WO2016062157A1 - 一种信息加密解密、管理密钥的方法、终端及网络服务器 - Google Patents

一种信息加密解密、管理密钥的方法、终端及网络服务器 Download PDF

Info

Publication number
WO2016062157A1
WO2016062157A1 PCT/CN2015/087535 CN2015087535W WO2016062157A1 WO 2016062157 A1 WO2016062157 A1 WO 2016062157A1 CN 2015087535 W CN2015087535 W CN 2015087535W WO 2016062157 A1 WO2016062157 A1 WO 2016062157A1
Authority
WO
WIPO (PCT)
Prior art keywords
random key
key
terminal
random
network server
Prior art date
Application number
PCT/CN2015/087535
Other languages
English (en)
French (fr)
Inventor
陈璐
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to JP2017522128A priority Critical patent/JP6467504B2/ja
Priority to US15/520,895 priority patent/US20170338950A1/en
Priority to EP15851967.8A priority patent/EP3197123B1/en
Publication of WO2016062157A1 publication Critical patent/WO2016062157A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H04L9/0841—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols
    • H04L9/0844—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement

Definitions

  • This document relates to, but not limited to, the field of communications, and specifically relates to a method for encrypting, decrypting, controlling key failure, and a terminal and a network server.
  • terminal A transmits some information and files to terminal B.
  • terminal A needs such information and files to be remotely destroyed by itself at any time. It is forwarded by the terminal B as evidence. But at present, there is no corresponding solution in the industry.
  • the embodiments of the present invention provide a method for encrypting, decrypting, and controlling a key failure, and a terminal and a network server, which improve the security of the information transmitted by the terminal, and implement remote control of the terminal to destroy the encrypted information.
  • an embodiment of the present invention provides an information encryption method, which is applied to a terminal side, and includes:
  • the sending terminal creates a random key on the network server
  • the transmitting terminal encrypts the encrypted ciphertext according to the public key negotiated with the receiving terminal and the information to be transmitted by the random key, or the transmitting terminal treats according to the random key
  • the transmitted information is encrypted to obtain an encrypted ciphertext
  • the transmitting terminal sends the encrypted ciphertext to the receiving terminal.
  • the random key includes: a random key ID and a corresponding key, and the random key includes one or more pairs.
  • the sending terminal encrypts the information to be transmitted according to the public key and the random key to obtain an encrypted ciphertext, including:
  • the sending terminal encrypts the information to be transmitted according to the random key to obtain an encrypted ciphertext, including:
  • the transmitting terminal encrypts the information to be transmitted according to the key corresponding to the random key ID to obtain encrypted transmission information, and adds the random key ID to generate a final encrypted ciphertext.
  • an embodiment of the present invention further provides a method for managing a key based on the information encryption method as described above, including:
  • the sending terminal After transmitting the encrypted ciphertext to the receiving terminal, the sending terminal sends an instruction to delete or freeze the random key to the network server, or the sending terminal sets the deletion on the network server. Or freeze the rules of the random key.
  • the setting, by the sending terminal, setting, on the network server, the rule for deleting or freezing the random key includes one or more of the following:
  • the threshold of the number of times the random key is queried by the same receiving terminal is set, and after the number of times the same receiving terminal queries the random key reaches the threshold of the number of times, the random key is deleted or frozen.
  • the method further includes:
  • the transmitting terminal sends an instruction to the network server to thaw the random key.
  • the method further includes:
  • the sending terminal sets a query rule of the random key on the network server.
  • the query rule of the random key includes one or more of the following:
  • the embodiment of the present invention further provides an information decryption method, which is applied to the terminal side, and includes:
  • the receiving terminal acquires a random key created by the sending terminal from the network server according to the encrypted ciphertext, and after obtaining the random key, using a public key negotiated with the sending terminal and the random key
  • the key decrypts the encrypted ciphertext, or decrypts the encrypted ciphertext using the random key.
  • the encrypted cipher text includes a random key ID
  • the receiving terminal acquires the random key created by the sending terminal from the network server according to the encrypted ciphertext, including:
  • the receiving terminal parses the encrypted ciphertext to obtain the random key ID, and acquires a random key corresponding to the random key ID from the network server according to the random key ID.
  • the encrypted ciphertext includes: a signature, a random key ciphertext, and encrypted transmission information;
  • the receiving terminal acquires a random key created by the receiving terminal from the network server, and if the random key is obtained, decrypts the encrypted ciphertext by using the public key and the random key, include:
  • the receiving terminal generates a signature by using a signature algorithm on the public key, and determines whether the signature is consistent with the signature in the encrypted ciphertext, and uses the public when the signature is consistent with the signature in the encrypted ciphertext. Decrypting the random key ciphertext in the encrypted ciphertext to obtain a random key ID, and querying, by the random key ID, the key corresponding to the random key ID, When the key corresponding to the random key ID is queried, the public key and the obtained key corresponding to the random key ID are mixed as a key, and the encrypted transmission information is decrypted. The transmission information of the transmitting terminal.
  • the embodiment of the present invention further provides a method for encrypting and decrypting information, which is applied to a network side, and includes:
  • the network server After receiving the request for the sending terminal to create the random key, the network server creates a random key and saves the random key to the sending terminal;
  • the network server receives the request for the receiving terminal to acquire the random key created by the sending terminal, and performs verification on the receiving terminal, and after passing the verification, sends the queried random key to the receiving terminal.
  • the random key includes: a random key ID and a corresponding key, and the random key includes one or more pairs.
  • the verifying the receiving terminal includes:
  • the method further includes:
  • the method further includes:
  • the rule for deleting or freezing the random key set by the sending terminal on the network server includes one or more of the following:
  • the threshold of the number of times the random key is queried by the same receiving terminal is set, and after the number of times the same receiving terminal queries the random key reaches the threshold of the number of times, the random key is deleted or frozen.
  • the method further includes:
  • the random key is thawed according to the instructions.
  • the request that the network server receives the creation of the random key by the sending terminal further includes a query rule for setting the random key, where the method further includes:
  • the query rule of the random key includes one or more of the following:
  • the embodiment of the present invention further provides a terminal, including:
  • a random key creation and maintenance module configured to create a random key on the network server
  • the encryption module is configured to encrypt the transmission information according to the public key negotiated with the receiving terminal and the random key to obtain the encrypted ciphertext, or encrypt the information to be transmitted according to the random key to obtain the encrypted ciphertext;
  • a sending module configured to send the encrypted ciphertext to the receiving terminal.
  • the random key includes: a random key ID and a corresponding key, and the random key includes one or more pairs.
  • the encryption module is configured to encrypt the information to be transmitted according to the public key and the random key to obtain an encrypted ciphertext, including:
  • the encryption module is configured to encrypt the information to be transmitted according to the random key to obtain an encrypted ciphertext, including:
  • the embodiment of the present invention further provides a terminal that is applicable to a management key based on the terminal as described above, and further includes:
  • a key management module configured to send, after the sending module sends the encrypted ciphertext to the receiving terminal, an instruction to delete or freeze the random key to the network server, or in the network server Set the rule to delete or freeze the random key.
  • the key management module is configured to set, on the network server, a rule for deleting or freezing the random key, including one or more of the following:
  • the threshold of the number of times the random key is queried by the same receiving terminal is set, and after the number of times the same receiving terminal queries the random key reaches the threshold of the number of times, the random key is deleted or frozen.
  • the key management module is further configured to send an instruction to the network server to thaw the random key.
  • the random key creation and maintenance module is configured to set a query rule of the random key on the network server after creating a random key on the network server.
  • the query rule of the random key includes one or more of the following:
  • the embodiment of the present invention further provides a terminal, including:
  • a receiving module configured to receive an encrypted ciphertext sent by the sending terminal
  • a decryption module configured to acquire a random key created by the sending terminal from the network server according to the encrypted ciphertext, and after obtaining the random key, using a public key and a protocol negotiated with the sending terminal The random key decrypts the encrypted ciphertext, or decrypts the encrypted ciphertext by using the random key.
  • the decrypting module is configured to acquire the random key created by the sending terminal from the network server according to the encrypted ciphertext, including:
  • the encrypted ciphertext includes a random key ID.
  • the decrypting module is configured to acquire, by the network server, a random key created by the receiving terminal, and if the random key is obtained, use the public key and the random key pair
  • the encrypted ciphertext decryption includes:
  • Generating a signature by using a signature algorithm on the public key determining whether the signature is consistent with a signature in the encrypted ciphertext, and using the public key pair when the signature is consistent with the signature in the encrypted ciphertext.
  • Decrypting the random key ciphertext in the encrypted ciphertext to obtain a random key ID querying the network server for the key corresponding to the random key ID according to the random key ID, and querying the random key ID corresponding to the query Decrypting the encrypted transmission information in the encrypted ciphertext by using the public key and the obtained key corresponding to the obtained random key ID as a key to obtain transmission information of the transmitting terminal;
  • the encrypted ciphertext includes: a signature, a random key ciphertext, and encrypted transmission information.
  • the decrypting module is further configured to: if the random key is not obtained, the decryption fails, and prompts the user that the random key acquisition fails.
  • the embodiment of the present invention further provides a network server, including:
  • a receiving module configured to receive a request for the sending terminal to create a random key, and receive a request for the receiving terminal to acquire the random key created by the sending terminal;
  • the random key creation and maintenance module is configured to: after receiving the request for creating the random key by the sending terminal, create a random key and save the data;
  • the querying module is configured to: after receiving the request that the receiving terminal acquires the random key created by the sending terminal, verify the receiving terminal, and query the random key created by the sending terminal after the verification is passed;
  • a sending module configured to send the created random key to the sending terminal, and send the queried random key to the receiving terminal.
  • the random key includes: a random key ID and a corresponding key, and the random key includes one or more pairs.
  • the querying module is configured to perform verification on the receiving terminal, including:
  • the querying module is further configured to: after verifying the receiving terminal, after verifying, determining whether the random key exists or is in a defrosted state, when the random key exists or is in a defrosted state And sending the queried random key to the receiving terminal.
  • the receiving module is further configured to receive an instruction for deleting or freezing the random key sent by the sending terminal, or receiving the deletion or freezing set by the sending terminal on the network server. Random key rule;
  • the random key creation and maintenance module is further configured to delete or freeze the random key according to the instruction or the rule.
  • the rule for deleting or freezing the random key set by the sending terminal on the network server includes one or more of the following:
  • the threshold of the number of times the random key is queried by the same receiving terminal is set, and after the number of times the same receiving terminal queries the random key reaches the threshold of the number of times, the random key is deleted or frozen.
  • the receiving module is further configured to receive the defrosting sent by the sending terminal Machine key instruction;
  • the random key creation and maintenance module is further configured to thaw the random key according to the instruction.
  • the request for the sending terminal to create a random key further includes: setting a query rule of the random key;
  • the random key creation and maintenance module is further configured to set a query rule of the random key when the random key is created;
  • the querying module is further configured to: when the receiving module receives the request that the receiving terminal acquires the random key created by the sending terminal, perform authentication according to the request, if the request meets the query rule, The authentication is passed, and the receiving terminal is allowed to perform an inquiry.
  • the query rule of the random key includes one or more of the following:
  • an embodiment of the present invention further provides an information encryption and decryption system, comprising: the terminal as described above, the terminal as described above, and the network server as described above.
  • the embodiment of the invention further provides a computer readable storage medium storing computer executable instructions for performing the above-mentioned information encryption method, information decryption method or information encryption and decryption method.
