TW202404303A - A supervision system and method on end-to-end encrypted messaging - Google Patents

Abstract

A supervision system and method on end-to-end encrypted massaging are provided. The method includes, generating a monitoring account for monitoring a chat room interface including a plurality of instant messaging terminals and a certificate for adding the monitoring account to the chat room interface, wherein member of the chat room interface incudes instant messaging terminals and the monitoring account; encrypting messages sent by the chat room interface, transmitting the encrypted messages and transmitting a key exchange information of the instant massaging terminals, obtaining keys after an end-to-end exchange operation, using the keys to decrypt the encrypted message, and sending an alarm information according to the decrypted message.

Description

End-to-end encrypted communication supervision system and method thereof

The present invention relates to a communication supervision system and a method thereof, and in particular, to an end-to-end encrypted communication supervision system and a method thereof.

Currently, existing communication monitoring technologies can be roughly divided into two types: obtaining communication information directly through the server, or installing additional monitoring software on the user terminal to detect the terminal's application window in real time and directly capture the input box information and upload it to Monitor the server.

The obvious shortcomings of the above two communication monitoring technologies are: the server must be able to directly obtain communication information or record the decryption key in the server, which greatly reduces the security of the communication system; and the installation of additional monitoring software will affect the user's ability to use it. experience, and there may be other ways to bypass or forcibly close the monitoring software in the terminal; after capturing the input box information and uploading it to the monitoring server, the information must also be encrypted and protected to prevent the monitored communication information from being intercepted and eavesdropped by a third party. .

In order to improve communication security, today's mainstream services have begun to adopt end-to-end encryption technology to prevent the server from storing communication information or decryption keys. Therefore, how to maintain the security of end-to-end encryption and monitor communication information at the same time becomes a problem. A major challenge for enterprise instant messaging service applications.

The present invention provides an end-to-end encrypted communication monitoring system and a method thereof, which can monitor instant messaging without destroying the security of end-to-end encrypted communication.

An end-to-end encrypted communication supervision system of the present invention includes a plurality of instant messaging terminals, a certificate authentication server, an instant messaging server and a supervision server. The instant messaging terminals include at least one monitored object. The certificate authentication server generates a monitoring account for monitoring the chat room interface of the instant messaging terminals and a certificate for adding the monitoring account to the chat room interface, where the members of the chat room interface include the instant messaging terminals and the monitoring account. The instant messaging server communicates with the instant messaging terminals and the certificate authentication server respectively, and the supervision server communicates with the certificate authentication server and the instant messaging server respectively. Among them, the instant messaging terminal encrypts the messages in the chat room interface, the instant messaging server sends the encrypted messages and sends the key exchange information of the instant messaging terminals to the instant messaging terminals and the supervision server. The communication terminal and the supervision server use the key exchange information to perform end-to-end key exchange operations to decrypt the message, and the supervision server issues alarm information based on the decrypted message.

In an embodiment of the present invention, in the above-mentioned end-to-end encrypted communication supervision system, the supervision server at least includes a security module and an analysis and decision-making module, wherein the security module is used to store the key exchange of members of the chat room interface. Information and keys, and the monitoring account is hidden in the chat room interface.

In an embodiment of the present invention, in the above-mentioned end-to-end encrypted communication monitoring system, the analysis and decision-making module synchronously receives the messages transmitted by the chat room interface in the form of HTTP long pulling, and uses the funds stored in the security module to The key is used to decrypt the message in the chat room interface, and the analysis and decision-making module is further used to determine whether the decrypted message includes high-risk keywords, so as to issue an alarm message when the decrypted message includes high-risk keywords, and analyze The decision-making module is further used to send a locking signal to the instant messaging server, so that the instant messaging server locks at least one monitored object and messages including high-risk keywords, and sends the signal to at least one through the instant messaging server. The monitored object is configured to cause at least one monitored object to perform an operation of deleting messages including high-risk keywords.

