Encrypted communication connection establishment method and system based on cloud mobile phone and storage medium

Abstract

The invention relates to the technical field of encrypted communication, and discloses an encrypted communication connection establishment method and system based on a cloud mobile phone, and a storage medium. The method comprises the steps that a user uses client equipment to perform account registration on a cloud mobile phone platform, a user identifier is generated, an equipment authentication request is sent to the cloud mobile phone platform, and the cloud mobile phone platform generates an equipment authentication instruction; the cloud mobile phone platform transmits the session key to the client device, and the client device receives and stores the session key; the client device encrypts the encryption request and transmits the encryption request to the target end device, and the target end device receives the encryption request and then decrypts the encryption request to generate request information and establish communication connection; and after the communication connection, the cloud mobile phone platform and the client device cooperatively update the session key based on a preset time period, and if a security event occurs in the client device, the cloud mobile phone platform revokes the session key. According to the invention, the security and reliability of encrypted communication connection establishment based on the cloud mobile phone are improved.

Description

Technical Field

[0001] The present application relates to the field of encrypted communication technology, and in particular to a method, system and storage medium for establishing an encrypted communication connection based on a cloud phone. Background Art

[0002] With the rapid development of mobile internet and cloud computing technologies, traditional mobile communications face numerous challenges, such as data security, privacy protection, and cross-platform compatibility. Cloud phones, as an emerging technology, virtualize mobile phone functions in the cloud, building cloud phone platforms that provide users with more secure and flexible services. However, establishing secure and reliable encrypted communication connections within cloud phone environments remains a pressing issue.

[0003] Similar prior art includes Chinese patent application publication number CN115361237A, which discloses a data encryption transmission method and system for cloud-terminal interaction. This method encrypts the original data by processing it into one-dimensional data, then segmenting it into segments (each consisting of 128 or 512 elements), sorting the elements within each segment, and then sorting the segments based on their sequence numbers. This method then encrypts the original data and generates ciphertext data. Simultaneously, when sorting the elements within each segment, the sequence of the elements within the segment is used to generate corresponding unit images. All of these unit images are then used to generate ciphertext images, which are then transmitted to the terminal. The terminal then decrypts the ciphertext data based on the ciphertext images to obtain restored data. The terminal calculates a first hash value using the original data, and the cloud calculates a second hash value on the restored data obtained through decryption, thereby verifying the consistency of the restored data with the original data. Chinese patent application publication number CN111917688A also discloses a method, device, and system for transmitting encrypted data via a cloud platform. The method includes: sending a first part selected from a device password table to a first device, and sending a second part selected from the device password table to a second device; wherein the device password table includes several sets of keys and key identifiers, and the first part is a subset of the second part; the first device is configured to select a key from the first part so that transmitted data is converted into encrypted data containing the corresponding key identifier based on the key selected from the first part; and the second device is configured to select a corresponding key from the second part based on the key identifier in the encrypted data so that received data is converted into decrypted data based on the key selected from the second part. The beneficial effect of this technical solution is that data is encrypted and decrypted using a key, eliminating unauthorized users from viewing the data and ensuring data security.

[0004] The shortcomings of the existing technology are mainly reflected in the encryption achieved by segmenting and sorting the original data and generating unit images. Relying on the sorting of data segments and the generation of unit images, there may be a problem of insufficient encryption strength. The encryption process is mainly carried out between the first device and the second device, and there is a lack of end-to-end encryption protection. In actual situations, the encrypted communication method based on cloud phones usually adopts more complex encryption algorithms, and it is necessary to ensure that the data is always encrypted during transmission, even on the cloud platform. Summary of the Invention

[0005] The present application provides a method, system and storage medium for establishing an encrypted communication connection based on a cloud phone, which are used to improve the security and reliability of establishing an encrypted communication connection based on a cloud phone.

[0006] In a first aspect, the present application provides a method for establishing an encrypted communication connection based on a cloud phone, the method comprising: The user registers an account on the cloud phone platform using a client device and generates a user identifier. When the user logs into the account on the client device, the client device sends a device authentication request to the cloud phone platform. The cloud phone platform verifies the authenticity of the client device based on the user identifier and generates a device authentication instruction. The cloud phone platform generates a session key based on the user identifier and the device authentication instruction, and transmits the session key to the client device, and the client device receives and stores the session key; The client device encrypts the connection request using the session key to generate an encrypted request, encrypts the encrypted request and transmits it to the target device based on the communication interface of the cloud phone platform. The target device decrypts the encrypted request after receiving it, generates request information, and establishes a communication connection based on the request information. After the communication connection, the cloud phone platform and the client device jointly update the session key based on a preset time period. The cloud phone platform generates log records corresponding to all communication connections. In the log records, if a security incident occurs on the client device, the cloud phone platform revokes the session key.

[0007] In combination with the first aspect, generating a user identifier includes: The timestamp of the account registration, the device information of the client device and the serial number corresponding to the account registration are respectively obtained, and the timestamp, the device information and the serial number are combined according to a predetermined number of digits to generate the user identifier.