  • the method for encrypting, decrypting, and controlling the key invalidation of the information provided by the embodiment of the present invention and the terminal and the network server are independent by using a random key stored in the network server, or combined with a public key for encryption or Decryption, the receiving terminal needs to query the server for the random key, and only after obtaining the random key, the decryption of the encrypted ciphertext can be completed, thereby improving the security of the information transmitted by the terminal, and further, the transmitting terminal deletes or freezes the network by deleting or freezing the network.
  • the random key on the server makes the receiving terminal unable to obtain the random key, and thus cannot be decrypted, thereby enabling the transmitting terminal to remotely control the destruction of the encrypted information.
  • FIG. 2 is a schematic diagram of a transmission terminal A acquiring a randomly generated id and a corresponding key KEYser from a server before transmitting in an application example;
  • FIG. 3 is a schematic diagram of an application example in which a transmitting terminal A transmits a key KEY that only the transmitting terminal A and the receiving terminal B can grasp to the receiving terminal B in a certain manner (without passing through a server);
  • FIG. 4 is a schematic diagram showing the composition content of an encrypted ciphertext that A passes to B in an application example
  • FIG. 5 is a flowchart of a method for decrypting information according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of an application example in which a receiving terminal B queries an id through an id from a server, and then decrypts the plaintext;
  • FIG. 7 is a schematic diagram of an application network server requesting a network server to destroy a KEYser in an application example
  • FIG. 8 is a flowchart of an information encryption and decryption method in an embodiment of the present invention.
  • FIG. 10 is a schematic diagram of B being unable to decrypt again after the KEYser is destroyed in an application example
  • 11 is a flow chart of an information encryption and decryption method in another application example.
  • FIG. 12 is a structural diagram of a transmitting terminal according to an embodiment of the present invention.
  • FIG. 13 is a structural diagram of a transmitting terminal for managing a key based on a transmitting terminal shown in FIG. 13 according to an embodiment of the present invention
  • FIG. 14 is a structural diagram of a receiving terminal according to an embodiment of the present invention.
  • Figure 15 is a structural diagram of a network server in an embodiment of the present invention.
  • this embodiment provides an information encryption method, which is applied to a sending terminal side, and includes:
  • the sending terminal creates a random key on the network server.
  • the random key includes: a random key ID and a corresponding key, that is, the random key is [id, KEYser], and the random key includes one or more pairs, and each pair of random keys passes Id to identify, and can be used for each pair of random key remarks, such as "and communication with a certain"; the length of the random key ID is long enough, so the ID value space is large enough, will not be generated when randomly generated With duplicate IDs, it is difficult to traverse the query by violence.
  • the sending terminal encrypts the information to be transmitted according to the public key negotiated with the receiving terminal and the random key to obtain an encrypted ciphertext, or the information to be transmitted by the sending terminal according to the random key. Encrypted to obtain an encrypted ciphertext;
  • the method further includes: before the step S101 and S102, the sending terminal and the receiving terminal negotiate a public key; for example, the sending terminal and the receiving terminal can verbally agree on a public key KEY.
  • the manner in which the sending terminal encrypts the information to be transmitted according to the public key and the random key to obtain the encrypted ciphertext includes:
  • the finally generated encrypted ciphertext includes: a signature, a ciphertext of a random key ID, a signature of a key corresponding to the random key ID, and encrypted transmission information, wherein the added random key ID
  • the signature of the corresponding key is used to verify whether the key corresponding to the random key ID returned from the server is correct.
  • the manner in which the sending terminal encrypts the information to be transmitted according to the public key and the random key to obtain the encrypted ciphertext is not limited to the foregoing manners, and includes multiple modes, as long as the encrypted ciphertext finally generated is included.
  • the random key ID and the encrypted transmission information are sufficient.
  • the manner in which the public key and the key corresponding to the random key ID are mixed into a key includes multiple types.
  • the public key and the random key may be XORed, and the result is used as a key. It is of course not limited to the exemplary way, which is a prior art and will not be described again.
  • the sending terminal encrypts the information to be transmitted according to the random key to obtain an encrypted ciphertext, including:
  • the transmitting terminal encrypts the information to be transmitted according to the key corresponding to the random key ID to obtain encrypted transmission information, and adds the random key ID to generate a final encrypted ciphertext.
  • the manner in which the sending terminal encrypts the information to be transmitted according to the random key to obtain the encrypted ciphertext includes various manners, such as increasing the signature of the key corresponding to the random key ID, etc., and details are not described herein.
  • the encrypted ciphertext finally generated includes the random key ID and the encrypted transmission information.
  • S104 The sending terminal sends the encrypted ciphertext to the receiving terminal.
  • the random key on the network server is insufficient to decrypt the encrypted ciphertext, that is, the network server cannot understand what information and files are transmitted by both parties of the communication, so that the hacker can be prevented from obtaining the key pair encryption from the network server.
  • the occurrence of ciphertext decryption occurs.
  • FIG. 2 is a schematic diagram of the sending terminal A acquiring a randomly generated id and a corresponding key KEYser from the server before sending.
  • A requests the server through a secure channel (for example, a secure shell protocol). Randomly generate an id and a corresponding key KEYser; a pair of randomly generated [id, KEYser] by the server, wherein the id is long enough (for example, 128 bits), so that the randomly generated id is not repeated, and it is difficult to traverse;
  • Server C stores the pair of random keys [id, KEYser] in the database, and returns [id, KEYser] to A through a secure channel;
  • FIG. 3 is a schematic diagram of the transmitting terminal A transmitting a key KEY that only the transmitting terminal A and the receiving terminal B can grasp to the receiving terminal B in a certain manner (without passing through the server).
  • this key must be kept secret, so that the outsiders not involved in this communication, including the network server, cannot decrypt the transmitted information and files.
  • the preferred way is that A and B agree on the key in advance and pass it orally.
  • FIG. 4 is a schematic diagram showing the composition content of an encrypted ciphertext that A passes to B, where:
  • 100 is a signature on the public key KEY (for example, md5 or sha algorithm) for verifying the receiving terminal B;
  • KEY for example, md5 or sha algorithm
  • 200 is a ciphertext generated by using a public key KEY as a key, id as a plaintext, and an encryption algorithm (for example, 128-bit AES), so that there is no public key KEY, and the id cannot be known;
  • a public key KEY as a key
  • id as a plaintext
  • an encryption algorithm for example, 128-bit AES
  • 300 is a combination of a public key KEY and a random key KEYser as a key, using the information and files transmitted this time as plaintext, ciphertext generated by an encryption algorithm (for example, 128-bit AES), a public key KEY, and a random key.
  • KEYser is missing any one and cannot be decrypted.
  • this embodiment provides an information decryption method, which is applied to the receiving terminal side, and includes:
  • the receiving terminal receives the encrypted ciphertext sent by the sending terminal.
  • S202 The receiving terminal acquires a random key created by the sending terminal from the network server.
  • the receiving terminal sends a request for acquiring the random key created by the sending terminal to the network server.
  • the request carries the user name and login password of the receiving terminal to log in on the network server, so as to facilitate The network server performs login authentication on the terminal.
  • the request does not exclude other information for the network server login authentication.
  • the method further includes: before the step, the receiving terminal and the sending terminal negotiate a public key; the public key here is the same as the public key in the encryption method provided in FIG. 1 .
  • the receiving terminal decrypts the encrypted ciphertext according to the public key and the random key, or only the encryption key according to the random key corresponds to the encryption mode of the sending terminal side, but finally needs to be parsed from the encrypted ciphertext.
  • the random key ID is obtained, and then the key corresponding to the random key ID is obtained from the network server to decrypt the encrypted transmission information.
  • the encrypted ciphertext includes: a signature, Random key ciphertext and encrypted transmission information;
  • Steps S203 and S204 specifically include:
  • the receiving terminal generates a signature by using a signature algorithm on the public key, and determines whether the signature is consistent with the signature in the encrypted ciphertext. If the signature is consistent, the public key is used to randomly encrypt the encrypted ciphertext. Decrypting the key ciphertext to obtain a random key ID, and querying the network server for the key corresponding to the random key ID according to the random key ID (that is, the receiving terminal sends the acquisition to the network server to acquire the created by the sending terminal. The request for the random key further carries a random key ID. If the key corresponding to the random key ID is queried, the public key and the obtained key corresponding to the random key ID are used. The key is paired to decrypt the encrypted ciphertext to obtain the transmitted information.
  • the encrypted cipher text includes a random key ID
  • the receiving terminal acquires the random key created by the sending terminal from the network server according to the encrypted ciphertext, including:
  • the receiving terminal parses the encrypted ciphertext to obtain the random key ID, and acquires a random key corresponding to the random key ID from the network server according to the random key ID.
  • the method further includes: if the random key is not obtained, the decryption fails, and prompting the user that the random key acquisition fails.
  • FIG. 6 is a schematic diagram of the receiving terminal B queried from the server to the KEYser through the id, and then decrypts and obtains the plaintext.
  • the receiving terminal B actually refers to the client that receives the ciphertext running on the B, and the B uses The public key KEY decrypts the id, and then sends a request to the network server C through a secure channel (for example, SSH), the request parameter has an id, and the C receives the id, queries the database, obtains the key KEYser corresponding to the id, and returns to the B. .
  • a secure channel for example, SSH
  • the request parameter has an id
  • the C receives the id, queries the database, obtains the key KEYser corresponding to the id, and returns to the B.
  • B masters the public key KEY and KEYser, and can decrypt the transmitted information and files.
  • the receiving terminal B does not allow to save the KEYser and the decrypted transmitted information and files, and the restriction is performed by the receiving terminal B.
  • the embodiment further provides a method for managing a key, including:
  • the transmitting terminal After transmitting the encrypted information and the encrypted ciphertext to the receiving terminal, the transmitting terminal sends And the network server sends an instruction to delete or freeze the random key, or the sending terminal sets a rule for deleting or freezing the random key on the network server.
  • the rule that the sending terminal sets to delete or freeze the random key on the network server includes one or more of the following:
  • the timer can be set to automatically delete/freeze after n days of creation; or automatically delete/freeze to a certain date;
  • the threshold of the number of times the random key is queried by the same receiving terminal is set, and after the number of times the same receiving terminal queries the random key reaches the threshold of the number of times, the random key is deleted or frozen.
  • the method further includes:
  • the transmitting terminal sends an instruction to the network server to thaw the random key.
  • the method further includes:
  • the sending terminal sets a query rule of the random key on the network server.
  • the query rule of the random key includes but is not limited to one or more of the following:
  • the user list includes one or more user names, which may be the mobile phone number of the end user or the user's own. A nickname.
  • the number of times the queried key is queried is that the number of times the key corresponding to the same random key ID is queried cannot exceed a certain number of times; when the random key is queried, some random keys can only be used in a certain day. These time periods are allowed to be queried.
  • FIG. 7 is a schematic diagram of A requesting the network server to destroy the KEYser, wherein A sends a request to the server through the secure channel, and the request parameter has an id, and after the server passes the authentication, the [id] saved in the database is deleted. ,KEYser];
  • the embodiment provides a method for encrypting and decrypting information, which is applied to the network side, and includes:
  • S301 The network server receives a request for the sending terminal to create a random key.
  • S302 Create a random key and save, and send the random key to the sending terminal.
  • the random key includes: a random key ID and a corresponding key, that is, the random key is [id, KEYser], and the random key includes one or more pairs, and each pair of random keys passes Id to identify, and can explain the information for each pair of random keys, such as "only for communication with a certain";
  • the network server receives a request that the receiving terminal acquires a random key created by the sending terminal.
  • the request for the network server to generate the random key by the sending terminal further includes a query rule for setting the random key, and the method further includes:
  • step S304 authenticating, according to the query rule, the request for the receiving terminal to obtain the random key created by the sending terminal, if the request meets the query rule, the authentication is passed, and the receiving terminal is allowed to perform the query. That is, step S304 is continued.
  • the query rule of the random key includes but is not limited to one or more of the following:
  • S304 Perform verification on the receiving terminal, and send the queried random key to the receiving terminal after passing the verification.
  • the verifying the receiving terminal includes:
  • step S304 the receiving terminal is verified. After the verification, the method further includes:
  • the method further includes:
  • S302a The network server receives an instruction for deleting or freezing the random key sent by the sending terminal, or receives a deletion or freezing of the random key set by the sending terminal on the network server. rule;
  • the rule for deleting or freezing the random key set by the sending terminal on the network server includes one or more of the following:
  • the threshold of the number of times the random key is queried by the same receiving terminal is set, and after the number of times the same receiving terminal queries the random key reaches the threshold of the number of times, the random key is deleted or frozen.
  • S302b Delete or freeze the random key according to the instruction or the rule.
  • the method further includes:
  • the random key is thawed according to the instructions.
  • A is the sending terminal
  • B is the receiving terminal
  • C is the network server
  • both A and B register the user name and password on C
  • a and B pre-agreed the secret that only A and B can grasp.
  • Key KEY public key
  • the method of information encryption and decryption includes the following steps:
  • S401 A accesses the HTTPS page through the browser or through the SSH channel established by the dedicated client, logs in C with its own username and password, creates a pair of [id, KEYser], and fills in a pair of [id, KEYser] for human identification.
  • the description such as "special communication with a certain"; A client used before sending encrypted information and encrypted ciphertext, you need to specify the [id, KEYser] used in this communication;
  • each pair of [id, KEYser] can set a query rule, and optional rules such as The foregoing rules are not described here.
  • each pair [id, KEYser] can be manually deleted/freeze/unfreeze, or deleted/frozen by setting corresponding rules on C. Freeze is not deleted, but [id, KEYser] in the frozen state, other users except A can not query; each pair [id, KEYser] can set delete/freeze rules, optional delete/freeze The rules are as described above and will not be described here.
  • S402 A uses KEY and KEYer to encrypt the transmitted information and files, and sends the encrypted ciphertext to B;
  • the encrypted ciphertext sent by A to B consists of three parts:
  • S403 After the client used by B receives the encrypted information and file, please input KEY into B, and after obtaining the input of B, the key generated by B is generated by the md5 algorithm and compared with (a) in S402. If they are consistent, Note B enters the correct KEY; decrypts (b) in the above S402 with KEY to get the id; then the client establishes an SSH channel with C, logs in with C with its own username and password, and initiates a query to C, the parameter is id, B username and password;
  • step S403 if A sets a query rule, C first authenticates the request of the client of B according to the query rule. If the username in the request is on the list of allowed users set in A, the authentication is performed. Pass, go to S404 to continue,
  • step S404 C further authenticates B according to the query rule, and if the authentication passes, step S405 is performed;
  • S405 After obtaining the [id, KEYser], the client of B decrypts the (402) of S402 with the 128-bit AES algorithm by using the operation result of the KEY XOR or KEYser as the key, and obtains the transmission information and the text.
  • FIG. 10 is a schematic diagram of B can not be decrypted after KEYser is destroyed.
  • B decrypts the id with KEY, and then sends a request to C through a secure channel (such as SSH).
  • the request parameter has an id
  • C receives the id. , query from the database, but KEYser has been destroyed and can not be found.
  • C returns null to B, and B has only the public key KEY, and cannot decrypt the transmitted information and files. This way the encrypted information and files are actually destroyed, just a bunch of garbled.
  • A is the transmitting terminal
  • B is the receiving terminal
  • C is the network server
  • both A and B register the user name and password on C
  • a and B do not need to agree on the public key in advance, and use random key encryption or Decryption; as shown in FIG. 11, the method for encrypting and decrypting information includes the following steps:
  • step S501 is the same as step S401, and is not described here;
  • S502 A uses KEYer to encrypt the transmitted information and files, and sends the encrypted ciphertext to B;
  • the encrypted ciphertext sent by A to B consists of two parts:
  • the client used by the B After receiving the encrypted ciphertext, the client used by the B obtains the id corresponding to the KEYser; then the client establishes an SSH channel with C, logs in to C with its own username and password, and initiates a query to C, the parameter is id , B's username and password;
  • step S504 is the same as step S404, and details are not described herein again;
  • S505 After obtaining the [id, KEYser], the client of B decrypts S502 (a) with the 128-bit AES algorithm with the KEYser as the key, and obtains the plaintext of the transmission information and the file; the client used by B will [id , KEYser], and the plaintext obtained by decryption are stored in memory, and do not provide the function of transferring them to the storage device. B can only use this dedicated client to view the decrypted information and files. Once exiting the client, the [id, KEYser] in memory and the plaintext obtained by decryption will disappear.
  • FIG. 10 is a schematic diagram of B can not be decrypted after KEYser is destroyed.
  • B decrypts the id with KEY, and then sends a request to C through a secure channel (such as SSH).
  • the request parameter has an id
  • C receives the id. , query from the database, but KEYser has been destroyed and can not be found.
  • C returns null to B, and B has only the public key KEY, and cannot decrypt the transmitted information and files. This way the encrypted information and files are actually destroyed, just a bunch of garbled.
  • this embodiment provides a sending terminal, which is used for information encryption, the transmitting terminal includes a processor and a program storage device, and the program storage device is configured to store a module including computer readable instructions, including :
  • a random key creation and maintenance module configured to create a random key on the network server
  • the random key includes: a random key ID and a corresponding key, and the random key includes one or more pairs.
  • the encryption module is configured to encrypt the transmission information according to the public key negotiated with the receiving terminal and the random key to obtain the encrypted ciphertext, or encrypt the information to be transmitted according to the random key to obtain the encrypted ciphertext;
  • a sending module configured to send the encrypted ciphertext to the receiving terminal.
  • the method further includes: a public key negotiation module, configured to negotiate a public key with the receiving terminal;
  • the cryptographic module is configured to encrypt the information to be transmitted according to the public key and the random key to obtain an encrypted ciphertext, including:
  • the encryption module is configured to encrypt the information to be transmitted according to the random key to obtain the encrypted ciphertext, including:
  • the embodiment further provides a transmitting terminal for managing a key based on the transmitting terminal shown in FIG. 12, as shown in FIG. 13, in addition to the modules included in FIG. include:
  • a key management module configured to send, after the sending module sends the encrypted ciphertext to the receiving terminal, an instruction to delete or freeze the random key to the network server, or in the network server Set the rule to delete or freeze the random key.
  • the key management module configured to set a rule for deleting or freezing the random key on the network server, includes one or more of the following:
  • the threshold of the number of times the random key is queried by the same receiving terminal is set, and after the number of times the same receiving terminal queries the random key reaches the threshold of the number of times, the random key is deleted or frozen.
  • the key management module is further configured to send an instruction to the network server to thaw the random key.
  • the random key creation and maintenance module is configured to set a query rule of the random key on the network server after the random key is created on the network server.
  • the query rule of the random key includes one or more of the following:
  • this embodiment provides a receiving terminal for information decryption, and the receiving
  • the terminal includes a processor and a program storage device for storing a module containing computer readable instructions, including:
  • a receiving module configured to receive the encrypted ciphertext sent by the sending terminal
  • a decryption module configured to acquire a random key created by the sending terminal from the network server according to the encrypted ciphertext, and after obtaining the random key, using a public key and a protocol negotiated with the sending terminal The random key decrypts the encrypted ciphertext, or decrypts the encrypted ciphertext by using the random key.
  • the terminal further includes: a public key negotiation module, configured to negotiate a public key with the sending terminal;
  • the decrypting module is configured to acquire, according to the encrypted ciphertext, a random key created by the sending terminal, to the network server, including:
  • the encrypted ciphertext includes a random key ID.
  • the decryption module is configured to acquire, from the network server, a random key created by the receiving terminal, and if the random key is obtained, use the public key and Decrypting the encrypted ciphertext by the random key, including:
  • the receiving terminal generates a signature by using a signature algorithm on the public key, and determines whether the signature is consistent with the signature in the encrypted ciphertext. If the signature is consistent, the public key is used to randomly encrypt the encrypted ciphertext. Decrypting the key ciphertext to obtain a random key ID, querying the network server for the key corresponding to the random key ID according to the random key ID, and if the key corresponding to the random key ID is queried, using the key Deriving the public key and the obtained key corresponding to the random key ID as a key to decrypt the encrypted transmission information, and obtaining transmission information of the transmitting terminal;
  • the encrypted ciphertext includes: a signature, a random key ciphertext, and encrypted transmission information.
  • the decryption module is further configured to decrypt if the random key is not obtained, and prompt the user to fail the random key acquisition.
  • this embodiment provides a network server, where the server includes a processor. And a program storage device for storing a module comprising computer readable instructions, comprising:
  • a receiving module configured to receive a request for the sending terminal to create a random key, and receive a request for the receiving terminal to acquire the random key created by the sending terminal;
  • the random key creation and maintenance module is configured to: after receiving the request for creating the random key by the sending terminal, create a random key and save the data;
  • the random key includes: a random key ID and a corresponding key, and the random key includes one or more pairs.
  • the receiving module is further configured to receive an instruction for deleting or freezing the random key sent by the sending terminal, or receiving the sending terminal to be set on the network server.
  • the rule of deleting or freezing the random key is further configured to receive an instruction for deleting or freezing the random key sent by the sending terminal, or receiving the sending terminal to be set on the network server.
  • the random key creation and maintenance module is further configured to delete or freeze the random key according to the instruction or the rule.
  • the rule for deleting or freezing the random key set by the sending terminal on the network server includes one or more of the following:
  • the threshold of the number of times the random key is queried by the same receiving terminal is set, and after the number of times the same receiving terminal queries the random key reaches the threshold of the number of times, the random key is deleted or frozen.
  • the receiving module is further configured to receive an instruction sent by the sending terminal to thaw the random key
  • the random key creation and maintenance module is further configured to thaw the random key according to the instruction.
  • the querying module is configured to: after receiving the request that the receiving terminal acquires the random key created by the sending terminal, verify the receiving terminal;
  • the query module is configured to perform verification on the receiving terminal, including:
  • the query module is further configured to: after verifying the receiving terminal, after verifying, determining whether the random key exists or is in a defrosted state (queryable state), and if yes, querying the A random key is sent to the receiving terminal.
  • the request for creating a random key by the sending terminal further includes: setting a query rule of the random key;
  • the random key creation and maintenance module is further configured to set a query rule of the random key when the random key is created;
  • the querying module is further configured to: when the receiving module receives the request that the receiving terminal acquires the random key created by the sending terminal, perform authentication according to the request, if the request meets the query rule, The authentication is passed, and the receiving terminal is allowed to perform an inquiry.
  • the query rule of the random key includes one or more of the following:
  • the sending module is configured to send the created random key to the sending terminal; after passing the verification, send the queried random key to the receiving terminal.
  • the embodiment further provides an information encryption and decryption system, comprising: the sending terminal, the receiving terminal and the network server as described above.
  • the method for encrypting, decrypting, and controlling the key failure and the terminal and the network server provided by the foregoing embodiments are independent of the random key stored in the network server, or
  • the public key combination is encrypted or decrypted, and the receiving terminal needs to query the server for the random key. Only when the random key is obtained can the decryption of the encrypted ciphertext be completed, thereby improving the security of the terminal transmission information, and further, the transmitting terminal By deleting or freezing the random key on the network server, the receiving terminal cannot obtain the random key, and thus cannot decrypt, so that the transmitting terminal can remotely control the destruction of the encrypted information.
  • the embodiment of the present invention uses the random key stored in the network server to be independent or combined with the public key for encryption or decryption, and the receiving terminal queries the server for the random key, and only obtains the random key to complete the encryption of the ciphertext. Decrypting, thereby improving the security of the information transmitted by the terminal.
  • the transmitting terminal can not obtain the random key by deleting or freezing the random key on the network server, thereby failing to decrypt, so that the transmitting terminal can remotely control the destruction. Encrypt information.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)
  • Telephonic Communication Services (AREA)

