WO2017092092A1 - 一种端加密传输的密钥管理的方法及装置 - Google Patents

一种端加密传输的密钥管理的方法及装置 Download PDF

Info

Publication number
WO2017092092A1
WO2017092092A1 PCT/CN2015/098482 CN2015098482W WO2017092092A1 WO 2017092092 A1 WO2017092092 A1 WO 2017092092A1 CN 2015098482 W CN2015098482 W CN 2015098482W WO 2017092092 A1 WO2017092092 A1 WO 2017092092A1
Authority
WO
WIPO (PCT)
Prior art keywords
key pair
key
data
index value
pair index
Prior art date
Application number
PCT/CN2015/098482
Other languages
English (en)
French (fr)
Inventor
邱吉刚
吴新勇
杨佳
Original Assignee
四川九洲电器集团有限责任公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 四川九洲电器集团有限责任公司 filed Critical 四川九洲电器集团有限责任公司
Priority to US15/739,693 priority Critical patent/US10601586B2/en
Publication of WO2017092092A1 publication Critical patent/WO2017092092A1/zh
Priority to ZA2018/00005A priority patent/ZA201800005B/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method and apparatus for key management of end-encrypted transmission.
  • GSM Global System for Mobile communications
  • data theft With the rapid development of the mobile communication industry, mobile phones are not only widely used in personal life, but also play an increasingly important role in many fields such as government business and business activities.
  • existing mobile communication networks have some security risks, resulting in frequent occurrences such as wireless eavesdropping.
  • the GSM system which is the mainstream mobile communication system, only supports air interface encryption and cannot provide end-to-end secure encrypted communication. Utilizing this feature of the GSM system, criminals can use devices such as pseudo base stations for voice eavesdropping and data theft.
  • the corresponding technical solutions mainly include three types: first, the transceiver end performs additional analog-to-digital conversion, digital-to-analog conversion and encryption/decryption processing on the original voice or data through an external hardware device; second, the encryption/decryption device Built in the mobile phone, the encryption/decryption processing is performed on the information such as analog-to-digital conversion and source-encoded processing; thirdly, the special VoIP-like communication software is designed to perform encryption/decryption processing on the user's short message and call information.
  • the existing end-to-end encryption mechanism is generally based on the communication link of the communication carrier, which adds an additional layer of encryption protection.
  • the existing end-to-end encryption mechanism cannot be implemented by means of infrastructure such as KDC/KTC already existing by the communication carrier. Under this circumstance, how the two parties communicate the encrypted key pair to realize the end-to-end encrypted transmission of data becomes a technical problem that needs to be solved urgently.
  • the present invention provides a method for determining a secret key pair, the method comprising:
  • a key pair index value generating step generating a key pair index value according to a preset key pair initial value, a scrambling code value, and an ID or a multicast/broadcast ID of the device performing data communication;
  • the key pair determining step decrypts the key pair data by using a preset high layer key to obtain a required key pair.
  • the index initial value, the scrambling code value, the ID of the device for performing data communication, and the number of key pairs for supporting point-to-point transmission are generated according to a preset algorithm by using a preset algorithm.
  • the key pair index value is generated according to a preset algorithm by using a preset algorithm.
  • the key pair index value is generated according to the following expression:
  • I key F Harsh (ID A , ID B , P t , I key_int ) mod(Nk)
  • I key represents a key pair index value
  • ID A and ID B respectively represent IDs of the data receiving device and the data transmitting device
  • P t represents a scrambling code value related to the current time t
  • I key_int represents a preset key pair index.
  • the initial value, N represents the total number of key pairs stored in the secure storage area
  • k represents the number of key pairs stored in the secure storage area for supporting multicast/broadcast.
  • the key pair index value generating step according to a preset key pair index initial value, a scrambling code value, a multicast/broadcast ID, and a number of key pairs for supporting multicast/broadcast transmission, a preset algorithm is used.
  • the key pair index value is generated.
  • the key pair index value is generated according to the following expression:
  • I key F Harsh (ID C ,0,P t ,I key_int )mod(k)+(Nk)
  • I key represents a key pair index value
  • ID C represents a multicast/broadcast ID
  • P t represents a scrambling code value related to a current time t
  • I key_int represents a preset key pair index initial value
  • N represents a secure storage area. The total number of key pairs stored internally, k represents the number of key pairs stored in the secure storage area to support multicast/broadcast.
  • the scrambling code value P t is generated using an m-stage PN sequence code generator with the current time t as an input.
  • the preset key pair index initial value is the first time that the device performs data communication.
  • the encrypted channel protocol is constructed by using the preset high-level encryption key.
  • the present invention also provides an apparatus for determining a key pair, the apparatus comprising:
  • a key pair data storage module for storing key pair data, the key pair data being a key pair encrypted by a preset high layer key.
  • a key pair index value generating module configured to determine a key pair index value according to a preset key pair initial value, a scrambling code value, and an ID of a device that performs data communication;
  • a key pair data determining module which is connected to the key pair data storage module and the key pair index value generating module, and is configured to select, from the key pair data storage module, the key pair index value Key pair data;
  • the key pair data decryption module is connected to the key pair data determining module, and is configured to decrypt the key pair data by using the preset high layer key to obtain a required key pair.
  • the key pair index value generating module is configured to: according to a preset key pair index initial value, a scrambling code value, an ID of a device for performing data communication, and a key pair for supporting point-to-point transmission The number is generated by using a preset algorithm to generate the key pair index value.
  • the key pair index value generating module is configured to generate the key pair index value according to the following expression:
  • I key F Harsh (ID A , ID B , P t , I key_int ) mod(Nk)
  • I key represents a key pair index value
  • ID A and ID B respectively represent IDs of the data receiving device and the data transmitting device
  • P t represents a scrambling code value related to the current time t
  • I key_int represents a preset key pair index.
  • the initial value, N represents the total number of key pairs stored in the secure storage area
  • k represents the number of key pairs stored in the secure storage area for supporting multicast/broadcast.