[0008] In combination with the first aspect, the generating of the device authentication instruction includes: hashing the user identifier using a hash function to generate a first hash value, hashing account login information using the hash function to generate a second hash value, performing an exclusive OR operation on the first hash value and the second hash value to generate an authentication initial value, and encoding the authentication initial value using an encoding function to generate a standard authentication symbol; The client device generates a first random number, performs hash processing and exclusive OR operation on the standard authentication symbol using the first random number respectively, outputs a first result, performs exclusive OR operation on the hash value of the standard authentication symbol and the hash value of the first random number, and outputs a second result. The client device sends the first result, the second result and the user identifier to the intermediate gateway node; The intermediate gateway node obtains the authentication initial value from the cloud mobile phone platform based on the user identifier, performs exclusive OR operation on the hash value of the standard authentication symbol and the first result to output a third result, and compares the hash value of the third result with the second result. If they are equal, the reliability meets the authentication, and the device authentication instruction is generated.

[0009] In combination with the first aspect, after the cloud mobile phone platform generates the device authentication instruction, it includes: The intermediate gateway node generates a second random number, performs exclusive OR operation on the authentication initial value to generate a new authentication initial value, encodes the new authentication initial value using the encoding function to generate a new standard authentication symbol, and the cloud mobile phone platform stores and records the new authentication initial value, the new standard authentication symbol and the user identifier.

[0010] In combination with the first aspect, the communication interface of the cloud mobile phone platform encrypts and transmits the encryption request to the target end device, including: The client device, the cloud mobile phone platform and the target end device all generate corresponding random numbers, combine all the random numbers to generate a public key, encrypt the encryption request using the public key, and the cloud mobile phone platform sends the encrypted encryption request as a payload to the intermediate gateway node; The intermediate gateway node sends the encrypted encryption request to the target end device, the target end device uses the public key to decode the received data, extracts the random numbers corresponding to the client device and the cloud mobile phone platform, generates a first encryption key, performs exclusive OR operation on the public key and the first encryption key to output a fourth result, and updates the public key based on the fourth result.

[0011] In combination with the first aspect, the communication connection is established based on the request information, including: After the target device generates the request information, the user starts the communication application of the client device and enters shared data, the control unit sends the shared data to the first encryption unit to generate first encrypted shared data, and the first encryption unit sends the first encrypted shared data to the control unit; The control unit associates the first encrypted shared data with the target device and sends the data to the output unit, and the output unit sends the first encrypted shared data to the target device via a network; The receiving unit of the target device receives the first encrypted shared data and sends it to the control unit. The control unit sends the first encrypted shared data to the second encryption unit. The second encryption unit encrypts the first encrypted shared data to generate second encrypted shared data and sends the second encrypted shared data to the control unit. The control unit sends the second encrypted shared data to the output unit. The output unit sends the second encrypted shared data to the client device. The receiving unit of the client device receives the second encrypted shared data and sends it to the control unit. The control unit sends the second encrypted shared data to the first decryption unit. The first decryption unit decrypts the second encrypted shared data to generate first decrypted data and sends the first decrypted data to the control unit. The control unit sends the first decrypted data to the output unit. The output unit sends the first decrypted data back to the target device. The receiving unit of the target end device receives the first decrypted data and sends the first decrypted data to the control unit. The control unit sends the first decrypted data to the second decryption unit. The second decryption unit decrypts the first decrypted data to generate second decrypted data and sends the second decrypted data to the control unit. The control unit sends the second decrypted data to the output unit, and the output unit sets the second decrypted data as plaintext shared data and displays it in the communication application; Among them, the client device includes the first encryption unit and the first decryption unit, the target device includes the second encryption unit and the second decryption unit, and the cloud phone platform includes the control unit and the output unit.

[0012] In combination with the first aspect, the collaboratively updating the session key based on a preset time period includes: The cloud phone platform generates a new key update request. After receiving the key update request, the client device verifies the legitimacy of the key update request, uses the session key as a seed, and generates a new key based on a key derivation function. The new key is encrypted using the session key and then sent to the cloud phone platform. After receiving the encrypted new key, the cloud phone platform decrypts it using the session key and verifies the validity of the new key. Based on the validity, an update confirmation message is sent to the client device and the new key is stored. After receiving the update confirmation information, the client device verifies the legitimacy of the new key, and based on the legitimacy, switches the cloud phone platform and the client device to use the new key for communication.

[0013] In combination with the first aspect, generating the encryption request includes: Obtaining public parameters of the client device, the client device randomly selecting a generator from a cyclic group, and calculating an intermediate value using a hash function, the connection request, and the generator; The encryption request is generated using the session key, the connection request, the generator, and the intermediate value summary.

[0014] In a second aspect, the present application provides a system for establishing an encrypted communication connection based on a cloud phone, the system comprising: An authentication module is used for a user to register an account on the cloud phone platform using a client device and generate a user identifier. When the user logs into the account on the client device, the client device sends a device authentication request to the cloud phone platform. The cloud phone platform verifies the authenticity of the client device based on the user identifier and generates a device authentication instruction. A session receiving module, configured for the cloud phone platform to generate a session key based on the user identifier and the device authentication instruction, and transmit the session key to the client device, where the client device receives and stores the session key; a communication connection module, configured for the client device to encrypt the connection request using the session key to generate an encrypted request, encrypt and transmit the encrypted request to the target device based on the communication interface of the cloud phone platform, and the target device to decrypt the encrypted request after receiving it, generate request information, and establish a communication connection based on the request information; The key processing module, after the communication connection, the cloud phone platform and the client device jointly update the session key based on a preset time period, and the cloud phone platform generates log records corresponding to all communication connections. In the log records, if a security incident occurs on the client device, the cloud phone platform revokes the session key.