Abstract

一种信息加密、解密、控制密钥失效的方法以及终端和网络服务器，所述方法包括：发送终端在网络服务器上创建随机密钥（S101）；所述发送终端根据与接收终端协商的公共密钥和所述随机密钥，或者仅根据随机密钥对待传输的信息进行加密得到加密密文（S102）；所述发送终端将所述加密密文发送给所述接收终端（S103）。利用存储在网络服务器的随机密钥独立，或与公共密钥组合进行加密或解密，接收终端向服务器查询该随机密钥，只有获得了该随机密钥才能完成对加密密文的解密，从而提高终端传输信息的安全性，此外，发送终端通过删除或冻结所述网络服务器上的随机密钥，使得接收终端无法获得该随机密钥，进而无法解密，使发送终端能够远程控制销毁加密信息。

Description

一种信息加密解密、管理密钥的方法、终端及网络服务器 技术领域
本文涉及但不限于通信领域，具体涉及一种信息加密、解密、控制密钥失效的方法以及终端和网络服务器。
背景技术
有一些信息和文件，需要只能让通信的双方知道，因此，对这些信息和文件加密以防止文件信息被窃取，中间的传输通道看到的全是密文，外人就无法了解通信的双方在传递什么信息和文件。随着移动智能终端的广泛应用，越来越多的黑客瞄准了移动终端用户，用户的文件和信息被窃取的现象越来越多，因此，对移动终端中用户的信息和文件进行有效的加密便显得尤为重要。
进一步的，用户有了一种新的通信需求，例如，终端A向终端B传输了一些信息和文件，在某些特殊情况下，终端A需要这些信息和文件能随时被自己远程销毁掉，不能被终端B作为证据转发。但目前，业界还没有相应的解决方案。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本发明实施例提供一种信息加密、解密、控制密钥失效的方法以及终端和网络服务器，提高终端传输信息的安全性，实现终端远程控制销毁加密信息。
一方面，本发明实施例提供了一种信息加密方法，应用于终端侧，包括：
发送终端在网络服务器上创建随机密钥；
所述发送终端根据与接收终端协商的公共密钥和所述随机密钥对待传输的信息进行加密得到加密密文，或者，所述发送终端根据所述随机密钥对待 传输的信息进行加密得到加密密文；
所述发送终端将所述加密密文发送给所述接收终端。
可选地，所述随机密钥包括：随机密钥ID及对应的密钥，所述随机密钥包括一对或多对。
可选地，所述发送终端根据所述公共密钥和所述随机密钥，对待传输的信息进行加密得到加密密文，包括：
对所述公共密钥采用签名算法生成签名；
以所述公共密钥为密钥对所述随机密钥ID进行加密生成随机密钥密文；
以所述公共密钥和所述随机密钥ID对应的密钥混合为密钥对所述待传输的信息进行加密得到加密的传输信息；
将所述签名、所述随机密钥密文和所述加密的传输信息组合生成最终的加密密文。
可选地，所述发送终端根据所述随机密钥对待传输的信息进行加密得到加密密文，包括：
所述发送终端根据所述随机密钥ID对应的密钥对所述待传输的信息进行加密得到加密的传输信息，并添加所述随机密钥ID生成最终的加密密文。
另一方面，本发明实施例还提供了一种基于如上所述的信息加密方法的管理密钥的方法，包括：
所述发送终端在将所述加密密文发送给所述接收终端后，向所述网络服务器发送删除或冻结所述随机密钥的指令，或者，所述发送终端在所述网络服务器上设置删除或冻结所述随机密钥的规则。
可选地，所述发送终端在所述网络服务器上设置删除或冻结所述随机密钥的规则包括以下一个或多个：
设置定时器，在所述网络服务器上创建随机密钥后的时间达到定时器设定时间后删除或冻结所述随机密钥；
设置所述随机密钥被同一接收终端查询的次数阈值，当所述同一接收终端查询所述随机密钥的次数达到所述次数阈值后，删除或冻结所述随机密钥。
可选地，所述方法还包括：
所述发送终端向所述网络服务器发送解冻所述随机密钥的指令。
可选地，所述发送终端在所述网络服务器上创建随机密钥后，还包括：
所述发送终端在所述网络服务器上设置所述随机密钥的查询规则。
可选地，所述随机密钥的查询规则包括以下一个或多个：
允许查询所述随机密钥的用户名单；
允许查询所述随机密钥的次数；
允许查询所述随机密钥的时间段。
又一方面，本发明实施例还提供了一种信息解密方法，应用于终端侧，包括：
接收终端接收到发送终端发送的加密密文；
所述接收终端根据所述加密密文向网络服务器获取所述发送终端创建的随机密钥，在获取到所述随机密钥后，利用与所述发送终端协商的公共密钥和所述随机密钥对所述加密密文解密，或者，利用所述随机密钥对所述加密密文解密。
可选地，所述加密密文中包含随机密钥ID，所述接收终端根据所述加密密文向网络服务器获取所述发送终端创建的随机密钥，包括：
所述接收终端解析所述加密密文获取所述随机密钥ID，根据所述随机密钥ID向所述网络服务器获取所述随机密钥ID对应的随机密钥。
可选地，所述加密密文包括：签名、随机密钥密文和加密的传输信息；
所述接收终端向所述网络服务器获取所述接收终端创建的随机密钥，如果获取到所述随机密钥，则利用所述公共密钥和所述随机密钥对所述加密密文解密，包括：
所述接收终端对所述公共密钥采用签名算法生成签名，判断所述签名与所述加密密文中的签名是否一致，当所述签名与所述加密密文中的签名一致时，利用所述公共密钥对所述加密密文中的随机密钥密文解密得到随机密钥ID，根据所述随机密钥ID向所述网络服务器查询该随机密钥ID对应的密钥， 当查询到所述随机密钥ID对应的密钥时，利用所述公共密钥和获取到的所述随机密钥ID对应的密钥混合为密钥，对所述加密的传输信息解密，得到发送终端的传输信息。
又一方面，本发明实施例还提供了一种信息加密解密的方法，应用于网络侧，包括：
网络服务器接收到发送终端创建随机密钥的请求后，创建随机密钥并保存，将所述随机密钥发送至所述发送终端；
所述网络服务器接收到接收终端获取所述发送终端创建的随机密钥的请求，对所述接收终端进行验证，在通过验证后，将查询到的所述随机密钥发送给所述接收终端。
可选地，所述随机密钥包括：随机密钥ID及对应的密钥，所述随机密钥包括一对或多对。
可选地，所述对所述接收终端进行验证，包括：
判断所述接收终端获取所述发送终端创建的随机密钥的请求中是否携带有所述随机密钥ID，如果是，则通过验证，如果所述请求中没有携带所述随机密钥ID，验证失败。
可选地，在对所述接收终端进行验证，在通过验证后，所述方法还包括：
判断所述随机密钥是否存在或处于解冻状态，当所述随机密钥存在或处于解冻状态时，则将查询到的所述随机密钥发送给所述接收终端。
可选地，在所述创建随机密钥并保存，将所述随机密钥发送至所述发送终端后，所述方法还包括：
所述网络服务器接收到所述发送终端发送的删除或冻结所述随机密钥的指令，或者，接收到所述发送终端在所述网络服务器上设置的删除或冻结所述随机密钥的规则，根据所述指令或所述规则删除或冻结所述随机密钥。
可选地，所述发送终端在所述网络服务器上设置的删除或冻结所述随机密钥的规则包括以下一个或多个：
设置定时器，在所述网络服务器上创建随机密钥后的时间达到定时器设定时间后删除或冻结所述随机密钥；
设置所述随机密钥被同一接收终端查询的次数阈值，当所述同一接收终端查询所述随机密钥的次数达到所述次数阈值后，删除或冻结所述随机密钥。
可选地，所述方法还包括：
所述网络服务器接收到所述发送终端发送的解冻所述随机密钥的指令；
根据所述指令解冻所述随机密钥。
可选地，所述网络服务器接收到所述发送终端创建随机密钥的请求中还包括设置所述随机密钥的查询规则，所述方法还包括：
所述网络服务器在创建所述随机密钥时，设置所述随机密钥的查询规则；
在接收到所述接收终端获取所述发送终端创建的随机密钥的请求时，根据所述请求进行鉴权，当所述请求符合所述查询规则时，鉴权通过，允许所述接收终端进行查询。
可选地，所述随机密钥的查询规则包括以下一个或多个：
允许查询所述随机密钥的用户名单；
允许查询所述随机密钥的次数；
允许查询所述随机密钥的时间段。
又一方面，本发明实施例还提供了一种终端，包括：
随机密钥创建及维护模块，设置为在网络服务器上创建随机密钥；
加密模块，设置为根据与接收终端协商的公共密钥和所述随机密钥对传输信息进行加密得到加密密文，或者，根据所述随机密钥对待传输的信息进行加密得到加密密文；
发送模块，设置为将所述加密密文发送给所述接收终端。
可选地，所述随机密钥包括：随机密钥ID及对应的密钥，所述随机密钥包括一对或多对。
可选地，所述加密模块，设置为根据所述公共密钥和所述随机密钥，对待传输的信息进行加密得到加密密文，包括：
对所述公共密钥采用签名算法生成签名；
以所述公共密钥为密钥对所述随机密钥ID进行加密生成随机密钥密文；
以所述公共密钥和所述随机密钥ID对应的密钥混合为密钥对所述待传输的信息进行加密得到加密的传输信息；
将所述签名、所述随机密钥密文和所述加密的传输信息组合生成最终的加密密文。
可选地，所述加密模块，设置为根据所述随机密钥对待传输的信息进行加密得到加密密文，包括：
根据所述随机密钥ID对应的密钥对所述待传输的信息进行加密得到加密的传输信息，并添加所述随机密钥ID生成最终的加密密文。
又一方面，本发明实施例还提供了一种基于如上所述的终端的适用于管理密钥的终端，还包括：
密钥管理模块，设置为在所述发送模块将所述加密密文发送给所述接收终端后，向所述网络服务器发送删除或冻结所述随机密钥的指令，或者，在所述网络服务器上设置删除或冻结所述随机密钥的规则。
可选地，所述密钥管理模块，设置为在所述网络服务器上设置删除或冻结所述随机密钥的规则包括以下一个或多个：
设置定时器，在所述网络服务器上创建随机密钥后的时间达到定时器设定时间后删除或冻结所述随机密钥；
设置所述随机密钥被同一接收终端查询的次数阈值，当所述同一接收终端查询所述随机密钥的次数达到所述次数阈值后，删除或冻结所述随机密钥。
可选地，所述密钥管理模块，还设置为向所述网络服务器发送解冻所述随机密钥的指令。
可选地，所述随机密钥创建及维护模块，设置为在所述网络服务器上创建随机密钥后，还在所述网络服务器上设置所述随机密钥的查询规则。
可选地，所述随机密钥的查询规则包括以下一个或多个：
允许查询所述随机密钥的用户名单；
允许查询所述随机密钥的次数；
允许查询所述随机密钥的时间段。
又一方面，本发明实施例还提供了一种终端，包括：
接收模块，设置为接收发送终端发送的加密密文；
解密模块，设置为根据所述加密密文向所述网络服务器获取所述发送终端创建的随机密钥，在获取到所述随机密钥后，利用与所述发送终端协商的公共密钥和所述随机密钥对所述加密密文解密，或者，利用所述随机密钥对所述加密密文解密。
可选地，所述解密模块，设置为根据所述加密密文向网络服务器获取所述发送终端创建的随机密钥，包括：
解析所述加密密文获取所述随机密钥ID，根据所述随机密钥ID向所述网络服务器获取所述随机密钥ID对应的随机密钥；
其中，所述加密密文中包含随机密钥ID。
可选地，所述解密模块，设置为向所述网络服务器获取所述接收终端创建的随机密钥，如果获取到所述随机密钥，则利用所述公共密钥和所述随机密钥对所述加密密文解密，包括：
对所述公共密钥采用签名算法生成签名，判断所述签名与所述加密密文中的签名是否一致，当所述签名与所述加密密文中的签名一致时，利用所述公共密钥对所述加密密文中的随机密钥密文解密得到随机密钥ID，根据所述随机密钥ID向所述网络服务器查询该随机密钥ID对应的密钥，当查询到所述随机密钥ID对应的密钥时，利用所述公共密钥和获取到的所述随机密钥ID对应的密钥混合为密钥对所述加密密文中加密的传输信息解密，得到发送终端的传输信息；
其中，所述加密密文包括：签名、随机密钥密文和加密的传输信息。
可选地，所述解密模块，还设置为如果获取不到所述随机密钥，则解密失败，并提示用户随机密钥获取失败。
又一方面，本发明实施例还提供了一种网络服务器，包括：
接收模块，设置为接收发送终端创建随机密钥的请求，接收接收终端获取所述发送终端创建的随机密钥的请求；
随机密钥创建及维护模块，设置为在接收到所述发送终端创建随机密钥的请求后，创建随机密钥并保存；
查询模块，设置为在接收到所述接收终端获取所述发送终端创建的随机密钥的请求后，对所述接收终端进行验证，在验证通过后，查询所述发送终端创建的随机密钥；
发送模块，设置为将创建的所述随机密钥发送至所述发送终端；将查询到的所述随机密钥发送给所述接收终端。
可选地，所述随机密钥包括：随机密钥ID及对应的密钥，所述随机密钥包括一对或多对。
可选地，所述查询模块，设置为对所述接收终端进行验证，包括：
判断所述接收终端获取所述发送终端创建的随机密钥的请求中是否携带有所述随机密钥ID，如果是，则通过验证，如果所述请求中没有携带所述随机密钥ID，验证失败。
可选地，所述查询模块，还设置为在对所述接收终端进行验证，在通过验证后，判断所述随机密钥是否存在或处于解冻状态，当所述随机密钥存在或处于解冻状态时，将查询到的所述随机密钥发送给所述接收终端。
可选地，所述接收模块，还设置为接收所述发送终端发送的删除或冻结所述随机密钥的指令，或者，接收所述发送终端在所述网络服务器上设置的删除或冻结所述随机密钥的规则；
所述随机密钥创建及维护模块，还设置为根据所述指令或所述规则删除或冻结所述随机密钥。
可选地，所述发送终端在所述网络服务器上设置的删除或冻结所述随机密钥的规则包括以下一个或多个：
设置定时器，在所述网络服务器上创建随机密钥后的时间达到定时器设定时间后删除或冻结所述随机密钥；
设置所述随机密钥被同一接收终端查询的次数阈值，当所述同一接收终端查询所述随机密钥的次数达到所述次数阈值后，删除或冻结所述随机密钥。
可选地，所述接收模块，还设置为接收所述发送终端发送的解冻所述随 机密钥的指令；
所述随机密钥创建及维护模块，还设置为根据所述指令解冻所述随机密钥。
可选地，所述发送终端创建随机密钥的请求中还包括设置所述随机密钥的查询规则；
所述随机密钥创建及维护模块，还设置为在创建所述随机密钥时，设置所述随机密钥的查询规则；
所述查询模块，还设置为在接收模块接收到所述接收终端获取所述发送终端创建的随机密钥的请求时，根据所述请求进行鉴权，如果所述请求符合所述查询规则，则鉴权通过，允许所述接收终端进行查询。