  • the key pair index value generating module is configured to be configured according to an initial value of the index according to the preset key pair, a scrambling code value, a device ID of the data transmitting and receiving parties, and a device for supporting multicast/broadcast transmission.
  • the number of key pairs is generated by using a preset algorithm to generate the key pair index value.
  • the key pair index value generating module is configured to generate the key pair index value according to the following expression:
  • I key F Harsh (ID C ,0,P t ,I key_int )mod(k)+(Nk)
  • I key represents a key pair index value
  • ID C represents a multicast/broadcast ID
  • P t represents a scrambling code value related to a current time t
  • I key_int represents a preset key pair index initial value
  • N represents a secure storage area. The total number of key pairs stored internally, k represents the number of key pairs stored in the secure storage area to support multicast/broadcast.
  • the invention also provides a data processing method, the method comprising:
  • the present invention provides a non-switched key pair determination method and apparatus, and a data processing method for data encryption or decryption using a key pair determined by the method.
  • the key pair determining method enables the data sending and receiving parties to "agree" the encryption key without using a key management entity such as KTC/KDC, thereby realizing the encrypted transmission of voice and data information, and solving the information leakage in the current wireless communication process. problem.
  • the method for determining a key pair does not require the establishment of a key management entity such as an enterprise-level KTC/KDC, thereby saving deployment costs while avoiding security risks caused by KTC/KDC being attacked.
  • the data transmitting and receiving parties perform the key pair index determination according to a predetermined rule, and the actual key is solidified in the secure area of the mobile phone, thereby ensuring high confidentiality and integrity of the communication process.
  • the method can also ensure secure transmission of services such as multicast/multicast by introducing a special index value corresponding to a key pair for multicast and broadcast.
  • FIG. 1 is a flow chart of a data processing method in accordance with one embodiment of the present invention.
  • FIG. 2 is a schematic structural diagram of a secure storage area according to an embodiment of the present invention.
  • FIG. 3 is a block diagram showing an apparatus for determining a key pair, in accordance with one embodiment of the present invention.
  • the steps illustrated in the flowchart of the figures may be in a computer system such as a set of computer executable instructions The execution is performed, and although the logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in a different order than the ones described herein.
  • KDC/KTC selects the key for the transmitting and receiving parties and sends it to the transmitting and receiving parties through a specific secure channel.
  • the main drawback of this solution is the need to establish an additional enterprise-level KDC/KTC center with a large investment.
  • the security and stability of the KDC/KTC Center and the secure channel are of paramount importance. Failure or attack will result in the interruption of all communication links or the loss of system-wide data.
  • Another method is to perform cryptographic negotiation in a peer-to-peer manner by using a specific signaling channel by the data transmitting end and the data receiving end, and transmit the public key for voice or data encryption to the opposite end through a specific channel.
  • the present invention provides a non-switched key cooperation mechanism for data processing, so that the transmitting and receiving parties can "agree" to encrypt without having to pass a key management entity such as KTC/KDC.
  • the key realizes the encrypted transmission of voice and data information, and solves the problem of information leakage in the current wireless communication process.
  • FIG. 1 shows a flow chart of a data processing method provided by this embodiment.
  • the data processing method provided in this embodiment establishes a communication connection between the data transmitting and receiving parties through the operator infrastructure in step S101.
  • the method determines the key pair index value according to the preset key pair index initial value, the scrambling code value, and the ID of the device performing data communication.
  • the key pair used for data encryption and decryption is solidified in a codebook form into a secure storage area such as a ROM or a mobile phone Trustzone.
  • the key pair data stored in the secure storage area includes both key pair data for point-to-point communication and key pair data for multicast/broadcast, where The key pair data for point-to-point communication is the Nk group, and the key pair data for multicast/broadcast is the k group.
  • the data transmission mode of the data transceiver device when the data transmission mode of the data transceiver device is point-to-point transmission, only the key pair for point-to-point communication may be stored in the secure storage area, and when the data transceiver device is used.
  • the data transmission mode is multicast or broadcast, only the key pair for multicast/broadcast may be stored in the secure storage area, and the present invention is not limited thereto.
  • the size of the codebook can be estimated and set according to the user size of the entire encryption system (i.e., the number of devices included in the entire encryption system).
  • ROM or The key pair stored by the secure storage area entity such as the mobile phone Trustzone is encrypted by a higher-level key, which can only be read or decrypted by a specific device or application to prevent the key from being leaked.
  • the remote management center can also send instructions to the device containing the secure storage area to perform data locking or deletion, thereby ensuring the security of the key and related data.
  • the key pair index value is determined by the non-traceable built-in module in step S102.
  • the key pair index value is obtained by mapping a data such as a user ID and a password pair initial value I key_int and a scrambling code value P t of the data transmitting and receiving parties by using a preset algorithm (for example, a Harsh algorithm).
  • a preset algorithm for example, a Harsh algorithm.
  • the key pair index value I key can be determined according to the following expression:
  • I key F Harsh (ID A , ID B , P t , I key_int ) mod(Nk) (1)
  • ID A and ID B represent the IDs of the data receiving device and the data transmitting device, respectively
  • P t represents the scrambling code value associated with the current time t
  • I key_int represents the initial value of the preset key pair index
  • the total number of key pairs stored in the storage area, k represents the number of key pairs stored in the secure storage area to support multicast/broadcast.
  • the preset key pair index initial value I key_int is preferably zero. It should be noted that, in other embodiments of the present invention, based on security enhancement considerations, the initial key pair index initial value I key_int may also be negotiated by the data transmitting and receiving parties through a peer-to-peer data signature process before the communication connection is established. The invention is not limited thereto.