In an embodiment of the present invention, in the above-mentioned end-to-end encrypted communication monitoring system, after the monitoring account is added to the chat room interface, the members of the chat room interface further use the key exchange information to re-perform the end-to-end key exchange operation to Obtain a new key and use the new key to encrypt the message. The instant messaging server sends the encrypted message and sends the key exchange information to the instant messaging terminals and the supervision server. Among them, the instant messaging server The instant messaging terminal and the supervision server use the key exchange information to perform an end-to-end key exchange operation and decrypt the message with a new key, and the supervision server issues an alarm information based on the decrypted message.

In an embodiment of the present invention, in the above-mentioned end-to-end encrypted communication monitoring system, the monitoring server is further used to verify the certificate in real time, so that when the certificate is valid, the instant messaging server will send the encrypted message and the key The exchange information is sent to the supervision server.

An end-to-end encrypted communication supervision method of the present invention includes: generating a monitoring account for monitoring a chat room interface including multiple instant messaging terminals and a certificate for adding the monitoring account to the chat room interface, wherein the members of the chat room interface include the some instant messaging terminals and monitoring accounts, these instant messaging terminals include at least one monitored object; encrypting messages in the chat room interface; transmitting encrypted messages and transmitting key exchange information of these instant messaging terminals; utilizing funds The key exchange information is used to decrypt the message with the key obtained after performing end-to-end key exchange operation; and alarm information is issued based on the decrypted message.

In an embodiment of the present invention, the above-mentioned end-to-end encrypted communication monitoring method further includes storing key exchange information and keys of members of the chat room interface, and the monitoring account is hidden in the chat room interface.

In an embodiment of the present invention, the above-mentioned end-to-end encrypted communication monitoring method, in which the key is used to decrypt the message, and the step of sending the alarm information based on the decrypted message further includes: using HTTP long connection (Long connection) Pulling) method to simultaneously receive the messages sent by the chat room interface, and use the stored key to decrypt the messages in the chat room interface; determine whether the decrypted messages include high-risk keywords, so as to ensure that the decrypted messages include high-risk keywords. issuing an alarm message when a keyword is used; and locking at least one monitored object and messages containing high-risk keywords, and sending a signal to at least one monitored object to cause at least one monitored object to delete messages containing high-risk keywords message operations.

In an embodiment of the present invention, the above-mentioned end-to-end encrypted communication monitoring method further includes: after the monitoring account is added to the chat room interface, the members of the chat room interface further use the key exchange information to conduct the end-to-end communication monitoring again. Key exchange operation to obtain a new key, and use the new key to encrypt the message; transmit the encrypted message and transmit the key exchange information; use the key exchange information to perform end-to-end key exchange operation and obtain Use the new key to decrypt the message; and issue alarm information based on the decrypted message.

In an embodiment of the present invention, the above-mentioned end-to-end encrypted communication supervision method, wherein the step of transmitting the encrypted message and transmitting the key exchange information further includes: real-time verification of the certificate, so that when the certificate is valid, Send encrypted messages and send key exchange information.

Based on the above, the present invention provides an end-to-end encrypted communication monitoring system and method, which can monitor instant messaging without destroying the security of end-to-end encrypted communication, and can verify the identity of the monitoring account when adding the monitoring account. Effectiveness prevents intermediaries from trying to impersonate monitoring accounts to steal secrets. Monitoring events can be added to system operation as needed, and the validity period of monitoring objects and monitoring events can be set to avoid abuse of monitoring rights.

In order to make the above-mentioned features and advantages of the present invention more obvious and easy to understand, embodiments are given below and described in detail with reference to the accompanying drawings.

Figure 1 is a schematic diagram of an end-to-end encrypted communication monitoring system according to an embodiment of the present invention.

Referring to FIG. 1 , the end-to-end encrypted communication supervision system 10 mainly includes a certificate authentication server 100 , an instant messaging server 200 , a supervision server 300 and a plurality of instant messaging terminals 400 .