[0015] The third aspect of the present application provides a computer-readable storage medium, which stores instructions. When the computer-readable storage medium is run on a computer, it enables the computer to execute the above-mentioned method for establishing an encrypted communication connection based on a cloud phone.

[0016] In the technical solution provided by this application, first, the client device is authenticated through the cloud phone platform. During the device authentication process, the cloud phone platform generates an authentication initial value and a standard authentication code, and verifies them through the intermediate gateway node. During the authentication process, hash functions, XOR operations, and random number generation technologies are used to ensure the security of the authentication information. After the authentication is completed, the intermediate gateway node generates a new authentication initial value and a standard authentication code, and updates and stores them. This can prevent the user identifier from being predicted or forged, improve the security of user identity authentication, ensure that only trusted devices can establish a communication connection, prevent the device from being stolen or the identity is impersonated, and regularly update the authentication information to prevent the potential risks brought about by the long-term use of the authentication information. Then, the cloud phone platform and the client device generate a session key based on the user identifier and the device authentication instruction, use a symmetric key encryption algorithm for encrypted transmission, and update it regularly. The update process uses a key derivation function and an encryption algorithm for secure processing, ensuring the efficiency of encryption and decryption. It is suitable for communications with large amounts of data, improves the security of the communication process, and prevents the key from being cracked or leaked. Finally, the client device, cloud phone platform and target device jointly generate a public key, which is composed of a combination of random numbers from each device and is hashed. The encryption request is encrypted and transmitted using the public key. After the target device receives the encryption request, it generates a first encryption key and updates the public key based on it. The public key generation mechanism ensures the unpredictability and security of the key, and the double encryption mechanism improves the security of data transmission.

[0017] This application also randomly selects a generator from the cyclic group through the client device, aggregates the session key, connection request, generator and intermediate value to generate an encryption request, which increases the complexity and security of the encryption request. After the communication connection is established, the multiple encryption mechanisms in the data interaction process further improve the security of the data, preventing the data from being stolen or tampered with during transmission. The decryption process is performed on the target device to ensure that the data is not leaked in the cloud. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0019] Figure 1 An embodiment of the method for establishing an encrypted communication connection based on a cloud phone in the embodiments of the present application; Figure 2 An embodiment of the device authentication process for generating a device authentication instruction in the embodiments of the present application; Figure 3 An embodiment of the multi-encryption and decryption process for data interaction in a communication connection in the embodiments of the present application; Figure 4 An embodiment of the system for establishing an encrypted communication connection based on a cloud phone in the embodiments of the present application. DETAILED DESCRIPTION

[0020] The embodiments of the present application provide a method and system for establishing an encrypted communication connection based on a cloud phone and a storage medium. The terms "first", "second", "third", "fourth" and the like (if any) in the specification and claims of the present application and the above drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the term "comprising" or "having" and any variation thereof is intended to cover non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0021] For the convenience of understanding, the specific process of the embodiments of the present application will be described below. Please refer to Figure 1 An embodiment of the method for establishing an encrypted communication connection based on a cloud phone in the embodiments of the present application includes: Step S101, a user uses a client device to register an account on a cloud phone platform, and generates a user identifier. When the user logs in the account on the client device, the client device sends a device authentication request to the cloud phone platform. The cloud phone platform verifies the reliability of the client device based on the user identifier, and generates a device authentication instruction.

[0022] It is understandable that the execution subject of this application can be a device for establishing an encrypted communication connection based on a cloud phone, or a terminal or a server, and the specific implementation is not limited here. The embodiment of this application is described by taking the server as the execution subject as an example.

[0023] Specifically, a client device refers to a communication device such as a smartphone or tablet. The cloud phone platform is a service model that runs a mobile operating system and applications on a cloud server, acting as an intermediary node for communication. Account registration involves providing necessary identity information, such as the client device's device information, mobile phone number, and basic user information. A user identifier is a unique identifier associated with the user, which can be stored in association with the user's provided identity information. When a user logs into a cloud phone platform account using a client device, the client device generates a device authentication request, which includes but is not limited to the user identifier, device information, a random number generated by the client device, and a timestamp. The cloud phone platform first verifies the validity of the user identifier to ensure that the user has registered and has access rights. Based on the user identifier, it then queries the device information associated with the user and compares it with the received device information to verify authenticity. If so, the client device is authentic. Otherwise, the device may have been stolen or the identity has been misused. The specific verification process is described below. If the device verification passes, the cloud phone platform generates a device authentication instruction, which includes the device authentication result, a timestamp, and other information.

[0024] Step S102: The cloud phone platform generates a session key based on the user identifier and the device authentication instruction, and transmits the session key to the client device. The client device receives and stores the session key.