  • the scrambling code value P t is a PN sequence code associated with the current time t, which is generated using the m-level PN sequence code generator with the current time t as the input. It can be seen from the expression (1) that since the communication connection establishment time is different, the scrambling code value P t is randomly hopped with time, and combined with the non-retroactivity of the Harsh value calculation process, the method provided by this embodiment It can effectively ensure the anti-attack capability of the key pair.
  • the method determines the required key pair data from the secure storage area according to the obtained key pair index value in step S103. Specifically, when the key pair index value obtained in step S102 is i (0 ⁇ i ⁇ Nk), the key pair corresponding to the key pair index value is extracted from the secure storage area in step S103. Data, the ith key pair data encrypted by the higher layer key.
  • the key pair data obtained in step S104 is decrypted using the higher layer key, thereby obtaining the required key pair (including the public key and the private key).
  • the data transmission and reception double facilitates the determination process of the key pair.
  • step S105 determines in step S105 whether the communication connection is successfully established. If the communication connection is successfully established, step S106 is performed to encrypt the data to be transmitted by using the public key, or to decrypt the received data by using the private key; and if the communication connection is not successfully established, return to step S101 to re-establish communication. connection.
  • the method determines in step S107 whether or not the current communication is ended. If the communication is not completed, proceed to step S106; otherwise, perform step S108 to delete the obtained key pair to prevent other illegal applications from stealing the key pair, thereby ensuring the security of the key pair, and then ensuring the security of the transmitted data. .
  • step S102 data transmission and reception may also be performed by means of multicast or broadcast encrypted communication.
  • the scrambling code value P t and the password pair index initial value I key are used to determine the key pair index value I key .
  • the key pair index value I key is determined according to the following expression:
  • I key F Harsh (ID C ,0,P t ,I key_int )mod(k)+(Nk) (2)
  • ID C represents a multicast ID or a broadcast ID.
  • This embodiment also provides an apparatus for determining a key pair, and FIG. 3 shows a schematic structural diagram of the apparatus.
  • the apparatus for determining a key pair includes: a key pair data storage module 301, a key pair index value generating module 302, a key pair data determining module 303, and a key pair.
  • Data decryption module 304 The key pair data storage module 301 is configured to store key pair data, and the key pair data is a key pair encrypted by a preset high layer key.
  • the key pair data storage module 301 is a secure storage area that uses a higher level key (ie, a preset high level key) to encrypt the stored data.
  • the key pair data storage module is implemented by using a ROM.
  • the key pair data storage module 301 can also be implemented by using other reasonable components or circuits, and the present invention is not limited thereto.
  • the key pair data storage module 301 can also be implemented by using Trustzone.
  • the key pair data storage module 301 stores the key pair data of the peer-to-peer communication of the user, and also stores the key pair data for multicast and broadcast communication.
  • the key pair index value generating module 302 is configured to determine a key pair index value according to the preset key pair index initial value, the scrambling code value, and the ID of the device that performs data communication. When the data transmitting and receiving parties are in point-to-point communication, the key pair index value generating module 302 uses the user ID and the preset password of the data sending and receiving parties to use the preset data I key_int and the scrambling code value P t to use preset data. An algorithm (such as the Harsh algorithm) is used to determine the key pair index value.
  • the key pair index value generating module 302 determines the key pair index value I key according to the expression (1).
  • the preset key pair index initial value I key_int is preferably zero. It should be noted that, in other embodiments of the present invention, based on security enhancement considerations, the initial key pair index initial value I key_int may also be negotiated by the data transmitting and receiving parties through a peer-to-peer data signature process before the communication connection is established. The invention is not limited thereto.
  • the key pair index value generating module 302 determines the index initial value I key_int according to the multicast ID or the broadcast ID, the scrambling code value P t and the password. Key pair index value I key . Specifically, in this embodiment, the key pair index value generating module 302 determines the key pair index value I key according to the expression (2).
  • the key pair data determining module 303 is connected to the key pair data storage module 301 and the key pair index value generating module 302 for selecting a key corresponding to the key pair index value from the key pair data storage module 301. For the data. Specifically, when the key pair index value generated by the key pair index value generating module 302 is i (0 ⁇ i ⁇ Nk), the key pair data determining module 303 extracts the key pair data storage module 301. The key pair data corresponding to the key pair index value, that is, the i-th key pair data, the i-th key pair data is the ith key pair encrypted by the higher layer key.
  • the key pair data decryption module 304 is connected to the key pair data determining module 303 for decrypting the key pair data transmitted by the key pair data determining module 303 by using a preset high layer key, thereby obtaining the required secret. Key pair.
  • the embodiment provides a non-switched key pair determining method and a data processing method for encrypting or decrypting data using the key pair determined by the method, the key pair
  • the method of determining enables the data sending and receiving parties to "agree" the encryption key without using a key management entity such as KTC/KDC, thereby realizing the encrypted transmission of voice and data information, and solving the problem of information leakage in the current wireless communication process.
  • the method for determining a key pair does not need to newly establish a key management entity such as an enterprise-level KTC/KDC, thereby saving deployment costs and avoiding security risks caused by KTC/KDC being attacked.
  • the data transmitting and receiving parties perform the key pair index determination according to a predetermined rule, and the actual key is solidified in the secure area of the mobile phone, thereby ensuring high confidentiality and integrity of the communication process.
  • the method can also ensure secure transmission of services such as multicast/multicast by introducing a special index value corresponding to a key pair for multicast and broadcast.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种用于确定秘钥对的方法及装置、数据处理方法，该用于确定密钥对的方法包括：根据预设密钥对索引初值、扰码值以及进行数据通信的设备的ID或组播/广播ID，生成密钥对索引值；根据密钥对索引值从安全存储区域内确定所需要的密钥对数据；利用预设高层密钥对密钥对数据进行解密，得到所需要的密钥对。该方法使得数据收发双方无需通过KTC/KDC等密钥管理实体，即可"约定"加密密钥，从而实现语音及数据信息的加密传输，解决了当前无线通信过程中的信息泄密问题。