Among them, the instant messaging terminal 400 includes at least one monitored object. For convenience of description, one of the instant messaging terminals in Figure 1 is called the monitored object 500. The instant messaging terminal 400 may have a processing unit (such as a processor but is not limited thereto), a communication unit coupled to the processing unit (such as a transceiver that supports various communication protocols such as mobile network, Bluetooth or WiFi) and a coupling Necessary components for running the instant messaging terminal 400 are stored in the storage unit of the processing unit (such as removable random access memory, flash memory or hard disk, but not limited to this). In this embodiment, the instant messaging terminals 400 can perform end-to-end key exchange through the instant messaging server 200, and the messages encrypted by the instant messaging terminals 400 can be transmitted through the instant messaging server 200, and through the end-to-end The key after the peer key exchange operation can be used to decrypt the encrypted message. In this way, the instant messaging terminal 400 can provide users with the function of sending messages to each other in a chat room interface and encrypting and decrypting the messages for instant messaging, and the instant messaging terminal 400 can store the message or delete the message.

The instant messaging server 200 communicates with the instant messaging terminal 400 and the certificate authentication server 100 respectively. In one embodiment, the instant messaging server 200 may have a processing unit (such as a processor but is not limited thereto), a communication unit coupled to the processing unit (for example, supporting various communication protocols such as mobile network, Bluetooth or WiFi). transceiver) and a storage unit coupled to the processing unit (such as removable random access memory, flash memory or hard disk, but not limited to these) and other necessary components for running the instant messaging server 200 .

The instant messaging terminal 400 encrypts the messages sent by the chat room interface including the monitored object 500, and the instant messaging server 200 can encrypt the messages encrypted by the instant messaging terminal 400 and perform end-to-end key exchange with the instant messaging terminal 400. The calculated key exchange information is sent to the instant messaging terminal 400 and to the supervision server 300 . In one embodiment, after the instant messaging server 200 adds the monitoring account to the chat room interface, the monitoring account can be used as a hidden member of the chat room interface, and the members of this chat room interface will re-perform the end-to-end key exchange operation. A new key is obtained, and the message is encrypted using the new key, and the instant messaging server 200 sends the encrypted message and key exchange information to the instant messaging terminal 400 and the supervision server 300 .

The supervision server 300 communicates with the certificate authentication server 100 and the instant messaging server 200 respectively. In one embodiment, the monitoring server 300 may have a processing unit (such as a processor but is not limited thereto), a communication unit coupled to the processing unit (such as a communication unit that supports various communication protocols such as mobile network, Bluetooth or WiFi). Transceivers) and storage units (such as removable random access memory, flash memory or hard disks, but not limited to these) coupled to the processing unit are necessary components for running the supervision server 300 .

Specifically, the supervision server 300 may include a security module 310 and an analysis and decision-making module 320. The security module 310 can store the key exchange information and keys of the members of the chat room interface. The members of the chat room interface can include monitored objects 500, monitoring accounts, and other instant messaging terminals 400 participating in the chat room, and the monitoring accounts are in The chat room interface is in a hidden state, and the monitored object 500 and other instant messaging terminals 400 can be directly displayed on the chat room interface without being hidden. Among them, the supervision server 300 can verify the certificate in real time, so that when the certificate is valid, the instant messaging server 200 will send the encrypted message and the key exchange information of the instant messaging terminal 400, the monitored object 500, and the monitoring account to the real-time Communication terminal 400 and supervision server 300.

After the monitoring account joins the chat room interface, the members of the chat room interface (including the instant messaging terminal 400, the monitored object 500, and the monitoring account) use the key exchange information to re-perform the end-to-end key exchange operation to obtain a new key. , and uses the new key to encrypt the message. The instant messaging server 200 sends the encrypted message and sends the key exchange information to the instant messaging terminal 400 and the supervision server 300 .

In this way, the instant messaging terminal 400 and the supervision server 300 can use the key exchange information to perform the end-to-end key exchange operation and obtain the new key to decrypt the message sent by the chat room interface, and the supervision server 300 will decrypt the message according to the experience. The decrypted message sends an alert message.

