WO2017181518A1 - 一种加密通讯的方法及装置、系统 - Google Patents

一种加密通讯的方法及装置、系统 Download PDF

Info

Publication number
WO2017181518A1
WO2017181518A1 PCT/CN2016/086902 CN2016086902W WO2017181518A1 WO 2017181518 A1 WO2017181518 A1 WO 2017181518A1 CN 2016086902 W CN2016086902 W CN 2016086902W WO 2017181518 A1 WO2017181518 A1 WO 2017181518A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
data
information
receiving end
module
Prior art date
Application number
PCT/CN2016/086902
Other languages
English (en)
French (fr)
Inventor
樊忠虎
李姣
张迪
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017181518A1 publication Critical patent/WO2017181518A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics

Definitions

  • the present application relates to, but is not limited to, a communication technology, and more particularly to an encryption communication method, apparatus, and system.
  • the current encryption communication method mainly has the following problems: the chat between the communication parties cannot be differentiated and encrypted, and can be easily parsed into all similar communication devices or communication protocols, and the security is poor.
  • the embodiment of the invention provides a method, device and system for encrypting communication.
  • An embodiment of the present invention provides a method for encrypting communications, including:
  • the receiving end stores the key in a security area, and stores the data in a common area, where the security area can only be accessed by a decryption operation single process, and the common area is the security end on the receiving end. Any storage area outside the area;
  • the receiving end decrypts the data according to the key stored in the secure area.
  • the receiving end stores the key in the security area, including: storing the ID and the ID information negotiated by the sending end in the security area.
  • the method further includes: the receiving end verifying the sending end according to the ID information negotiated with the sending end, and acquiring the foregoing, before the receiving end decrypts the data. Access to the security zone.
  • the receiving end After the receiving end acquires the access right of the security zone, the receiving end reads the key from the security zone, and decrypts the data by using the key in the common zone.
  • the receiving end After the receiving end acquires the access right of the security zone, the data is read from the common area and sent to the security zone; in the security zone, the receiving end passes the key pair.
  • the data is decrypted and returns a decrypted data flag bit; if the decrypted data flag bit indicates that the decryption was successful, the decrypted data is read from the secure area.
  • the decrypted data is read from any one of the security zones.
  • the security zone includes a secure file system SFS zone and a return visit protection storage block RPMB zone.
  • the method further includes: negotiating the ID information between the sending end and the receiving end, and storing the negotiation result in a local security area.
  • An embodiment of the present invention provides a receiving end device configured to encrypt communications, where the receiving end device includes: a receiving module, an access module, and a decrypting module;
  • the receiving module is configured to receive a key and data from the sending end, where the key is a key created by the sending end according to the identity ID information negotiated with the receiving end device, where the data is the sending end Data encrypted by the key;
  • An access module configured to store the key received by the receiving module in a security area, and store the data received by the receiving module in a common area, where the security area can only be accessed by a decryption operation single process.
  • the normal area is any storage area on the receiving end except the security area;
  • a decryption module is configured to decrypt the data based on the key stored in the secure area.
  • the access module is configured to store the key in the secure area corresponding to the ID information of the sending end.
  • the decryption module is further configured to negotiate with the sending end according to the receiving end device.
  • the ID information is verified by the sender, and the access authority of the security zone is obtained.
  • the decryption module is configured to read the key from the security area after acquiring the access authority of the security zone, and decrypt the data by using the key in the common area.
  • the decryption module is configured to: after acquiring the access authority of the security zone, read the data from the common area by using the access module, and send the data to the security zone; and, set to be in the The secure area decrypts the data by the key and returns a decrypted data mark bit, and if the decrypted data mark bit indicates that the decryption is successful, the decrypted said read from the secure area by the access module data.
  • the decryption module is configured to read, after the security zone has more than one, if all the security zones return the decrypted data flag bit indicating that the decryption is successful, read the decrypted code from any one of the security zones. The data.
  • the security zone includes a secure file system SFS zone and a return visit protection storage block RPMB zone.
  • An embodiment of the present invention provides a method for encrypting communications, including:
  • the sender creates a key according to the identity ID information negotiated with the receiving end;
  • the sender encrypts the data by using the key
  • the sender sends the key and the encrypted data to the receiving end.
  • the creating a key according to the identity ID information negotiated with the receiving end includes: combining the ID information of the sending end with the ID information of the receiving end to form an encryption number, and inserting the encrypted data into the encryption algorithm by using the encrypted binary data as the encrypted unique identification data.
  • Generating a key; or, the sending end negotiates an extraction rule with the receiving end, and extracts an ID information field from the ID information of the sending end and the ID information of the receiving end according to the extracting rule, and merges the extracted ID information fields to form an encrypted number.
  • the binary data of the encrypted number is used as the encrypted unique identification data to be input into the encryption algorithm to generate a key; and the extraction rule indicates that the specified segment bit is extracted from the designated extractable field of the ID information by extracting the specified starting digit.
  • the method for combining the extracted ID information fields to form an encryption number is: when the data fields obtained by combining the ID information fields do not meet the requirements of the encryption algorithm, the extracted ID information fields are combined and a random number is added to form the Encrypted number.
  • An embodiment of the present invention provides a sending end device configured to encrypt communications, where the sending end device includes: a first creating module, a first encrypting module, and a first sending module;
  • a first creating module configured to create a key according to the identity ID information negotiated with the receiving end
  • a first encryption module configured to encrypt data by using a key created by the first creation module
  • the first sending module is configured to send the key created by the first creating module and the data encrypted by the first encryption module to the receiving end.
  • the first creation module is specifically configured to: combine the ID information of the sender and the ID information of the receiver to form an encryption number, and use the binary data of the encryption number as the encrypted unique identification data to be put into the encryption algorithm to generate a key; or
  • the ID information field is extracted from the ID information of the sender and the ID information of the receiver, and the extracted ID information fields are combined to form an encryption number, and the binary data of the encryption number is used as an encryption.
  • the unique identification data is placed in an encryption algorithm to generate a key; the extraction rule represents a specified segment bit from the specified decimable field of the ID information extracted from the specified starting digit.
  • the first creation module is configured to combine the extracted ID information fields to form an encryption number, that is: when the data fields obtained by combining the ID information fields do not meet the requirements of the encryption algorithm, the extracted ID information fields are combined and then added randomly. Number to form the encrypted number.
  • the embodiment of the invention further provides a method for encrypting communication, including:
  • the sender creates a key according to the ID information determined in consultation with the receiving end;
  • the sender sends the key to the receiving end together with the ID information determined by negotiation;
  • the transmitting end encrypts the data by the key and sends it to the receiving end.
  • the embodiment of the invention further provides a method for encrypting communication, including:
  • the sender When the data is to be sent, the sender creates a key according to the ID information determined by negotiation with the receiving end;
  • the sender encrypts the current data to be sent by using the key
  • the sender sends the encrypted current data, the ID information determined by negotiation, and the key to the receiving end.
  • the key includes a key body and an information number header file, and the information encoding header file includes an information number that marks the current data.
  • the embodiment of the invention further provides a sending end device configured to encrypt communication, comprising:
  • a second creating module configured to create a key according to the ID information determined by negotiation with the receiving end
  • a second sending module configured to: after the second creating module creates a key, send the key to the receiving end together with the ID information determined by negotiation; and, when the data needs to be sent, set the first The encrypted data of the second encryption module is sent to the receiving end;
  • a second encryption module is configured to encrypt data by the key.
  • the embodiment of the invention further provides a sending end device configured to encrypt communication, comprising:
  • a third creating module configured to create a key according to the ID information determined by negotiation with the receiving end when the current data is to be sent;
  • a third encryption module configured to encrypt the current data to be sent by using the key
  • the third sending module is configured to send the current data encrypted by the third encryption module, the ID information determined by the negotiation, and the key created by the second creating module to the receiving end.
  • An embodiment of the present invention further provides a system configured to encrypt communications, where the system includes the above-mentioned receiving device and the above-mentioned transmitting device;
  • the sending module of the sending end device is further configured to interact with the receiving module of the receiving end device, negotiate ID information of the sending end device and the receiving end device, and store the negotiation result in the sending end device. local;
  • the receiving module of the receiving device is further configured to interact with the sending module of the sending device, negotiate the ID information of the sending device and the receiving device, and store the negotiation result in the receiving device. local.
  • the embodiment of the invention further provides a computer readable storage medium storing computer executable instructions, which are implemented by the processor to implement any of the above encrypted communication methods.
  • the embodiment of the present invention creates a key according to the ID information negotiated between the sender and the receiver, and stores the key and the data in different areas respectively, according to the ID information of different receiving ends and sending ends.
  • Different keys are created, and there is only one pair of keys between a pair of terminals. Only the communication parties can decrypt the communication data, and the third party terminal cannot decrypt the data, which not only realizes differential encryption during communication, but also is dense.
  • the key can only be parsed by the communication parties, there is no need to set up the server, and the local data can be read when the data is decrypted, which not only has high communication security, but also has high processing efficiency.