Description

一种端加密传输的密钥管理的方法及装置
相关技术的交叉引用
本申请要求享有2015年12月04日提交的名称为：“一种用于确定密钥对的方法及装置、数据处理方法”的中国专利申请CN 201510885208.0的优先权，其全部内容通过引用并入本文中。
技术领域
本发明涉及通信技术领域，具体地说，涉及一种端加密传输的密钥管理的方法及装置。
背景技术
随着移动通信产业的迅猛发展，手机不仅仅在个人生活中得到广泛的应用，而且在诸如政府公务以及商务活动等诸多领域中也扮演着愈来愈重要的角色。然而，现有的移动通信网络存在一些安全隐患，导致无线窃听等事件屡有发生。例如，作为移动通信主流制式的GSM系统，其仅支持空口加密，不能提供端到端的安全加密通信。利用GSM系统的这一特点，不法分子可以利用伪基站等设备来进行语音窃听和数据盗取。
为此，国内外有关厂家对端到端加密传输体制进行了深入的技术研究。相应的技术解决方案主要包括三种：其一、收发端通过外置的硬件设备对原始的语音或者数据进行额外的模数转换、数模转换和加/解密处理；其二、加/解密设备内置于手机中，对模数转换及信源编码处理后的语音等信息进行加/解密处理；其三、设计专门的VoIP类通信软件，对使用者的短信与通话信息进行加/解密处理。
由上可知，现有的端到端加密机制一般基于通信运营商的通信链路，这样也就增加了额外的一层加密防护措施。然而出于成本、安全等因素的考虑，现有的端到端加密机制无法借助通信运营商已有的KDC/KTC等基础设施来实现。在此情况下，通信双方如何协定加密的密钥对来实现数据的端到端加密传输，成为一个迫切需要解决的技术难题。
发明内容
为解决上述问题，本发明提供了一种用于确定秘钥对的方法，所述方法包括：
密钥对索引值生成步骤，根据预设密钥对索引初值、扰码值以及进行数据通信的设备的ID或组播/广播ID，生成密钥对索引值；
密钥对数据确定步骤，根据所述密钥对索引值从安全存储区域内确定所需要的密钥对数据；
密钥对确定步骤，利用预设高层密钥对所述密钥对数据进行解密，得到所需要的密钥对。
根据本发明的一个实施例，当所述数据收发双方的数据传输方式为点对点传输时，
在所述密钥对索引值生成步骤中，根据预设密钥对索引初值、扰码值、进行数据通信的设备的ID以及用于支持点对点传输的密钥对数量，利用预设算法生成所述密钥对索引值。
根据本发明的一个实施例，在所述密钥对索引值生成步骤中，根据如下表达式生成所述密钥对索引值：
Ikey＝FHarsh(IDA，IDB，Pt，Ikey_int)mod(N-k)
其中，Ikey表示密钥对索引值，IDA和IDB分别表示数据接收设备和数据发送设备的ID，Pt表示与当前时间t有关的扰码值，Ikey_int表示预设密钥对索引初值，N表示安全存储区内存储的密钥对的总数量，k表示安全存储区内存储的用于支持组播/广播的密钥对的数量。
根据本发明的一个实施例，当所述数据收发双方的数据传输方式为组播/广播传输时，
在所述密钥对索引值生成步骤中，根据预设密钥对索引初值、扰码值、组播/广播ID以及用于支持组播/广播传输的密钥对数量，利用预设算法生成所述密钥对索引值。
根据本发明的一个实施例，在所述密钥对索引值生成步骤中，根据如下表达式生成所述密钥对索引值：
Ikey＝FHarsh(IDC，0，Pt，Ikey_int)mod(k)+(N-k)
其中，Ikey表示密钥对索引值，IDC表示组播/广播ID，Pt表示与当前时间t有关的扰码值，Ikey_int表示预设密钥对索引初值，N表示安全存储区内存储的密钥对的总数量，k表示安全存储区内存储的用于支持组播/广播的密钥对的数量。
根据本发明的一个实施例，以当前时间t为输入，采用m级PN序列码发生器生成所述扰码值Pt。
根据本发明的一个实施例，所述预设密钥对索引初值是进行数据通信的设备在首次 通信过程中，利用预设高层加密秘钥构建的加密通道协定得到的。
本发明还提供了一种用于确定密钥对的装置，所述装置包括：
密钥对数据存储模块，其用于存储密钥对数据，所述密钥对数据为经预设高层密钥加密的密钥对。
密钥对索引值生成模块，其用于根据预设密钥对索引初值、扰码值以及进行数据通信的设备的ID，确定密钥对索引值；
密钥对数据确定模块，其与所述密钥对数据存储模块和密钥对索引值生成模块连接，用于从所述密钥对数据存储模块中选取与所述密钥对索引值相对应的密钥对数据；
密钥对数据解密模块，其与所述密钥对数据确定模块连接，用于利用所述预设高层密钥对所述密钥对数据进行解密，从而得到所需要的密钥对。
根据本发明的一个实施例，所述密钥对索引值生成模块配置为根据预设密钥对索引初值、扰码值、进行数据通信的设备的ID以及用于支持点对点传输的密钥对数量，利用预设算法生成所述密钥对索引值。
根据本发明的一个实施例，所述密钥对索引值生成模块配置为根据如下表达式生成所述密钥对索引值：
Ikey＝FHarsh(IDA，IDB，Pt，Ikey_int)mod(N-k)
其中，Ikey表示密钥对索引值，IDA和IDB分别表示数据接收设备和数据发送设备的ID，Pt表示与当前时间t有关的扰码值，Ikey_int表示预设密钥对索引初值，N表示安全存储区内存储的密钥对的总数量，k表示安全存储区内存储的用于支持组播/广播的密钥对的数量。
根据本发明的一个实施例，所述密钥对索引值生成模块配置为根据根据预设密钥对索引初值、扰码值、数据收发双方的设备ID以及用于支持组播/广播传输的密钥对数量，利用预设算法生成所述密钥对索引值。
根据本发明的一个实施例，所述密钥对索引值生成模块配置为根据如下表达式生成所述密钥对索引值：
Ikey＝FHarsh(IDC，0，Pt，Ikey_int)mod(k)+(N-k)
其中，Ikey表示密钥对索引值，IDC表示组播/广播ID，Pt表示与当前时间t有关的扰码值，Ikey_int表示预设密钥对索引初值，N表示安全存储区内存储的密钥对的总数量，k表示安全存储区内存储的用于支持组播/广播的密钥对的数量。
本发明还提供了一种数据处理方法，所述方法包括：
利用如上任一项所述的方法确定密钥对；