In more detail, the analysis and decision-making module 320 of the supervision server 300 synchronously receives the messages sent by the chat room interface in the form of HTTP long connection (Long Pulling), and uses the key stored in the security module 310 to compare the messages sent in the chat room interface. The message is decrypted, and the analysis and decision-making module 320 can determine whether the decrypted message includes high-risk keywords, so as to issue an alarm message when the decrypted message includes high-risk keywords, for example, by end-to-end encrypted communication The administrator of the supervision system 10 sends the alarm information by sending an email or sending a text message.

In addition, the analysis and decision-making module 320 of the supervision server 300 can send a locking signal to the instant messaging server 200, so that the instant messaging server 200 locks the monitored object 500 and messages including high-risk keywords, and through real-time The communication server 200 sends a signal to the monitored object 500, so that the monitored object 500 performs an operation of deleting messages including high-risk keywords.

Figure 2 is a flow chart of monitoring account credential application and management according to an embodiment of the present invention.

Please refer to Figure 2. In step S201, a certificate and a key are generated. Specifically, the public and private keys required to apply for certificates and certificates are generated, as well as the public and private keys required to participate in the key negotiation required for end-to-end encryption (this public key provides the key exchange information required for the instant messaging terminal 400 to perform key exchange. ), it should be noted that the end-to-end key exchange operation mainly uses the private key of the instant messaging terminal 400 (for example, the instant messaging terminal 400 corresponding to the monitoring account) and the other party (i.e., other members of the chat room interface, such as the monitored one) Object 500) performs operations on the public key in the key exchange information. After the operation, the key can be obtained, and this key is used to encrypt the message. In the same way, the other party can also use its private key and corresponding monitoring in turn. The key exchange information provided by the instant messaging terminal 400 of the account is calculated to obtain the same key for decrypting the message.

In step S202, apply for a supervision-specific certificate and monitoring account. That is to say, the end-to-end encrypted communication monitoring system 10 applies to the certificate authentication server 100 for a certificate and monitoring account exclusive to this monitoring event. This monitoring event may include the monitored object, monitoring period, reason for applying for monitoring, or other matters, the present invention is not limited thereto.

In step S203, the certificate authentication server 100 creates a monitoring account and sets permissions. In step S204, a monitoring account is opened. After receiving the certificate and IP information sent by the certificate authentication server 100, the monitoring server 300 needs to use the certificate and IP information to open a monitoring account with the instant messaging server 200.

In step S205, a random number is generated to require signature. The instant messaging server 200 requests the supervision server 300 for signature and verification. The verification method may use but is not limited to generating random numbers to provide the supervision server 300 with the signature. The supervision server 300 signs the signature through the security module 310 and sends it back to the instant messaging server 200 .

In step S206, the certificate authentication server (Certificate Authority, CA) 100 verifies the validity of the certificate. The instant messaging server 200 sends the certificate to the certificate authentication server 100 for validity query. If the certificate is valid and the information of the monitoring account recorded in the certificate is a valid account registered in the instant messaging server 200, the certificate authentication server 100 Perform signature verification.

In step S207, a monitoring account is opened and IP and API usage rights are locked. If the monitoring account passes the verification, the instant messaging server 200 opens the monitoring account, connects the monitoring account to the IP, and sets the API usage rights of the monitoring account.

In step S208, key exchange information required for end-to-end encryption is registered. After the monitoring account is successfully opened, the supervision server 300 can register with the instant messaging server 200 the key exchange information required to participate in end-to-end encryption. The key exchange information includes the key exchange public key stored in the security module 310, and Use digital credentials to sign. In one embodiment, after the supervision server 300 completes the account opening, it still needs to verify the validity of the certificate in real time every time it communicates with the instant messaging server 200 . If the certificate authentication server 100 finds that the certificate held by the monitoring server 300 has expired or been canceled, it will send a signal to the instant messaging server 200 to log out the monitoring account from all chat room interfaces and set the certificate to be invalid.

Figure 3 is a flow chart of chat room participation and re-key exchange according to an embodiment of the present invention.