[0025] Specifically, the session key can be generated using a symmetric key encryption algorithm (e.g., AES) and have a sufficient length (e.g., 256 bits) to ensure encryption and decryption efficiency. During the transmission of the session key, the session key can be encrypted, and the device authentication instruction can be signed using digital signature technology to improve the security of data transmission. The specific steps for encrypting and transmitting the session key are as follows: the cloud phone platform generates a temporary symmetric encryption key, and encrypts the temporary symmetric encryption key using the public key of the client device (e.g., RSA); the session key is divided into multiple segments (e.g., K1, K2, K3, K4), and each segment is encrypted using the temporary symmetric encryption key: C i =AES temp_key (K i ), where C iis the i-th encrypted segment, where i is an integer from 1 to 4. All encrypted segments C1, C2, C3, and C4 are concatenated into a complete encrypted data packet. The cloud phone platform sends the encrypted data packet to the client device via a secure communication channel (such as TLS). The client device receives the device authentication command and session key from the cloud phone platform, verifies the signature of the device authentication command to ensure it has not been tampered with, decrypts the session key using the cloud phone platform's public key, and stores it in a secure storage area.

[0026] Step S103: The client device uses the session key to encrypt the connection request to generate an encrypted request, and encrypts the encrypted request based on the communication interface of the cloud phone platform and transmits it to the target device. After receiving the encrypted request, the target device decrypts it, generates request information, and establishes a communication connection based on the request information.

[0027] Specifically, when a user initiates a communication connection request, the client device uses the stored session key to encrypt the connection request and generate an encrypted request. The encrypted request contains information such as the session key, the connection request, and a timestamp. The client device encrypts and transmits the encrypted request to the target device through the cloud phone platform's communication interface (e.g., API interface). The target device refers to the communication device that communicates with the client device. The encrypted transmission process will be described later. During the transmission process, the transport layer security protocol (e.g., TLS) can be used to ensure the security of data transmission. The target device verifies the validity of the request information and establishes a communication connection based on the request information.

[0028] Step S104: After the communication is connected, the cloud phone platform and the client device jointly update the session key based on a preset time period. The cloud phone platform generates log records corresponding to all communication connections. In the log records, if a security incident occurs on the client device, the cloud phone platform revokes the session key.

[0029] Specifically, collaboratively updating session keys can effectively prevent session hijacking attacks. In log records, the cloud phone platform monitors client devices for security incidents, such as jailbreaking, malware installation, and frequent abnormal login attempts. If a security incident is detected on a client device, the cloud phone platform will immediately revoke the device's session key and notify the user. After the session key is revoked, the client device will no longer be able to use the session key for communication connections. The client device will need to re-authenticate the device and obtain a new session key before it can continue to use the cloud phone platform's services.

[0030] In a specific embodiment, generating a user identifier includes: The timestamp of the account registration, the device information of the client device, and the serial number corresponding to the account registration are obtained respectively, and the timestamp, device information, and serial number are combined according to a predetermined number of digits to generate a user identifier.

[0031] Specifically, when the user starts the registration process, the cloud phone platform server will record the current system time, accurate to milliseconds or higher. This is the timestamp when the account is registered. Device information refers to information such as the device ID. When the client device initiates a registration request, it will send its device ID to the cloud phone platform. In order to enhance security, the client device can hash the device ID before sending it to prevent the device ID from being leaked. The device ID is used to associate the user identifier with a specific device. When a user registers, the cloud phone platform will generate a unique serial number for the user, which is the serial number corresponding to the account registration. The serial number ensures that even if multiple users register in a very short period of time, the uniqueness of each user identifier can be guaranteed. During the combination process, the length of each part is determined, the parts are spliced ​​together in sequence, and the combined string is encoded to generate a user identifier.

[0032] In a specific embodiment, generating a device authentication instruction includes: (1) Use a hash function to hash the user identifier to generate a first hash value, use a hash function to hash the account login information to generate a second hash value, perform an XOR operation on the first hash value and the second hash value to generate an authentication initial value, use an encoding function to encode the authentication initial value to generate a standard authentication character.

[0033] (2) The client device generates a first random number, performs a hash process and an XOR operation on the standard authenticator using the first random number, outputs a first result, performs an XOR operation on the hash value of the standard authenticator and the hash value of the first random number, outputs a second result, and the client device sends the first result, the second result and the user identifier to the intermediate gateway node.

[0034] (3) The intermediate gateway node obtains the authentication initial value from the cloud phone platform based on the user identifier, and performs an XOR operation on the hash value of the standard authenticator and the first result, outputs a third result, and compares the hash value of the third result with the second result. If they are equal, the reliability meets the authentication requirements and a device authentication instruction is generated.

[0035] Specifically, Figure 2Device authentication flow chart for generating device authentication instructions. In order to be able to conduct secure network communication from the client device to the cloud phone platform through encrypted communication without being affected by the communication means, the reliability of the client device is verified to generate a device authentication instruction. The cloud phone platform uses a predetermined hash function (for example, SHA-256) to hash the user identifier to generate a first hash value. Account login information includes information such as account login number and password, which belongs to authentication information. The initial authentication value is the unique authentication value of the client device corresponding to the user, and can be used to establish an initial encrypted communication channel between the client device and the intermediate gateway node. The standard authenticator is an encoded authentication value that serves as the local authentication credential of the client device and is used for self-authentication when needed. This mutual verification mechanism enhances the security of authentication.