  • the ID information used when creating a key between the same sending end and different receiving ends or between the same receiving end and different sending ends or between different receiving ends and different sending ends is different, and the used encryption number is used.
  • the encryption difference between different terminals is obvious, the third-party terminal cannot decrypt, realizes differentiated encryption, and ensures secure communication between terminals.
  • FIG. 1 is a schematic flowchart of a method for encrypting communication according to an embodiment of the present invention
  • FIG. 2 is a schematic structural diagram of a structure of an encrypted communication system according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart of processing an encrypted information by a transmitting end of an encrypted communication method according to an embodiment of the present invention
  • FIG. 4 is a schematic flowchart of storing encrypted information by a receiving end of an encrypted communication method according to an embodiment of the present invention
  • FIG. 5 is a schematic flowchart of a preferred embodiment of a method for decrypting data at a receiving end of an encrypted communication method according to an embodiment of the present invention
  • FIG. 6 is a schematic flowchart of another preferred embodiment of decrypting data at a receiving end of an encrypted communication method according to an embodiment of the present invention.
  • FIG. 7 is a schematic flowchart diagram of a preferred embodiment of a method for encrypting communication at a transmitting end according to an embodiment of the present invention
  • FIG. 8 is a schematic flowchart diagram of another preferred embodiment of an encryption communication method at a transmitting end according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a preferred embodiment of a transmitting end device according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of another preferred embodiment of a transmitting end device according to an embodiment of the present invention.
  • FIG. 11 is a diagram showing an example of a hardware structure of a transmitting end device and a receiving end device according to an embodiment of the present invention.
  • the main idea of the embodiment of the present invention is: in the communication process, both parties of the communication establish a chat protocol according to the identity (ID) information of the opposite party, and negotiate the used key, and use the key for all the encrypted data of the user, in the terminal part.
  • ID identity
  • the key is stored as a table storage information, and the terminal ID information is stored in one-to-one correspondence with the key.
  • the sender and the receiver are mutually agreed.
  • the key is dynamically created according to the negotiated ID information and the data is encrypted by the key, such as header information or tail information of the encrypted data, and the encrypted data and the created secret are encrypted.
  • the key is sent to the receiving end.
  • the receiving end When the receiving end decrypts, it needs to read its key in the secure area of the key storage to decrypt it. In this way, the receiving end stores the key locally, and different recipients and senders can create different keys according to their ID information, and there is only one pair of keys between the pair of terminals, and only the communication parties can The chat record is decrypted, and the third party terminal cannot decrypt the data, which not only realizes the differentiated encryption during communication, but also the key can be parsed only by the communication parties, and does not need to set up the server, and the local data can be read when the data is decrypted.
  • the encryption communication method in the embodiment of the present invention may mainly be as follows:
  • Step 101 The sender creates a key according to the identity ID information negotiated with the receiving end, encrypts the data by using the key, and sends the key and the data to the receiving end.
  • the key created by the sender is related to the ID information determined by the receiver.
  • the relationship between the key and the ID information determined by the negotiation may be a one-to-one correspondence.
  • the key may be a pair of keys, including a decryption key and an encryption key, and the decryption key and the encryption key may be symmetric or asymmetric.
  • the sender encrypts the data by using an encryption key, and only sends the decryption key to the receiving end, and the receiving end decrypts the data according to the decryption key when decrypting the data.
  • the key may be generated in two ways: the key may be generated in the process of negotiating the ID information between the sender and the receiver; or may be generated in the non-negotiation phase.
  • the sending end After the sender determines the ID information of each other in the process of negotiating the ID information with the receiving end, the sending end generates a key pair corresponding to the ID information determined by the negotiation, and the key pair includes the encryption key and the decryption key.
  • the key sends the decryption key of the key pair to the receiving end during the negotiation process, and the receiving end stores the decryption key in the secure area.
  • the decryption key is already stored in the local security area of the receiving end, and the transmitting end encrypts the data by using the encryption key in the key pair, and then sends the data to the receiving end to receive
  • the terminal decrypts the data according to the ID information (including the ID of the sender and the ID of the receiver) from the security area to find a corresponding decryption key.
  • the key can also be generated during the non-negotiating phase. After the ID information negotiation has been completed on the transmitting end and the receiving end.
  • the sender When performing data interaction, for each interaction data, the following process is performed: the sender generates a key pair corresponding to the ID information determined by negotiation, and the key pair includes an encryption key and a decryption key.
  • the transmitting end When transmitting the current data, the transmitting end sends the current data encrypted by the encryption key, the decryption key, and the ID information determined by negotiation to the receiving end.
  • each key (encryption key and decryption key) in the key pair generated by the sender includes two parts: a key body and an information encoding header file, and the information encoding header file includes the tag current data.
  • the information number (for example, the Nth data sent to the receiving end, N can be used as the information number of the data).
  • the key body generated each time data is sent is the same, but the content of the information number header file is different.
  • the receiving end receives the data, the decryption key and the ID information sent by the transmitting end, stores the decryption key in a secure area, and places the current data in a common area. Since the header file of each session data decryption key is different, each dialog data needs to be decrypted by applying corresponding decrypted data. Therefore, when the receiving end decrypts, it is necessary to obtain the corresponding decryption key body according to the information number of the current data and the ID information determined by negotiation, and then decrypt the data of the common area.
  • the sender also stores the encryption key in a local security area, and stores it in the form of table storage information, where the table storage information includes an encryption key, ID information of the receiving end, and a correspondence between the two.
  • Step 102 The receiving end receives the key and data from the sending end.
  • Step 103 The receiving end stores the key in a security area, and stores the data in a common area.
  • the security zone can only be accessed by a decryption operation single process, and the common area is Any storage area other than the security area on the receiving end.
  • the security zones may be one, two or more.
  • the secure area may be a secure file system (SFS) on the modem side under the Qualcomm platform and a return visit protected storage block (RPMB) area on the side of the wireless access point (AP).
  • FSS secure file system
  • RPMB return visit protected storage block
  • the receiving end stores the key in a secure area in the form of table storage information, and stores the key in the table storage information corresponding to the ID information of the sending end.
  • Step 104 The receiving end decrypts the data according to the key stored in the secure area.
  • Step 101 The sending end negotiates the ID information with the receiving end, and stores the negotiation result locally.
  • the method before decrypting the data, the method further includes: the receiving end authenticating the sending end according to the ID information negotiated with the sending end, and acquiring the access right of the security area.
  • the embodiment of the present invention further provides a method for encrypting communication at a transmitting end, comprising: a sending end creates a key according to the identity ID information negotiated with the receiving end; the sending end encrypts the data by using the key; the sending end encrypts the data The key and the encrypted data are sent to the receiving end.
  • the creating a key according to the ID information negotiated with the receiving end includes: combining the ID information of the sending end with the ID information of the receiving end to form an encrypted number, and using the encrypted binary data as the encrypted unique identification data to be generated by the encryption algorithm. Key; or, the sending end negotiates an extraction rule with the receiving end, and extracts an ID information field from the ID information of the sending end and the ID information of the receiving end according to the extracting rule, and merges the extracted ID information fields to form an encrypted number,
  • the binary data of the encrypted number is inserted into the encryption algorithm as a key to identify the unique identification data; the extraction rule indicates that the specified segment bit is extracted from the specified extractable field of the ID information by extracting the specified starting digit.
  • the ID information may specifically be International Mobile Equipment Identity (IMEI) information.
  • IMEI International Mobile Equipment Identity
  • the method of combining the extracted ID information fields to form an encryption number includes: when the data field obtained by combining the extracted ID information does not satisfy the encryption algorithm requirement, a random number is further added after the data field to form the encryption number. If the extracted ID information is merged, the data field is satisfied. When the algorithm requires it, you can add no random number or you can add random numbers as needed.
  • the ID information determined by negotiation includes both IMEI information as an example, and how to create a key based on the ID information.
  • IMEI information as an example
  • the encryption number is directly obtained by the IMEI information of the two terminals, and the encryption number only includes the IMEI information of the two terminals.
  • the IMEIs of the two terminals ie, the transmitting end and the receiving end described herein
  • the IMEIs of the two terminals are merged (the combined order may be adopted in combination, for example, the terminal that initiates the negotiation request (ie, the transmitting end described herein) may be IMEI.
  • the IMEI is formed to form an encrypted number, and the binary data obtained by binarizing the encrypted number is used as the encrypted unique identification data, and is inserted into the encryption algorithm to generate the secret. key.
  • the IMEI of terminal A is: 867241020720126; the IMEI of terminal B is: 861267030000916; the IMEI of terminal C is: 869641150105329;
  • the encryption number formed by the IMEI combination between the terminal A and the terminal B is specifically: 867241020720126861267030000916, and the binary data of the encrypted number is used as the encrypted unique identification data in the encryption algorithm to generate the confidentiality between the terminal A and the terminal B. key.
  • the advantage of this method is that the implementation is simple, and the differentiation is obvious.
  • the disadvantage is that there are too many data bits.
  • the encryption number formed by the IMEI combination between the terminal A and the terminal C is specifically: 867241020720126869641150105329, and the binary data of the encrypted number is used as the encrypted unique identification data in the encryption algorithm to generate a key for communication between the terminal A and the terminal C.
