Key agreement method, apparatus, and related device

Abstract

The present disclosure provides a key negotiation method, device and related equipment, and relates to the technical field of communication. The method comprises the following steps: encrypting public keys corresponding to various encryption level information based on a negotiation mode and a target key to obtain public key ciphertexts corresponding to the various encryption level information; sending the public key ciphertexts corresponding to the various encryption level information to a responder; receiving target ciphertexts corresponding to the various encryption level information sent by the responder, decrypting the target ciphertexts corresponding to the various encryption level information based on the negotiation mode and the target key to obtain session key ciphertexts corresponding to the various encryption level information; and decrypting the session key ciphertexts corresponding to the various encryption level information using the public keys corresponding to the various encryption level information to obtain session keys corresponding to the various encryption level information. Through the above technical means, the problems of security risks in key negotiation and the inability to adapt to different security requirement scenarios in the prior art are solved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of communication technology, and in particular, to a key agreement method, device and related equipment. BACKGROUND

[0002] With the continuous development of quantum technology, there is a potential security risk in continuing to use traditional cryptographic algorithms for key agreement. In addition, traditional cryptographic algorithms often use a single security strategy, which is difficult to adapt to different security requirement scenarios, thereby limiting the flexibility of the key agreement process. SUMMARY

[0003] The present disclosure provides a key agreement method, device and related equipment, which at least to some extent improves the security guarantee of key agreement.

[0004] Other characteristics and advantages of the present disclosure will become apparent from the following detailed description, or will be learned by practice of the present disclosure.

[0005] According to one aspect of the present disclosure, a key agreement method is provided, applied to an initiator, comprising: receiving a target key, a negotiation mode and multiple encryption level information sent by a responder, wherein each encryption level information includes an encryption algorithm category and a security level; obtaining public keys corresponding to various encryption level information, encrypting the public keys corresponding to various encryption level information based on the negotiation mode and the target key to obtain public key ciphertexts corresponding to various encryption level information; sending the public key ciphertexts corresponding to various encryption level information to the responder, so that the responder generates target ciphertexts corresponding to various encryption level information based on the public key ciphertexts corresponding to various encryption level information; receiving the target ciphertexts corresponding to various encryption level information sent by the responder, decrypting the target ciphertexts corresponding to various encryption level information based on the negotiation mode and the target key to obtain session key ciphertexts corresponding to various encryption level information; and decrypting the session key ciphertexts corresponding to various encryption level information using the public keys corresponding to various encryption level information to obtain session keys corresponding to various encryption level information.

[0006] In one embodiment of the present disclosure, receiving the target key, the negotiation mode and the multiple encryption level information sent by the responder comprises: receiving a key agreement response message from the responder, wherein the key agreement response message includes a key exchange field, a negotiation mode field and a security proposal field; after receiving the key agreement response message from the responder, the method further comprises: parsing the target key, the negotiation mode and the multiple encryption level information from the key exchange field, the negotiation mode field and the security proposal field, respectively.

[0007] In one embodiment of the present disclosure, after receiving the target key, the negotiation mode and the plurality of encryption level information sent by the responder, the method further comprises: when the negotiation mode is the concatenation mode: encrypting the public key corresponding to each encryption level information by using the target key to obtain the public key ciphertext corresponding to each encryption level information; sending the public key ciphertext corresponding to each encryption level information to the responder, so that the responder generates the target ciphertext corresponding to each encryption level information based on the public key ciphertext corresponding to each encryption level information; receiving the target ciphertext corresponding to each encryption level information, and decrypting the target ciphertext corresponding to each encryption level information by using the target key to obtain the session key ciphertext corresponding to each encryption level information; and decrypting the session key ciphertext corresponding to each encryption level information by using the public key corresponding to each encryption level information to obtain the session key corresponding to each encryption level information.

[0008] In one embodiment of the present disclosure, after receiving the target key, the negotiation mode and the plurality of encryption level information sent by the responder, the method further comprises: when the negotiation mode is the concatenation mode: updating the target key at each interaction, and obtaining the session key corresponding to each encryption level information through multiple interactions with the responder, wherein each interaction is used to negotiate the session key corresponding to one encryption level information; wherein each interaction comprises: encrypting the public key corresponding to the encryption level information by using the target key to obtain the public key ciphertext corresponding to the encryption level information; sending the public key ciphertext corresponding to the encryption level information to the responder, so that the responder generates the target ciphertext corresponding to the encryption level information based on the public key ciphertext corresponding to the encryption level information; receiving the target ciphertext corresponding to the encryption level information, and decrypting the target ciphertext corresponding to the encryption level information by using the target key to obtain the session key ciphertext corresponding to the encryption level information; and decrypting the session key ciphertext corresponding to the encryption level information by using the public key corresponding to the encryption level information to obtain the session key corresponding to the encryption level information.

[0009] In one embodiment of the present disclosure, after receiving the target key, the negotiation mode and the multiple encryption level information sent by the responder, the method further comprises: when the negotiation mode is the cascade mode, performing the following loop: determining whether i is greater than N, where i represents the serial number of the encryption level information, the initial value of i is 1, and N represents the number of the encryption level information; if i is greater than N, exiting the loop; if i is less than or equal to N, encrypting the public key corresponding to the i-th encryption level information by using the target key to obtain the public key ciphertext corresponding to the i-th encryption level information; sending the public key ciphertext corresponding to the i-th encryption level information to the responder, so that the responder generates the target ciphertext corresponding to the i-th encryption level information based on the public key ciphertext corresponding to the i-th encryption level information; receiving the target ciphertext corresponding to the i-th encryption level information, decrypting the target ciphertext corresponding to the i-th encryption level information by using the target key to obtain the session key ciphertext corresponding to the i-th encryption level information; decrypting the session key ciphertext corresponding to the i-th encryption level information by using the public key corresponding to the i-th encryption level information to obtain the session key corresponding to the i-th encryption level information; updating the target key by using the exclusive or value of the target key and the session key corresponding to the i-th encryption level information, and updating i by using the value of i plus 1.

[0010] In one embodiment of the present disclosure, after decrypting the session key ciphertext corresponding to each encryption level information by using the public key corresponding to each encryption level information to obtain the session key corresponding to each encryption level information, the method further comprises: generating a target session key based on the target key and the session key corresponding to each encryption level information; and using the target session key for encryption in the interaction with the responder.

[0011] According to another aspect of the present disclosure, a key negotiation method applied to a responder is provided, comprising: sending a target key, a negotiation mode and multiple encryption level information to an initiator, so that the initiator generates public key ciphertext corresponding to each encryption level information based on the target key, the negotiation mode and the multiple encryption level information, wherein each encryption level information comprises one encryption algorithm category and one security level; receiving the public key ciphertext corresponding to each encryption level information from the initiator, decrypting the public key ciphertext corresponding to each encryption level information based on the negotiation mode and the target key to obtain the public key corresponding to each encryption level information; encrypting the session key corresponding to each encryption level information by using the public key corresponding to each encryption level information to obtain the session key ciphertext corresponding to each encryption level information; encrypting the session key ciphertext corresponding to each encryption level information based on the negotiation mode and the target key to obtain the target ciphertext corresponding to each encryption level information; and sending the target ciphertext corresponding to each encryption level information to the initiator.

[0012] In one embodiment of the present disclosure, the target key, the negotiation mode and the multiple encryption level information are sent to the initiator, including: sending a key negotiation response message to the initiator, wherein the key negotiation response message includes a key exchange field, a negotiation mode field and a security proposal field; before sending the key negotiation response message to the initiator, the method further includes: packing the target key, the negotiation mode and the multiple encryption level information into the key exchange field, the negotiation mode field and the security proposal field respectively to obtain the key negotiation response message.

[0013] In one embodiment of the present disclosure, after receiving the public key ciphertext corresponding to the multiple encryption level information from the initiator, the method further includes: when the negotiation mode is the concatenation mode: decrypting the public key ciphertext corresponding to the multiple encryption level information by using the target key to obtain the public key corresponding to the multiple encryption level information; encrypting the session key corresponding to the multiple encryption level information by using the public key corresponding to the multiple encryption level information to obtain the session key ciphertext corresponding to the multiple encryption level information; encrypting the session key ciphertext corresponding to the multiple encryption level information by using the target key to obtain the target ciphertext corresponding to the multiple encryption level information; and sending the target ciphertext corresponding to the multiple encryption level information to the initiator.

[0014] In one embodiment of the present disclosure, after receiving the public key ciphertext corresponding to the multiple encryption level information from the initiator, the method further includes: when the negotiation mode is the concatenation mode: updating the target key at each interaction, and negotiating the session key corresponding to the multiple encryption level information through multiple interactions with the initiator, wherein each interaction is used to negotiate the session key corresponding to one encryption level information; wherein each interaction includes: decrypting the public key ciphertext corresponding to the encryption level information by using the target key to obtain the public key corresponding to the encryption level information; encrypting the session key corresponding to the encryption level information by using the public key corresponding to the encryption level information to obtain the session key ciphertext corresponding to the encryption level information; encrypting the session key ciphertext corresponding to the encryption level information by using the target key to obtain the target ciphertext corresponding to the encryption level information; and sending the target ciphertext corresponding to the encryption level information to the initiator.