[0036] The first random number generated by the client device prevents replay attacks. Both the first and second results are hash values ​​of the payload used when the client device initiates the authentication request. The intermediate gateway node is the relay gateway that establishes communication between the client device and the cloud phone platform. As an important component of the authentication process, the intermediate gateway node is responsible for verifying the information sent by the client device. Therefore, the intermediate gateway node handles the authentication request initiated by the client device.

[0037] If the third result is equal to the second result, it means that the authentication request of the cloud platform mobile phone to the client device is successful, that is, the client device is reliable, and a device authentication instruction can be generated.

[0038] In a specific embodiment, after the cloud phone platform generates a device authentication instruction, the following steps are included: The intermediate gateway node generates a second random number and performs an XOR operation with the authentication initial value to generate a new authentication initial value. The new authentication initial value is encoded using an encoding function to generate a new standard authentication character. The cloud phone platform stores and records the new authentication initial value, the new standard authentication character and the user identifier.

[0039] Specifically, the intermediate gateway node effectively prevents replay attacks by generating a new second random number and performing an XOR operation with the current authentication initial value to generate a new authentication initial value. Because a new random number is generated for each authentication, attackers cannot intercept old authentication information for repeated authentication, making the authentication information dynamic. The new authentication initial value is then encoded to generate a new standard authenticator. This step ensures the correlation between the new authentication initial value and the authentication initial value. The encoding also increases the complexity of the authenticator, making it more difficult to crack. Storage records ensure traceability of the authentication process.

[0040] In a specific embodiment, the communication interface based on the cloud phone platform encrypts and transmits the encryption request to the target end device, including: (1) The client device, cloud phone platform and target device all generate corresponding random numbers, combine all random numbers to generate a public key, use the public key to encrypt the encryption request, and the cloud phone platform sends the encrypted encryption request as a payload to the intermediate gateway node.

[0041] (2) The intermediate gateway node sends the encrypted encryption request to the target device. The target device uses the public key to decode the received data, extracts the random numbers corresponding to the client device and the cloud phone platform, and generates a first encryption key. It performs an XOR operation on the public key and the first encryption key, outputs a fourth result, and updates the public key based on the fourth result.

[0042] Specifically, during encrypted transmission, public keys are exchanged and the data contained in the encryption request is encrypted for transmission. The client device uses the public key to encrypt the previously generated encryption request, generating a doubly encrypted request. The cloud phone platform receives the doubly encrypted request from the client device and sends it as a payload to the intermediate gateway node. This can be transmitted using a secure transport protocol (e.g., TLS) to ensure data security during transmission.

[0043] The target device uses the public key to decrypt the received data, extracts the random number from the client device and the random number corresponding to the cloud phone platform, and performs an XOR operation on the extracted random number to generate a first encryption key, which is the new encryption key. The target device sends the fourth result obtained by XORing the public key and the first encryption key, along with the user identifier, to the client device, which then updates the public key based on the fourth result.

[0044] In a specific embodiment, establishing a communication connection based on the request information includes: (1) After the target device generates a request message, the user starts the communication application of the client device and inputs the shared data. The control unit sends the shared data to the first encryption unit to generate the first encrypted shared data. The first encryption unit sends the first encrypted shared data to the control unit.

[0045] (2) The control unit associates the first encrypted shared data with the target device and sends the data to the output unit. The output unit sends the first encrypted shared data to the target device via the network.

[0046] (3) The receiving unit of the target device receives the first encrypted shared data and sends it to the control unit. The control unit sends the first encrypted shared data to the second encryption unit. The second encryption unit encrypts the first encrypted shared data to generate second encrypted shared data and sends the second encrypted shared data to the control unit. The control unit sends the second encrypted shared data to the output unit. The output unit sends the second encrypted shared data to the client device.

[0047] (4) The receiving unit of the client device receives the second encrypted shared data and sends it to the control unit. The control unit sends the second encrypted shared data to the first decryption unit. The first decryption unit decrypts the second encrypted shared data to generate first decrypted data and sends the first decrypted data to the control unit. The control unit sends the first decrypted data to the output unit. The output unit sends the first decrypted data back to the target device.

[0048] (5) The receiving unit of the target end device receives the first decrypted data and sends the first decrypted data to the control unit. The control unit sends the first decrypted data to the second decryption unit. The second decryption unit decrypts the first decrypted data to generate second decrypted data and sends the second decrypted data to the control unit.

[0049] (6) The control unit sends the second decrypted data to the output unit. The output unit sets the second decrypted data as plaintext shared data and displays it in the communication application.

[0050] (7) The client device includes a first encryption unit and a first decryption unit, the target device includes a second encryption unit and a second decryption unit, and the cloud phone platform includes a control unit and an output unit.