  • the IMEI information is extracted from the fields of the two terminals according to a predetermined extraction rule, and then the extracted number is obtained from the extracted field.
  • the encrypted number may include not only IMEI information of the two terminals, but also a random number.
  • the IMEI of the two terminals are respectively according to the pre-negotiated extraction rules.
  • the IMEI field is extracted, and the extracted IMEI fields are merged (the combination may be in a predetermined order.
  • the IMEI field of the terminal that initiates the negotiation request ie, the sender described herein
  • the terminal that confirms the negotiation request is confirmed.
  • the IMEI field is listed later to form an encryption number, and the binary data obtained by binarizing the encrypted number is placed into the encryption algorithm to generate a key as the encrypted unique identification data. If the data obtained by combining the IMEI fields does not satisfy the total bit requirement of the encryption algorithm, a random number may be added after the merged data, and the random number is a randomly generated number.
  • the extraction rule may include a specified decimable field of the IMEI, and a extracted segment bit and a starting digit, indicating a field for extracting the specified segment bit from the specified extractable field of the IMEI.
  • the extraction rule can be determined by negotiation between two terminals. The terminal is different, and the extraction rules determined by negotiation are also different, that is, each two terminals have their own specific extraction rules.
  • the starting digit of the extracted field indicates that the starting digit is extracted from the corresponding digit of the IMEI, and the starting digit is actually a number, and the digit is randomly generated.
  • the IMEI of terminal A is: 867241020720126; the IMEI of terminal B is: 861267030000916; the IMEI of terminal C is: 869641150105329;
  • the terminal A and the terminal B can negotiate the contract extraction rule in advance: using 4 segments, the 15-bit field of the IMEI extracts the first 12 to 12 fields, and the randomly generated starting digit is 5, that is, 1 to 1 in the IMEI. In the beginning of the ⁇ 12 digits, the last 4 digits are extracted from the 5th digit.
  • the IMEI field of the terminal A is: 4102; the IMEI field of the terminal B is: 6703; the IMEI field of the terminal A is merged with the IMEI field of the terminal B to obtain the data 41026703. Since the field of the data 41026703 has only 8 bits, the encryption is not satisfied.
  • the algorithm requires that the random number (for example, 00) be added after the data 41026703 to obtain the encryption number of 4102670300.
  • the binary data of the encrypted number is: 11110100100010011100011111011100, and the binary data is used as the encrypted unique identification data in the encryption algorithm. , generating the keys of the terminal A and the terminal B.
  • the negotiation rule can be negotiated in advance: using 5 segments, the 15-bit field of the IMEI extracts the first field from 1 to 11 bits, and the randomly generated starting digit is 6, that is, in In the first field of the 1 to 11 bits of the IMEI, the last 5 digits are extracted from the sixth digit.
  • the IMEI field of the terminal A is: 10207; the IMEI field of the terminal B is: 11501; the IMEI field of the terminal A is merged with the IMEI field of the terminal B to obtain the data 1020711501, because the data
  • the field of 1020711501 has 10 bits, which satisfies the requirements of the encryption algorithm, and does not need to complement the data.
  • the data is directly binarized, and the obtained binary data 111100110101101101001001001101 is inserted into the encryption algorithm as the encrypted unique identification data, and the terminal A and the terminal C are generated. Key.
  • the second method between different terminals, such as between terminal A and terminal B, between terminal A and terminal C, and between terminal B and terminal C, not only the IMEI used but also the extraction rules are different, and the number of encryptions is different.
  • the random number used is also different, the difference in the number of encryption used is more obvious, and the number of data bits of the encrypted number is controllable, which not only realizes highly differentiated encryption, but also has higher communication security.
  • the embodiment of the present invention further provides a sending end device configured to encrypt communication, the sending end device comprising: a first creating module, a first encrypting module, and a first sending module; wherein the first creating module is set to be based on The first ID module is configured to encrypt the data by using the key created by the first creating module, and the first sending module is configured to set the key created by the creating module. And the encrypted data of the first encryption module is sent to the receiving end.
  • the first creating module is configured to: combine the ID information of the sending end and the ID information of the receiving end to form an encrypted number, and use the encrypted binary data as the encrypted unique identification data to be put into the encryption algorithm to generate a key; or, according to the sending
  • the extraction rule negotiated between the terminal and the receiving end extracts the ID information field from the ID information of the transmitting end and the ID information of the receiving end, and combines the extracted ID information fields to form an encrypted number, and the binary data of the encrypted number is uniquely identified as the encryption.
  • the data is placed in an encryption algorithm to generate a key; the extraction rule represents a specified segment bit from the specified decimable field of the ID information extracted from the specified starting digit.
  • the ID information may specifically be IMEI information.
  • the first creation module is configured to combine the extracted ID information fields to form an encryption number, that is: when the data fields obtained by combining the ID information fields do not meet the requirements of the encryption algorithm, the extracted ID information fields are combined and then added randomly. Number to form the encrypted number.
  • the embodiment of the invention further provides a receiving end device configured to encrypt communication, the receiving end device comprising: a receiving module, an access module, and a decrypting module; wherein the receiving module is configured to receive the secret from the sending end Key and data, the key is a key created by the sending end according to the identity ID information negotiated with the receiving device, and the data is data encrypted by the sending end by the key; access a module configured to store the key received by the receiving module in a security area, where the data received by the receiving module is stored in a common area, the security area can only be accessed by a decryption operation single process, and the common area is any storage on the receiving end except the security area.
  • An area; a decryption module configured to decrypt the data based on the key stored in the secure area.
  • the decryption module is further configured to perform verification on the sending end according to the ID information negotiated by the receiving end device and the sending end, and obtain the access right of the security area.
  • the decrypting module is configured to read the key from the security area after acquiring the access right of the security zone, and decrypt the data by using the key in the common area.
  • the decrypting module is configured to: after acquiring the access authority of the security zone, read the data from the common area by using the access module and send the data to the security zone; and, set to The secure area decrypts the data by the key and returns a decrypted data mark bit. If the decrypted data mark bit indicates that the decryption is successful, the decryption data is read and decrypted from any one of the secure areas by the access module. The latter data. And the decrypting module is configured to: when all of the security areas return the decrypted data flag bit indicating that the decryption is successful, read the decrypted content from any one of the security areas data.
  • the secure area includes an SFS area and an RPMB area.
  • an embodiment of the present invention further provides an encrypted communication system, where the system includes the above-mentioned sender device and receiver device.
  • the sending module of the sending end device is further configured to interact with the receiving module of the receiving end device, negotiate ID information of the sending end device and the receiving end device, and store the negotiation result in the sending.
  • the receiving device of the receiving device is further configured to interact with the sending module of the sending device, negotiate the ID information of the sending device and the receiving device, and store the negotiation result in the The receiving device is local.
  • the sender device in the encrypted communication system may also be the sender device shown in FIG. 9 or FIG. 10 below.
  • the encrypted communication process in the embodiment of the present invention may include four stages: a negotiation process, a process of processing the encrypted information by the transmitting end, a process of storing the encrypted information by the receiving end, and a process of decrypting the data by the receiving end.
  • the negotiation process is: a process in which the sender and the receiver negotiate the ID information combination method used for encryption, and the negotiation result is recorded in the sender and the receiver.
  • the result of the negotiation includes the sender ID information and the receiver ID information represented by the combination of the ID information.
  • the ID information includes information describing the inherent attributes of the terminal itself, but the embodiment is not limited to the intrinsic attributes.
  • the ID information combination may be an International Mobile Equipment Identity (IMEI) and/or a Media Access Control (MAC) address of the terminal.
  • IMEI International Mobile Equipment Identity
  • MAC Media Access Control
  • the process of the sender processing the encrypted information begins.
  • the process of processing the encrypted information by the transmitting end may include the following steps:
  • Step 301 The transmitting end selects the receiving end to be communicated, creates a key according to the ID information negotiated by both parties, and encrypts the data;
  • Step 302 The transmitting end sends the encrypted data and the key to the receiving end.
  • the sender when transmitting data and a key, the sender also sends its ID information together to the receiving end. And, the sender also stores the encryption key in the key locally. It is stored in the same way as the receiving end and is also stored in a secure area.
  • the transmitting end processes the encrypted information
  • the receiving end starts the process of storing the encrypted information.
  • the process of storing the encrypted information on the receiving end may include the following steps:
  • Step 401 The receiving end receives the key and data sent by the sending end.
  • Step 402 Determine whether the sender is a negotiated terminal; if yes, proceed to step 403, otherwise, continue to step 404;
  • the receiving end compares the ID information of the sending end with the locally stored negotiation result, and determines whether the sending end has negotiated with itself. If the ID of the sender is included in the negotiation result of the local storage, the sender has negotiated with the receiver; if the ID of the sender is not found in the negotiation result of the local storage, the sender has not yet Negotiation or negotiation with the receiving end is not completed.
  • Step 403 Verify that the sender and the receiver have negotiated, and the receiver stores the key in the security area and stores the data in the normal area.
  • the security zone may be one, two or more.