[0015] In one embodiment of the present disclosure, after receiving the public key ciphertext corresponding to the various encryption level information from the initiator, the method further comprises: when the negotiation mode is the cascade mode, performing the following loop: determining whether i is greater than N, where i represents the serial number of the encryption level information, the initial value of i is 1, and N represents the number of the encryption level information; if i is greater than N, exiting the loop; if i is less than or equal to N, decrypting the public key ciphertext corresponding to the i-th encryption level information using the target key to obtain the public key corresponding to the i-th encryption level information; encrypting the session key corresponding to the i-th encryption level information using the public key corresponding to the i-th encryption level information to obtain the session key ciphertext corresponding to the i-th encryption level information; encrypting the session key ciphertext corresponding to the i-th encryption level information using the target key to obtain the target ciphertext corresponding to the i-th encryption level information; sending the target ciphertext corresponding to the i-th encryption level information to the initiator; and updating the target key using the exclusive or value of the target key and the session key corresponding to the i-th encryption level information, and updating i using the value of i+1.

[0016] In one embodiment of the present disclosure, before sending the target key, the negotiation mode and the various encryption level information to the initiator, the method further comprises: receiving a key negotiation request message from the initiator; and determining the various encryption level information from the key packaging mechanism list in the security proposal field of the key negotiation request message.

[0017] According to still another aspect of the present disclosure, a key negotiation apparatus is provided, which is applied to an initiator and comprises: a receiving module configured to receive the target key, the negotiation mode and the various encryption level information sent by a responder, wherein each encryption level information comprises an encryption algorithm category and a security level; a first encryption module configured to determine the public key corresponding to the various encryption level information, encrypt the public key corresponding to the various encryption level information based on the negotiation mode and the target key to obtain the public key ciphertext corresponding to the various encryption level information; a first sending module configured to send the public key ciphertext corresponding to the various encryption level information to the responder so that the responder generates the target ciphertext corresponding to the various encryption level information based on the public key ciphertext corresponding to the various encryption level information; a first decryption module configured to receive the target ciphertext corresponding to the various encryption level information sent by the responder, decrypt the target ciphertext corresponding to the various encryption level information based on the negotiation mode and the target key to obtain the session key ciphertext corresponding to the various encryption level information; and a second decryption module configured to decrypt the session key ciphertext corresponding to the various encryption level information using the public key corresponding to the various encryption level information to obtain the session key corresponding to the various encryption level information.

[0018] According to a further aspect of the present disclosure, there is provided a key agreement apparatus applied to a responder, comprising: a second sending module configured to send a target key, a negotiation mode and a plurality of encryption level information to an initiator, so that the initiator generates public key ciphertext corresponding to each encryption level information based on the target key, the negotiation mode and the plurality of encryption level information, wherein each encryption level information comprises one encryption algorithm category and one security level; a third decryption module configured to receive the public key ciphertext corresponding to each encryption level information from the initiator, and decrypt the public key ciphertext corresponding to each encryption level information based on the negotiation mode and the target key to obtain the public key corresponding to each encryption level information; a second encryption module configured to encrypt the session key corresponding to each encryption level information using the public key corresponding to each encryption level information to obtain session key ciphertext corresponding to each encryption level information; a third encryption module configured to encrypt the session key ciphertext corresponding to each encryption level information based on the negotiation mode and the target key to obtain target ciphertext corresponding to each encryption level information; and a third sending module configured to send the target ciphertext corresponding to each encryption level information to the initiator.

[0019] According to a further aspect of the present disclosure, there is provided an electronic device, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any of the above methods via execution of the executable instructions.

[0020] According to a further aspect of the present disclosure, there is provided a computer readable storage medium having stored thereon a computer program, which, when executed by a processor, implements any of the above methods.

[0021] According to a further aspect of the present disclosure, there is provided a computer program product comprising computer instructions stored in a computer readable storage medium, which, when executed by a processor, implement the operational instructions of any of the above methods.

[0022] In the embodiments of the present disclosure, the target ciphertext corresponding to each encryption level information is decrypted based on the negotiation mode and the target key to obtain the session key ciphertext corresponding to each encryption level information, and the session key ciphertext corresponding to each encryption level information is decrypted using the public key corresponding to each encryption level information to obtain the session key corresponding to each encryption level information, thereby solving the problems of security risks in key agreement and inability to adapt to different security requirement scenarios in the prior art, and further enhancing the security and flexibility of key agreement.

[0023] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and are not limiting to the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0024] The accompanying drawings, which are incorporated herein and constitute part of the specification, illustrate embodiments consistent with the present disclosure and, together with the description, further serve to explain the principles of the present disclosure. It is to be understood that the drawings are only schematic, and that they do not purport to be to scale with respect to one another. The embodiments will be described with reference to the drawings in conjunction with a detailed description.

[0025] Figure 1 A schematic diagram of a key agreement system in an embodiment of the present disclosure is shown.

[0026] Figure 2 A flow chart of a key agreement method in an embodiment of the present disclosure is shown.

[0027] Figure 3 A flow chart of another key agreement method in an embodiment of the present disclosure is shown.

[0028] Figure 4 A flow chart of a key agreement method in a concatenation mode in an embodiment of the present disclosure is shown.

[0029] Figure 5 A flow chart of another key agreement method in a concatenation mode in an embodiment of the present disclosure is shown.

[0030] Figure 6 A flow chart of a key agreement method in a concatenation mode in an embodiment of the present disclosure is shown.

[0031] Figure 7 A flow chart of another key agreement method in a concatenation mode in an embodiment of the present disclosure is shown.

[0032] Figure 8 A flow chart of a key agreement method in a concatenation mode in an embodiment of the present disclosure is shown.

[0033] Figure 9 A schematic diagram of a key agreement apparatus in an embodiment of the present disclosure is shown.

[0034] Figure 10 A schematic diagram of another key agreement apparatus in an embodiment of the present disclosure is shown.

[0035] Figure 11 A schematic diagram of an electronic device provided in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0036] Example implementations are now described with reference to the drawings. Example implementations can, however, be implemented in many different forms and should not be construed as limited to the examples set forth herein; rather, these implementations are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the example implementations to those skilled in the art. The described features, structures, or characteristics can be combined in one or more implementations.

[0037] In addition, the accompanying drawings are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this specification. The drawings illustrate examples of the present disclosure and, as such, a change can be made in the size of some of the elements for the sake of illustration in the drawings. Like reference numerals refer to like elements throughout the drawings. It should be noted that the elements in the figures are not necessarily drawn to scale. In the figures, like reference numerals refer to like parts throughout the various views. Some embodiments are illustrated by way of example, not by way of limitation, in the figures.

[0038] It should be understood that various steps in the methods of the present disclosure can be performed in a different order and / or concurrently. Furthermore, the methods of the present disclosure can include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this regard.

[0039] It should be noted that the terms "first", "second", and the like, used in the present disclosure, are used to distinguish one element from another, and do not imply the order or sequence of the execution of the functions of the elements, or the interdependence of the elements.

[0040] It should be noted that the terms "one", "multiple", used in the present disclosure are illustrative and not restrictive, and those skilled in the art should understand that "one" or "multiple" should be understood as "one or more" unless otherwise explicitly indicated in the context.

[0041] It should be noted that the embodiments of the present disclosure and the technical features in the embodiments can be combined with each other without conflict.

[0042] For ease of understanding, the following first explains several terms related to the present disclosure as follows:

[0043] Post Quantum Cryptography (PQC), also known as "quantum-resistant cryptography", is a new generation of cryptographic algorithm that resists quantum computer attacks on existing cryptographic algorithms, is a key technology to maintain network security in the quantum information era, and is an important part of countering quantum computer threats.

[0044] CRYSTALS-KYBER (Key Encapsulation Mechanism, KEM) is a quantum-resistant cryptographic algorithm. It is based on the Module-Learning With Errors (MLWE) problem, which is considered to be a mathematical problem that remains difficult to solve even in the era of quantum computing. KYBER was proposed as part of the NIST post-quantum cryptography standard and has gained attention for its performance and security.

[0045] IKE is a protocol used to securely establish and manage Security Associations (SAs) within the IPsec (Internet Protocol Security) framework. It is responsible for negotiating encryption algorithms, authentication methods, and generating shared session keys to provide confidentiality, integrity, and authentication services at the network layer.

[0046] KEM (Key Encapsulation Mechanism) is a technique used to securely generate and transmit symmetric keys. It is often used in conjunction with encryption algorithms to ensure that symmetric keys can be securely exchanged over an insecure communication channel. The main role of KEM is to establish a shared secret key between two or more parties, which can then be used for efficient data encryption and decryption operations.

[0047] Initiator: In the key agreement process, the party responsible for initiating the key agreement request.

[0048] Responder: The party that responds to the initiator's key agreement request and participates in the key generation process.

[0049] The specific implementation of the embodiments of the present disclosure will be described in detail below in conjunction with the accompanying drawings.