可选地，所述随机密钥的查询规则包括以下一个或多个：
允许查询所述随机密钥的用户名单；
允许查询所述随机密钥的次数；
允许查询所述随机密钥的时间段。
再一方面，本发明实施例还提供了一种信息加密解密系统，包括：如上所述的终端、如上所述的终端和如上所述的网络服务器。
本发明实施例还提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述的信息加密方法、信息解密方法或信息加密解密的方法。
与现有技术相比，本发明实施例提供的信息加密、解密、控制密钥失效的方法以及终端和网络服务器，利用存储在网络服务器的随机密钥独立，或与公共密钥组合进行加密或解密，接收终端需要向服务器查询该随机密钥，只有获得了该随机密钥才能完成对加密密文的解密，从而提高了终端传输信息的安全性，此外，发送终端通过删除或冻结所述网络服务器上的随机密钥，使得接收终端无法获得该随机密钥，进而无法解密，从而使发送终端能够远程控制销毁加密信息。
在阅读并理解了附图和详细描述后，可以明白其它方面。
附图概述
图1是本发明实施例中一种信息加密方法的流程图；
图2是一个应用示例中发送终端A在发送前从服务器获取随机生成的id和对应的密钥KEYser的示意图；
图3是一个应用示例中发送终端A通过某种方式(不经过服务器)将只有发送终端A，接收终端B能掌握的密钥KEY传递给接收终端B的示意图；
图4是一个应用示例中A传递给B的加密密文的组成内容的示意图；
图5是本发明实施例中一种信息解密方法的流程图；
图6是一个应用示例中接收终端B从服务器通过id查询到KEYser，然后解密获得明文的示意图；
图7是一个应用示例中A请求网络服务器销毁KEYser的示意图；
图8是本发明实施例中一种信息加密解密方法的流程图；
图9是一个应用示例中一种信息加密解密方法的流程图；
图10是一个应用示例中KEYser销毁后，B无法再解密的示意图；
图11是另一个应用示例中一种信息加密解密方法的流程图；
图12是本发明实施例中一种发送终端的结构图；
图13是本发明实施例中基于如图13所示的发送终端的用于管理密钥的发送终端的结构图；
图14是本发明实施例中一种接收终端的结构图；
图15是本发明实施例中一种网络服务器的结构图。
本发明的较佳实施方式
下文中将结合附图对本发明的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
实施例：
如图1所示，本实施例提供了一种信息加密方法，应用于发送终端侧，包括：
S101：发送终端在网络服务器上创建随机密钥；
其中，所述随机密钥包括：随机密钥ID及对应的密钥，即所述随机密钥为[id，KEYser]，所述随机密钥包括一对或多对，每对随机密钥通过id来识别，并且可以为每对随机密钥备注说明信息，如“和某某通信专用”；随机密钥ID的长度要足够长，这样ID取值空间才足够大，随机生成时才不会出现重复ID，才难以被暴力遍历查询。
S102：所述发送终端根据与接收终端协商的公共密钥和所述随机密钥，对待传输的信息进行加密得到加密密文，或者，所述发送终端根据所述随机密钥，对待传输的信息进行加密得到加密密文；
其中，在步骤S101和S102之前还包括：发送终端与接收终端协商公共密钥；例如，发送终端与接收终端可以口头约定一个公共密钥KEY。
其中，作为一种可选的方式，发送终端根据公共密钥和随机密钥对待传输的信息进行加密得到加密密文的方式包括：
对所述公共密钥采用签名算法生成签名；
以所述公共密钥为密钥，对所述随机密钥ID进行加密生成随机密钥密文；
以所述公共密钥和所述随机密钥ID对应的密钥混合为密钥，对所述待传输的信息进行加密得到加密的传输信息；
将所述签名、所述随机密钥密文(随机密钥ID的密文)和所述加密的传输信息组合生成最终的加密密文。
又或者，增加一个部分，最终生成的加密密文包括：签名、随机密钥ID的密文、随机密钥ID对应的密钥的签名和加密的传输信息，其中，增加的这个随机密钥ID对应的密钥的签名，用于验证从服务器返回的随机密钥ID对应的密钥是否正确。
又或者，去掉一个组成部分，例如去掉签名，结构变为2部分：随机密钥密文和加密的传输信息。
本实施例中，发送终端根据公共密钥和随机密钥对待传输的信息进行加密得到加密密文的方式并不限于上述几种方式，包括多种方式，只要在最终生成的加密密文中包含有随机密钥ID和加密后的传输信息即可。
其中，以所述公共密钥和所述随机密钥ID对应的密钥混合为密钥的方式包括多种，例如，可以将公共密钥和随机密钥做异或运算，所得结果作为密钥，当然不限于举例的这种方式，此处为现有技术，不再赘述。
其中，所述发送终端根据所述随机密钥，对待传输的信息进行加密得到加密密文，包括：
所述发送终端根据所述随机密钥ID对应的密钥，对所述待传输的信息进行加密得到加密的传输信息，并添加所述随机密钥ID生成最终的加密密文。
本实施例中，发送终端根据随机密钥对待传输的信息进行加密得到加密密文的方式也包括多种方式，比如增加随机密钥ID对应的密钥的签名等等，这里不再赘述，只要在最终生成的加密密文中包含有随机密钥ID和加密后的传输信息即可。
S104：所述发送终端将加密密文发送给所述接收终端。
本实施例中，网络服务器上的随机密钥不足以解密该加密密文，即网络服务器也无法了解通信的双方在传递什么信息和文件，因此，可以避免黑客从网络服务器上获取密钥对加密密文解密的情况的发生。
在一个应用示例中，图2是发送终端A在发送前从服务器获取随机生成的id和对应的密钥KEYser的示意图，如图2所示，A通过安全通道(例如安全外壳协议)向服务器请求随机生成id和对应的密钥KEYser；服务器随机生成的一对[id，KEYser]，其中，这个id要足够长(例如128位)，使得随机生成的id不会有重复，并且难以遍历；网络服务器C将这对随机密钥[id，KEYser]存入数据库，并通过安全通道将[id，KEYser]返回给A；
图3是发送终端A通过某种方式(不经过服务器)将只有发送终端A和接收终端B能掌握的密钥KEY传递给接收终端B的示意图。其中，这个密钥必须保密，这样与这次通信无关的外人包括网络服务器都无法解密所传输的信息和文件。较佳方式是A和B事先约定好密钥，用口头传递。
图4是A传递给B的加密密文的组成内容的示意图，其中：
100是对公共密钥KEY做的签名(例如md5或sha算法)，用于对接收终端B进行验证；
200是以公共密钥KEY作为密钥，以id为明文，用加密算法(例如128位AES)生成的密文，这样没有公共密钥KEY，将无法知道id；
300是以公共密钥KEY和随机密钥KEYser混合作为密钥，以此次传输的信息和文件作为明文，用加密算法(例如128位AES)生成的密文，公共密钥KEY和随机密钥KEYser缺少任意一个，均不能解密。
如图5所示，本实施例提供了一种信息解密方法，应用于接收终端侧，包括：
S201：所述接收终端接收到发送终端发送的加密密文；
S202：所述接收终端向所述网络服务器获取所述发送终端创建的随机密钥；
其中，接收终端向所述网络服务器发送获取所述发送终端创建的随机密钥的请求，一种可选的方式是，该请求中携带接收终端在网络服务器上登录的用户名和登录密码，以便于网络服务器对终端进行登录认证，当然并不排除请求携带其他用于网络服务器登录认证的信息。
S203：在获取到所述随机密钥后，利用与所述发送终端协商的公共密钥和所述随机密钥对所述加密密文解密，或者，利用所述随机密钥对所述加密密文解密。
其中，在上述步骤之前还包括：接收终端与发送终端协商公共密钥；此处的公共密钥与图1提供的加密方法中的公共密钥是相同。
本实施例中，接收终端根据公共密钥和随机密钥，或者仅根据随机密钥对加密密文解密的方式与发送终端侧的加密方式是对应的，但最终都需要从加密密文中解析得到随机密钥ID，然后向网络服务器获取该随机密钥ID对应的密钥对加密后的传输信息解密。
作为一种可选的方式，与发送终端侧对应地，所述加密密文包括：签名、 随机密钥密文和加密的传输信息；
步骤S203和S204，具体包括：
所述接收终端对所述公共密钥采用签名算法生成签名，判断所述签名与所述加密密文中的签名是否一致，如果一致，则利用所述公共密钥对所述加密密文中的随机密钥密文解密得到随机密钥ID，根据所述随机密钥ID向所述网络服务器查询该随机密钥ID对应的密钥(即接收终端在向所述网络服务器发送获取所述发送终端创建的随机密钥的请求中还携带有随机密钥ID)，如果查询到所述随机密钥ID对应的密钥，则利用所述公共密钥和获取到的所述随机密钥ID对应的密钥混合为密钥对加密密文解密，得到传输的信息。
其中，作为另一种可选的方式，所述加密密文中包含随机密钥ID，所述接收终端根据所述加密密文向网络服务器获取所述发送终端创建的随机密钥，包括：
所述接收终端解析所述加密密文获取所述随机密钥ID，根据所述随机密钥ID向所述网络服务器获取所述随机密钥ID对应的随机密钥。
此外，所述方法还包括：如果获取不到所述随机密钥，则解密失败，并提示用户随机密钥获取失败。
在一个应用示例中，图6是接收终端B从服务器通过id查询到KEYser，然后解密获得明文的示意图，其中，接收终端B，其实是指代B上运行的接收密文的客户端，B用公共密钥KEY解密出id，然后通过安全通道(例如SSH)向网络服务器C发出请求，请求参数中带有id，C收到id，从数据库查询，得到id对应的密钥KEYser，返回给B。此时，B掌握了公共密钥KEY和KEYser，能够解密得到被传输的信息和文件。
其中，接收终端B不允许保存KEYser，以及解密出来的被传输的信息和文件，该限制由接收终端B来执行。
基于上述信息加密和解密的方法，本实施例还提供了一种管理密钥的方法，包括：
所述发送终端在将加密信息和所述加密密文发送给所述接收终端后，向 所述网络服务器发送删除或冻结所述随机密钥的指令，或者，所述发送终端在所述网络服务器上设置删除或冻结所述随机密钥的规则。
其中，所述发送终端在所述网络服务器上设置删除或冻结所述随机密钥的规则包括以下一个或多个：
设置定时器，在所述网络服务器上创建随机密钥后的时间达到定时器设定时间后删除或冻结所述随机密钥；
例如，在具体实现时，通过定时器设定时间，可以为创建的n天后自动删除/冻结；或者，到某一个日期时自动删除/冻结；
设置所述随机密钥被同一接收终端查询的次数阈值，当所述同一接收终端查询所述随机密钥的次数达到所述次数阈值后，删除或冻结所述随机密钥。
所述方法还包括：
所述发送终端向所述网络服务器发送解冻所述随机密钥的指令。
作为一种可选的方式，在步骤S102中所述发送终端在所述网络服务器上创建随机密钥后，本方法还包括：
所述发送终端在所述网络服务器上设置所述随机密钥的查询规则。
所述随机密钥的查询规则包括但不限于以下的一个或多个：
允许查询所述随机密钥的用户名单；
允许查询所述随机密钥的次数；
允许查询所述随机密钥的时间段。
其中，和大多数网站一样，每个用户都需要在网络服务器上注册用户名和密码，用户名单包括一个或多个用户名，所述用户名可以是终端用户的手机号码，也可以用户自己取的一个昵称。查询所述随机密钥的次数，是指同一随机密钥ID对应的密钥被查询的次数不能超过一定次数；查询所述随机密钥的时间段，有些随机密钥只能在一天中的某些时间段允许被查询。
在一个应用示例中，图7是A请求网络服务器销毁KEYser的示意图，其中，A通过安全通道向服务器发出请求，请求参数中带有id，服务器在鉴权通过后，删除数据库中保存的[id，KEYser]；
如图8所示，本实施例提供了一种信息加密解密的方法，应用于网络侧，包括：
S301：网络服务器接收到发送终端创建随机密钥的请求；
S302：创建随机密钥并保存，将所述随机密钥发送至所述发送终端；
其中，所述随机密钥包括：随机密钥ID及对应的密钥，即所述随机密钥为[id，KEYser]，所述随机密钥包括一对或多对，每对随机密钥通过id来识别，并且可以为每对随机密钥备注说明信息，如“和某某通信专用”；
S303：所述网络服务器接收到接收终端获取所述发送终端创建的随机密钥的请求；
作为一种可选的方式，所述网络服务器接收到所述发送终端创建随机密钥的请求中还包括设置所述随机密钥的查询规则，所述方法还包括：
所述网络服务器在创建所述随机密钥时，设置所述随机密钥的查询规则；
并根据所述查询规则对所述接收终端获取所述发送终端创建的随机密钥的请求进行鉴权，如果所述请求符合所述查询规则，则鉴权通过，允许所述接收终端进行查询，即继续执行步骤S304。
其中，所述随机密钥的查询规则包括但不限于以下一个或多个：
允许查询所述随机密钥的用户名单；
允许查询所述随机密钥的次数；
允许查询所述随机密钥的时间段。
S304：对所述接收终端进行验证，在通过验证后，将查询到的所述随机密钥发送给所述接收终端。
其中，所述对所述接收终端进行验证，包括：
判断所述接收终端获取所述发送终端创建的随机密钥的请求中是否携带有所述随机密钥ID，如果是，则通过验证，否则，验证失败。
由于存在所述随机密钥已被删除或冻结(不可查询状态)的情况，所以，在步骤S304中，对所述接收终端进行验证，在通过验证后，还包括：
判断所述随机密钥是否存在或处于解冻状态(可查询状态)，如果是，则将查询到的所述随机密钥发送给所述接收终端。
其中，在步骤S302之后，所述方法还包括：
S302a：所述网络服务器接收到所述发送终端发送的删除或冻结所述随机密钥的指令，或者，接收到所述发送终端在所述网络服务器上设置的删除或冻结所述随机密钥的规则；
其中，所述发送终端在所述网络服务器上设置的删除或冻结所述随机密钥的规则包括以下一个或多个：
设置定时器，在所述网络服务器上创建随机密钥后的时间达到定时器设定时间后删除或冻结所述随机密钥；
设置所述随机密钥被同一接收终端查询的次数阈值，当所述同一接收终端查询所述随机密钥的次数达到所述次数阈值后，删除或冻结所述随机密钥。
S302b：根据所述指令或所述规则删除或冻结所述随机密钥。
其中，所述方法还包括：
所述网络服务器接收到所述发送终端发送的解冻所述随机密钥的指令；
根据所述指令解冻所述随机密钥。