  • the security zone may be an SFS zone on the modem side and a RPMB zone on the AP side under the Qualcomm platform.
  • the receiving end when the key is stored, stores the ID information of the sending end and the key sent by the sending end.
  • Step 404 The receiving end deletes the data and the key.
  • an implementation manner of decrypting data by the receiving end may include the following steps:
  • Step 501 The receiving end performs identity verification on the sending end according to the ID information of the sending end and the result of the local storage negotiation. If the verification succeeds, the access right of the security area is obtained, and the process proceeds to step 502. If the verification fails, the terminal cannot Access the security zone, go directly to step 506;
  • Step 502 Access a security area where the key is stored, wherein the security area is only accessible by the local machine, and only the decryption operation order process is accessible;
  • Step 503 Find a corresponding key in the security area according to the ID information of the sending end, and read the key from the security area.
  • Step 504 Decrypt the data sent by the sending end by using the key in the normal area. If the decryption is successful, proceed to step 505. If the decryption is unsuccessful, proceed to step 506.
  • Step 505 Obtain the complete data and display it to the user.
  • Step 506 Delete the data.
  • an implementation manner of decrypting data by the receiving end may include the following steps:
  • Step 601 The receiving end performs identity verification on the sending end according to the ID information of the sending end and the negotiation result with the local storage. If the verification succeeds, the access right of the security area is obtained, and the process proceeds to step 602. If the verification fails, the terminal cannot Access the security zone, directly jump to step 606;
  • Step 602 The receiving end accesses the security zone where the key is stored, and sends the data to be decrypted in the common area to the security zone on both sides.
  • the security zone is a dual-sided zone, which is located on the modem side and the AP side respectively.
  • the security zone is only accessible by the local machine, and only the decryption operation process can be accessed.
  • Step 603 The receiving end finds corresponding information in the security areas on both sides according to the ID information of the sending end. Key, and after decrypting the data, returning the decrypted data flag bit;
  • the decrypted data flag is recorded as 1; if the decryption is unsuccessful, the decrypted data flag is recorded as 0.
  • Step 604 Determine whether the decrypted data flag bits returned by the dual-side security area are all 1;
  • Step 605 The data is decrypted by the security end and displayed to the user if and only when the two-sided security area is used.
  • Step 606 When the decrypted data flag bit of the double-sided security area is all 0 or the decrypted data flag bit of any side is 0, the data is deleted or a prompt for decryption failure is displayed to the user.
  • the embodiment of the present invention further provides a method for encrypting communication at a transmitting end, which may include:
  • Step 701 The sender establishes a key according to the ID information determined by negotiation with the receiving end.
  • Step 702 The sender sends the key to the receiving end together with the ID information determined by negotiation;
  • Step 703 When data needs to be sent, the transmitting end encrypts the data by using the key and sends the data to the receiving end.
  • another method for encrypting communication at a transmitting end may include:
  • Step 801 When the current data is to be sent, the sending end creates a key according to the ID information determined through negotiation with the receiving end.
  • the key includes a key body and an information number header file
  • the information encoding header file contains an information number that marks the current data.
  • Step 802 The sender encrypts the current data to be sent by using the key.
  • Step 803 The sender sends the encrypted current data, the ID information determined by negotiation, and the key to the receiving end.
  • the embodiment of the present invention further provides another sending end device configured to encrypt communications, including: a second creating module, configured to create a key according to ID information determined in agreement with the receiving end; a sending module, configured to: after the second creation module creates a key, send the key to the receiving end together with the ID information determined by negotiation; and, set to send data in need And transmitting, by the second encryption module, the encrypted data to the receiving end; and the second encryption module is configured to encrypt the data by using the key.
  • a second creating module configured to create a key according to ID information determined in agreement with the receiving end
  • a sending module configured to: after the second creation module creates a key, send the key to the receiving end together with the ID information determined by negotiation; and, set to send data in need And transmitting, by the second encryption module, the encrypted data to the receiving end; and the second encryption module is configured to encrypt the data by using the key.
  • the embodiment of the present invention further provides another sending end device configured to encrypt communication, and includes: a third creating module, configured to determine an ID determined according to the negotiation with the receiving end when the current data is to be sent.
  • the information creation key is configured to encrypt the current data to be sent by the key
  • the third sending module is configured to encrypt the current data after the third encryption module, and determine the ID determined by the negotiation.
  • the information and the key created by the second creation module are sent to the receiving end together.
  • the second creation module and the third creation module also have the specific function of generating the key according to the ID information by the first creation module. That is to say, the second creation module and the third creation may also be specifically configured to combine the ID information of the sender and the ID information of the receiver to form an encryption number, and use the binary data of the encryption number as the encrypted unique identification data to be generated by the encryption algorithm.
  • the binary data is inserted into the encryption algorithm as a key to encrypt the unique identification data; the extraction rule indicates that the specified segment bit is extracted from the specified extractable field of the ID information by extracting the specified starting digit.
  • the ID information may specifically be IMEI information.
  • the second creation module or the third creation module is configured to combine the extracted ID information fields to form an encryption number, which is: the ID information to be extracted when the data field obtained by combining the ID information fields does not satisfy the encryption algorithm requirement. The fields are merged and a random number is added to form the encrypted number.
  • the above-mentioned transmitting end device and receiving end device provided by the embodiments of the present invention can be implemented by the mobile terminal 100 as shown in FIG. 11, wherein the mobile terminal 100 can include: a wireless communication unit 110, A/V (audio/video) The input unit 120, the user input unit 130, the sensing unit 140, the output unit 150, the memory 160, the interface unit 170, the controller 180, and the movie unit 190.
  • the wireless communication unit 110 may specifically include a broadcast receiving module 111, a mobile communication module 112, a wireless internet module 113, a short-range communication module 114, a location information module 115, and the like.
  • the A/V input unit 120 may specifically include a camera 121 and a microphone 122.
  • the sensing unit 140 may specifically include a proximity sensor 141 or the like; the controller 180 may include a multimedia module 181 and the like; the output unit 150 may include a display module 151, an audio output module 152, an alarm module 153, and the like.
  • storage The router 160 may include a normal area and a security area, wherein the security area includes an SFS area on the modem side and an RPMB area on the AP side.
  • a computer readable storage medium storing computer executable instructions that, when executed by a processor, implement any of the above described encrypted communication methods.
  • the storage medium includes, but is not limited to, an optical disk, a floppy disk, a hard disk, a rewritable memory, and the like.
  • modules or steps of the embodiments of the present invention can be implemented by a general computing device, which can be concentrated on a single computing device or distributed in multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from The steps shown or described are performed sequentially, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated into a single integrated circuit module. Thus, the application is not limited to any particular combination of hardware and software.
  • the embodiment of the invention provides an encrypted communication method at the receiving end, a receiving end device, an encrypted communication method at the transmitting end, a transmitting end device, and an encrypted communication method and system on the system side.
  • the method for encrypting communication at the receiving end includes: receiving, by the receiving end, a key and data from the sending end, where the key is a key created by the sending end according to the identity ID information negotiated with the receiving end, where the data is The transmitting end encrypts the data by the key; the receiving end stores the key in a security area, and stores the data in a common area, and the security area can only be accessed by a decryption operation single process.
  • the normal area is any storage area on the receiving end except the security area; the receiving end pairs the data according to the key stored in the security area Line decryption.
  • the embodiment of the present invention creates a key according to the ID information negotiated between the sender and the receiver, and stores the key and the data in different areas respectively. For different receivers and senders, different keys are created according to the ID information. There is only one pair of keys between the terminals, and only the communication parties can decrypt the communication data, and the third party terminal cannot decrypt the data, which not only realizes differential encryption during communication, but also the key can be resolved only by the communication parties. There is no need to set up a server, and local data can be read when decrypting data, which not only has high communication security, but also has high processing efficiency.
  • the ID information used when creating a key between the same sending end and different receiving ends or between the same receiving end and different sending ends or between different receiving ends and different sending ends is different, and the used encryption number is used.
  • the encryption difference between different terminals is obvious, the third-party terminal cannot decrypt, realizes differentiated encryption, and ensures secure communication between terminals.