根据所述密钥对对需要发送的数据进行加密，或对接收到的数据进行解密
本发明提供了一种基于非交换式的密钥对确定方法以及装置，以及使用该方法所确定的密钥对来进行数据加密或解密的数据处理方法。该密钥对确定方法使得数据收发双方无需通过KTC/KDC等密钥管理实体，即可“约定”加密密钥，从而实现语音及数据信息的加密传输，解决了当前无线通信过程中的信息泄密问题。
本发明所提供的确定密钥对的方法由于不需要新建企业级的KTC/KDC等密钥管理实体，因此在节约部署开支的同时，还避免了因KTC/KDC被攻击而导致的安全风险。同时，在该方法中，数据收发双方通过按照预定的规则进行密钥对索引的确定，而实际密钥固化于手机的安全区域，从而确保了通信过程的高保密性和完整性。此外，该方法通过引入与用于组播、广播的密钥对相对应的特殊索引值，还能够确保多播/组播等业务的保密传输。
本发明的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本发明而了解。本发明的目的和其他优点可通过在说明书、权利要求书以及附图中所特别指出的结构来实现和获得。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要的附图做简单的介绍：
图1是根据本发明一个实施例的数据处理方法的流程图；
图2是根据本发明一个实施例的安全存储区域的结构示意图；
图3是根据本发明一个实施例的用于确定密钥对的装置的结构示意图。
具体实施方式
以下将结合附图及实施例来详细说明本发明的实施方式，借此对本发明如何应用技术手段来解决技术问题，并达成技术效果的实现过程能充分理解并据以实施。需要说明的是，只要不构成冲突，本发明中的各个实施例以及各实施例中的各个特征可以相互结合，所形成的技术方案均在本发明的保护范围之内。
同时，在以下说明中，出于解释的目的而阐述了许多具体细节，以提供对本发明实施例的彻底理解。然而，对本领域的技术人员来说显而易见的是，本发明可以不用这里的具体细节或者所描述的特定方式来实施。
另外，在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统 中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
目前，针对端到端加密传输尤其是语音加密传输的密钥管理体制正逐渐引起业内各界人士关注，所提出的针对密钥管理的技术方案已在特定场合采用。
其中一种比较直接的方式是为端加密传输建立集中式的KDC/KTC中心，由KDC/KTC为收发双方选取密钥，并通过特定的保密信道发送给收发双方。该方案的主要缺陷在于需要额外建立企业级的KDC/KTC中心，投资较大。此外，KDC/KTC中心及保密通道的安全性和稳定性至为重要，一旦失效或者被攻击，将导致所有通信链路中断或者全系统数据的泄密。
另一种方法是由数据发送端和数据接收端利用特定的信令通道通过点对点方式进行密码协商，并将用于语音或者数据加密的公钥通过特定的信道传送至对端。采用此技术方案，一方面需要考虑更严密或者更高层次的加密措施确保密钥传输渠道的安全；另一方面，每次数据通讯都需要协商密钥，将导致额外的信令开销和连接建立时延。
针对现有技术中存在的上述问题，本发明提供了一种基于非交换式的密钥协作机制来进行数据处理，使得收发双方无需通过KTC/KDC等密钥管理实体，即可“约定”加密密钥，实现语音及数据信息的加密传输，解决当前无线通信过程中的信息泄密问题。
图1示出了本实施例所提供的数据处理方法的流程图。
如图1所示，本实施例所提供的数据处理方法在步骤S101中数据收发双方通过运营商基础设施建立通信连接。
在密钥对索引值生成步骤S102中，该方法根据预设密钥对索引初值、扰码值以及进行数据通信的设备的ID，确定密钥对索引值。本实施例中，用于数据加密和解密的密钥对是以码本形式固化到一个ROM或者手机Trustzone等安全存储区域中的。如图2所示，本实施例中，安全存储区域中所存储的密钥对数据既包括用于点对点通信的密钥对数据，也包括用于组播/广播的密钥对数据，其中，用于对点通信的密钥对数据为N-k组，而用于组播/广播的密钥对数据为k组。
需要说明的是，在本发明的其他实施例中，当数据收发设备的数据传输方式为点对点传输时，安全存储区域中还可以仅存储用于对点通信的密钥对，而当数据收发设备的数据传输方式为组播或广播时，安全存储区域中还可以仅存储用于组播/广播的密钥对，本发明不限于此。
同时，还需要指出的是，在本发明的不同实施例中，密码本的大小可以根据整个加密系统的用户规模(即整个加密系统中所包含的设备数量)来进行估算和设置。ROM或 者手机Trustzone等安全存储区域实体存储的密钥对采用更高层次的密钥进行加密处理，其只能由特定的设备或应用来进行读取或解密，以防备密钥的外泄。同时，在包含安全存储区域的设备(例如手机)遗失的情况下，还可以通过远程管理中心向包含安全存储区域的设备发送指令来进行数据锁定或删除，从而确保密钥以及相关数据的安全。
具体地，本实施例中，在步骤S102中通过不可溯源的内置模块来确定密钥对索引值。其中，密钥对索引值是基于数据收发双方的用户ID、密码对索引初值Ikey_int、扰码值Pt等数据利用预设算法(例如Harsh算法)映射得到。具体地，本实施例中，可以根据如下表达式确定密钥对索引值Ikey：
Ikey＝FHarsh(IDA，IDB，Pt，Ikey_int)mod(N-k)  (1)
其中，IDA和IDB分别表示数据接收设备和数据发送设备的ID，Pt表示与当前时间t有关的扰码值，Ikey_int表示预设密钥对索引初值，N＝2n表示安全存储区内存储的密钥对的总数量，k表示安全存储区内存储的用于支持组播/广播的密钥对的数量。
本实施例中，预设密钥对索引初值Ikey_int优选地为零。需要指出的是，在本发明的其他实施例中，基于安全性增强的考虑，预设密钥对索引初值Ikey_int还可以在通信连接建立前由数据收发双方通过点对点的数据签名过程协商得出，本发明不限于此。