[0050] Figure 1 A schematic diagram of a key agreement system in an embodiment of the present disclosure is shown,

[0051] The initiator 101 and the responder 102 can be various mobile devices and various servers, etc.

[0052] The application program installed in the initiator 101 can be configured to perform the following: receiving the target key, the negotiation mode and the multiple encryption level information sent by the responder, wherein each encryption level information comprises an encryption algorithm category and a security level; obtaining the public key corresponding to each encryption level information, encrypting the public key corresponding to each encryption level information based on the negotiation mode and the target key to obtain the public key ciphertext corresponding to each encryption level information; sending the public key ciphertext corresponding to each encryption level information to the responder, so that the responder generates the target ciphertext corresponding to each encryption level information based on the public key ciphertext corresponding to each encryption level information; receiving the target ciphertext corresponding to each encryption level information sent by the responder, decrypting the target ciphertext corresponding to each encryption level information based on the negotiation mode and the target key to obtain the session key ciphertext corresponding to each encryption level information; and decrypting the session key ciphertext corresponding to each encryption level information based on the public key corresponding to each encryption level information to obtain the session key corresponding to each encryption level information.

[0053] The application program installed in the responder 102 can be configured to perform the following: sending the target key, the negotiation mode and the multiple encryption level information to the initiator, so that the initiator generates the public key ciphertext corresponding to each encryption level information based on the target key, the negotiation mode and the multiple encryption level information, wherein each encryption level information comprises an encryption algorithm category and a security level; receiving the public key ciphertext corresponding to each encryption level information from the initiator, decrypting the public key ciphertext corresponding to each encryption level information based on the negotiation mode and the target key to obtain the public key corresponding to each encryption level information; encrypting the session key corresponding to each encryption level information based on the public key corresponding to each encryption level information to obtain the session key ciphertext corresponding to each encryption level information; encrypting the session key ciphertext corresponding to each encryption level information based on the negotiation mode and the target key to obtain the target ciphertext corresponding to each encryption level information; and sending the target ciphertext corresponding to each encryption level information to the initiator.

[0054] The initiator 101 and the responder 102 are connected through a communication network. Optionally, the communication network is a wired network or a wireless network.

[0055] Optionally, the wireless or wired networks described above use standard communications technologies and / or protocols. The networks typically carry Internet traffic, but can also include, without limitation, any combination of Local Area Network (LAN), Metropolitan Area Network (MAN), Wide Area Network (WAN), mobile, wired, or wireless network, private network, or virtual private network. In some embodiments, technologies and / or formats including, without limitation, Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), and the like are used to represent data exchanged over the networks. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Networks (VPN), Internet Protocol Security (IPsec), and the like can be used to encrypt all or some links. In other embodiments, custom and / or proprietary data communications technologies can be used in place of, or to supplement, the data communications technologies described above.

[0056] Figure 2 A flow chart of a method of key agreement is shown in the embodiments of the present disclosure, which is applied to an initiator, such as a client, and a responder, such as a server. Figure 2 As shown, the method comprises the following steps:

[0057] S201, receiving target key, negotiation mode and multiple encryption level information sent by the responder, wherein each encryption level information comprises an encryption algorithm category and a security level;

[0058] The target key is a key for encrypting subsequent information interaction between the initiator and the responder. The negotiation mode is a specific rule or algorithm used in the process of key agreement and encryption and decryption. The negotiation mode includes splicing mode and cascading mode, etc. Each encryption level information can be regarded as a combination of an encryption algorithm category and a security level. An encryption algorithm category represents a PQC algorithm, and a PQC algorithm provides multiple parameter sets to adapt to the needs of different security levels.

[0059] For example, CRYSTALS-KYBER provides different parameter sets to adapt to different security requirements and application scenarios, and each parameter set defines different public key sizes, ciphertext sizes, and key generation, encryption and decryption speeds, etc. Kyber512: provides about 128-bit classical security strength, suitable for most applications. Kyber768: provides higher security strength, about equivalent to 192-bit classical security strength. Kyber1024: provides the highest security level, about 256-bit classical security strength.

[0060] S202, obtain the public key corresponding to each encryption level information, and encrypt the public key corresponding to each encryption level information based on the negotiation mode and the target key to obtain the public key ciphertext corresponding to each encryption level information;

[0061] The public key ciphertext is the ciphertext obtained by encrypting the public key using the target key. Each encryption level information corresponds to a public key.

[0062] In an exemplary embodiment, each encryption level information corresponds to an identification number, and each identification number corresponds to a public key. The public key corresponding to each encryption level information can be obtained from the key encapsulation mechanism list based on the identification number corresponding to the encryption level information.

[0063] S203, send the public key ciphertext corresponding to each encryption level information to the responder, so that the responder generates the target ciphertext corresponding to each encryption level information based on the public key ciphertext corresponding to each encryption level information;

[0064] S204, receive the target ciphertext corresponding to each encryption level information sent by the responder, and decrypt the target ciphertext corresponding to each encryption level information based on the negotiation mode and the target key to obtain the session key ciphertext corresponding to each encryption level information;

[0065] The target ciphertext is the encryption information generated by the responder based on the public key ciphertext, which is used to finally generate the session key. The session key ciphertext is the encryption information obtained by decrypting the target ciphertext, which needs to be further decrypted to obtain the session key.

[0066] S205, decrypt the session key ciphertext corresponding to each encryption level information using the public key corresponding to each encryption level information to obtain the session key corresponding to each encryption level information.

[0067] The session key is a temporary key for encrypting the actual communication content of both parties. Through the above technical means, the negotiation of the session key in IKE or KEM is realized. The encryption and decryption process in the present disclosure can use a symmetric encryption algorithm.

[0068] According to the technical scheme provided by the embodiment of the present disclosure, there are multiple encryption level information, the flexibility of key negotiation is enhanced, appropriate encryption level can be selected according to different security requirements, and the security adaptability is improved. The public keys are encrypted based on the negotiation mode and the target key, the security of key transmission is improved, and the public keys are ensured not to be tampered with or stolen in the transmission process. The session key ciphertext is obtained by decrypting the session key ciphertext based on the negotiation mode and the target key, and the session key is obtained by decrypting the session key ciphertext based on the public key, and the uniqueness of the session key is ensured.

[0069] For example, in an online bank transaction system, a customer (initiator) wants to establish a secure connection with a bank server (responder) to exchange sensitive information. First, the bank server provides the customer with a target key, a negotiation mode, and multiple encryption level information. Then, the customer selects the highest level of encryption level according to the received information, and encrypts the corresponding public key based on the provided target key. Then, the encrypted public key ciphertext is sent back to the bank server, and the server generates the target ciphertext based on this and returns it to the customer. The customer decrypts the received target ciphertext to obtain the session key ciphertext, and further decrypts it using the public key, and finally obtains the session key used to protect the communication between it and the bank.

[0070] Figure 3 A flowchart of another key negotiation method in the embodiment of the present disclosure is shown, which is applied to the responder, as shown in Figure 3 The method comprises the following steps:

[0071] S301, sending a target key, a negotiation mode and multiple encryption level information to an initiator, so that the initiator generates public key ciphertext corresponding to each encryption level information based on the target key, the negotiation mode and the multiple encryption level information, wherein each encryption level information comprises an encryption algorithm category and a security level;

[0072] S302, receiving the public key ciphertext corresponding to each encryption level information from the initiator, decrypting the public key ciphertext corresponding to each encryption level information based on the negotiation mode and the target key, to obtain the public key corresponding to each encryption level information;

[0073] S303, encrypting the session key corresponding to each encryption level information using the public key corresponding to each encryption level information, to obtain the session key ciphertext corresponding to each encryption level information;

[0074] S304, encrypting the session key ciphertext corresponding to each encryption level information based on the negotiation mode and the target key, to obtain the target ciphertext corresponding to each encryption level information;

[0075] S305, send the target ciphertext corresponding to various encryption level information to the initiator.

[0076] According to the technical scheme provided by the embodiment of the present disclosure, there are multiple encryption level information, the initialization security in the key negotiation process is enhanced, and it is ensured that the initiator can select a suitable encryption strategy based on the information, thereby improving the flexibility and adaptability of the key negotiation. The public key ciphertext corresponding to various encryption level information is received from the initiator, and the public key is obtained by decrypting the public key ciphertext based on the negotiation mode and the target key, thereby enhancing the secure transmission capability of the information. The session key corresponding to various encryption level information is encrypted by using the parsed public key, the session key ciphertext is generated, the session key ciphertext is encrypted based on the negotiation mode and the target key, and the target ciphertext is generated. The technical means strengthens the security guarantee of the key negotiation process, ensures the integrity and confidentiality of the information, and improves the security level of the overall communication.