[0051] Specifically, Figure 3 This is a flowchart for the multiple encryption and decryption processes involved in data exchange during a communication connection. The control unit coordinates the entire communication process, including data forwarding and command delivery. The output unit is responsible for sending data to the client or target device. Shared data refers to the plaintext data that the user wishes to share and transmit with the target device. The first encryption unit uses an encryption algorithm that satisfies both commutative and associative laws, such as XOR operations or circular shifts, to generate the first encrypted shared data.

[0052] The control unit of the cloud phone platform receives the first encrypted shared data, and then the output unit of the cloud phone platform forwards the data to the target terminal device.

[0053] The second encryption unit in the target device and the first encryption unit in the client device use the same encryption algorithm to encrypt the first encrypted shared data to generate second encrypted shared data.

[0054] The control unit of the cloud phone platform receives the second encrypted shared data from the target terminal device, and sends the second encrypted shared data to the output unit, which then sends the second encrypted shared data back to the client device via the network.

[0055] Using the same process and reverse decryption, the first decryption unit decrypts the second encrypted shared data using a decryption algorithm that is the inverse of the encryption algorithm used by the first encryption unit, generating the first decrypted data. Finally, the output unit sends the first decrypted data back to the target device. The second decryption unit on the target device decrypts the first decrypted data using a decryption algorithm that is the inverse of the encryption algorithm used by the second encryption unit, generating the second decrypted data (i.e., the plaintext shared data), thus completing the communication connection.

[0056] Data is encrypted twice when transmitted between the client and target devices. Even if intercepted by the cloud phone platform, the plaintext information cannot be obtained. The client and target devices must use the same encryption and decryption keys and exchange them securely, such as using the Diffie-Hellman key exchange algorithm.

[0057] In one embodiment, collaboratively updating a session key based on a preset time period includes: (1) The cloud phone platform generates a new key update request. After receiving the key update request, the client device verifies the legitimacy of the key update request, uses the session key as a seed, and generates a new key based on the key derivation function.

[0058] (2) The new key is encrypted using the session key and sent to the cloud phone platform. After receiving the encrypted new key, the cloud phone platform decrypts it using the session key and verifies the validity of the new key. Based on the validity, it sends an update confirmation message to the client device and stores the new key.

[0059] (3) After the client device receives the update confirmation information, it verifies the legitimacy of the new key and switches the cloud phone platform and the client device to use the new key for communication based on the legitimacy.

[0060] Specifically, the cloud phone platform triggers a session key update based on a preset time period (for example, every 24 hours) and generates a key update request containing an update request identifier, timestamp, and other information. The client device verifies the key update request to ensure its legitimacy, checks whether the timestamp is within a reasonable range to prevent replay attacks, and checks whether the update request identifier is unique to prevent duplicate requests. If the key update request is digitally signed, the client device can verify the validity of the signature.

[0061] The client device encrypts the new key using the current session key to generate a new encrypted key. Encryption can use a symmetric key encryption algorithm (for example, AES). Decryption uses the same symmetric key encryption algorithm used for encryption. Verifying the validity of the new key includes format verification and security verification.

[0062] The cloud phone platform sends an update confirmation message to the client device, notifying it of the successful key update. The update confirmation message includes information such as the update request identifier and a confirmation timestamp. The client device verifies the new key and compares it with the update confirmation message sent by the cloud phone platform to ensure that the new key is consistent with the new key generated by the cloud phone platform. If they are consistent, the client device replaces the current session key with the new key, encrypting communications between the client device and the cloud phone platform using the new session key.

[0063] In a specific embodiment, generating an encryption request includes: (1) Obtain the public parameters of the client device. The client device randomly selects a generator from the cyclic group and calculates the intermediate value using the hash function, the connection request, and the generator.

[0064] (2) Generate an encryption request using the session key, connection request, generator, and intermediate value summary.

[0065] Specifically, public parameters refer to a set of public, predefined parameters preconfigured on the client device or obtained from a key generation device. For example, consider a cyclic group (G, p, g), where G is the set of elements in the cyclic group, p is the order of the cyclic group, and g is the generator of the cyclic group. If the order of g is p, then the public parameters can be set to (p, g). Public parameters should be transmitted securely, such as using digital certificates for encrypted transmission, to prevent tampering. The client device randomly selects an element from the cyclic group G as the random generator g1, and the intermediate value t = H(M, g1), where H represents the hash function and M is the data corresponding to the connection request. The encryption request is a set generated by sequentially combining the session key, connection request, generator, and intermediate value. The client device sends the encryption request to the target device via the cloud phone platform's communication interface.

[0066] The above describes the method for establishing an encrypted communication connection based on a cloud phone in the embodiment of the present application. The following describes the system for establishing an encrypted communication connection based on a cloud phone in the embodiment of the present application. Figure 4 In the embodiment of the present application, an embodiment of the system for establishing an encrypted communication connection based on a cloud phone includes: Authentication module 201 is used for users to register accounts on the cloud phone platform using client devices and generate user identifiers. When the user logs in to the account on the client device, the client device sends a device authentication request to the cloud phone platform. The cloud phone platform verifies the reliability of the client device based on the user identifier and generates a device authentication instruction.