扰码值Pt是与当前时间t有关的PN序列码，它是以当前时间t为输入采用m级PN序列码生成器生成的。从表达式(1)中可以看出，由于通信连接建立时间的不同将使得扰码值Pt随时间随机跳变，再结合Harsh值计算过程的不可追溯性，因此本实施例所提供的方法能够有效确保密钥对的抗攻击能力。
再次如图1所示，当在步骤S102中得到密钥对索引值后，本方法在步骤S103中根据所得到的密钥对索引值从安全存储区域中确定出所述需要的密钥对数据。具体地，当在步骤S102中得到的密钥对索引值为i(0≤i≤N-k)时，在步骤S103中则会从安全存储区域中提取该密钥对索引值所对应的密钥对数据，即经高层密钥加密的第i个密钥对数据。
在密钥对确定步骤S104中，利用高层密钥对步骤S104中所得到的密钥对数据进行解密，从而得到所需要的密钥对(包括公钥和私钥)。
至此，数据收发双方便完成了密钥对的确定过程。
当得到所需要的密钥对后，该方法在步骤S105中判断通信连接是否建立成功。如果通信连接建立成功，则执行步骤S106以利用公钥对待发送数据进行加密，或是利用私钥对接收到的数据进行解密；而如果通信连接没有建立成功，那么则返回步骤S101以重新建立通信连接。
本方法在步骤S107中会判断本次通信是否结束。如果通信未结束，则继续执行步骤S106；否则执行步骤S108以删除所得到密钥对，以防止其他非法应用窃取该密钥对，从而保证密钥对的安全性，继而保证传输数据的安全性。
需要说明的是，在本发明的其他实施例中，数据的收发还可以是以组播或广播加密通信的方式进行传输的，在这种情况下，在步骤S102中则会根据组播ID或广播ID、扰码值Pt以及密码对索引初值Ikey来确定密钥对索引值Ikey。
具体地，在该实施例中，根据如下表达式确定密钥对索引值Ikey：
Ikey＝FHarsh(IDC，0，Pt，Ikey_int)mod(k)+(N-k)  (2)
其中，IDC表示组播ID或广播ID。
本实施例还提供了一种用于确定密钥对的装置，图3示出了该装置的结构示意图。
如图3所示，本实施例所提供的用于确定密钥对的装置包括：密钥对数据存储模块301、密钥对索引值生成模块302、密钥对数据确定模块303以及密钥对数据解密模块304。其中，密钥对数据存储模块301用于存储密钥对数据，密钥对数据为经预设高层密钥加密的密钥对。
密钥对数据存储模块301即为安全存储区域，其采用更高层次的密钥(即预设高层密钥)来对所存储的数据进行加密。本实施例中，密钥对数据存储模块采用ROM来实现。需要说明的是，在本发明的不同实施例中，密钥对数据存储模块301还可以采用其他合理的元器件或电路来实现，本发明不限于此。例如在本发明的一个实施例中，密钥对数据存储模块301还可以采用Trustzone来实现。
如图2所示，本实施例中，密钥对数据存储模块301中既存储了用户点对点通信的密钥对数据，也存储了用于组播、广播通信的密钥对数据。
密钥对索引值生成模块302用于根据预设密钥对索引初值、扰码值以及进行数据通信的设备的ID，确定密钥对索引值。其中，当数据收发双方为点到点通信时，密钥对索引值生成模块302会根据数据收发双方的用户ID、预设密码对索引初值Ikey_int、扰码值Pt等数据利用预设算法(例如Harsh算法)来确定出密钥对索引值。
具体地，本实施例中，当数据收发双方为点到点通信时，密钥对索引值生成模块302根据表达式(1)来确定密钥对索引值Ikey。本实施例中，预设密钥对索引初值Ikey_int优选地为零。需要指出的是，在本发明的其他实施例中，基于安全性增强的考虑，预设密钥对索引初值Ikey_int还可以在通信连接建立前由数据收发双方通过点对点的数据签名过程协商得出，本发明不限于此。
当数据收发双方通过组播或广播的方式来进行数据通信时，密钥对索引值生成模块 302则会根据组播ID或广播ID、扰码值Pt以及密码对索引初值Ikey_int来确定密钥对索引值Ikey。具体地，本实施例中，密钥对索引值生成模块302会根据表达式(2)来确定密钥对索引值Ikey。
密钥对数据确定模块303与密钥对数据存储模块301和密钥对索引值生成模块302连接，其用于从密钥对数据存储模块301中选取与密钥对索引值相对应的密钥对数据。具体地，当密钥对索引值生成模块302所生成的密钥对索引值为i(0≤i≤N-k)时，密钥对数据确定模块303则会从密钥对数据存储模块301中提取该密钥对索引值所对应的密钥对数据，即第i个密钥对数据，该第i个密钥对数据为经高层密钥加密的第i个密钥对。
密钥对数据解密模块304与密钥对数据确定模块303连接，其用于利用预设高层密钥对密钥对数据确定模块303传输来的密钥对数据进行解密，从而得到所需要的密钥对。
从上述描述中可以看出，本实施例提供了一种基于非交换式的密钥对确定方法以及使用该方法所确定的密钥对来进行数据加密或解密的数据处理方法，该密钥对确定方法使得数据收发双方无需通过KTC/KDC等密钥管理实体，即可“约定”加密密钥，从而实现语音及数据信息的加密传输，解决了当前无线通信过程中的信息泄密问题。
本实施例所提供的确定密钥对的方法由于不需要新建企业级的KTC/KDC等密钥管理实体，因此在节约部署开支的同时，还避免了因KTC/KDC被攻击而导致的安全风险。同时，在该方法中，数据收发双方通过按照预定的规则进行密钥对索引的确定，而实际密钥固化于手机的安全区域，从而确保了通信过程的高保密性和完整性。此外，该方法通过引入与用于组播、广播的密钥对相对应的特殊索引值，还能够确保多播/组播等业务的保密传输。
应该理解的是，本发明所公开的实施例不限于这里所公开的特定处理步骤，而应当延伸到相关领域的普通技术人员所理解的这些特征的等同替代。还应当理解的是，在此使用的术语仅用于描述特定实施例的目的，而并不意味着限制。
虽然上述示例用于说明本发明在一个或多个应用中的原理，但对于本领域的技术人员来说，在不背离本发明的原理和思想的情况下，明显可以在形式上、用法及实施的细节上作各种修改而不用付出创造性劳动。因此，本发明由所附的权利要求书来限定。