[0077] For example, in an online banking transaction system, a customer (initiator) wants to establish a secure connection with a bank server (responder) to exchange sensitive information. First, the bank server provides the customer with a target key, a negotiation mode, and multiple encryption level information. The customer selects the highest level of encryption level based on the information, encrypts the corresponding public key based on the provided target key, and then sends the encrypted public key ciphertext back to the bank server. After receiving the public key ciphertext, the bank server decrypts it based on the negotiation mode and the target key to obtain the public key. Then, the bank server encrypts the session key using the public key to generate the session key ciphertext, and further encrypts the session key ciphertext based on the negotiation mode and the target key to generate the target ciphertext. Finally, the bank server sends the target ciphertext to the customer, so that both parties can perform subsequent encrypted communication based on the commonly determined security parameters. In this way, not only the security of transaction information is enhanced, but also the trust of users for online services is improved.

[0078] In one embodiment of the present disclosure, the target key, the negotiation mode and the multiple encryption level information sent by the responder are received, including: receiving a key negotiation response message from the responder, wherein the key negotiation response message includes a key exchange field, a negotiation mode field and a security proposal field; after receiving the key negotiation response message from the responder, the method further includes: parsing the target key, the negotiation mode and the multiple encryption level information from the key exchange field, the negotiation mode field and the security proposal field, respectively.

[0079] In this embodiment, the process of receiving the target key, negotiation mode and multiple encryption level information sent by the responder is achieved by analyzing the key negotiation response message provided by the responder. First, the initiator receives the key negotiation response message containing the key exchange field, negotiation mode field and security proposal field. Then, the target key, negotiation mode and multiple encryption level information are parsed from the three fields respectively. Through the above technical means, the accuracy and efficiency of information parsing are enhanced, the flexibility and security in the key negotiation process are improved, and the ability to cope with different security requirements is improved.

[0080] In one embodiment, in addition to directly parsing the key negotiation response message sent by the responder, the target key, negotiation mode and multiple encryption level information can be obtained through a pre-shared security protocol configuration file. The specific implementation is that the initiator and the responder agree on a set of security protocol configuration files in advance, and when key negotiation is needed, both parties automatically select the appropriate target key, negotiation mode and encryption level information according to the configuration file, without additional key negotiation response message transmission. This method can also enhance the security and efficiency of the key negotiation process, while improving the flexibility and adaptability of the system. In this case, even in the case of an unsatisfactory network environment, the smooth progress of key negotiation can be effectively guaranteed.

[0081] In one embodiment of the present disclosure, sending the target key, negotiation mode and multiple encryption level information to the initiator includes sending a key negotiation response message to the initiator, wherein the key negotiation response message includes a key exchange field, a negotiation mode field and a security proposal field; before sending the key negotiation response message to the initiator, the method further includes: packing the target key, negotiation mode and multiple encryption level information into the key exchange field, negotiation mode field and security proposal field respectively to obtain the key negotiation response message.

[0082] In this embodiment, the process of sending the target key, negotiation mode and multiple encryption level information to the initiator is achieved by constructing and sending a key negotiation response message to the initiator. First, the responder encapsulates the target key, negotiation mode and multiple encryption level information into the key exchange field, negotiation mode field and security proposal field of the key negotiation response message respectively, thereby forming a complete key negotiation response message. Through the above technical means, the structuring and standardization of information organization are enhanced, the interoperability between different systems is improved, and the security and efficiency of the key negotiation process are improved.

[0083] Figure 4 A flowchart of a key negotiation method in a splicing mode in an embodiment of the present disclosure is shown, which is applied to an initiator, as shown in Figure 4 The method includes the following steps:

[0084] When the negotiation mode is the splicing mode:

[0085] S401, encrypt the public keys corresponding to various encryption level information using the target key to obtain public key ciphertexts corresponding to various encryption level information;

[0086] S402, send the public key ciphertexts corresponding to various encryption level information to the responder, so that the responder generates target ciphertexts corresponding to various encryption level information based on the public key ciphertexts corresponding to various encryption level information;

[0087] S403, receive the target ciphertexts corresponding to various encryption level information, and decrypt the target ciphertexts corresponding to various encryption level information using the target key to obtain session key ciphertexts corresponding to various encryption level information;

[0088] S404, decrypt the session key ciphertexts corresponding to various encryption level information using the public keys corresponding to various encryption level information to obtain session keys corresponding to various encryption level information.

[0089] When the negotiation mode is the splicing mode, first, the public keys corresponding to various encryption level information are encrypted using the target key to obtain public key ciphertexts corresponding to various encryption level information, which enhances the security of the public keys in the transmission process and ensures that they will not be tampered with or stolen in the transmission process. Send these public key ciphertexts to the responder. Then, receive the target ciphertexts corresponding to various encryption level information from the responder, and decrypt them using the target key to obtain session key ciphertexts corresponding to various encryption level information, which further strengthens the mutual authentication mechanism in the key negotiation process, ensures the authenticity of the identities of the two parties in communication, and improves the security of the entire key exchange process. Finally, the session key ciphertexts are decrypted using the public keys corresponding to various encryption level information to obtain session keys corresponding to various encryption level information, which ensures the freshness and uniqueness of the session keys and improves the security of the communication.

[0090] For example: In an online banking transaction system, a client (initiator) and a bank server (responder) need to establish a secure connection to exchange sensitive information. When the negotiation mode is splicing mode, the client first encrypts the public keys corresponding to the selected multiple encryption level information using the target key received from the bank server to form public key ciphertexts, and sends them back to the bank server. The bank server generates target ciphertexts based on the received public key ciphertexts and returns them to the client. The client decrypts the received target ciphertexts to obtain session key ciphertexts, and further decrypts them using the previously selected public keys to finally obtain the session keys used to protect the communication between the client and the bank. In this way, not only the security of transaction information is enhanced, but also the trust of users for online services is improved.

[0091] Figure 5 A flow chart of a key agreement method in another splicing mode in the embodiments of the present disclosure is shown, which is applied to the responder, as shown in Figure 5 The method comprises the following steps:

[0092] When the negotiation mode is the splicing mode:

[0093] S501, decrypt the public key ciphertext corresponding to each encryption level information by using the target key, to obtain the public key corresponding to each encryption level information;

[0094] S502, encrypt the session key corresponding to each encryption level information by using the public key corresponding to each encryption level information, to obtain the session key ciphertext corresponding to each encryption level information;

[0095] S503, encrypt the session key ciphertext corresponding to each encryption level information by using the target key, to obtain the target ciphertext corresponding to each encryption level information;

[0096] S504, send the target ciphertext corresponding to each encryption level information to the initiator.

[0097] When the negotiation mode is the splicing mode, first, the responder decrypts the received public key ciphertext corresponding to each encryption level information by using the target key, to restore the original public key corresponding to each encryption level information, which enhances the security of the public key in the transmission process and ensures that it will not be tampered with or stolen in the transmission process. Next, the restored public keys are used to encrypt the session keys corresponding to each encryption level information, to generate the session key ciphertext corresponding to each encryption level information, which improves the security of the session key and ensures that it will not be obtained by an unauthorized third party before being transmitted to the initiator. Subsequently, the target key is used to encrypt the session key ciphertext again, to form the target ciphertext corresponding to each encryption level information, which further enhances the security mechanism of the entire key agreement process, ensures the integrity and confidentiality of the information, and improves the trust between the two communicating parties.

[0098] In one embodiment of the present disclosure, after receiving the target key, the negotiation mode and the plurality of encryption level information sent by the responder, the method further comprises: when the negotiation mode is the cascade mode: updating the target key in each interaction, obtaining the session key corresponding to each encryption level information through multiple interactions with the responder, wherein each interaction is used to negotiate the session key corresponding to one encryption level information; wherein each interaction comprises: encrypting the public key corresponding to the encryption level information using the target key to obtain the public key ciphertext corresponding to the encryption level information; sending the public key ciphertext corresponding to the encryption level information to the responder, so that the responder generates the target ciphertext corresponding to the encryption level information based on the public key ciphertext corresponding to the encryption level information; receiving the target ciphertext corresponding to the encryption level information, decrypting the target ciphertext corresponding to the encryption level information using the target key to obtain the session key ciphertext corresponding to the encryption level information; and decrypting the session key ciphertext corresponding to the encryption level information using the public key corresponding to the encryption level information to obtain the session key corresponding to the encryption level information.

[0099] When the negotiation mode is the cascade mode, the target key is updated using the exclusive or value of the target key and the session key negotiated in each interaction. The session keys corresponding to various encryption level information are negotiated through multiple interactions with the responder. Specifically, the public key corresponding to the selected encryption level information is first encrypted using the current target key to obtain the public key ciphertext corresponding to the encryption level information, and the public key ciphertext corresponding to the encryption level information is sent to the responder. Through the above technical means, the security of each interaction is enhanced, and the confidentiality and integrity of data transmission are ensured.

[0100] Next, the target ciphertext corresponding to the encryption level information is received, and the updated target key is used to decrypt it to obtain the session key ciphertext corresponding to the encryption level information, and the public key corresponding to the encryption level information is used to decrypt the session key ciphertext to obtain the session key corresponding to the encryption level information. Through the above technical means, the dynamic nature and security in the key negotiation process are enhanced, and the ability to cope with complex network environments is improved.