Abstract

本文公布了一种加密通讯方法，包括：接收端接收来自发送端的密钥和数据，所述密钥为所述发送端根据与所述接收端协商的身份ID信息创建的密钥，所述数据为所述发送端通过所述密钥加密后的数据；所述接收端将所述密钥存储在安全区域，将所述数据存储在普通区域；所述接收端根据所述密钥对所述数据进行解密。本文还公开了加密通讯的发送端装置、接收端装置和系统，实现了一对终端之间有且仅有一对密钥，仅通讯双方可对该通讯数据进行解密，不仅实现了通讯时的差异化加密，而且密钥只有通讯双方能够解析，不需要搭建服务器，解密数据时读取本地数据即可，不仅通讯安全性高，而且处理效率高。

Description

一种加密通讯的方法及装置、系统 技术领域
本申请涉及但不限于通讯技术，尤指一种加密通讯方法及装置、系统。
背景技术
现代社会，通讯技术已经深入到人们生活的方方面面，也已经是人们日常生活非常重要的部分。为保证通信双方的信息安全，需要对通讯信息进行加密。
目前的加密通讯方法，主要存在如下问题：通讯双方之间的聊天不能进行差异化加密，复制到所有类似的通讯设备或通讯协议中都可轻易解析，安全性差。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保围。
本发明实施例提供了一种加密通讯的方法及装置、系统。
本发明实施例提供了一种加密通讯的方法，包括：
接收端接收来自发送端的密钥和数据，所述密钥为所述发送端根据与所述接收端协商的身份ID信息创建的密钥，所述数据为所述发送端通过所述密钥加密后的数据；
所述接收端将所述密钥存储在安全区域，将所述数据存储在普通区域，所述安全区域仅能够被解密操作单进程访问，所述普通区域为所述接收端上除所述安全区域以外的任意存储区域；
所述接收端根据所述存储在安全区域的密钥对所述数据进行解密。
其中，所述接收端将所述密钥存储在安全区域，包括：将所述密钥与所述发送端协商的ID信息对应存储在所述安全区域。
其中，在所述接收端对所述数据进行解密之前，所述方法还包括：所述接收端根据与所述发送端协商的ID信息对所述发送端进行验证，获取所述 安全区域的访问权限。
其中，所述接收端获取所述安全区域的访问权限后，从所述安全区域读取所述密钥，并在所述普通区域通过所述密钥对所述数据进行解密。
其中，所述接收端获取所述安全区域的访问权限后，从所述普通区域读取所述数据并送到所述安全区域；在所述安全区域，所述接收端通过所述密钥对所述数据进行解密并返回解密数据标记位；如果所述解密数据标记位表示解密成功，则从所述安全区域读取解密后的所述数据。
其中，在所述安全区域不止一个时，如果所有的安全区域均返回了表示解密成功的所述解密数据标记位，则从任意一个所述安全区域读取解密后的所述数据。
其中，所述安全区域包括安全文件系统SFS区域和回访保护存储块RPMB区域。
其中，所述方法还包括：所述发送端与所述接收端之间协商所述ID信息，并分别将协商结果存储在本地的安全区域。
本发明实施例提供了一种设置为加密通讯的接收端装置，所述接收端装置包括：接收模块、存取模块、以及解密模块；其中，
所述接收模块，设置为接收来自发送端的密钥和数据，所述密钥为所述发送端根据与所述接收端装置协商的身份ID信息创建的密钥，所述数据为所述发送端通过所述密钥加密后的数据；
存取模块，设置为将所述接收模块接收的所述密钥存储在安全区域，将所述接收模块接收的所述数据存储在普通区域，所述安全区域仅能够被解密操作单进程访问，所述普通区域为所述接收端上除所述安全区域以外的任意存储区域；
解密模块，设置为根据所述存储在安全区域的密钥对所述数据进行解密。
其中，所述存取模块，设置为将所述密钥与所述发送端的ID信息对应存储在所述安全区域。
其中，所述解密模块，还设置为根据所述接收端装置与所述发送端协商 的ID信息对所述发送端进行验证，获取所述安全区域的访问权限。
其中，所述解密模块，设置为获取所述安全区域的访问权限后，从所述安全区域读取所述密钥，并在所述普通区域通过所述密钥对所述数据进行解密。
其中，所述解密模块，设置为获取所述安全区域的访问权限后，通过所述存取模块从所述普通区域读取所述数据并送到所述安全区域；以及，设置为在所述安全区域通过所述密钥对所述数据进行解密并返回解密数据标记位，如果所述解密数据标记位表示解密成功，则通过所述存取模块从所述安全区域读取解密后的所述数据。
其中，所述解密模块，设置为在所述安全区域不止一个时，如果所有的安全区域均返回了表示解密成功的所述解密数据标记位，则从任意一个所述安全区域读取解密后的所述数据。
其中，所述安全区域包括安全文件系统SFS区域和回访保护存储块RPMB区域。
本发明实施例提供了一种加密通讯的方法，包括：
发送端根据与接收端协商的身份ID信息创建密钥；
发送端通过所述密钥对数据进行加密；
发送端将所述密钥和加密后的数据发送给所述接收端。
其中，所述根据与接收端协商的身份ID信息创建密钥，包括：将发送端的ID信息与接收端的ID信息合并形成加密数，以该加密数的二进制数据作为加密唯一识别数据放入加密算法生成密钥；或者，发送端与接收端之间协商抽取规则，根据所述抽取规则从发送端的ID信息和接收端的ID信息中分别抽取ID信息字段，将抽取的ID信息字段合并形成加密数，以该加密数的二进制数据作为加密唯一识别数据放入加密算法生成密钥；所述抽取规则表示从ID信息的指定可抽取字段中抽取指定起始数位起的指定段位。
其中，所述将抽取的ID信息字段合并形成加密数，为：所述ID信息字段合并得到的数据字段不满足加密算法要求时，将抽取的ID信息字段合并后添加随机数，以形成所述加密数。
本发明实施例提供了一种设置为加密通讯的发送端装置，所述发送端装置包括：第一创建模块、第一加密模块和第一发送模块；其中，
第一创建模块，设置为根据与接收端协商的身份ID信息创建密钥；
第一加密模块，设置为通过所述第一创建模块创建的密钥对数据进行加密；
第一发送模块，设置为将所述第一创建模块创建的密钥和所述第一加密模块加密后的数据发送给所述接收端。
其中，所述第一创建模块，具体设置为：将发送端的ID信息与接收端的ID信息合并形成加密数，以该加密数的二进制数据作为加密唯一识别数据放入加密算法生成密钥；或者，根据发送端与接收端之间协商的抽取规则，从发送端的ID信息和接收端的ID信息中分别抽取ID信息字段，将抽取的ID信息字段合并形成加密数，以该加密数的二进制数据作为加密唯一识别数据放入加密算法生成密钥；所述抽取规则表示从ID信息的指定可抽取字段中抽取指定起始数位起的指定段位。
其中，所述第一创建模块设置为将抽取的ID信息字段合并形成加密数，为：所述ID信息字段合并得到的数据字段不满足加密算法要求时，将抽取的ID信息字段合并后添加随机数，以形成所述加密数。
本发明实施例还提供了一种加密通讯的方法，包括：
发送端根据与接收端协商确定的ID信息，创建密钥；
发送端将所述密钥与协商确定的ID信息一起发送给接收端；
需发送数据时，发送端通过所述密钥加密数据并发送给所述接收端。
本发明实施例还提供了一种加密通讯的方法，包括：
在要发送本次数据时，发送端根据与接收端协商确定的ID信息，创建密钥；
发送端通过所述密钥加密要发送的本次数据；
发送端将加密后的本次数据、协商确定的ID信息以及所述密钥一起发送给接收端。
其中，所述密钥包含密钥主体和信息编号头文件，所述信息编码头文件包含标记本次数据的信息编号。
本发明实施例还提供了一种设置为加密通讯的发送端装置，包括：
第二创建模块，设置为根据与接收端协商确定的ID信息，创建密钥；
第二发送模块，设置为在所述第二创建模块创建密钥之后，将所述密钥与协商确定的ID信息一起发送给接收端；以及，设置为在需要发送数据时，将所述第二加密模块加密后的数据发送给接收端；
第二加密模块，设置为通过所述密钥加密数据。
本发明实施例还提供了一种设置为加密通讯的发送端装置，包括：
第三创建模块，设置为在要发送本次数据时，根据与接收端协商确定的ID信息创建密钥；
第三加密模块，设置为通过所述密钥加密要发送的本次数据；
第三发送模块，设置为将所述第三加密模块加密后的本次数据、协商确定的ID信息以及所述第二创建模块创建的密钥一起发送给接收端。
本发明实施例还提供了一种设置为加密通讯的系统，所述系统包括上述的接收端装置和上述的发送端装置；
所述发送端装置的发送模块，还设置为与所述接收端装置的接收模块交互，协商所述发送端装置与所述接收端装置的ID信息，并将协商结果存储在所述发送端装置本地；
所述接收端装置的接收模块，还设置为与所述发送端装置的发送模块交互，协商所述发送端装置与所述接收端装置的ID信息，并将协商结果存储在所述接收端装置本地。
本发明实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被处理器执行时实现上述加密通讯方法的任意一种。
本发明实施例根据发送端与接收端协商的ID信息创建密钥，并将密钥与数据分别存储在不同区域，针对不同的接收端和发送端，根据其ID信息 创建不同的密钥，一对终端之间有且仅有一对密钥，仅通讯双方可对该通讯数据进行解密，第三方终端无法解密该数据，不仅实现了通讯时的差异化加密，而且密钥只有通讯双方能够解析，不需要搭建服务器，解密数据时读取本地数据即可，不仅通讯安全性高，而且处理效率高。