在一个应用示例中，A为发送终端，B为接收终端，C为网络服务器；A和B均在C上注册了用户名和密码；A和B事先通过口头约定了只有A，B能掌握的密钥KEY(公共密钥)，采用公共密钥和随机密钥加密/解密的方式；如图9所示，信息加密解密的方法，包括以下步骤：
S401：A通过浏览器访问HTTPS页面或者通过专用客户端建立的SSH通道，用自己的用户名和密码登录C，创建一对[id，KEYser]，为这对[id，KEYser]填写一段人类可以识别的说明，如“和某某通信专用”；A使用的客户端在发送加密信息和加密密文前，需要请A指定这次通信所使用的[id，KEYser]；
在本实现例中，每对[id，KEYser]都可以设定查询规则，可选的规则如 前述规则，这里不再赘述。
在本实现例中，每对[id，KEYser]都可以手动删除/冻结/解冻，也可以通过在C上设置相应规则来实现删除/冻结。冻结并非删除，但是处于冻结状态下的[id，KEYser]，除A之外的其它用户均查询不到；每对[id，KEYser]都可以设定删除/冻结规则，可选的删除/冻结规则如前述规则，这里不再赘述。
S402：A利用KEY和KEYer对传输的信息和文件进行加密，将加密密文发送给B；
其中，A发送给B的加密密文由3部分组成：
(a)对KEY用md5算法生成的签名；
(b)以KEY为密钥，用128位AES算法对id进行加密得到的随机密钥密文；
(c)以KEY异或KEYser的运算结果作为密钥，以此次传输的信息和文件作为明文，用128位AES算法生成的加密密文；
S403：B使用的客户端收到了加密的信息和文件后，请B输入KEY，获得B的输入后，对B输入的密钥用md5算法生成了签名与S402中(a)比较，如果一致，说明B输入了正确的KEY；用KEY解密上述S402中(b)，得到id；然后该客户端与C建立起SSH通道，用自己的用户名和密码登录C，向C发起查询，参数是id，B的用户名和密码；
S404：C根据id在数据库中查询，如果查询到有匹配的结果(并且状态为“未冻结”)，就把查到的[id，KEYser]返回给B的客户端；
如果没有查询到，则返回B的客户端null；
其中，在步骤S403后，如果A设置了查询规则，C会先按照查询规则对B的客户端的请求进行鉴权，如果请求中的用户名在A设置的允许访问的用户名单上，则鉴权通过，转到S404继续执行，
或者，在执行步骤S404后，C进一步按照查询规则对B进行鉴权，如果鉴权通过则执行步骤S405；
S405：B的客户端在得到了[id，KEYser]后，以KEY异或KEYser的运算结果作为密钥，用128位AES算法解密S402中(c)，得到传输信息和文 件的明文；B使用的客户端将[id，KEYser]，以及解密得到的明文存放在内存中，不提供将它们转存在存储设备上的功能。B只能使用这个专用客户端查看解密得到的信息和文件。一旦退出客户端，内存中的[id，KEYser]和解密得到的明文均会消失。
如果C上的[id，KEYser]已经被删除或冻结，则B无法获取到KEYser。图10是KEYser销毁后，B无法再解密的示意图，如图所示，B用KEY解密出id，然后通过安全通道(例如SSH)向C发出请求，请求参数中带有id，C收到id，从数据库查询，但是KEYser已经销毁无法再查到。此时，C向B返回null，B只有公共密钥KEY，不能解密得到被传输的信息和文件。这样加密信息和文件实际上已被销毁，只是一堆乱码了。
在一个应用示例中，A为发送终端，B为接收终端，C为网络服务器；A和B均在C上注册了用户名和密码；A和B无需事先约定公共密钥，利用随机密钥加密或解密；如图11所示，信息加密解密的方法，包括以下步骤：
S501与步骤S401相同，此处不再赘述；
S502：A利用KEYer对传输的信息和文件进行加密，将加密密文发送给B；
其中，A发送给B的加密密文由2部分组成：
(a)以KEYser为密钥，以此次传输的信息和文件作为明文，用128位AES算法生成的加密密文；
(b)KEYser对应的id；
S503：B使用的客户端收到了加密密文后，得到所述KEYser对应的id；然后该客户端与C建立起SSH通道，用自己的用户名和密码登录C，向C发起查询，参数是id，B的用户名和密码；
S504与步骤S404相同，此处不再赘述；
S505：B的客户端在得到了[id，KEYser]后，以KEYser为密钥，用128位AES算法解密S502中(a)，得到传输信息和文件的明文；B使用的客户端将[id，KEYser]，以及解密得到的明文存放在内存中，不提供将它们转存在存储设备上的功能。B只能使用这个专用客户端查看解密得到的信息和文件。 一旦退出客户端，内存中的[id，KEYser]和解密得到的明文均会消失。
如果C上的[id，KEYser]已经被删除或冻结，则B无法获取到KEYser。图10是KEYser销毁后，B无法再解密的示意图，如图所示，B用KEY解密出id，然后通过安全通道(例如SSH)向C发出请求，请求参数中带有id，C收到id，从数据库查询，但是KEYser已经销毁无法再查到。此时，C向B返回null，B只有公共密钥KEY，不能解密得到被传输的信息和文件。这样加密信息和文件实际上已被销毁，只是一堆乱码了。
如图12所示，本实施例提供了一种发送终端，用于信息加密，所述发送终端包括处理器和程序存储设备，所述程序存储设备用于存储包含计算机可读指令的模块，包括：
随机密钥创建及维护模块，设置为在网络服务器上创建随机密钥；
其中，所述随机密钥包括：随机密钥ID及对应的密钥，所述随机密钥包括一对或多对。
加密模块，设置为根据与接收终端协商的公共密钥和所述随机密钥，对传输信息进行加密得到加密密文，或者，根据所述随机密钥对待传输的信息进行加密得到加密密文；
发送模块，设置为将所述加密密文发送给所述接收终端。
其中，作为一种可选的方式，还包括：公共密钥协商模块，设置为与接收终端协商公共密钥；
其中，作为一种可选的方式，所述加密模块，设置为根据所述公共密钥和所述随机密钥，对待传输的信息进行加密得到加密密文，包括：
对所述公共密钥采用签名算法生成签名；
以所述公共密钥为密钥对所述随机密钥ID进行加密生成随机密钥密文；
以所述公共密钥和所述随机密钥ID对应的密钥混合为密钥对所述待传输的信息进行加密得到加密的传输信息；
将所述签名、所述随机密钥密文和所述加密的传输信息组合生成最终的 加密密文。
其中，作为另一种可选的方式，所述加密模块，设置为根据所述随机密钥对待传输的信息进行加密得到加密密文，包括：
根据所述随机密钥ID对应的密钥对所述待传输的信息进行加密得到加密的传输信息，并添加所述随机密钥ID生成最终的加密密文。
如图13所示，本实施例还提供了一种基于如图12所示的发送终端的用于管理密钥的发送终端，如图13所示，除了图12中包括的模块之外，还包括：
密钥管理模块，设置为在所述发送模块将所述加密密文发送给所述接收终端后，向所述网络服务器发送删除或冻结所述随机密钥的指令，或者，在所述网络服务器上设置删除或冻结所述随机密钥的规则。
所述密钥管理模块，设置为在所述网络服务器上设置删除或冻结所述随机密钥的规则包括以下一个或多个：
设置定时器，在所述网络服务器上创建随机密钥后的时间达到定时器设定时间后删除或冻结所述随机密钥；
设置所述随机密钥被同一接收终端查询的次数阈值，当所述同一接收终端查询所述随机密钥的次数达到所述次数阈值后，删除或冻结所述随机密钥。
其中，所述密钥管理模块，还设置为向所述网络服务器发送解冻所述随机密钥的指令。
其中，所述随机密钥创建及维护模块，设置为在所述网络服务器上创建随机密钥后，还在所述网络服务器上设置所述随机密钥的查询规则。
其中，所述随机密钥的查询规则包括以下一个或多个：
允许查询所述随机密钥的用户名单；
允许查询所述随机密钥的次数；
允许查询所述随机密钥的时间段。
如图14所示，本实施例提供了一种接收终端，用于信息解密，所述接收 终端包括处理器和程序存储设备，所述程序存储设备用于存储包含计算机可读指令的模块，包括：
接收模块，设置为接收所述发送终端发送的加密密文；
解密模块，设置为根据所述加密密文向所述网络服务器获取所述发送终端创建的随机密钥，在获取到所述随机密钥后，利用与所述发送终端协商的公共密钥和所述随机密钥对所述加密密文解密，或者，利用所述随机密钥对所述加密密文解密。
其中，作为一种可选的方式，所述终端还包括：公共密钥协商模块，用于与发送终端协商公共密钥；
其中，作为一种可选的方式，所述解密模块，设置为根据所述加密密文向网络服务器获取所述发送终端创建的随机密钥，包括：
解析所述加密密文获取所述随机密钥ID，根据所述随机密钥ID向所述网络服务器获取所述随机密钥ID对应的随机密钥；
其中，所述加密密文中包含随机密钥ID。
其中，作为一种可选的方式，所述解密模块，设置为向所述网络服务器获取所述接收终端创建的随机密钥，如果获取到所述随机密钥，则利用所述公共密钥和所述随机密钥对所述加密密文解密，包括：
所述接收终端对所述公共密钥采用签名算法生成签名，判断所述签名与所述加密密文中的签名是否一致，如果一致，则利用所述公共密钥对所述加密密文中的随机密钥密文解密得到随机密钥ID，根据所述随机密钥ID向所述网络服务器查询该随机密钥ID对应的密钥，如果查询到所述随机密钥ID对应的密钥，则利用所述公共密钥和获取到的所述随机密钥ID对应的密钥混合为密钥对所述加密的传输信息解密，得到发送终端的传输信息；
其中，所述加密密文包括：签名、随机密钥密文和加密的传输信息。
此外，所述解密模块，还设置为如果获取不到所述随机密钥，则解密失败，并提示用户随机密钥获取失败。
如图15所示，本实施例提供了一种网络服务器，所述服务器包括处理器 和程序存储设备，所述程序存储设备用于存储包含计算机可读指令的模块，包括：
接收模块，设置为接收发送终端创建随机密钥的请求，接收接收终端获取所述发送终端创建的随机密钥的请求；
随机密钥创建及维护模块，设置为在接收到所述发送终端创建随机密钥的请求后，创建随机密钥并保存；
其中，所述随机密钥包括：随机密钥ID及对应的密钥，所述随机密钥包括一对或多对。
其中，作为一种可选的方式，所述接收模块，还设置为接收所述发送终端发送的删除或冻结所述随机密钥的指令，或者，接收所述发送终端在所述网络服务器上设置的删除或冻结所述随机密钥的规则；
所述随机密钥创建及维护模块，还设置为根据所述指令或所述规则删除或冻结所述随机密钥。
所述发送终端在所述网络服务器上设置的删除或冻结所述随机密钥的规则包括以下一个或多个：
设置定时器，在所述网络服务器上创建随机密钥后的时间达到定时器设定时间后删除或冻结所述随机密钥；
设置所述随机密钥被同一接收终端查询的次数阈值，当所述同一接收终端查询所述随机密钥的次数达到所述次数阈值后，删除或冻结所述随机密钥。
其中，作为一种可选的方式，所述接收模块，还设置为接收所述发送终端发送的解冻所述随机密钥的指令；
所述随机密钥创建及维护模块，还设置为根据所述指令解冻所述随机密钥。
查询模块，设置为在接收到所述接收终端获取所述发送终端创建的随机密钥的请求后，对所述接收终端进行验证；
其中，所述查询模块，设置为对所述接收终端进行验证，包括：
判断所述接收终端获取所述发送终端创建的随机密钥的请求中是否携带 有所述随机密钥ID，如果是，则通过验证，否则，验证失败。
所述查询模块，还设置为在对所述接收终端进行验证，在通过验证后，判断所述随机密钥是否存在或处于解冻状态(可查询状态)，如果是，则将查询到的所述随机密钥发送给所述接收终端。
其中，作为一种可选的方式，所述发送终端创建随机密钥的请求中还包括设置所述随机密钥的查询规则；
所述随机密钥创建及维护模块，还设置为在创建所述随机密钥时，设置所述随机密钥的查询规则；
所述查询模块，还设置为在接收模块接收到所述接收终端获取所述发送终端创建的随机密钥的请求时，根据所述请求进行鉴权，如果所述请求符合所述查询规则，则鉴权通过，允许所述接收终端进行查询。
所述随机密钥的查询规则包括以下一个或多个：
允许查询所述随机密钥的用户名单；
允许查询所述随机密钥的次数；
允许查询所述随机密钥的时间段。
发送模块，设置为将创建的所述随机密钥发送至所述发送终端；在通过验证后，将查询到的所述随机密钥发送给所述接收终端。
此外，本实施例还提供了一种信息加密解密系统，包括：如上所述的发送终端、接收终端和网络服务器。
从上述实施例可以看出，相对于现有技术，上述实施例中提供的信息加密、解密、控制密钥失效的方法以及终端和网络服务器，利用存储在网络服务器的随机密钥独立，或与公共密钥组合进行加密或解密，接收终端需要向服务器查询该随机密钥，只有获得了该随机密钥才能完成对加密密文的解密，从而提高了终端传输信息的安全性，此外，发送终端通过删除或冻结所述网络服务器上的随机密钥，使得接收终端无法获得该随机密钥，进而无法解密，从而使发送终端能够远程控制销毁加密信息。
本领域普通技术人员可以理解上述方法中的全部或部分步骤可通过程序来指令相关硬件完成，所述程序可以存储于计算机可读存储介质中，如只读存储器、磁盘或光盘等，上述相关指令可以由处理器执行，以实现相应的方法。可选地，上述实施例的全部或部分步骤也可以使用一个或多个集成电路来实现。相应地，上述实施例中的各模块/单元可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。本发明不限制于任何特定形式的硬件和软件的结合。
以上所述仅为本发明的优选实施例而已，并非用于限定本发明的保护范围。根据本发明的发明内容，还可有其他多种实施例，在不背离本发明精神及其实质的情况下，熟悉本领域的技术人员当可根据本发明作出各种相应的改变和变形，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
本发明实施例利用存储在网络服务器的随机密钥独立，或与公共密钥组合进行加密或解密，接收终端向服务器查询该随机密钥，只有获得了该随机密钥才能完成对加密密文的解密，从而提高终端传输信息的安全性，此外，发送终端通过删除或冻结所述网络服务器上的随机密钥，使得接收终端无法获得该随机密钥，进而无法解密，使发送终端能够远程控制销毁加密信息。