[0101] For example, in an online banking transaction system, a secure connection needs to be established between a client (initiator) and a bank server (responder) for the exchange of sensitive information. For example, in the first interaction, the client encrypts the public key corresponding to the first encryption level information with the initial target key, forms the public key ciphertext and sends it to the bank server. The bank server generates the target ciphertext according to the received public key ciphertext and returns it to the client. The client decrypts the received target ciphertext to obtain the session key ciphertext, and further decrypts it using the public key corresponding to the first encryption level information selected before, to finally obtain the session key corresponding to the first encryption level information. The target key is updated using the exclusive or value of the target key and the session key negotiated in this interaction. Subsequently, in the second interaction, the above process is repeated, and so on, until the session keys corresponding to all selected encryption level information are negotiated. In this way, not only the security of transaction information is enhanced, but also the trust of users for online services is improved.

[0102] In an embodiment of the present disclosure, after receiving the public key ciphertext corresponding to various encryption level information from the initiator, the method further comprises: when the negotiation mode is the cascading mode: updating the target key at each interaction, negotiating the session keys corresponding to various encryption level information through multiple interactions with the initiator, wherein each interaction is used to negotiate the session key corresponding to one encryption level information; wherein each interaction comprises: decrypting the public key ciphertext corresponding to the encryption level information with the target key to obtain the public key corresponding to the encryption level information; encrypting the session key corresponding to the encryption level information with the public key corresponding to the encryption level information to obtain the session key ciphertext corresponding to the encryption level information; encrypting the session key ciphertext corresponding to the encryption level information with the target key to obtain the target ciphertext corresponding to the encryption level information; sending the target ciphertext corresponding to the encryption level information to the initiator.

[0103] When the negotiation mode is the cascade mode, in each interaction, the target key is updated by the exclusive or value of the target key and the session key negotiated in the interaction. The session key corresponding to each encryption level information is negotiated through multiple interactions with the initiator. Specifically, the received public key ciphertext corresponding to the encryption level information is decrypted using the current target key to obtain the original public key corresponding to the encryption level information, which enhances the security of public key transmission and ensures that it will not be tampered with or stolen during transmission. Next, the public key corresponding to the encryption level information is used to encrypt the session key corresponding to the encryption level information to generate the session key ciphertext corresponding to the encryption level information. This technical means improves the security of the session key and ensures that it will not be obtained by an unauthorized third party before being sent to the initiator. Subsequently, the session key ciphertext corresponding to the encryption level information is encrypted again using the updated target key to form the target ciphertext corresponding to the encryption level information, further strengthening the security mechanism of the entire key negotiation process, ensuring the integrity and confidentiality of the information, and improving the trust between the two communicating parties.

[0104] Figure 6 A flowchart of a key negotiation method in a cascade mode in an embodiment of the present disclosure is shown, which is applied to an initiator, such as Figure 6 As shown, the method comprises the following steps:

[0105] When the negotiation mode is the cascade mode, the following loop is executed:

[0106] S601, determining whether i is greater than N, where i represents the serial number of the encryption level information, the initial value of i is 1, and N represents the number of encryption level information;

[0107] S602, if i is greater than N, the loop is exited;

[0108] S603, if i is less than or equal to N, the public key corresponding to the i-th encryption level information is encrypted using the target key to obtain the public key ciphertext corresponding to the i-th encryption level information;

[0109] S604, the public key ciphertext corresponding to the i-th encryption level information is sent to the responder, so that the responder generates the target ciphertext corresponding to the i-th encryption level information based on the public key ciphertext corresponding to the i-th encryption level information;

[0110] S605, receiving the target ciphertext corresponding to the i-th encryption level information, and decrypting the target ciphertext corresponding to the i-th encryption level information using the target key to obtain the session key ciphertext corresponding to the i-th encryption level information;

[0111] S606, decrypt the session key corresponding to the i-th encryption level information using the public key corresponding to the i-th encryption level information to obtain the session key corresponding to the i-th encryption level information;

[0112] S607, update the target key using the exclusive or value of the target key and the session key corresponding to the i-th encryption level information, and update i with i+1.

[0113] i represents the serial number of the encryption level information currently being processed, and N represents the total number of encryption level information.

[0114] When the negotiation mode is the cascade mode, the initiator enters a loop processing flow after receiving the target key, the negotiation mode, and multiple encryption level information. The loop sequentially performs key negotiation operations according to the serial numbers of the encryption level information (from 1 to N). First, it is judged whether the serial number i of the current encryption level information is greater than the total number N of encryption level information. If i is greater than N, it means that the negotiation of all session keys has been completed, and the loop is exited. Otherwise, the i-th encryption level information is processed.

[0115] For the i-th encryption level information, the initiator encrypts the public key corresponding to the encryption level information using the current target key to generate the public key ciphertext corresponding to the i-th encryption level information, enhancing the security of public key transmission and ensuring that it will not be tampered with or stolen during transmission. Then, the generated public key ciphertext corresponding to the i-th encryption level information is sent to the responder, and the target ciphertext corresponding to the i-th encryption level information is received from the responder. The current target key is used to decrypt it to obtain the session key ciphertext corresponding to the i-th encryption level information. Then, the session key ciphertext is decrypted using the public key corresponding to the i-th encryption level information to obtain the session key corresponding to the i-th encryption level information. Finally, the current target key and the session key corresponding to the i-th encryption level information are bitwise XORed, and the result is used as the new target key. i is updated with i+1, and the next loop is entered. Through the above technical means, the target key is dynamically updated, the security in the key negotiation process is enhanced, and the risk of key leakage is reduced.

[0116] For example: In an online banking transaction system, a client (initiator) and a bank server (responder) need to establish a secure connection to exchange sensitive information. When the cascade mode is used, the two parties agree to have 3 encryption level information (i.e. N=3). After receiving the target key, the negotiation mode, and the three encryption level information, the client starts to execute the loop processing flow.

[0117] In the first cycle, the client checks whether i=1 is less than or equal to N=3. Since the condition is true, the client encrypts the public key corresponding to the first encryption level information with the current target key, generates the public key ciphertext corresponding to the first encryption level information, and sends it to the bank server. The bank server generates the target ciphertext according to the received public key ciphertext and returns it to the client. The client decrypts the received target ciphertext to obtain the session key ciphertext, and further decrypts it using the public key corresponding to the first encryption level information, and finally obtains the session key corresponding to the first encryption level information. Subsequently, the client updates the target key using the exclusive or value of the current target key and the session key corresponding to the first encryption level information, and updates i to 2, entering the second cycle.

[0118] Figure 7 A flowchart of a key agreement method in another cascade mode in the embodiments of the present disclosure is shown, which is applied to the responder, as shown in Figure 7 The method comprises the following steps:

[0119] When the negotiation mode is the cascade mode, the following cycle is performed:

[0120] S701, determining whether i is greater than N, wherein i represents the serial number of the encryption level information, the initial value of i is 1, and N represents the number of the encryption level information;

[0121] S702, if i is greater than N, exiting the cycle;

[0122] S703, if i is less than or equal to N, decrypting the public key ciphertext corresponding to the i-th encryption level information with the target key to obtain the public key corresponding to the i-th encryption level information;

[0123] S704, encrypting the session key corresponding to the i-th encryption level information with the public key corresponding to the i-th encryption level information to obtain the session key ciphertext corresponding to the i-th encryption level information;

[0124] S705, encrypting the session key ciphertext corresponding to the i-th encryption level information with the target key to obtain the target ciphertext corresponding to the i-th encryption level information;

[0125] S706, sending the target ciphertext corresponding to the i-th encryption level information to the initiator;

[0126] S707, updating the target key with the exclusive or value of the target key and the session key corresponding to the i-th encryption level information, and updating i with the value of i+1.

[0127] Through the above technical means, the target key is dynamically updated, the security in the key agreement process is enhanced, and the risk of key leakage is reduced.

[0128] In one embodiment of the present disclosure, after the session key corresponding to each encryption level information is decrypted by using the public key corresponding to the encryption level information, the method further comprises: generating a target session key based on the target key and the session key corresponding to each encryption level information; and performing encryption in the interaction with the responder by using the target session key.

[0129] After the session key corresponding to each encryption level information is generated, the initiator can splice or perform some encryption operation (such as a hash function or an exclusive or operation) on the target key and the session key corresponding to each encryption level information to obtain a target session key. Subsequently, the initiator performs encryption in the interaction with the responder by using the target session key. Through the above technical means, the practical application ability of the key agreement result is enhanced, and the overall security of the communication is improved.

[0130] In one embodiment of the present disclosure, after the target ciphertext corresponding to each encryption level information is sent to the initiator, the method further comprises: generating a target session key based on the target key and the session key corresponding to each encryption level information; and performing encryption in the interaction with the initiator by using the target session key.

[0131] Through the above technical means, the practical application ability of the key agreement result is enhanced, the overall security of the communication is improved, and the trust degree of the user experience is improved.

[0132] Figure 8 A flowchart of a method for confirming encryption level information in an embodiment of the present disclosure is shown, which is applied to a responder, as shown in Figure 8 The method comprises the following steps:

[0133] S801, receiving a key agreement request message from an initiator;

[0134] S802, determining multiple encryption level information from a key encapsulation mechanism list in a security proposal field of the key agreement request message.