本发明实施例中，同一发送端与不同接收端之间或者同一接收端与不同发送端之间或者不同接收端与不同发送端之间，创建密钥时使用的ID信息不同，使用的加密数就不同，不同终端之间的加密差异化明显，第三方终端无法解密，实现了差异化加密，而且可确保终端之间安全通讯。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1为本发明实施例加密通讯方法的流程示意图；
图2为本发明实施例加密通讯系统的组成结构示意图；
图3为本发明实施例加密通讯方法发送端处理加密信息的流程示意图；
图4为本发明实施例加密通讯方法接收端存储加密信息的流程示意图；
图5为本发明实施例加密通讯方法接收端解密数据一优选实施例的流程示意图；
图6为本发明实施例加密通讯方法接收端解密数据另一优选实施例的流程示意图；
图7为本发明实施例发送端的加密通讯方法一优选实施例的流程示意图；
图8为本发明实施例发送端的加密通讯方法另一优选实施例的流程示意图；
图9为本发明实施例发送端装置一优选实施例的组成结构示意图；
图10为本发明实施例发送端装置另一优选实施例的组成结构示意图；
图11为本发明实施例发送端装置及接收端装置的硬件结构示例图。
本发明的实施方式
为使本申请的目的、技术方案和优点更加清楚明白，下文中将结合附图对本发明的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行。并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
本发明实施例的主要思想是：通讯的终端双方在通讯过程中，同时根据对方身份(ID)信息创建聊天协议，并协商所用密钥，对该用户所有加密数据采用密钥，在终端内部分为数据存储的普通区域以及密钥存储的安全区域，密钥存储为表存储信息，将终端ID信息与密钥一一对应进行存储。发送端与接收端经双方协定，发送数据时根据协商的ID信息动态创建密钥并通过该密钥加密数据，例如加密数据的头信息或尾信息等，并将加密后的数据和创建的密钥发送给接收端，接收端解密时需在密钥存储的安全区域读取其密钥方可进行解密。如此，接收端将密钥存储在本地，针对不同的接收端和发送端，可以根据其ID信息创建不同的密钥，一对终端之间有且仅有一对密钥，仅通讯双方可对该聊天记录进行解密，第三方终端无法解密该数据，不仅实现了通讯时的差异化加密，而且密钥只有通讯双方能够解析，不需要搭建服务器，解密数据时读取本地数据即可。
如图1所示，本发明实施例的加密通讯方法，主要可以如下步骤：
步骤101：发送端根据与接收端协商的身份ID信息创建密钥，通过密钥对数据进行加密，并将所述密钥和所述数据发送给所述接收端；
其中，发送端创建的密钥与其和接收端协商确定的ID信息相关。密钥与协商确定的ID信息的关系可以是一一对应关系。该密钥可以是一对密钥，包括解密密钥和加密密钥，解密密钥和加密密钥可以是对称的，也可以是非对称的。发送端通过加密密钥对数据进行加密，可以仅将其中的解密密钥发送给接收端，接收端在解密数据时根据该解密密钥对所述数据进行解密。
其中，密钥具体可以通过如下两种方式产生：密钥可以在发送端与接收端之间协商ID信息的过程中产生；或者，也可以在非协商阶段产生。
具体的，发送端在与接收端协商ID信息的过程中，确定彼此的ID信息之后，发送端生成与协商确定的ID信息相对应的密钥对，该密钥对包含加密密钥和解密密钥，发送端在协商过程中将密钥对中的解密密钥发送给接收端，接收端将所述解密密钥存储在安全区域。这样，后续发送端与接收端之间交互数据时，解密密钥已经存储在接收端的本地安全区域，发送端使用所述密钥对中的加密密钥对数据进行加密后发送给接收端，接收端根据其中的ID信息(包含发送端的ID和接收端的ID)，从安全区域找到相应的解密密钥对所述数据进行解密。
具体的，密钥也可以在非协商阶段产生。在发送端与接收端已经完成了ID信息协商之后。进行数据交互时，针对每个交互数据，都要经历如下过程：发送端生成与协商确定的ID信息相对应的密钥对，密钥对包含加密密钥和解密密钥。发送本次数据时，发送端将使用所述加密密钥加密后的本次数据、解密密钥及协商确定的ID信息一起发送给接收端。这里，发送端产生的密钥对中每个密钥(加密密钥和解密密钥)都包含两个部分：密钥主体和信息编码头文件，该信息编码头文件中包含有标记本次数据的信息编号(例如，向接收端发送的第N条数据，N即可作为该条数据的信息编号)。每次发送数据时产生的密钥主体相同，但信息编号头文件的内容不同。接收端接收发送端发送的数据、解密密钥及ID信息，将所述解密密钥存储在安全区域，将本次数据放在普通区域。由于每个对话数据解密密钥的头文件不同，每个对话数据需应用对应的解密数据来解密。因此，接收端解密时需要根据当前数据的信息编号、协商确定的ID信息得到相应的解密密钥主体再对普通区域的数据进行解密。
这里，发送端还将加密秘钥存储在本地的安全区域，存储时以表存储信息的形式进行存储，该表存储信息中包含加密密钥、接收端的ID信息以及两者之间的对应关系。
步骤102：接收端接收来自发送端的所述密钥和数据；
步骤103：接收端将所述密钥存储在安全区域，将所述数据存储在普通区域；
其中，所述安全区域仅能够被解密操作单进程访问，所述普通区域为所 述接收端上除所述安全区域以外的任意存储区域。实际应用中，所述安全区域可以是一个、两个或多个。例如，安全区域可以是在高通平台下的调制解调器(modem)侧的安全文件系统(SFS)和在无线访问接入点(AP)侧的回访保护存储块(RPMB)区域。
实际应用中，接收端将密钥以表存储信息的形式存储在安全区域，在该表存储信息中将密钥与发送端的ID信息对应保存。
步骤104：接收端根据所述存储在安全区域的密钥对所述数据进行解密。
进一步地，在步骤101之前，所述方法还包括：步骤100，所述发送端与所述接收端之间协商所述ID信息，并分别将协商结果存储在本地。
进一步地，步骤104中，对所述数据进行解密之前，还包括：所述接收端根据与所述发送端协商的ID信息对所述发送端进行验证，获取所述安全区域的访问权限。
本发明实施例还提供了一种发送端的加密通讯方法，包括：发送端根据与接收端协商的身份ID信息创建密钥；发送端通过所述密钥对数据进行加密；发送端将所述密钥和加密后的数据发送给所述接收端。
其中，所述根据与接收端协商的ID信息创建密钥，包括：将发送端的ID信息与接收端的ID信息合并形成加密数，以该加密数的二进制数据作为加密唯一识别数据放入加密算法生成密钥；或者，发送端与接收端之间协商抽取规则，根据所述抽取规则从发送端的ID信息和接收端的ID信息中分别抽取ID信息字段，将抽取的ID信息字段合并形成加密数，以该加密数的二进制数据作为加密唯一识别数据放入加密算法生成密钥；所述抽取规则表示从ID信息的指定可抽取字段中抽取指定起始数位起的指定段位。这里，ID信息具体可以是国际移动设备标识(IMEI，International Mobile Equipment Identity)信息。
其中，所述将抽取的ID信息字段合并形成加密数，包括：抽取的ID信息合并得到的数据字段不满足加密算法要求时，在该数据字段后还添加随机数，以形成所述加密数。如果抽取的ID信息合并得到的数据字段满足加密 算法要求时，可以不添加随机数或者可以根据需要添加随机数。
下面对于本发明实施例中如何将ID信息与密钥直接关联，也就是如何基于ID信息创建密钥进行详细说明，以使得不同终端之间交互时采用不同的密钥，最终实现差异化加密通讯。
这里，以协商确定的ID信息包含双方IMEI信息为例，说明如何基于ID信息创建密钥。根据协商的ID信息创建密钥具体可以采用如下的两种方式：
方式一，加密数由两终端的IMEI信息直接得到，该加密数仅包含两终端的IMEI信息。具体的，将两终端(即本文所述的发送端与接收端)的IMEI合并(合并时可以采用预定的排列顺序，例如，可以将发起协商请求的终端(即本文所述的发送端)IMEI放在前，将确认协商请求的终端(即本文所述的接收端)IMEI排在后)形成加密数，该加密数二进制化得到的二进制数据作为加密唯一识别数据，放入加密算法中生成密钥。
假设：终端A的IMEI为：867241020720126；终端B的IMEI为：861267030000916；终端C的IMEI为：869641150105329；
按照上述方式，终端A与终端B之间IMEI合并形成的加密数具体为：867241020720126861267030000916，将该加密数的二进制数据作为加密唯一识别数据放入加密算法，生成终端A与终端B之间通讯的密钥。此方式的优点是实现简单，且差异化体现明显，缺点是数据位数过多。终端A与终端C之间IMEI合并形成的加密数具体为：867241020720126869641150105329，将该加密数的二进制数据作为加密唯一识别数据放入加密算法，生成终端A与终端C之间通讯的密钥。