Claims (45)

  1. 一种信息加密方法，应用于终端侧，包括：
    发送终端在网络服务器上创建随机密钥；
    所述发送终端根据与接收终端协商的公共密钥和所述随机密钥，对待传输的信息进行加密得到加密密文，或者，所述发送终端根据所述随机密钥对待传输的信息进行加密得到加密密文；
    所述发送终端将所述加密密文发送给所述接收终端。
  2. 如权利要求1所述的方法，其中：
    所述随机密钥包括：随机密钥ID及对应的密钥，所述随机密钥包括一对或多对。
  3. 如权利要求2所述的方法，其中：
    所述发送终端根据所述公共密钥和所述随机密钥，对待传输的信息进行加密得到加密密文，包括：
    对所述公共密钥采用签名算法生成签名；
    以所述公共密钥为密钥对所述随机密钥ID进行加密生成随机密钥密文；
    以所述公共密钥和所述随机密钥ID对应的密钥混合为密钥，对所述待传输的信息进行加密得到加密的传输信息；
    将所述签名、所述随机密钥密文和所述加密的传输信息组合生成最终的加密密文。
  4. 如权利要求2所述的方法，其中：
    所述发送终端根据所述随机密钥对待传输的信息进行加密得到加密密文，包括：
    所述发送终端根据所述随机密钥ID对应的密钥对所述待传输的信息进行加密得到加密的传输信息，并添加所述随机密钥ID生成最终的加密密文。
  5. 一种基于如权利要求1至4任一项所述的信息加密方法的管理密钥的 方法，包括：
    所述发送终端在将所述加密密文发送给所述接收终端后，向所述网络服务器发送删除或冻结所述随机密钥的指令，或者，所述发送终端在所述网络服务器上设置删除或冻结所述随机密钥的规则。
  6. 如权利要求5所述的方法，其中：
    所述发送终端在所述网络服务器上设置删除或冻结所述随机密钥的规则包括以下一个或多个：
    设置定时器，在所述网络服务器上创建随机密钥后的时间达到定时器设定时间后删除或冻结所述随机密钥；
    设置所述随机密钥被同一接收终端查询的次数阈值，当所述同一接收终端查询所述随机密钥的次数达到所述次数阈值后，删除或冻结所述随机密钥。
  7. 如权利要求5所述的方法，还包括：
    所述发送终端向所述网络服务器发送解冻所述随机密钥的指令。
  8. 如权利要求5所述的方法，其中：
    所述发送终端在所述网络服务器上创建随机密钥后，还包括：
    所述发送终端在所述网络服务器上设置所述随机密钥的查询规则。
  9. 如权利要求8所述的方法，其中：
    所述随机密钥的查询规则包括以下一个或多个：
    允许查询所述随机密钥的用户名单；
    允许查询所述随机密钥的次数；
    允许查询所述随机密钥的时间段。
  10. 一种信息解密方法，应用于终端侧，包括：
    接收终端接收到发送终端发送的加密密文；
    所述接收终端根据所述加密密文向网络服务器获取所述发送终端创建的随机密钥，在获取到所述随机密钥后，利用与所述发送终端协商的公共密钥 和所述随机密钥对所述加密密文解密，或者，利用所述随机密钥对所述加密密文解密。
  11. 如权利要求10所述的方法，其中：
    所述加密密文中包含随机密钥ID，所述接收终端根据所述加密密文向网络服务器获取所述发送终端创建的随机密钥，包括：
    所述接收终端解析所述加密密文获取所述随机密钥ID，根据所述随机密钥ID向所述网络服务器获取所述随机密钥ID对应的随机密钥。
  12. 如权利要求10所述的方法，其中：
    所述加密密文包括：签名、随机密钥密文和加密的传输信息；
    所述接收终端向所述网络服务器获取所述接收终端创建的随机密钥，如果获取到所述随机密钥，则利用所述公共密钥和所述随机密钥对所述加密密文解密，包括：
    所述接收终端对所述公共密钥采用签名算法生成签名，判断所述签名与所述加密密文中的签名是否一致，当所述签名与所述加密密文中的签名一致时，利用所述公共密钥对所述加密密文中的随机密钥密文解密得到随机密钥ID，根据所述随机密钥ID向所述网络服务器查询该随机密钥ID对应的密钥，当查询到所述随机密钥ID对应的密钥时，利用所述公共密钥和获取到的所述随机密钥ID对应的密钥混合为密钥，对所述加密的传输信息解密，得到发送终端的传输信息。
  13. 一种信息加密解密的方法，应用于网络侧，包括：
    网络服务器接收到发送终端创建随机密钥的请求后，创建随机密钥并保存，将所述随机密钥发送至所述发送终端；
    所述网络服务器接收到接收终端获取所述发送终端创建的随机密钥的请求，对所述接收终端进行验证，在通过验证后，将查询到的所述随机密钥发送给所述接收终端。
  14. 如权利要求13所述的方法，其中：
    所述随机密钥包括：随机密钥ID及对应的密钥，所述随机密钥包括一对或多对。
  15. 如权利要求14所述的方法，其中：
    所述对所述接收终端进行验证，包括：
    判断所述接收终端获取所述发送终端创建的随机密钥的请求中是否携带有所述随机密钥ID，如果是，则通过验证，如果所述请求中没有携带所述随机密钥ID，验证失败。
  16. 如权利要求15所述的方法，其中：
    在对所述接收终端进行验证，在通过验证后，所述方法还包括：
    判断所述随机密钥是否存在或处于解冻状态，当所述随机密钥存在或处于解冻状态时，将查询到的所述随机密钥发送给所述接收终端。
  17. 如权利要求14所述的方法，其中：
    在所述创建随机密钥并保存，将所述随机密钥发送至所述发送终端后，所述方法还包括：
    所述网络服务器接收到所述发送终端发送的删除或冻结所述随机密钥的指令，或者，接收到所述发送终端在所述网络服务器上设置的删除或冻结所述随机密钥的规则，根据所述指令或所述规则删除或冻结所述随机密钥。
  18. 如权利要求17所述的方法，其中：
    所述发送终端在所述网络服务器上设置的删除或冻结所述随机密钥的规则包括以下一个或多个：
    设置定时器，在所述网络服务器上创建随机密钥后的时间达到定时器设定时间后删除或冻结所述随机密钥；
    设置所述随机密钥被同一接收终端查询的次数阈值，当所述同一接收终端查询所述随机密钥的次数达到所述次数阈值后，删除或冻结所述随机密钥。
  19. 如权利要求17或18所述的方法，还包括：
    所述网络服务器接收到所述发送终端发送的解冻所述随机密钥的指令；
    根据所述指令解冻所述随机密钥。
  20. 如权利要求13所述的方法，其中
    所述网络服务器接收到所述发送终端创建随机密钥的请求中还包括设置所述随机密钥的查询规则，所述方法还包括：
    所述网络服务器在创建所述随机密钥时，设置所述随机密钥的查询规则；
    在接收到所述接收终端获取所述发送终端创建的随机密钥的请求时，根据所述请求进行鉴权，当所述请求符合所述查询规则时，鉴权通过，允许所述接收终端进行查询。
  21. 如权利要求20所述的方法，其中：
    所述随机密钥的查询规则包括以下一个或多个：
    允许查询所述随机密钥的用户名单；
    允许查询所述随机密钥的次数；
    允许查询所述随机密钥的时间段。
  22. 一种终端，包括：
    随机密钥创建及维护模块，设置为在网络服务器上创建随机密钥；
    加密模块，设置为根据与接收终端协商的公共密钥和所述随机密钥对传输信息进行加密得到加密密文，或者，根据所述随机密钥对待传输的信息进行加密得到加密密文；
    发送模块，设置为将所述加密密文发送给所述接收终端。
  23. 如权利要求22所述的终端，其中：
    所述随机密钥包括：随机密钥ID及对应的密钥，所述随机密钥包括一对或多对。
  24. 如权利要求22所述的终端，其中：
    所述加密模块，设置为根据所述公共密钥和所述随机密钥，对待传输的 信息进行加密得到加密密文，包括：
    对所述公共密钥采用签名算法生成签名；
    以所述公共密钥为密钥对所述随机密钥ID进行加密生成随机密钥密文；
    以所述公共密钥和所述随机密钥ID对应的密钥混合为密钥对所述待传输的信息进行加密得到加密的传输信息；
    将所述签名、所述随机密钥密文和所述加密的传输信息组合生成最终的加密密文。
  25. 如权利要求22所述的终端，其中：
    所述加密模块，设置为根据所述随机密钥对待传输的信息进行加密得到加密密文，包括：
    根据所述随机密钥ID对应的密钥对所述待传输的信息进行加密得到加密的传输信息，并添加所述随机密钥ID生成最终的加密密文。
  26. 一种基于如权利要求22至25任一项所述的终端的适用于管理密钥的终端，还包括：
    密钥管理模块，设置为在所述发送模块将所述加密密文发送给所述接收终端后，向所述网络服务器发送删除或冻结所述随机密钥的指令，或者，在所述网络服务器上设置删除或冻结所述随机密钥的规则。
  27. 如权利要求26所述的终端，其中：
    所述密钥管理模块，设置为在所述网络服务器上设置删除或冻结所述随机密钥的规则包括以下一个或多个：
    设置定时器，在所述网络服务器上创建随机密钥后的时间达到定时器设定时间后删除或冻结所述随机密钥；
    设置所述随机密钥被同一接收终端查询的次数阈值，当所述同一接收终端查询所述随机密钥的次数达到所述次数阈值后，删除或冻结所述随机密钥。
  28. 如权利要求26所述的终端，其中：
    所述密钥管理模块，还设置为向所述网络服务器发送解冻所述随机密钥的指令。
  29. 如权利要求26所述的终端，其中：
    所述随机密钥创建及维护模块，设置为在所述网络服务器上创建随机密钥后，还在所述网络服务器上设置所述随机密钥的查询规则。
  30. 如权利要求29所述的终端，其中：
    所述随机密钥的查询规则包括以下一个或多个：
    允许查询所述随机密钥的用户名单；
    允许查询所述随机密钥的次数；
    允许查询所述随机密钥的时间段。
  31. 一种终端，包括：
    接收模块，设置为接收发送终端发送的加密密文；
    解密模块，设置为根据所述加密密文向所述网络服务器获取所述发送终端创建的随机密钥，在获取到所述随机密钥后，利用与所述发送终端协商的公共密钥和所述随机密钥对所述加密密文解密，或者，利用所述随机密钥对所述加密密文解密。
  32. 如权利要求31所述的终端，其中：
    所述解密模块，设置为根据所述加密密文向网络服务器获取所述发送终端创建的随机密钥，包括：
    解析所述加密密文获取所述随机密钥ID，根据所述随机密钥ID向所述网络服务器获取所述随机密钥ID对应的随机密钥；
    其中，所述加密密文中包含随机密钥ID。
  33. 如权利要求31所述的终端，其中：
    所述解密模块，设置为向所述网络服务器获取所述接收终端创建的随机密钥，当获取到所述随机密钥时，利用所述公共密钥和所述随机密钥对所述 加密密文解密，包括：
    对所述公共密钥采用签名算法生成签名，判断所述签名与所述加密密文中的签名是否一致，当所述签名与所述加密密文中的签名一致时，利用所述公共密钥对所述加密密文中的随机密钥密文解密得到随机密钥ID，根据所述随机密钥ID向所述网络服务器查询该随机密钥ID对应的密钥，当查询到所述随机密钥ID对应的密钥时，利用所述公共密钥和获取到的所述随机密钥ID对应的密钥混合为密钥对所述加密密文中加密的传输信息解密，得到发送终端的传输信息；
    其中，所述加密密文包括：签名、随机密钥密文和加密的传输信息。
  34. 如权利要求31所述的终端，其中：
    所述解密模块，还设置为如果获取不到所述随机密钥，则解密失败，并提示用户随机密钥获取失败。
  35. 一种网络服务器，包括：
    接收模块，设置为接收发送终端创建随机密钥的请求，接收接收终端获取所述发送终端创建的随机密钥的请求；
    随机密钥创建及维护模块，设置为在接收到所述发送终端创建随机密钥的请求后，创建随机密钥并保存；
    查询模块，设置为在接收到所述接收终端获取所述发送终端创建的随机密钥的请求后，对所述接收终端进行验证，在验证通过后，查询所述发送终端创建的随机密钥；
    发送模块，设置为将创建的所述随机密钥发送至所述发送终端；将查询到的所述随机密钥发送给所述接收终端。
  36. 如权利要求35所述的网络服务器，其中：
    所述随机密钥包括：随机密钥ID及对应的密钥，所述随机密钥包括一对或多对。
  37. 如权利要求36所述的网络服务器，其中：
    所述查询模块，设置为对所述接收终端进行验证，包括：
    判断所述接收终端获取所述发送终端创建的随机密钥的请求中是否携带有所述随机密钥ID，如果是，则通过验证，如果所述请求中没有携带所述随机密钥ID，验证失败。
  38. 如权利要求37所述的网络服务器，其中：
    所述查询模块，还设置为在对所述接收终端进行验证，在通过验证后，判断所述随机密钥是否存在或处于解冻状态，当所述随机密钥存在或处于解冻状态时，将查询到的所述随机密钥发送给所述接收终端。
  39. 如权利要求36所述的网络服务器，其中：
    所述接收模块，还设置为接收所述发送终端发送的删除或冻结所述随机密钥的指令，或者，接收所述发送终端在所述网络服务器上设置的删除或冻结所述随机密钥的规则；
    所述随机密钥创建及维护模块，还设置为根据所述指令或所述规则删除或冻结所述随机密钥。
  40. 如权利要求39所述的网络服务器，其中：
    所述发送终端在所述网络服务器上设置的删除或冻结所述随机密钥的规则包括以下一个或多个：
    设置定时器，在所述网络服务器上创建随机密钥后的时间达到定时器设定时间后删除或冻结所述随机密钥；
    设置所述随机密钥被同一接收终端查询的次数阈值，当所述同一接收终端查询所述随机密钥的次数达到所述次数阈值后，删除或冻结所述随机密钥。
  41. 如权利要求39或40所述的网络服务器，其中：
    所述接收模块，还设置为接收所述发送终端发送的解冻所述随机密钥的指令；
    所述随机密钥创建及维护模块，还设置为根据所述指令解冻所述随机密钥。
  42. 如权利要求35所述的网络服务器，其中：
    所述发送终端创建随机密钥的请求中还包括设置所述随机密钥的查询规则；
    所述随机密钥创建及维护模块，还设置为在创建所述随机密钥时，设置所述随机密钥的查询规则；
    所述查询模块，还设置为在接收模块接收到所述接收终端获取所述发送终端创建的随机密钥的请求时，根据所述请求进行鉴权，如果所述请求符合所述查询规则，则鉴权通过，允许所述接收终端进行查询。
  43. 如权利要求42所述的网络服务器，其中：
    所述随机密钥的查询规则包括以下一个或多个：
    允许查询所述随机密钥的用户名单；
    允许查询所述随机密钥的次数；
    允许查询所述随机密钥的时间段。
  44. 一种信息加密解密系统，包括：如权利要求22～30所述的终端、如权利要求31～34所述的终端和如权利要求35～43所述的网络服务器。
  45. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1-9，10-12或13-21任一项的方法。
PCT/CN2015/087535 2014-10-21 2015-08-19 一种信息加密解密、管理密钥的方法、终端及网络服务器 WO2016062157A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
JP2017522128A JP6467504B2 (ja) 2014-10-21 2015-08-19 情報暗号化・復号化、暗号化キー管理の方法、端末及びネットワークサーバー
US15/520,895 US20170338950A1 (en) 2014-10-21 2015-08-19 Method, terminal, and network server for information encryption and decryption and key management
EP15851967.8A EP3197123B1 (en) 2014-10-21 2015-08-19 Method, terminal, and network server for information encryption and decryption and key management