Please refer to Figure 3. In this embodiment, the instant messaging server 200 will add the monitoring account to the chat room interface in which the monitored object participates. After the monitoring account is added to the chat room interface, the members of the chat room interface (including real-time The communication terminal 400, the monitored object 500, and the monitoring account) re-perform end-to-end key negotiation/exchange so that the monitoring account can decrypt the messages transmitted in the chat room interface. The detailed process is as follows.

In step S301, the instant messaging server 200 adds the monitoring account to the relevant chat room including the monitored object based on the monitored object applied for in the monitoring event, and marks the member category as the monitoring account.

In step S302, the instant messaging server 200 synchronously transmits the digital certificate of the monitoring account and the public key required for key exchange to the instant messaging terminal 400.

In step S303, the instant messaging server 200 synchronously transmits the member change information of the relevant chat room to the instant messaging terminal 400. When the new member is synchronized as a monitoring account, the instant messaging terminal 400 will monitor the account in the interface of the relevant chat room. To hide.

In step S304, the instant messaging server 200 sets the status of the negotiated key in the relevant chat room to invalid (in a general end-to-end encrypted communication system, the instant messaging server 200 does not hold the key of the relevant chat room). The key information only assists in managing the status of the key, so it only sets the status of the key to invalid and synchronously transmits it to the instant messaging terminal 400).

In step S305, after receiving the status that the key is invalid, the instant messaging terminal 400 needs to re-check the legitimacy of all members in the chat room. If the member has a monitoring account, it needs to confirm whether the digital signature of the key exchange information is valid. Correct to ensure that monitoring accounts are not impersonated by middlemen.

In step S306, the instant messaging terminal 400 re-negotiates the key, negotiates the key of the chat room in an end-to-end encryption manner, and then transmits the renegotiated key exchange information to all members in the chat room, including the monitoring account.

In step S307, the supervision server 300 synchronously transmits the renegotiated key exchange information to the instant messaging server 200, and stores it in the security module 310, which can be used for message synchronization and subsequent decryption.

The key negotiation methods mentioned above include, but are not limited to, group key exchange, or one-to-one key exchange for end-to-end encrypted communication between all chat room members and monitoring accounts. However, Digital signature verification is required to ensure that the exchange object has not been replaced by an intermediary.

After the above process of participating in chat rooms and re-key exchange, the end-to-end encrypted communication monitoring method also includes the process of supervision and data protection. The specific process is as follows.

The monitoring server 300 uses the analysis and decision-making module 320 to synchronously transmit the information of the relevant chat room including the monitored object to the instant messaging server 200 in real time in a (HTTP Long Pulling) manner.

The analysis and decision-making module 320 decrypts the message using the chat room key stored in the security module 310 to obtain the decrypted message. The analysis and decision-making module 320 can integrate text analysis and decision-making methods, including but not limited to natural language processing (NLP), keyword comparison, rule-based system (Rule-Base System) or AI machine learning, etc. Automatically analyze the decrypted message to determine whether the decrypted message contains high-risk keywords or confidential information.

If the analysis and decision-making module 320 determines that the decrypted message contains high-risk keywords or confidential information, it can mark the message and send an alarm message to notify the system administrator, and at the same time send a locking signal to the instant messaging server 200 to lock it. Important information.

The instant messaging server 200 locks the access rights of the marked messages to prevent the instant messaging terminal 400 from obtaining the marked messages again, and sends a signal to the instant messaging terminal 400, and the instant messaging terminal 400 destroys its local messages to avoid Exfiltration of messages containing high-risk keywords or confidential information. In addition to locking message access rights, the instant messaging server 200 can suspend related accounts and store suspicious chat room conversation messages. The analysis and decision-making module 320 can only store marked messages, and messages that are determined to contain high-risk keywords or confidential information by the end-to-end encrypted communication monitoring system 10 will be deleted immediately.

Figure 4 is a flow chart of an end-to-end encrypted communication supervision method according to an embodiment of the present invention.

In step S401, the certificate authentication server 100 generates a monitoring account for monitoring a chat room interface including multiple instant messaging terminals 400 and a certificate for adding the monitoring account to the chat room interface, where members of the chat room interface include multiple instant messaging users. Terminal 400 and monitoring account.