[0067] The session receiving module 202 is used for the cloud phone platform to generate a session key based on the user identifier and the device authentication instruction, and transmit the session key to the client device, which receives and stores the session key.

[0068] The communication connection module 203 is used for the client device to encrypt the connection request using the session key to generate an encrypted request, and the encrypted request is encrypted and transmitted to the target device based on the communication interface of the cloud phone platform. After receiving the encrypted request, the target device decrypts it, generates request information, and establishes a communication connection based on the request information.

[0069] Key processing module 204, after the communication connection, the cloud phone platform and the client device jointly update the session key based on a preset time period. The cloud phone platform generates log records corresponding to all communication connections. In the log records, if a security incident occurs on the client device, the cloud phone platform revokes the session key.

[0070] Through the collaborative efforts of the aforementioned components, the cloud phone platform first authenticates the client device. During device authentication, the cloud phone platform generates an initial authentication value and a standard authenticator, which are then verified by an intermediate gateway node. The authentication process utilizes hash functions, XOR operations, and random number generation techniques to ensure the security of the authentication information. After authentication is complete, the intermediate gateway node generates a new initial authentication value and standard authenticator, which are updated and stored. This prevents user identifiers from being predicted or forged, improving the security of user authentication and ensuring that only trusted devices can establish communication connections, preventing device theft or identity theft. Authentication information is regularly updated to mitigate the potential risks associated with long-term use of authentication information. Next, the cloud phone platform and the client device generate a session key based on the user identifier and device authentication instructions. This key is encrypted and transmitted using a symmetric key encryption algorithm, and is regularly updated. The update process utilizes a key derivation function and encryption algorithm for secure processing, ensuring efficient encryption and decryption. This makes it suitable for communications involving large amounts of data, improving the security of the communication process and preventing key cracking or leakage. Finally, the client device, cloud phone platform and target device jointly generate a public key, which is composed of a combination of random numbers from each device and is hashed. The encryption request is encrypted and transmitted using the public key. After the target device receives the encryption request, it generates a first encryption key and updates the public key based on it. The public key generation mechanism ensures the unpredictability and security of the key, and the double encryption mechanism improves the security of data transmission.

[0071] This application also randomly selects a generator from the cyclic group through the client device, aggregates the session key, connection request, generator and intermediate value to generate an encryption request, which increases the complexity and security of the encryption request. After the communication connection is established, the multiple encryption mechanisms in the data interaction process further improve the security of the data, preventing the data from being stolen or tampered with during transmission. The decryption process is performed on the target device to ensure that the data is not leaked in the cloud.

[0072] The present application also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of the method for establishing an encrypted communication connection based on a cloud phone.

[0073] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, systems and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0074] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program code.

[0075] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for establishing an encrypted communication connection based on a cloud phone, characterized in that: The method for establishing an encrypted communication connection based on a cloud phone includes: The user registers an account on the cloud phone platform using a client device and generates a user identifier. When the user logs into the account on the client device, the client device sends a device authentication request to the cloud phone platform. The cloud phone platform verifies the authenticity of the client device based on the user identifier and generates a device authentication instruction. The cloud phone platform generates a session key based on the user identifier and the device authentication instruction, and transmits the session key to the client device, and the client device receives and stores the session key; The client device encrypts the connection request using the session key to generate an encrypted request, encrypts the encrypted request and transmits it to the target device based on the communication interface of the cloud phone platform. The target device decrypts the encrypted request after receiving it, generates request information, and establishes a communication connection based on the request information. After the communication connection, the cloud phone platform and the client device jointly update the session key based on a preset time period. The cloud phone platform generates log records corresponding to all communication connections. In the log records, if a security incident occurs on the client device, the cloud phone platform revokes the session key.

2. The method for establishing an encrypted communication connection based on a cloud phone according to claim 1, characterized in that: Generating a user identifier includes: The timestamp of the account registration, the device information of the client device and the serial number corresponding to the account registration are respectively obtained, and the timestamp, the device information and the serial number are combined according to a predetermined number of digits to generate the user identifier.

3. The method for establishing an encrypted communication connection based on a cloud phone according to claim 1, characterized in that: The generating device authentication instruction includes: Performing a hash calculation on the user identifier using a hash function to generate a first hash value, performing a hash calculation on the account login information using the hash function to generate a second hash value, performing an XOR operation on the first hash value and the second hash value to generate an initial authentication value, and encoding the initial authentication value using an encoding function to generate a standard authenticator; The client device generates a first random number, performs a hash process and an XOR operation on the standard authenticator using the first random number, outputs a first result, performs an XOR operation on the hash value of the standard authenticator and the hash value of the first random number, outputs a second result, and the client device sends the first result, the second result, and the user identifier in combination to the intermediate gateway node; The intermediate gateway node obtains the authentication initial value from the cloud phone platform based on the user identifier, and performs an XOR operation on the hash value of the standard authenticator and the first result, outputs a third result, compares the hash value of the third result with the second result, and if they are equal, the reliability meets the authentication requirements, and generates the device authentication instruction.