[0135] The key encapsulation mechanism list contains multiple encryption level information determined by the initiator, and the responder selects encryption algorithms and security levels supported by the responder from the key encapsulation mechanism list to obtain multiple encryption level information determined by the responder. Through the above technical means, the adaptability of the negotiated key is enhanced.

[0136] In one embodiment, the key agreement request message further comprises a key exchange field and a negotiation mode field.

[0137] The initiator indicates the selected target key in the key exchange field in the key agreement request message. The responder indicates the confirmation of using the target key in the key exchange field in the key agreement response message. The initiator indicates the selected negotiation mode in the negotiation mode field in the key agreement request message. The responder indicates the confirmation of using the negotiation mode in the negotiation mode field in the key agreement response message.

[0138] Based on the same inventive concept, the disclosure embodiments also provide a key agreement device, as follows. Since the principles of the device embodiments for solving problems are similar to the above-mentioned method embodiments, the implementation of the device embodiments can be referred to the implementation of the above-mentioned method embodiments, and the repeated parts will not be described here.

[0139] Figure 9 A schematic diagram of a key agreement device in the disclosure embodiments is shown, which is applied to the initiator, as shown in the figure, the key agreement device can include: Figure 9

[0140] The receiving module 901 is configured to receive the target key, the negotiation mode and the multiple encryption level information sent by the responder, wherein each encryption level information includes an encryption algorithm category and a security level;

[0141] The first encryption module 902 is configured to determine the public key corresponding to each encryption level information, and encrypt the public key corresponding to each encryption level information based on the negotiation mode and the target key to obtain the public key ciphertext corresponding to each encryption level information;

[0142] The first sending module 903 is configured to send the public key ciphertext corresponding to each encryption level information to the responder, so that the responder generates the target ciphertext corresponding to each encryption level information based on the public key ciphertext corresponding to each encryption level information;

[0143] The first decryption module 904 is configured to receive the target ciphertext corresponding to each encryption level information sent by the responder, and decrypt the target ciphertext corresponding to each encryption level information based on the negotiation mode and the target key to obtain the session key ciphertext corresponding to each encryption level information;

[0144] The second decryption module 905 is configured to decrypt the session key ciphertext corresponding to each encryption level information by using the public key corresponding to each encryption level information to obtain the session key corresponding to each encryption level information.

[0145] ​In some embodiments, the receiving module 901 is further configured to receive a key agreement response message from the responder, wherein the key agreement response message comprises a key exchange field, a negotiation mode field and a security proposal field; after receiving the key agreement response message from the responder, the method further comprises parsing the target key, the negotiation mode and the multiple encryption level information from the key exchange field, the negotiation mode field and the security proposal field respectively.

[0146] In some embodiments, the first encryption module 902 is further configured to, when the negotiation mode is the concatenation mode: encrypt the public key corresponding to each encryption level information using the target key to obtain the public key ciphertext corresponding to each encryption level information; send the public key ciphertext corresponding to each encryption level information to the responder, so that the responder generates the target ciphertext corresponding to each encryption level information based on the public key ciphertext corresponding to each encryption level information; receive the target ciphertext corresponding to each encryption level information, and decrypt the target ciphertext corresponding to each encryption level information using the target key to obtain the session key ciphertext corresponding to each encryption level information; and decrypt the session key ciphertext corresponding to each encryption level information using the public key corresponding to each encryption level information to obtain the session key corresponding to each encryption level information.

[0147] In some embodiments, the first encryption module 902 is further configured to, when the negotiation mode is the concatenation mode: update the target key at each interaction, and obtain the session key corresponding to each encryption level information through multiple interactions with the responder, wherein each interaction is used to negotiate the session key corresponding to one encryption level information; wherein each interaction comprises: encrypting the public key corresponding to the encryption level information using the target key to obtain the public key ciphertext corresponding to the encryption level information; sending the public key ciphertext corresponding to the encryption level information to the responder, so that the responder generates the target ciphertext corresponding to the encryption level information based on the public key ciphertext corresponding to the encryption level information; receiving the target ciphertext corresponding to the encryption level information, and decrypting the target ciphertext corresponding to the encryption level information using the target key to obtain the session key ciphertext corresponding to the encryption level information; and decrypting the session key ciphertext corresponding to the encryption level information using the public key corresponding to the encryption level information to obtain the session key corresponding to the encryption level information.

[0148] In some embodiments, the first encryption module 902 is further configured to, when the negotiation mode is the cascade mode, perform the following loop: determine whether i is greater than N, where i represents the serial number of the encryption level information, the initial value of i is 1, and N represents the number of the encryption level information; if i is greater than N, exit the loop; if i is less than or equal to N, encrypt the public key corresponding to the i-th encryption level information by using the target key to obtain the public key ciphertext corresponding to the i-th encryption level information; send the public key ciphertext corresponding to the i-th encryption level information to the responder, so that the responder generates the target ciphertext corresponding to the i-th encryption level information based on the public key ciphertext corresponding to the i-th encryption level information; receive the target ciphertext corresponding to the i-th encryption level information, decrypt the target ciphertext corresponding to the i-th encryption level information by using the target key to obtain the session key ciphertext corresponding to the i-th encryption level information; decrypt the session key ciphertext corresponding to the i-th encryption level information by using the public key corresponding to the i-th encryption level information to obtain the session key corresponding to the i-th encryption level information; update the target key by using the exclusive or value of the target key and the session key corresponding to the i-th encryption level information, and update i by using the value of i plus 1.

[0149] In some embodiments, the second decryption module 905 is further configured to generate a target session key based on the target key and the session keys corresponding to various encryption level information; and perform encryption in the interaction with the responder by using the target session key.

[0150] Figure 10 A schematic diagram of another key negotiation device in the embodiments of the present disclosure is shown, which is applied to a responder, as shown in the figure, the key negotiation device can include: Figure 10

[0151] The second sending module 1001 is configured to send the target key, the negotiation mode and the multiple encryption level information to the initiator, so that the initiator generates the public key ciphertext corresponding to various encryption level information based on the target key, the negotiation mode and the multiple encryption level information, wherein each encryption level information includes one encryption algorithm category and one security level;

[0152] The third decryption module 1002 is configured to receive the public key ciphertext corresponding to various encryption level information from the initiator, decrypt the public key ciphertext corresponding to various encryption level information based on the negotiation mode and the target key to obtain the public key corresponding to various encryption level information;

[0153] The second encryption module 1003 is configured to encrypt the session key corresponding to various encryption level information by using the public key corresponding to various encryption level information to obtain the session key ciphertext corresponding to various encryption level information;

[0154] ​The third encryption module 1004 is configured to encrypt the session key ciphertext corresponding to various encryption level information based on the negotiation mode and the target key to obtain target ciphertext corresponding to various encryption level information;

[0155] The third sending module 1005 is configured to send the target ciphertext corresponding to various encryption level information to the initiator.

[0156] In some embodiments, the second sending module 1001 is further configured to send a key negotiation response message to the initiator, wherein the key negotiation response message includes a key exchange field, a negotiation mode field and a security proposal field; before sending the key negotiation response message to the initiator, the method further includes: packing the target key, the negotiation mode and the multiple encryption level information into the key exchange field, the negotiation mode field and the security proposal field respectively to obtain the key negotiation response message.

[0157] In some embodiments, the third decryption module 1002 is further configured to, when the negotiation mode is the splicing mode: decrypt the public key ciphertext corresponding to various encryption level information by using the target key to obtain the public key corresponding to various encryption level information; encrypt the session key corresponding to various encryption level information by using the public key corresponding to various encryption level information to obtain the session key ciphertext corresponding to various encryption level information; encrypt the session key ciphertext corresponding to various encryption level information by using the target key to obtain the target ciphertext corresponding to various encryption level information; and send the target ciphertext corresponding to various encryption level information to the initiator.

[0158] In some embodiments, the third decryption module 1002 is further configured to, when the negotiation mode is the cascading mode: update the target key at each interaction, and negotiate the session key corresponding to various encryption level information through multiple interactions with the initiator, wherein each interaction is used to negotiate the session key corresponding to one encryption level information; wherein each interaction includes: decrypting the public key ciphertext corresponding to the encryption level information by using the target key to obtain the public key corresponding to the encryption level information; encrypting the session key corresponding to the encryption level information by using the public key corresponding to the encryption level information to obtain the session key ciphertext corresponding to the encryption level information; encrypting the session key ciphertext corresponding to the encryption level information by using the target key to obtain the target ciphertext corresponding to the encryption level information; and sending the target ciphertext corresponding to the encryption level information to the initiator.