Claims (13)

  1. 一种用于确定秘钥对的方法，其中，所述方法包括：
    密钥对索引值生成步骤，根据预设密钥对索引初值、扰码值以及进行数据通信的设备的ID或组播/广播ID，生成密钥对索引值；
    密钥对数据确定步骤，根据所述密钥对索引值从安全存储区域内确定所需要的密钥对数据；
    密钥对确定步骤，利用预设高层密钥对所述密钥对数据进行解密，得到所需要的密钥对。
  2. 如权利要求1所述的方法，其中，当所述数据收发双方的数据传输方式为点对点传输时，
    在所述密钥对索引值生成步骤中，根据预设密钥对索引初值、扰码值、进行数据通信的设备的ID以及用于支持点对点传输的密钥对数量，利用预设算法生成所述密钥对索引值。
  3. 如权利要求2所述的方法，其中，在所述密钥对索引值生成步骤中，根据如下表达式生成所述密钥对索引值：
    Ikey＝FHarsh(IDA，IDB，Pt，Ikey_int)mod(N-k)
    其中，Ikey表示密钥对索引值，IDA和IDB分别表示数据接收设备和数据发送设备的ID，Pt表示与当前时间t有关的扰码值，Ikey_int表示预设密钥对索引初值，N表示安全存储区内存储的密钥对的总数量，k表示安全存储区内存储的用于支持组播/广播的密钥对的数量。
  4. 如权利要求1～3中任一项所述的方法，其中，当所述数据收发双方的数据传输方式为组播/广播传输时，
    在所述密钥对索引值生成步骤中，根据预设密钥对索引初值、扰码值、组播/广播ID以及用于支持组播/广播传输的密钥对数量，利用预设算法生成所述密钥对索引值。
  5. 如权利权利要求4所述的方法，其中，在所述密钥对索引值生成步骤中，根据如下表达式生成所述密钥对索引值：
    Ikey＝FHarsh(IDC，0，Pt，Ikey_int)mod(k)+(N-k)
    其中，Ikey表示密钥对索引值，IDC表示组播/广播ID，Pt表示与当前时间t有关的扰码值，Ikey_int表示预设密钥对索引初值，N表示安全存储区内存储的密钥对的总数量，k表示安全存储区内存储的用于支持组播/广播的密钥对的数量。
  6. 如权利要求3或5所述的方法，其中，以当前时间t为输入，采用m级PN序列码 发生器生成所述扰码值Pt。
  7. 如权利要求1～6中任一项所述的方法，其中，所述预设密钥对索引初值是进行数据通信的设备在首次通信过程中，利用预设高层加密秘钥构建的加密通道协定得到的。
  8. 一种用于确定密钥对的装置，其中，所述装置包括：
    密钥对数据存储模块，其用于存储密钥对数据，所述密钥对数据为经预设高层密钥加密的密钥对。
    密钥对索引值生成模块，其用于根据预设密钥对索引初值、扰码值以及进行数据通信的设备的ID，确定密钥对索引值；
    密钥对数据确定模块，其与所述密钥对数据存储模块和密钥对索引值生成模块连接，用于从所述密钥对数据存储模块中选取与所述密钥对索引值相对应的密钥对数据；
    密钥对数据解密模块，其与所述密钥对数据确定模块连接，用于利用所述预设高层密钥对所述密钥对数据进行解密，从而得到所需要的密钥对。
  9. 如权利要求8所述的装置，其中，所述密钥对索引值生成模块配置为根据预设密钥对索引初值、扰码值、进行数据通信的设备的ID以及用于支持点对点传输的密钥对数量，利用预设算法生成所述密钥对索引值。
  10. 如权利要求9所述的装置，其中，所述密钥对索引值生成模块配置为根据如下表达式生成所述密钥对索引值：
    Ikey＝FHarsh(IDA，IDB，Pt，Ikey_int)mod(N-k)
    其中，Ikey表示密钥对索引值，IDA和IDB分别表示数据接收设备和数据发送设备的ID，Pt表示与当前时间t有关的扰码值，Ikey_int表示预设密钥对索引初值，N表示安全存储区内存储的密钥对的总数量，k表示安全存储区内存储的用于支持组播/广播的密钥对的数量。
  11. 如权利要求8～10中任一项所述的装置，其中，所述密钥对索引值生成模块配置为根据根据预设密钥对索引初值、扰码值、数据收发双方的设备ID以及用于支持组播/广播传输的密钥对数量，利用预设算法生成所述密钥对索引值。
  12. 如权利要求11所述的装置，其中，所述密钥对索引值生成模块配置为根据如下表达式生成所述密钥对索引值：
    Ikey＝FHarsh(IDC，0，Pt，Ikey_int)mod(k)+(N-k)
    其中，Ikey表示密钥对索引值，IDC表示组播/广播ID，Pt表示与当前时间t有关的扰码值，Ikey_int表示预设密钥对索引初值，N表示安全存储区内存储的密钥对的总数量，k表示安全存储区内存储的用于支持组播/广播的密钥对的数量。
  13. 一种数据处理方法，其中，所述方法包括：
    利用如权利要求1～7中任一项所述的方法确定密钥对；
    根据所述密钥对对需要发送的数据进行加密，或对接收到的数据进行解密。
PCT/CN2015/098482 2015-12-04 2015-12-23 一种端加密传输的密钥管理的方法及装置 WO2017092092A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US15/739,693 US10601586B2 (en) 2015-12-04 2015-12-23 Method and apparatus for key management of end encrypted transmission
ZA2018/00005A ZA201800005B (en) 2015-12-04 2018-01-02 Method and apparatus for key management ofend encrypted transmission

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510885208.0A CN105450392B (zh) 2015-12-04 2015-12-04 一种用于确定密钥对的方法及装置、数据处理方法
CN201510885208.0 2015-12-04

Publications (1)

Publication Number Publication Date
WO2017092092A1 true WO2017092092A1 (zh) 2017-06-08

Family

ID=55560213

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/098482 WO2017092092A1 (zh) 2015-12-04 2015-12-23 一种端加密传输的密钥管理的方法及装置

Country Status (4)

Country Link
US (1) US10601586B2 (zh)
CN (1) CN105450392B (zh)
WO (1) WO2017092092A1 (zh)
ZA (1) ZA201800005B (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220417740A1 (en) * 2021-06-09 2022-12-29 T-Mobile Usa, Inc. Determining and ameliorating wireless telecommunication network functionalities that are impaired when using end-to-end encryption