In step S402, the instant messaging terminal 400 encrypts the message in the chat room interface, the instant messaging server 200 sends the encrypted message and sends the key exchange information of the instant messaging terminal 400 to the instant messaging terminal 400 and the supervision server 300 . The instant messaging terminal includes at least one monitored object. Specifically, after the monitoring account joins the chat room interface, the members of the chat room interface re-exchange the end-to-end key to generate a new key, and the supervision server 300 verifies the certificate in real time, so that when the certificate is valid, the instant messaging The server 200 sends the encrypted message and the new key exchange information required for re-executing the end-to-end key exchange operation to the instant messaging terminal 400 and the supervision server 300 .

In step S403, the instant messaging terminal 400 and the supervision server 300 decrypt the message using the new key obtained after performing end-to-end key exchange operation on the new key exchange information, and send out alarm information based on the decrypted message. . Specifically, the monitoring server 300 determines whether the decrypted message includes high-risk keywords, so as to issue an alarm message when the decrypted message includes high-risk keywords. In one embodiment, the analysis and decision-making module 320 of the supervision server 300 can send out alarm information via email, SMS, or other means to notify the system administrator, and can mark the message after receiving the alarm information. Confirm, if it is a misjudgment, the system administrator will modify the account suspension and message access restrictions of the monitored object 500.

In step S404, the instant messaging server 200 locks the monitored object 500 and messages containing high-risk keywords to limit access to the messages and prevents them from continuing to synchronously send this message to other instant messaging terminals 400 in the chat room interface. The monitored object 500 is disabled, restricted from logging into the account and sending and receiving messages, and sends a signal to the monitored object 500 to cause the monitored object 500 to delete messages containing high-risk keywords locally.

Based on the above, the present invention provides an end-to-end encrypted communication monitoring system and method, which can monitor instant messaging without destroying the security of end-to-end encrypted communication, and can verify the identity of the monitoring account when adding the monitoring account. Effectiveness prevents intermediaries from trying to impersonate monitoring accounts to steal secrets. Monitoring events can be added to system operation as needed, and the validity period of monitoring objects and monitoring events can be set to avoid abuse of monitoring rights.

Although the disclosure has been disclosed above through embodiments, they are not intended to limit the disclosure. Anyone with ordinary knowledge in the technical field may make slight changes and modifications without departing from the spirit and scope of the disclosure. Therefore, The scope of protection of this disclosure shall be determined by the scope of the appended patent application.

10: End-to-end encrypted communication supervision system 100:Certificate authentication server 200: Instant messaging server 300:Supervision server 400: Instant messaging terminal 500: Monitored object S201, S202, S203, S204, S205, S206, S207, S208, S301, S302, S303, S304, S305, S306, S307, S401, S402, S403, S404: Steps

Figure 1 is a schematic diagram of an end-to-end encrypted communication monitoring system according to an embodiment of the present invention. Figure 2 is a flow chart of monitoring account credential application and management according to an embodiment of the present invention. Figure 3 is a flow chart of chat room participation and re-key exchange according to an embodiment of the present invention. Figure 4 is a flow chart of an end-to-end encrypted communication supervision method according to an embodiment of the present invention.

S401, S402, S403, S404: steps

Claims (10)