[0159] In some embodiments, the third decryption module 1002 is further configured to perform the following loop when the negotiation mode is the cascaded mode: judging whether i is greater than N, where i represents the serial number of the encryption level information, the initial value of i is 1, and N represents the number of the encryption level information; if i is greater than N, exiting the loop; if i is less than or equal to N, decrypting the public key ciphertext corresponding to the i-th encryption level information by using the target key to obtain the public key corresponding to the i-th encryption level information; encrypting the session key corresponding to the i-th encryption level information by using the public key corresponding to the i-th encryption level information to obtain the session key ciphertext corresponding to the i-th encryption level information; encrypting the session key ciphertext corresponding to the i-th encryption level information by using the target key to obtain the target ciphertext corresponding to the i-th encryption level information; sending the target ciphertext corresponding to the i-th encryption level information to the initiator; and updating the target key by using the exclusive or value of the target key and the session key corresponding to the i-th encryption level information, and updating i by using the value of i+1.

[0160] In some embodiments, the second sending module 1001 is further configured to receive the key negotiation request message from the initiator; and determine the multiple encryption level information from the key encapsulation mechanism list in the security proposal field of the key negotiation request message.

[0161] Those skilled in the art can understand that various aspects of the present disclosure can be implemented as a system, a method or a program product. Therefore, various aspects of the present disclosure can be embodied as a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation combined with hardware and software aspects, which can be collectively referred to as "circuitry", "module" or "system" here.

[0162] The electronic device 1100 according to this implementation form of the present disclosure will be described below with reference to Figure 11 . Figure 11 The electronic device 1100 shown is merely an example, and should not bring any limitation to the functions and use range of the embodiments of the present disclosure.

[0163] As shown in Figure 11 , the electronic device 1100 is in the form of a general computing device. The components of the electronic device 1100 can include, but are not limited to, the above-mentioned at least one processing unit 1110, the above-mentioned at least one storage unit 1120, and the bus 1130 connecting different system components (including the storage unit 1120 and the processing unit 1110).

[0164] The storage unit stores program codes which can be executed by the processing unit 1110, so that the processing unit 1110 performs steps described in the above “Exemplary Methods” section according to various exemplary embodiments of the present disclosure. For example, the processing unit 1110 can perform the following steps of the above method embodiments: receiving the target key, the negotiation mode and the plurality of encryption level information sent by the responder, wherein each encryption level information comprises an encryption algorithm category and a security level; obtaining the public key corresponding to each encryption level information, encrypting the public key corresponding to each encryption level information based on the negotiation mode and the target key to obtain the public key ciphertext corresponding to each encryption level information; sending the public key ciphertext corresponding to each encryption level information to the responder, so that the responder generates the target ciphertext corresponding to each encryption level information based on the public key ciphertext corresponding to each encryption level information; receiving the target ciphertext corresponding to each encryption level information sent by the responder, decrypting the target ciphertext corresponding to each encryption level information based on the negotiation mode and the target key to obtain the session key ciphertext corresponding to each encryption level information; and decrypting the session key ciphertext corresponding to each encryption level information using the public key corresponding to each encryption level information to obtain the session key corresponding to each encryption level information.

[0165] The processing unit 1110 can also perform the following steps of the above method embodiments: sending the target key, the negotiation mode and the plurality of encryption level information to the initiator, so that the initiator generates the public key ciphertext corresponding to each encryption level information based on the target key, the negotiation mode and the plurality of encryption level information, wherein each encryption level information comprises an encryption algorithm category and a security level; receiving the public key ciphertext corresponding to each encryption level information from the initiator, decrypting the public key ciphertext corresponding to each encryption level information based on the negotiation mode and the target key to obtain the public key corresponding to each encryption level information; encrypting the session key corresponding to each encryption level information using the public key corresponding to each encryption level information to obtain the session key ciphertext corresponding to each encryption level information; encrypting the session key ciphertext corresponding to each encryption level information based on the negotiation mode and the target key to obtain the target ciphertext corresponding to each encryption level information; and sending the target ciphertext corresponding to each encryption level information to the initiator.

[0166] The storage unit 1120 can include a readable medium in the form of a volatile storage unit, such as a random access memory (RAM) 11201 and / or a cache memory 11202, and can further include a read-only memory (ROM) 11203.

[0167] Storage unit 1120 may also include a program / utility 11204 having a set (at least one) program module 11205, such program module 11205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0168] Bus 1130 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0169] Electronic device 1100 can also communicate with one or more external devices 1140 (e.g., keyboard, pointing device, Bluetooth device, etc.), negotiate keys that enable a user to interact with electronic device 1100, and / or communicate with any device that enables electronic device 1100 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1150. Furthermore, electronic device 1100 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1160. As shown, network adapter 1160 communicates with other modules of electronic device 1100 via bus 1130. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1100, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0170] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0171] In the disclosed exemplary embodiments, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium.

[0172] In some possible implementation manners, various aspects of the present disclosure can also be implemented as a program product, including a program code, which, when run on a terminal device, is used to cause the terminal device to perform the steps described in the above “specific implementation” section according to various exemplary embodiments of the present disclosure.

[0173] More specific examples of the computer readable storage medium in the present disclosure can include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination of the foregoing.

[0174] In the present disclosure, the computer readable storage medium can include a data signal carried in the baseband or as a part of a carrier wave, in which readable program codes are borne. Such a propagated data signal can take multiple forms, including but not limited to electro-magnetic signal, optical signal, or any appropriate combination of the foregoing. The readable signal medium can also be any readable medium that can be used to carry or store program codes for use by or in connection with an instruction execution system, apparatus or device.

[0175] Optionally, the program codes contained in the computer readable storage medium can be transmitted by any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any appropriate combination of the foregoing.

[0176] In the implementation, the program codes for performing the operations of the present disclosure can be written in any combination of one or more programming languages, including an object-oriented programming language, such as Java, C++, etc., and a conventional procedural programming language, such as the “C” language or similar programming languages. The program codes can be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case involving a remote computing device, the remote computing device can be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, connected to the Internet through an Internet service provider).

[0177] The embodiment of the present disclosure provides a computer program product or computer program, the computer program product or computer program includes computer instructions stored in a computer readable storage medium. The processor of the computer equipment reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer equipment executes the key negotiation method provided in any embodiment of the present disclosure in various optional modes.

[0178] It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, such division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into modules or units embodied by multiple modules or units.

[0179] In addition, although the steps of the method in the present disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired result. In addition or alternatively, some steps can be omitted, multiple steps can be combined into one step, and / or one step can be divided into multiple steps, etc.

[0180] Through the description of the above embodiments, those skilled in the art can easily understand that the example embodiments described herein can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or network, including a plurality of instructions to make a computing device (which can be a personal computer, server, mobile terminal, or network device, etc.) execute the method according to the embodiments of the present disclosure.

[0181] Other embodiments of the present disclosure will be apparent to those skilled in the art with the disclosure herein. The present disclosure is intended to cover any variations, uses, or adaptations of the present disclosure following, in general, the principles of the present disclosure and including such departures from the present disclosure that come within known or customary practice in the art to which the present disclosure pertains. The specification and drawings should be considered exemplary only, with the true scope of the disclosure being indicated by the appended claims.

Claims

1. A key negotiation method, applied to the initiator, characterized in that, include: The receiver sends the target key, negotiation mode, and multiple encryption level information, where each encryption level information includes an encryption algorithm category and a security level. Obtain the public key corresponding to each encryption level information, and encrypt the public key corresponding to each encryption level information based on the negotiation mode and the target key to obtain the public key ciphertext corresponding to each encryption level information. The public key ciphertexts corresponding to various encryption levels are sent to the respondent so that the respondent can generate target ciphertexts corresponding to various encryption levels based on the public key ciphertexts corresponding to various encryption levels. Receive the target ciphertext corresponding to various encryption level information sent by the responder, and decrypt the target ciphertext corresponding to various encryption level information based on the negotiation mode and the target key to obtain the session key ciphertext corresponding to various encryption level information; By using the public key corresponding to each encryption level, the ciphertext of the session key corresponding to each encryption level is decrypted to obtain the session key corresponding to each encryption level.

2. The method according to claim 1, characterized in that, The process of receiving the target key, negotiation mode, and multiple encryption level information sent by the responding party includes: receiving a key negotiation response message from the responding party, wherein the key negotiation response message includes a key exchange field, a negotiation mode field, and a security proposal field; After receiving the key negotiation response message from the responding party, the method further includes: parsing the target key, the negotiation mode, and multiple encryption level information from the key exchange field, the negotiation mode field, and the security proposal field, respectively.

3. The method according to claim 1, characterized in that, After receiving the target key, negotiation mode, and multiple encryption levels sent by the responding party, the method further includes: When the negotiation mode is the splicing mode: The target key is used to encrypt the public key corresponding to each encryption level information to obtain the public key ciphertext corresponding to each encryption level information. The public key ciphertexts corresponding to various encryption levels are sent to the respondent so that the respondent can generate target ciphertexts corresponding to various encryption levels based on the public key ciphertexts corresponding to various encryption levels. Receive target ciphertexts corresponding to various encryption levels, and use the target key to decrypt the target ciphertexts corresponding to various encryption levels to obtain session key ciphertexts corresponding to various encryption levels. By using the public key corresponding to each encryption level, the ciphertext of the session key corresponding to each encryption level is decrypted to obtain the session key corresponding to each encryption level.

