password information based on the first identification information to obtain an encrypted password, and sends the encrypted password to the communication requester; After sending the encrypted communication request to the communication responder through the communication server, the method further includes: In response to the received encrypted password, the encrypted password is decrypted according to the first identification information to obtain the current password information.

5. The method according to claim 1, characterized in that The step of generating a first key according to the received current password information and the acquired target timestamp includes: Determine a key validity period of the first key according to the target timestamp and a preset validity period; After determining the key validity period of the first key according to the target timestamp and the preset validity period, the method further includes: Get real-time timestamp; In response to the real-time timestamp exceeding the key validity period, invalidating the first key.

6. The method according to claim 5, characterized in that The determining the key validity period of the first key according to the target timestamp and the preset validity period includes: Obtaining the importance level of the content to be encrypted; The key validity period is adjusted according to the importance level, and the importance level and the key validity period are positively correlated or negatively correlated.

7. An end-to-end encrypted communication method, characterized in that: The method is applied to a communication responder in a communication terminal, the communication responder is connected to a communication requester via a communication server, and the method comprises: In response to the received encrypted communication request, generate an encrypted communication response of the encrypted communication request and send it to the communication server end, so that the communication server end generates current password information after determining that the communication response end agrees to the encrypted communication request according to the encrypted communication response, and sends the current password information to the communication request end and the communication response end respectively; Generate a second key according to the received current password information and the acquired target timestamp; In response to the received communication ciphertext, the communication ciphertext is decrypted according to the second key to obtain communication plaintext.

8. The method according to claim 7, characterized in that The generating of the second key according to the received current password information and the acquired target timestamp includes: Perform key generation processing according to the current password information, the target timestamp, and a preset asymmetric key algorithm to obtain the second key, where the second key includes a second public key and a second private key; The decrypting the communication ciphertext according to the second key to obtain the communication plaintext includes: The communication ciphertext is decrypted according to the second private key to obtain the communication plaintext.

9. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the processor is used to execute program instructions stored in the memory to implement the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having program instructions stored thereon, characterized in that: When the program instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images