4. The method for establishing an encrypted communication connection based on a cloud phone according to claim 3, characterized in that: After the cloud phone platform generates the device authentication instruction, the following steps are included: The intermediate gateway node generates a second random number and performs an XOR operation with the authentication initial value to generate a new authentication initial value, uses the encoding function to encode the new authentication initial value to generate a new standard authentication code, and the cloud phone platform stores and records the new authentication initial value, the new standard authentication code and the user identifier.

5. The method for establishing an encrypted communication connection based on a cloud phone according to claim 1, characterized in that: The communication interface based on the cloud phone platform encrypts and transmits the encryption request to the target terminal device, including: The client device, the cloud phone platform, and the target device all generate corresponding random numbers, combine all the random numbers to generate a public key, use the public key to encrypt the encryption request, and the cloud phone platform sends the encrypted encryption request as a payload to the intermediate gateway node; The intermediate gateway node sends the encrypted encryption request to the target end device, the target end device uses the public key to decode the received data, extracts the random numbers corresponding to the client device and the cloud phone platform, and generates a first encryption key, performs an XOR operation on the public key and the first encryption key, outputs a fourth result, and updates the public key based on the fourth result.

6. The method for establishing an encrypted communication connection based on a cloud phone according to claim 1, characterized in that: The establishing of a communication connection based on the request information includes: After the target device generates the request information, the user starts the communication application of the client device and enters shared data, the control unit sends the shared data to the first encryption unit to generate first encrypted shared data, and the first encryption unit sends the first encrypted shared data to the control unit; The control unit associates the first encrypted shared data with the target device and sends the data to the output unit, and the output unit sends the first encrypted shared data to the target device via a network; The receiving unit of the target device receives the first encrypted shared data and sends it to the control unit. The control unit sends the first encrypted shared data to the second encryption unit. The second encryption unit encrypts the first encrypted shared data to generate second encrypted shared data and sends the second encrypted shared data to the control unit. The control unit sends the second encrypted shared data to the output unit. The output unit sends the second encrypted shared data to the client device. The receiving unit of the client device receives the second encrypted shared data and sends it to the control unit. The control unit sends the second encrypted shared data to the first decryption unit. The first decryption unit decrypts the second encrypted shared data to generate first decrypted data and sends the first decrypted data to the control unit. The control unit sends the first decrypted data to the output unit. The output unit sends the first decrypted data back to the target device. The receiving unit of the target end device receives the first decrypted data and sends the first decrypted data to the control unit. The control unit sends the first decrypted data to the second decryption unit. The second decryption unit decrypts the first decrypted data to generate second decrypted data and sends the second decrypted data to the control unit. The control unit sends the second decrypted data to the output unit, and the output unit sets the second decrypted data as plaintext shared data and displays it in the communication application; Among them, the client device includes the first encryption unit and the first decryption unit, the target device includes the second encryption unit and the second decryption unit, and the cloud phone platform includes the control unit and the output unit.

7. The method for establishing an encrypted communication connection based on a cloud phone according to claim 1, characterized in that: The collaboratively updating the session key based on a preset time period includes: The cloud phone platform generates a new key update request. After receiving the key update request, the client device verifies the legitimacy of the key update request, uses the session key as a seed, and generates a new key based on a key derivation function. The new key is encrypted using the session key and then sent to the cloud phone platform. After receiving the encrypted new key, the cloud phone platform decrypts it using the session key and verifies the validity of the new key. Based on the validity, an update confirmation message is sent to the client device and the new key is stored. After receiving the update confirmation information, the client device verifies the legitimacy of the new key, and based on the legitimacy, switches the cloud phone platform and the client device to use the new key for communication.

8. The method for establishing an encrypted communication connection based on a cloud phone according to claim 1, characterized in that: Generating the encryption request includes: Obtaining public parameters of the client device, the client device randomly selecting a generator from a cyclic group, and calculating an intermediate value using a hash function, the connection request, and the generator; The encryption request is generated using the session key, the connection request, the generator, and the intermediate value summary.

9. A cloud phone-based encrypted communication connection establishment system, characterized in that: The encrypted communication connection establishment system based on cloud mobile phone includes: An authentication module is used for a user to register an account on the cloud phone platform using a client device and generate a user identifier. When the user logs into the account on the client device, the client device sends a device authentication request to the cloud phone platform. The cloud phone platform verifies the authenticity of the client device based on the user identifier and generates a device authentication instruction. A session receiving module, configured for the cloud phone platform to generate a session key based on the user identifier and the device authentication instruction, and transmit the session key to the client device, where the client device receives and stores the session key; a communication connection module, configured for the client device to encrypt the connection request using the session key to generate an encrypted request, encrypt and transmit the encrypted request to the target device based on the communication interface of the cloud phone platform, and the target device to decrypt the encrypted request after receiving it, generate request information, and establish a communication connection based on the request information; The key processing module, after the communication connection, the cloud phone platform and the client device jointly update the session key based on a preset time period, and the cloud phone platform generates log records corresponding to all communication connections. In the log records, if a security incident occurs on the client device, the cloud phone platform revokes the session key.

10. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instruction is executed by the processor, the method for establishing an encrypted communication connection based on a cloud phone as described in any one of claims 1 to 8 is implemented.

Images