此方式一中，不同终端之间，如终端A与终端B之间、终端A与终端C之间、终端B与终端C之间，使用的IMEI不同，因而使用的加密数不同，差异化明显，可实现差异化加密通讯且可确保通讯安全。
方法二，先按照预定的抽取规则分别从两终端的IMEI信息抽取字段再由抽取的字段得到加密数。该加密数不仅可以包含两终端的IMEI信息，还可包含有随机数。具体的，按照预先协商的抽取规则分别从两终端的IMEI 抽取IMEI字段，将抽取的IMEI字段合并(合并时可以采用预定的排列顺序，例如，可以将发起协商请求的终端(即本文所述的发送端)IMEI字段放在前，将确认协商请求的终端(即本文所述的接收端)IMEI字段排在后)形成加密数，将该加密数二进制化得到的二进制数据作为加密唯一识别数据放入加密算法生成密钥。如果所述IMEI字段合并得到的数据不满足加密算法的总数位要求，可在合并得到的数据之后再添加随机数，该随机数为随机生成的数字。
其中，所述抽取规则可以包含IMEI的指定可抽取字段、以及抽取的段位和起始数位，表示从IMEI的指定可抽取字段中抽取所述起始数位起指定段位的字段。该抽取规则可以由两终端协商确定，终端不同，协商确定的抽取规则也不同，也就是说每两个终端之间有其特定的抽取规则。其中，抽取字段的起始数位表示从IMEI的相应数位开始抽取，该起始数位实际为一个数字，该数字为随机生成。
假设：终端A的IMEI为：867241020720126；终端B的IMEI为：861267030000916；终端C的IMEI为：869641150105329；
例如，终端A与终端B可以提前协商约定抽取规则为：使用4段位，IMEI的15位字段抽取1～12位开头字段，随机生成的起始数位为5，也就是说，在IMEI的1～～12位开头字段中从第5个数字起抽取后4位。如此，终端A的IMEI字段为：4102；终端B的IMEI字段为：6703；将终端A的IMEI字段与终端B的IMEI字段合并得到数据41026703，由于该数据41026703的字段只有8位，不满足加密算法要求，需继续在该数据41026703后添加随机数(例如，00)得到加密数为4102670300，该加密数二进制化后的二进制数据为：11110100100010011100011111011100，将该二进制数据作为加密唯一识别数据放入加密算法，生成终端A与终端B的密钥。
例如，终端A与终端C之间，可以提前协商约定抽取规则为：使用5段位，IMEI的15位字段抽取1～～11位开头字段，随机生成的起始数位为6，也就是说，在IMEI的1～～11位开头字段中从第6个数字起抽取后5位。如此，终端A的IMEI字段为：10207；终端B的IMEI字段为：11501；将终端A的IMEI字段与终端B的IMEI字段合并得到数据1020711501，由于该数据 1020711501的字段有10位，满足加密算法要求，无需补位数据，那么，直接对该数据二进制化，将得到的二进制数据111100110101101101001001001101作为加密唯一识别数据放入加密算法中，生成终端A与终端C的密钥。
此方式二中，不同终端之间，如终端A与终端B之间、终端A与终端C之间、终端B与终端C之间，不仅使用的IMEI不同，而且抽取规则也不相同，加密数采用的随机数也不同，使用的加密数差异化更加明显，且加密数的数据位数可控，不仅实现了高度的差异化加密，而且通讯安全度更高。
本发明实施例还提供了一种设置为加密通讯的发送端装置，该发送端装置包括：第一创建模块、第一加密模块和第一发送模块；其中，第一创建模块，设置为根据与接收端协商的身份ID信息创建密钥；第一加密模块，设置为通过所述第一创建模块创建的密钥对数据进行加密；第一发送模块，设置为将所述创建模块创建的密钥和所述第一加密模块加密后的数据发送给所述接收端。
所述第一创建模块，是设置为：将发送端的ID信息与接收端的ID信息合并形成加密数，以该加密数的二进制数据作为加密唯一识别数据放入加密算法生成密钥；或者，根据发送端与接收端之间协商的抽取规则，从发送端的ID信息和接收端的ID信息中分别抽取ID信息字段，将抽取的ID信息字段合并形成加密数，以该加密数的二进制数据作为加密唯一识别数据放入加密算法生成密钥；所述抽取规则表示从ID信息的指定可抽取字段中抽取指定起始数位起的指定段位。这里，ID信息具体可以是IMEI信息。
其中，所述第一创建模块设置为将抽取的ID信息字段合并形成加密数，为：所述ID信息字段合并得到的数据字段不满足加密算法要求时，将抽取的ID信息字段合并后添加随机数，以形成所述加密数。
本发明实施例还提供了一种设置为加密通讯的接收端装置，所述接收端装置包括：接收模块、存取模块、以及解密模块；其中，所述接收模块，设置为接收来自发送端的密钥和数据，所述密钥为所述发送端根据与所述接收端装置协商的身份ID信息创建的密钥，所述数据为所述发送端通过所述密钥加密后的数据；存取模块，设置为将所述接收模块接收的所述密钥存储在 安全区域，将所述接收模块接收的所述数据存储在普通区域，所述安全区域仅能够被解密操作单进程访问，所述普通区域为所述接收端上除所述安全区域以外的任意存储区域；解密模块，设置为根据所述存储在安全区域的密钥对所述数据进行解密。
其中，所述解密模块，还设置为根据所述接收端装置与所述发送端协商的ID信息对所述发送端进行验证，获取所述安全区域的访问权限。
具体地，所述解密模块，设置为获取所述安全区域的访问权限后，从所述安全区域读取所述密钥，并在所述普通区域通过所述密钥对所述数据进行解密。
和/或，所述解密模块，设置为获取所述安全区域的访问权限后，通过所述存取模块从所述普通区域读取所述数据并送到所述安全区域；以及，设置为在所述安全区域通过所述密钥对所述数据进行解密并返回解密数据标记位，如果所述解密数据标记位表示解密成功，则通过所述存取模块从任意一个所述安全区域读取解密后的所述数据。所述解密模块，设置为在所述安全区域不止一个时，如果所有的安全区域均返回了表示解密成功的所述解密数据标记位，则从任意一个所述安全区域读取解密后的所述数据。这里，所述安全区域包括SFS区域和RPMB区域。
如图2所示，本发明实施例还提供了一种加密通讯系统，该系统包括上述的发送端装置和接收端装置。其中，所述发送端装置的发送模块，还设置为与所述接收端装置的接收模块交互，协商所述发送端装置与所述接收端装置的ID信息，并将协商结果存储在所述发送端装置本地；所述接收端装置的接收模块，还设置为与所述发送端装置的发送模块交互，协商所述发送端装置与所述接收端装置的ID信息，并将协商结果存储在所述接收端装置本地。其中，该加密通讯系统中的发送端装置也可以是下文图9或图10所示的发送端装置。
下面对本发明实施例中加密通讯的具体实现过程进行详细说明。
本发明实施例的加密通讯过程可以包括四个阶段：协商过程、发送端处理加密信息的过程、接收端存储加密信息的过程、接收端解密数据的过程。
协商过程为：是发送端与接收端对加密时采用的ID信息组合方式进行协商的过程，协商结果记录在发送端和接收端内部。协商结果包括以所述ID信息组合方式表示的发送端ID信息和接收端ID信息。其中，ID信息包含描述终端本身固有属性的信息，但体现形式并不限于固有属性。例如ID信息组合可以是终端的国际移动设备标识(IMEI，International Mobile Equipment Identity)和/或介质访问控制(MAC，Media Access Control)地址。
发送端与接收端已协商好ID信息组合方式之后，发送端处理加密信息的过程开始。如图3所示，发送端处理加密信息的过程可以包括如下步骤：
步骤301：发送端选择要通讯的接收端，根据双方协商的ID信息创建密钥并加密数据；
步骤302：发送端将加密后的数据以及所述密钥发送给接收端。
这里，在发送数据和密钥时，发送端还会将其ID信息一同发送给接收端。并且，发送端还会将所述密钥中的加密密钥存储在本地。存储的方式与接收端相同，也是存储在安全区域。
发送端处理加密信息的过程之后，开始接收端存储加密信息的过程。如图4所示，接收端存储加密信息的过程，可以包括如下步骤：
步骤401：接收端接收发送端发送的密钥和数据；
步骤402：判断所述发送端是否是已协商的终端；如果是，则继续步骤403，否则，继续步骤404；
具体地，接收端将发送端的ID信息与本地存储的协商结果对比，判断所述发送端是否与自身已协商过。如果本地存储的协商结果中有所述发送端的ID信息，则说明所述发送端已与接收端协商；如果本地存储的协商结果中没有所述发送端的ID信息，则说明所述发送端还未与接收端协商或者协商未完成。
步骤403：验证所述发送端与接收端已协商通过，接收端将密钥存储在安全区域，将数据存储到普通区域。
其中，安全区域可以是一个、两个或多个，例如，安全区域可以是高通平台下的modem侧的SFS区域和在AP侧的RPMB区域。
实际应用中，在存储密钥时，接收端将与所述发送端的ID信息与所述发送端发送的密钥对应存储。
步骤404：接收端将所述数据和密钥删除。
最后，接收端对数据解密的过程可以有两种实现方式。
如图5所示，接收端解密数据的一种实现方式可以包括如下步骤：