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410562747.6 2014-10-21
CN201410562747.6A CN104506483A (zh) 2014-10-21 2014-10-21 一种信息加密解密、管理密钥的方法、终端及网络服务器

Publications (1)

Publication Number Publication Date
WO2016062157A1 true WO2016062157A1 (zh) 2016-04-28

Family

ID=52948198

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/087535 WO2016062157A1 (zh) 2014-10-21 2015-08-19 一种信息加密解密、管理密钥的方法、终端及网络服务器

Country Status (5)

Country Link
US (1) US20170338950A1 (zh)
EP (1) EP3197123B1 (zh)
JP (1) JP6467504B2 (zh)
CN (1) CN104506483A (zh)
WO (1) WO2016062157A1 (zh)

Families Citing this family (28)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9882713B1 (en) * 2013-01-30 2018-01-30 vIPtela Inc. Method and system for key generation, distribution and management
CN104506483A (zh) * 2014-10-21 2015-04-08 中兴通讯股份有限公司 一种信息加密解密、管理密钥的方法、终端及网络服务器
CN106302316A (zh) * 2015-05-15 2017-01-04 中兴通讯股份有限公司 密码管理方法及装置、系统
CN106936786B (zh) * 2015-12-30 2020-12-22 哈尔滨海能达科技有限公司 一种数据加密传输方法、基站及pdt终端
CN105653965B (zh) * 2016-01-22 2018-09-11 东信和平科技股份有限公司 一种智能卡加密机监控装置及方法
CN105847006A (zh) * 2016-03-17 2016-08-10 北京奇虎科技有限公司 程序文件的签名方法和装置、及移动终端
CN105897405B (zh) * 2016-06-02 2019-04-05 北京赛思信安技术股份有限公司 一种128位对称密钥生成及保护装置
CN105847304A (zh) * 2016-06-21 2016-08-10 北京中电普华信息技术有限公司 一种文件解密方法和装置
CA3031334A1 (en) * 2016-08-12 2018-02-15 7Tunnels, Inc. Devices and methods for enabling portable secure communication using random cipher pad cryptography
CN106658442A (zh) * 2016-09-27 2017-05-10 北京奇虎科技有限公司 保密短信的方法和装置
CN106506487A (zh) * 2016-11-03 2017-03-15 武汉斗鱼网络科技有限公司 一种信息加、解密方法及装置
CN108111469B (zh) * 2016-11-24 2020-06-02 阿里巴巴集团控股有限公司 一种在集群中建立安全通道的方法和装置
CN107786328A (zh) * 2017-09-01 2018-03-09 深圳市金立通信设备有限公司 一种生成密钥的方法、服务节点设备及计算机可读介质
GB201717052D0 (en) * 2017-10-17 2017-11-29 Comcarde Ltd Data transfer apparatus and method
CN109995700B (zh) * 2017-12-29 2021-10-15 北京易安睿龙科技有限公司 一种应用程序的安全防护方法、应用客户端及acr服务器
CN109040109B (zh) * 2018-08-31 2022-01-21 国鼎网络空间安全技术有限公司 基于密钥管理机制的数据交易方法及系统
CN109218307A (zh) * 2018-09-13 2019-01-15 中通国脉物联科技南京有限公司 一种客户端身份认证的方法
CN110020524B (zh) * 2019-03-31 2021-05-18 西安邮电大学 一种基于智能卡的双向认证方法
CN110166426A (zh) * 2019-04-11 2019-08-23 北京媒球信息科技有限公司 信息发送终端、接收终端及其保密通信方法、存储介质
CN110213247B (zh) * 2019-05-16 2021-10-01 福建天泉教育科技有限公司 一种提高推送信息安全性的方法及系统
CN111104691A (zh) * 2019-11-28 2020-05-05 贝壳技术有限公司 敏感信息的处理方法、装置、存储介质及设备
CN110881048B (zh) * 2019-12-16 2021-11-09 苏宁云计算有限公司 基于身份认证的安全通讯方法及装置
CN111327616A (zh) * 2020-02-25 2020-06-23 上海东普信息科技有限公司 密钥管理方法、装置、设备及计算机可读存储介质
CN111585998B (zh) * 2020-04-24 2022-03-01 广东电网有限责任公司 一种审计数据安全传输方法和系统
CN112671710B (zh) * 2020-11-26 2023-01-06 中国大唐集团科学技术研究院有限公司 一种基于国密算法的安全加密装置、双向认证及加密方法
CN114124501A (zh) * 2021-11-16 2022-03-01 武汉光阴南北网络技术咨询中心 数据处理方法、电子设备及计算机存储介质
EP4262147A1 (en) 2022-02-28 2023-10-18 Rakuten Group, Inc. Communication system, communication method, and program
JP7358659B1 (ja) 2022-02-28 2023-10-10 楽天グループ株式会社 通信システム、通信方法、及びプログラム

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6567914B1 (en) * 1998-07-22 2003-05-20 Entrust Technologies Limited Apparatus and method for reducing transmission bandwidth and storage requirements in a cryptographic security system
CN1929369A (zh) * 2005-09-09 2007-03-14 三星电子株式会社 以对等方式安全地发送和接收数据的设备和方法
CN103595793A (zh) * 2013-11-13 2014-02-19 华中科技大学 一种无需可信第三方支持的云端数据安全删除系统与方法
CN104506483A (zh) * 2014-10-21 2015-04-08 中兴通讯股份有限公司 一种信息加密解密、管理密钥的方法、终端及网络服务器

Family Cites Families (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6625734B1 (en) * 1999-04-26 2003-09-23 Disappearing, Inc. Controlling and tracking access to disseminated information
JP2001203678A (ja) * 2000-01-19 2001-07-27 Mitsubishi Electric Corp 暗号鍵配送システムおよび暗号鍵配送方法
JP2001320356A (ja) * 2000-02-29 2001-11-16 Sony Corp 公開鍵系暗号を使用したデータ通信システムおよびデータ通信システム構築方法
JP2004501532A (ja) * 2000-03-29 2004-01-15 ヴァディアム　テクノロジー　インコーポレイテッド 鍵中央提供及びキー入力可能文字によるワンタイムパッド暗号化
AU2002332671A1 (en) * 2001-08-13 2003-03-03 Board Of Trustees Of The Leland Stanford Junior University Systems and methods for identity-based encryption and related cryptographic techniques
US7146009B2 (en) * 2002-02-05 2006-12-05 Surety, Llc Secure electronic messaging system requiring key retrieval for deriving decryption keys
JP4490649B2 (ja) * 2002-05-09 2010-06-30 パナソニック株式会社 認証通信システム、認証通信装置及び認証通信方法
JP2004166154A (ja) * 2002-11-15 2004-06-10 Nec Corp マルチキャスト配信のための鍵管理方式
JP4684714B2 (ja) * 2005-03-31 2011-05-18 エヌ・ティ・ティ・ソフトウェア株式会社 ファイル管理システム、及びプログラム
CN101479984B (zh) * 2006-04-25 2011-06-08 斯蒂芬·L.·博伦 用于身份管理、验证服务器、数据安全和防止中间人攻击的动态分发密钥系统和方法
US9002018B2 (en) * 2006-05-09 2015-04-07 Sync Up Technologies Corporation Encryption key exchange system and method
JP2008219454A (ja) * 2007-03-05 2008-09-18 Hitachi Ltd 通信内容監査支援システム
CN101741548B (zh) * 2009-12-18 2012-02-01 西安西电捷通无线网络通信股份有限公司 交换设备间安全连接的建立方法及系统
CN101789865B (zh) * 2010-03-04 2011-11-30 深圳市华信安创科技有限公司 一种用于加密的专用服务器及加密方法
WO2012039178A1 (ja) * 2010-09-22 2012-03-29 インターナショナル・ビジネス・マシーンズ・コーポレーション データ配信装置、データ配信システム、クライアント装置、データ配信方法、データ受信方法、プログラムおよび記録媒体
US20120155644A1 (en) * 2010-12-20 2012-06-21 Motorola, Inc. Method to maintain end-to-end encrypted calls through a tetra tmo-dmo gateway when using super groups
US8631460B2 (en) * 2011-03-23 2014-01-14 CipherPoint Software, Inc. Systems and methods for implementing transparent encryption
CN105052072A (zh) * 2012-12-28 2015-11-11 威斯科数据安全国际有限公司 远程认证和业务签名
KR101460541B1 (ko) * 2013-07-15 2014-11-11 고려대학교 산학협력단 사용자 아이디 기반 공개키 암호화 방법
JP6362483B2 (ja) * 2014-09-02 2018-07-25 キヤノン株式会社 情報処理装置、情報処理方法及びプログラム

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6567914B1 (en) * 1998-07-22 2003-05-20 Entrust Technologies Limited Apparatus and method for reducing transmission bandwidth and storage requirements in a cryptographic security system
CN1929369A (zh) * 2005-09-09 2007-03-14 三星电子株式会社 以对等方式安全地发送和接收数据的设备和方法
CN103595793A (zh) * 2013-11-13 2014-02-19 华中科技大学 一种无需可信第三方支持的云端数据安全删除系统与方法
CN104506483A (zh) * 2014-10-21 2015-04-08 中兴通讯股份有限公司 一种信息加密解密、管理密钥的方法、终端及网络服务器

Also Published As

Publication number Publication date
EP3197123A4 (en) 2017-09-27
US20170338950A1 (en) 2017-11-23
EP3197123A1 (en) 2017-07-26
EP3197123B1 (en) 2019-11-27
JP6467504B2 (ja) 2019-02-13
JP2017531967A (ja) 2017-10-26
CN104506483A (zh) 2015-04-08

Similar Documents

Publication Publication Date Title
WO2016062157A1 (zh) 一种信息加密解密、管理密钥的方法、终端及网络服务器
US11647007B2 (en) Systems and methods for smartkey information management
CN109347835B (zh) 信息传输方法、客户端、服务器以及计算机可读存储介质
CN106104562B (zh) 机密数据安全储存和恢复系统及方法
US8059818B2 (en) Accessing protected data on network storage from multiple devices
US20030081774A1 (en) Method and apparatus for dynamic generation of symmetric encryption keys and exchange of dynamic symmetric key infrastructure
WO2015187640A2 (en) System and method for secure review of audit logs
CN106790037B (zh) 一种用户态加密的即时通讯方法与系统
CN111080845B (zh) 临时解锁方法、系统、门锁、管理员终端和可读存储介质
CN109543443A (zh) 基于区块链的用户数据管理方法、装置、设备和存储介质
CN108809633B (zh) 一种身份认证的方法、装置及系统
US20180063105A1 (en) Management of enciphered data sharing
US20220337428A1 (en) Anonymous broadcast method, key exchange method, anonymous broadcast system, key exchange system, communication device, and program
WO2014183671A1 (zh) 一种云存储安全控制的方法
JP4818975B2 (ja) 情報通信システム
CN104767766A (zh) 一种Web Service接口验证方法、Web Service服务器、客户端
CN104394532A (zh) 移动端防暴力破解的安全登录方法
Hussien et al. Scheme for ensuring data security on cloud data storage in a semi-trusted third party auditor
Paverd et al. Omnishare: Encrypted cloud storage for the multi-device era
KR102210438B1 (ko) 대칭키 알고리즘을 이용한 경량 암복호화 방법 및 시스템
US9036822B1 (en) Methods for managing user information and devices thereof
Gerdes et al. RFC 9202: Datagram Transport Layer Security (DTLS) Profile for Authentication and Authorization for Constrained Environments (ACE)
Mohamed et al. New packet header support and key exchange mechanism for secure trivial file transfer protocol
Prakasha et al. Secure and Efficient User Authentication Using Modified Otway Rees Protocol in Distributed Networks
Kleppmann et al. Strengthening Public Key Authentication Against Key Theft (Short Paper)

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15851967

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2017522128

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2015851967

Country of ref document: EP