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106022584A (zh) * 2016-05-13 2016-10-12 成都镜杰科技有限责任公司 小型企业资源管理方法
CN106412891B (zh) * 2016-09-06 2019-12-03 北京汇通金财信息科技有限公司 一种lte专网终端提升安全性的方法及装置
CN108494549B (zh) * 2018-02-27 2020-10-02 北京赛博兴安科技有限公司 基于fpga的密钥索引协商装置、系统及方法
CN109413092B (zh) * 2018-11-20 2021-03-12 国网浙江省电力有限公司电力科学研究院 一种密钥异构防御方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101866668A (zh) * 2009-04-16 2010-10-20 株式会社东芝 记录装置以及内容数据再现系统
US20120114120A1 (en) * 2010-11-05 2012-05-10 Kabushiki Kaisha Toshiba Storage device, access device, and program product
CN104038930A (zh) * 2013-03-04 2014-09-10 北京信威通信技术股份有限公司 一种端到中心ip数据分组加密的方法
CN104184591A (zh) * 2014-09-10 2014-12-03 爱康普科技（大连）有限公司 一种ttf认证方法

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FI114061B (fi) * 2002-05-17 2004-07-30 Nokia Corp Menetelmä ja järjestelmä digitaalisessa langattomassa tiedonsiirtoverkossa datasalauksen järjestämiseksi ja vastaava palvelin
US7233664B2 (en) * 2003-03-13 2007-06-19 New Mexico Technical Research Foundation Dynamic security authentication for wireless communication networks
US7981064B2 (en) 2005-02-18 2011-07-19 So Sound Solutions, Llc System and method for integrating transducers into body support structures
CN101212642B (zh) * 2006-12-25 2012-06-27 北京握奇数据系统有限公司 一种广播信号处理方法、系统及接收终端
CN101277181A (zh) * 2008-05-04 2008-10-01 福州大学 一种流媒体数字权限管理的动态多层加密方法
WO2010069033A1 (en) * 2008-12-18 2010-06-24 Bce Inc Validation method and system for use in securing nomadic electronic transactions
US20120102322A1 (en) * 2008-12-18 2012-04-26 O'brien William G Processing of communication device signatures for use in securing nomadic electronic transactions
WO2014165747A1 (en) * 2013-04-05 2014-10-09 Interdigital Patent Holdings, Inc. Securing peer-to-peer and group communications
CN103580859B (zh) * 2013-11-11 2017-05-10 国家电网公司 一种用于智能用电互动的非对称加密方法
CN104660412A (zh) * 2014-10-22 2015-05-27 南京泽本信息技术有限公司 一种移动设备无密码安全认证方法及系统
CN104836664B (zh) * 2015-03-27 2019-05-14 腾讯科技（深圳）有限公司 一种执行业务处理的方法、装置和系统
US9960911B2 (en) * 2015-09-11 2018-05-01 Signalchip Innovations Private Limited System and method for securing wireless communication through physical layer control and data channel

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101866668A (zh) * 2009-04-16 2010-10-20 株式会社东芝 记录装置以及内容数据再现系统
US20120114120A1 (en) * 2010-11-05 2012-05-10 Kabushiki Kaisha Toshiba Storage device, access device, and program product
CN104038930A (zh) * 2013-03-04 2014-09-10 北京信威通信技术股份有限公司 一种端到中心ip数据分组加密的方法
CN104184591A (zh) * 2014-09-10 2014-12-03 爱康普科技（大连）有限公司 一种ttf认证方法

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220417740A1 (en) * 2021-06-09 2022-12-29 T-Mobile Usa, Inc. Determining and ameliorating wireless telecommunication network functionalities that are impaired when using end-to-end encryption
US11706615B2 (en) * 2021-06-09 2023-07-18 T-Mobile Usa, Inc. Determining and ameliorating wireless telecommunication network functionalities that are impaired when using end-to-end encryption
US12015912B2 (en) 2021-06-09 2024-06-18 T-Mobile Usa, Inc. Determining and ameliorating wireless telecommunication network functionalities that are impaired when using end-to-end encryption

Also Published As

Publication number Publication date
US20180199191A1 (en) 2018-07-12
CN105450392B (zh) 2019-01-25
ZA201800005B (en) 2018-11-28
CN105450392A (zh) 2016-03-30
US10601586B2 (en) 2020-03-24

Similar Documents

Publication Publication Date Title
JP6023152B2 (ja) ダイレクトリンク通信のための拡張されたセキュリティ
JP4866909B2 (ja) 長いキーパッドを用いた共用鍵暗号化
CN110891269B (zh) 一种数据保护方法、设备及系统
CN102572817B (zh) 实现移动通信保密的方法和智能存储卡
WO2017092092A1 (zh) 一种端加密传输的密钥管理的方法及装置
CN106712932A (zh) 密钥管理方法、装置及系统
KR20040104724A (ko) 무선 근거리 또는 도시권 보안통신망 및 이에 관련된 방법
JP2006514789A (ja) 安全な移動体アドホック・ネットワーク及び関連の方法
CN101707767B (zh) 一种数据传输方法及设备
WO2012024906A1 (zh) 一种移动通信系统及其语音通话加密的方法
CN107454590A (zh) 一种数据加密方法、解密方法及无线路由器
CN103167494B (zh) 信息发送方法和系统
WO2021103772A1 (zh) 数据传输方法和装置
CN109450627B (zh) 一种将量子通信与无线通信相融合的移动设备通信网络及其通信方法
WO2024041498A1 (zh) 一种保密通信处理方法、第一终端及存储介质
CN105262759A (zh) 一种加密通信的方法和系统
Sagheer et al. Sms security for smartphone
CN105827601A (zh) 移动设备数据加密应用方法及系统
WO2012075761A1 (zh) 一种加密mms的方法及系统
JP2005167635A (ja) 装置、及び、データ送受信方法
CN112054905A (zh) 一种移动终端的安全通信方法及系统
WO2010069102A1 (zh) 移动终端及其密钥传输、解密方法、保密通信的实现方法
KR20000054258A (ko) 단문 메시지 암호화 방법 및 그 시스템
Sukhodolskiy et al. Analysis of Secure Protocols аnd Authentication Methods for Messaging
CN114268944A (zh) 一种身份认证方法、配网器、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15909606

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15909606

Country of ref document: EP

Kind code of ref document: A1