4. The method according to claim 1, characterized in that, After receiving the target key, negotiation mode, and multiple encryption levels sent by the responding party, the method further includes: When the negotiation mode is a cascading mode: The target key is updated during each interaction. Through multiple interactions with the responder, session keys corresponding to various encryption levels are obtained. Each interaction is used to negotiate a session key corresponding to an encryption level. Each interaction includes: The target key is used to encrypt the public key corresponding to the encryption level information to obtain the public key ciphertext corresponding to the encryption level information. The public key ciphertext corresponding to the encryption level information is sent to the responder, so that the responder can generate the target ciphertext corresponding to the encryption level information based on the public key ciphertext corresponding to the encryption level information. Receive the target ciphertext corresponding to the encryption level information, and use the target key to decrypt the target ciphertext corresponding to the encryption level information to obtain the session key ciphertext corresponding to the encryption level information; The session key corresponding to the encryption level information is decrypted using the public key corresponding to the encryption level information to obtain the session key corresponding to the encryption level information.

5. The method according to claim 1, characterized in that, After receiving the target key, negotiation mode, and multiple encryption levels sent by the responding party, the method further includes: When the negotiation mode is a cascading mode, the following loop is executed: Determine if i is greater than N, where i represents the sequence number of the encryption level information, the initial value of i is 1, and N represents the number of encryption level information; If i is greater than N, then exit the loop; If i is less than or equal to N, use the target key to encrypt the public key corresponding to the i-th encryption level information to obtain the public key ciphertext corresponding to the i-th encryption level information. Send the public key ciphertext corresponding to the i-th encryption level information to the responder, so that the responder can generate the target ciphertext corresponding to the i-th encryption level information based on the public key ciphertext corresponding to the i-th encryption level information. Receive the target ciphertext corresponding to the i-th encryption level information, and use the target key to decrypt the target ciphertext corresponding to the i-th encryption level information to obtain the session key ciphertext corresponding to the i-th encryption level information; The session key corresponding to the i-th encryption level is decrypted using the public key corresponding to the i-th encryption level information to obtain the session key corresponding to the i-th encryption level information. The target key is updated using the XOR value of the target key and the session key corresponding to the i-th encryption level information, and i is updated by adding 1 to i.

6. The method according to claim 1, characterized in that, After decrypting the ciphertext of the session key corresponding to each encryption level using the public key corresponding to each encryption level to obtain the session key corresponding to each encryption level, the method further includes: Based on the target key and the session keys corresponding to various encryption levels, a target session key is generated; Encryption is performed during interactions with the responder using the target session key.

7. A key negotiation method, applied to the responding party, characterized in that, include: Send a target key, negotiation mode, and multiple encryption level information to the initiator so that the initiator can generate public key ciphertexts corresponding to various encryption level information based on the target key, the negotiation mode, and the multiple encryption level information. Each encryption level information includes an encryption algorithm category and a security level. Receive public key ciphertexts corresponding to various encryption level information from the initiator, and decrypt the public key ciphertexts corresponding to various encryption level information based on the negotiation mode and the target key to obtain the public key corresponding to various encryption level information; The session key corresponding to each encryption level is encrypted using the public key corresponding to each encryption level information to obtain the ciphertext of the session key corresponding to each encryption level information. Based on the negotiation mode and the target key, the session key ciphertext corresponding to various encryption level information is encrypted to obtain the target ciphertext corresponding to various encryption level information. The target ciphertext corresponding to various encryption levels is sent to the initiator.

8. The method according to claim 7, characterized in that, Sending the target key, negotiation mode, and multiple encryption level information to the initiator includes: sending a key negotiation response message to the initiator, wherein the key negotiation response message includes a key exchange field, a negotiation mode field, and a security proposal field; Before sending the key negotiation response message to the initiator, the method further includes: packaging the target key, the negotiation mode, and multiple encryption level information into the key exchange field, the negotiation mode field, and the security proposal field, respectively, to obtain the key negotiation response message.

9. The method according to claim 7, characterized in that, After receiving the public key ciphertext corresponding to various encryption level information from the initiator, the method further includes: When the negotiation mode is the splicing mode: The target key is used to decrypt the public key ciphertext corresponding to various encryption levels to obtain the public key corresponding to each encryption level. The session key corresponding to each encryption level is encrypted using the public key corresponding to each encryption level information to obtain the ciphertext of the session key corresponding to each encryption level information. The target key is used to encrypt the ciphertext of the session key corresponding to various encryption levels to obtain the target ciphertext corresponding to various encryption levels. The target ciphertext corresponding to various encryption levels is sent to the initiator.

10. The method according to claim 7, characterized in that, After receiving the public key ciphertext corresponding to various encryption level information from the initiator, the method further includes: When the negotiation mode is a cascading mode: The target key is updated during each interaction. Through multiple interactions with the initiator, session keys corresponding to various encryption levels are negotiated. Each interaction is used to negotiate a session key corresponding to one encryption level. Each interaction includes: The target key is used to decrypt the public key ciphertext corresponding to the encryption level information to obtain the public key corresponding to the encryption level information. The session key corresponding to the encryption level information is encrypted using the public key corresponding to the encryption level information to obtain the ciphertext of the session key corresponding to the encryption level information. The target key is used to encrypt the ciphertext of the session key corresponding to the encryption level information to obtain the target ciphertext corresponding to the encryption level information. The target ciphertext corresponding to this encryption level information is sent to the initiator.

11. The method according to claim 7, characterized in that, After receiving the public key ciphertext corresponding to various encryption level information from the initiator, the method further includes: When the negotiation mode is a cascading mode, the following loop is executed: Determine if i is greater than N, where i represents the sequence number of the encryption level information, the initial value of i is 1, and N represents the number of encryption level information; If i is greater than N, then exit the loop; If i is less than or equal to N, use the target key to decrypt the public key ciphertext corresponding to the i-th encryption level information to obtain the public key corresponding to the i-th encryption level information; Encrypt the session key corresponding to the i-th encryption level information using the public key corresponding to the i-th encryption level information to obtain the ciphertext of the session key corresponding to the i-th encryption level information. The target key is used to encrypt the session key ciphertext corresponding to the i-th encryption level information to obtain the target ciphertext corresponding to the i-th encryption level information; Send the target ciphertext corresponding to the i-th encryption level information to the initiator; The target key is updated using the XOR value of the target key and the session key corresponding to the i-th encryption level information, and i is updated by adding 1 to i.

12. The method according to claim 7, characterized in that, Before sending the target key, negotiation mode, and multiple encryption levels to the initiator, the method further includes: Receive a key negotiation request message from the initiator; Multiple encryption levels are determined from the list of key encapsulation mechanisms in the security proposal field of the key negotiation request message.

13. A key negotiation device, applied to an initiator, characterized in that, include: The receiving module is configured to receive the target key, negotiation mode, and multiple encryption level information sent by the responder, wherein each encryption level information includes an encryption algorithm category and a security level; The first encryption module is configured to determine the public key corresponding to various encryption level information, and encrypt the public key corresponding to various encryption level information based on the negotiation mode and the target key to obtain the public key ciphertext corresponding to various encryption level information. The first sending module is configured to send the public key ciphertext corresponding to various encryption level information to the responder, so that the responder can generate the target ciphertext corresponding to various encryption level information based on the public key ciphertext corresponding to various encryption level information. The first decryption module is configured to receive target ciphertexts corresponding to various encryption level information sent by the responder, and decrypt the target ciphertexts corresponding to various encryption level information based on the negotiation mode and the target key to obtain session key ciphertexts corresponding to various encryption level information. The second decryption module is configured to use the public key corresponding to each encryption level to decrypt the ciphertext of the session key corresponding to each encryption level, thereby obtaining the session key corresponding to each encryption level.

14. A key negotiation device, applied to a responding party, characterized in that, include: The second sending module is configured to send a target key, negotiation mode, and multiple encryption level information to the initiator, so that the initiator can generate public key ciphertexts corresponding to various encryption level information based on the target key, the negotiation mode, and the multiple encryption level information, wherein each encryption level information includes an encryption algorithm category and a security level. The third decryption module is configured to receive public key ciphertexts corresponding to various encryption level information from the initiator, and decrypt the public key ciphertexts corresponding to various encryption level information based on the negotiation mode and the target key to obtain the public key corresponding to various encryption level information. The second encryption module is configured to use the public key corresponding to each encryption level information to encrypt the session key corresponding to each encryption level information to obtain the ciphertext of the session key corresponding to each encryption level information. The third encryption module is configured to encrypt the session key ciphertext corresponding to various encryption level information based on the negotiation mode and the target key, so as to obtain the target ciphertext corresponding to various encryption level information. The third sending module is configured to send the target ciphertext corresponding to various encryption levels to the initiator.

15. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the method of any one of claims 1-6 or 7-12 by executing the executable instructions.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-6 or 7-12.

17. A computer program product comprising computer instructions stored in a computer-readable storage medium, wherein the computer instructions, when executed by a processor, implement the operation instructions of the method according to any one of claims 1-6 or 7-12.

Images