An end-to-end encrypted communication supervision system, including: Multiple instant messaging terminals, including at least one monitored object; A certificate authentication server that generates a monitoring account for monitoring the chat room interface including the instant messaging terminals and a certificate for adding the monitoring account to the chat room interface, where the members of the chat room interface include the Instant messaging terminal and the monitoring account; The instant messaging server communicates and connects the instant messaging terminals and the certificate authentication server respectively; and The supervision server communicates with the certificate authentication server and the instant messaging server respectively. Among them, the instant messaging terminals encrypt the messages in the chat room interface, the instant messaging server transmits the encrypted messages and transmits the key exchange information of the instant messaging terminals to the instant messaging terminals and the supervisor. server, Among them, the instant messaging terminals and the supervision server use the key exchange information to perform end-to-end key exchange operations to decrypt the message, and the supervision server sends out a message based on the decrypted message. Alarm information. The end-to-end encrypted communication monitoring system as described in claim 1, wherein the monitoring server at least includes a security module and an analysis and decision-making module, wherein the security module is used to store the key of the member of the chat room interface Information and the key are exchanged, and the monitoring account is hidden in the chat room interface. The end-to-end encrypted communication monitoring system as described in request item 2, wherein the analysis and decision-making module synchronously receives the message sent by the chat room interface in the form of HTTP long connection (Long Pulling), and uses the security module to store the message. The key is used to decrypt the message in the chat room interface, and the analysis and decision-making module is further used to determine whether the decrypted message includes high-risk keywords, so that the decrypted message includes the high-risk keyword. This warning message is issued when the keyword is entered. The analysis and decision-making module is further used to send a locking signal to the instant messaging server, so that the instant messaging server locks the at least one monitored object and the message including the high-risk keyword, and through the real-time messaging server The communication server sends a signal to the at least one monitored object to cause the at least one monitored object to perform an operation of deleting messages including the high-risk keyword. The end-to-end encrypted communication monitoring system as described in claim 1, wherein after the monitoring account joins the chat room interface, the member of the chat room interface further uses the key exchange information to re-perform the end-to-end key exchange. Calculate to obtain a new key, and use the new key to encrypt the message, Wherein, the instant messaging server sends the encrypted message and sends the key exchange information to the instant messaging terminals and the supervision server, Among them, the instant messaging terminals and the supervision server use the key exchange information to perform the end-to-end key exchange operation and obtain the new key to decrypt the message, and the supervision server decrypts the message based on the decrypted key. The message sends the alarm information. The end-to-end encrypted communication supervision system as described in request item 4, wherein the supervision server is further used to verify the certificate in real time, so that when the certificate is valid, the instant messaging server will encrypt the message and the Key exchange information is sent to the custody server. An end-to-end encrypted communication supervision method, including: Generate a monitoring account for monitoring a chat room interface including multiple instant messaging terminals and a certificate for adding the monitoring account to the chat room interface, where the members of the chat room interface include the instant messaging terminals and the monitoring account. The instant messaging terminal includes at least one monitored object; Encrypt messages in the chat room interface; Send the encrypted message and send the key exchange information of the instant messaging terminals; Decrypt the message using the key obtained after performing an end-to-end key exchange operation on the key exchange information; and Alarm information is issued based on the decrypted message. The end-to-end encrypted communication supervision method as described in request item 6, wherein the method further includes: The key exchange information and the key of the member of the chat room interface are stored, and the monitoring account is hidden in the chat room interface. As for the end-to-end encrypted communication supervision method described in claim 7, the step of using the key to decrypt the message, and issuing the alarm information based on the decrypted message further includes: Synchronously receive the message sent by the chat room interface in the form of HTTP long pulling, and use the stored key to decrypt the message in the chat room interface, Determine whether the decrypted message includes the high-risk keyword, so as to issue the alert information when the decrypted message includes the high-risk keyword, and Send a lock signal to cause the at least one monitored object and the message including the high-risk keyword to be locked, and send a signal to the at least one monitored object to cause the at least one monitored object to delete the message including the Actions on messages for high-risk keywords. The end-to-end encrypted communication supervision method as described in request item 6, wherein the method further includes: After the monitoring account joins the chat room interface, the members of the chat room interface further use the key exchange information to re-perform the end-to-end key exchange operation to obtain a new key, and use the new key to Messages are encrypted; transmit the encrypted message and transmit the key exchange information; Decrypt the message using the new key obtained after performing the end-to-end key exchange operation using the key exchange information; and The alarm information is issued based on the decrypted message. The end-to-end encrypted communication supervision method as described in claim 9, wherein the step of transmitting the encrypted message and transmitting the key exchange information further includes: Verify the certificate immediately to send the encrypted message and send the key exchange information when the certificate is valid.

Images