步骤501：接收端根据发送端的ID信息以及与本地存储的协商结果，对所述发送端进行身份验证，如果验证通过，则获得安全区域的访问权限，继续步骤502，如果验证未通过，则不能访问安全区域，直接跳转到步骤506；
步骤502：访问存放密钥的安全区域，其中，安全区域仅本机可访问，仅解密操作单进程可访问；
步骤503：根据发送端的ID信息在所述安全区域找到对应的密钥，并从所述安全区域将所述密钥读取出来；
步骤504：在普通区域通过所述密钥对所述发送端发送的数据进行解密，如果解密成功，则继续步骤505，如果解密不成功，则继续步骤506；
步骤505：获得完整数据并显示给用户。
步骤506：删除数据。
如图6所示，接收端解密数据的一种实现方式可以包括如下步骤：
步骤601：接收端根据发送端的ID信息以及与本地存储的协商结果，对所述发送端进行身份验证，如果验证通过，则获得安全区域的访问权限，继续步骤602，如果验证未通过，则不能访问安全区域，直接跳转到步骤606；
步骤602：接收端访问存放密钥的安全区域，将普通区域待解密的数据分别送往两侧安全区域，安全区域为双侧区域，分别位于modem侧和AP侧；
其中，安全区域仅本机可访问，仅解密操作单进程可访问。
步骤603：接收端根据发送端的ID信息分别在两侧安全区域找到对应的 密钥，并对所述数据解密后，返回解密数据标记位；
如果解密成功，则将所述解密数据标记位记为1；如果解密不成功，则将所述解密数据标记位记为0。
步骤604：判断双侧安全区域返回的解密数据标记位是否均为1；
步骤605：当且仅当双侧安全区域的时，接收端才调用安全区域解密后的数据，并显示给用户；
步骤606：当双侧安全区域的解密数据标记位全为0或任意一侧的解密数据标记位为0时，则删除数据或者显示解密失败的提示给用户。
如图7所示，本发明实施例还提供了一种发送端的加密通讯方法，可以包括：
步骤701：发送端根据与接收端协商确定的ID信息，创建密钥；
步骤702：发送端将所述密钥与协商确定的ID信息一起发送给接收端；
步骤703：需发送数据时，发送端通过所述密钥加密数据并发送给所述接收端。
如图8所示，本发明实施例提供的另一种发送端的加密通讯方法，可以包括：
步骤801：在要发送本次数据时，发送端根据与接收端协商确定的ID信息，创建密钥；
这里，所述密钥包含密钥主体和信息编号头文件，所述信息编码头文件包含标记本次数据的信息编号。
步骤802：发送端通过所述密钥加密要发送的本次数据；
步骤803：发送端将加密后的本次数据、协商确定的ID信息以及所述密钥一起发送给接收端。
如图9所示，本发明实施例还提供了另一种设置为加密通讯的发送端装置，包括：第二创建模块，设置为根据与接收端协商确定的ID信息，创建密钥；第二发送模块，设置为在所述第二创建模块创建密钥之后，将所述密钥与协商确定的ID信息一起发送给接收端；以及，设置为在需要发送数据 时，将所述第二加密模块加密后的数据发送给接收端；第二加密模块，设置为通过所述密钥加密数据。
如图10所示，本发明实施例还提供了另一种设置为加密通讯的发送端装置，包括：第三创建模块，设置为在要发送本次数据时，根据与接收端协商确定的ID信息创建密钥；第三加密模块，设置为通过所述密钥加密要发送的本次数据；第三发送模块，设置为将所述第三加密模块加密后的本次数据、协商确定的ID信息以及所述第二创建模块创建的密钥一起发送给接收端。
这里，第二创建模块与第三创建模块也同时具有上述第一创建模块根据ID信息生成密钥的具体功能。也就是说，第二创建模块和第三创建，也具体可设置为将发送端的ID信息与接收端的ID信息合并形成加密数，以该加密数的二进制数据作为加密唯一识别数据放入加密算法生成密钥；或者，根据发送端与接收端之间协商的抽取规则，从发送端的ID信息和接收端的ID信息中分别抽取ID信息字段，将抽取的ID信息字段合并形成加密数，以该加密数的二进制数据作为加密唯一识别数据放入加密算法生成密钥；所述抽取规则表示从ID信息的指定可抽取字段中抽取指定起始数位起的指定段位。这里，ID信息具体可以是IMEI信息。其中，所述第二创建模块或第三创建模块设置为将抽取的ID信息字段合并形成加密数，为：所述ID信息字段合并得到的数据字段不满足加密算法要求时，将抽取的ID信息字段合并后添加随机数，以形成所述加密数。
本发明实施例提供的上述发送端装置和接收端装置均可以通过如图11所示的移动终端100来实现，其中，移动终端100可以包括：无线通信单元110、A/V(音频/视频)输入单元120、用户输入单元130、感测单元140、输出单元150、存储器160、接口单元170、控制器180、电影单元190。其中，无线通信单元110具体可以包括广播接收模块111、移动通信模块112、无线互联网模块113、短程通信模块114、位置信息模块115等；A/V输入单元120具体可以包括照相121和麦克风122等；感测单元140具体可以包括接近传感器141等；控制器180可以包括多媒体模块181等；输出单元150可以包括显示模块151、音频输出模块152和警报模块153等。其中，存储 器160中可以包含普通区域和安全区域，其中，安全区域包括在modem侧的SFS区域和在AP侧的RPMB区域。
在另外一个实施例中，还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被处理器执行时实现上述的任意一种加密通讯方法。该存储介质包括但不限于：光盘、软盘、硬盘、可擦写存储器等。
显然，本领域的技术人员应该明白，上述的本发明实施例的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本申请不限制于任何特定的硬件和软件结合。
虽然本申请所揭露的实施方式如上，但所述的内容仅为便于理解本申请而采用的实施方式，并非用以限定本申请。任何本申请所属领域内的技术人员，在不脱离本申请所揭露的精神和范围的前提下，可以在实施的形式及细节上进行任何的修改与变化，但本申请的专利保护范围，仍须以所附的权利要求书所界定的范围为准。
工业实用性
本发明实施例提供了一种接收端的加密通讯方法及接收端装置、发送端的加密通讯方法及发送端装置、以及系统侧的加密通讯方法及系统。
其中，接收端的加密通讯方法，包括：接收端接收来自发送端的密钥和数据，所述密钥为所述发送端根据与所述接收端协商的身份ID信息创建的密钥，所述数据为所述发送端通过所述密钥加密后的数据；所述接收端将所述密钥存储在安全区域，将所述数据存储在普通区域，所述安全区域仅能够被解密操作单进程访问，所述普通区域为所述接收端上除所述安全区域以外的任意存储区域；所述接收端根据所述存储在安全区域的密钥对所述数据进 行解密。
本发明实施例根据发送端与接收端协商的ID信息创建密钥，并将密钥与数据分别存储在不同区域，针对不同的接收端和发送端，根据其ID信息创建不同的密钥，一对终端之间有且仅有一对密钥，仅通讯双方可对该通讯数据进行解密，第三方终端无法解密该数据，不仅实现了通讯时的差异化加密，而且密钥只有通讯双方能够解析，不需要搭建服务器，解密数据时读取本地数据即可，不仅通讯安全性高，而且处理效率高。
本发明实施例中，同一发送端与不同接收端之间或者同一接收端与不同发送端之间或者不同接收端与不同发送端之间，创建密钥时使用的ID信息不同，使用的加密数就不同，不同终端之间的加密差异化明显，第三方终端无法解密，实现了差异化加密，而且可确保终端之间安全通讯。

Claims (28)

  1. 一种加密通讯的方法，包括：
    接收端接收来自发送端的密钥和数据，所述密钥为所述发送端根据与所述接收端协商的身份ID信息创建的密钥，所述数据为所述发送端通过所述密钥加密后的数据；
    所述接收端将所述密钥存储在安全区域，将所述数据存储在普通区域，所述安全区域仅能够被解密操作单进程访问，所述普通区域为所述接收端上除所述安全区域以外的任意存储区域；
    所述接收端根据所述存储在安全区域的密钥对所述数据进行解密。
  2. 根据权利要求1所述的方法，其中，所述接收端将所述密钥存储在安全区域，包括：将所述密钥与所述发送端协商的ID信息对应存储在所述安全区域。
  3. 根据权利要求1所述的方法，其中，在所述接收端对所述数据进行解密之前，所述方法还包括：
    所述接收端根据与所述发送端协商的ID信息对所述发送端进行验证，获取所述安全区域的访问权限。
  4. 根据权利要求1至3任一项所述的方法，其中，
    所述接收端获取所述安全区域的访问权限后，从所述安全区域读取所述密钥，并在所述普通区域通过所述密钥对所述数据进行解密。
  5. 根据权利要求1至3任一项所述的方法，其中，
    所述接收端获取所述安全区域的访问权限后，从所述普通区域读取所述数据并送到所述安全区域；
    在所述安全区域，所述接收端通过所述密钥对所述数据进行解密并返回解密数据标记位；
    如果所述解密数据标记位表示解密成功，则从所述安全区域读取解密后的所述数据。
  6. 根据权利要求5所述的方法，其中，在所述安全区域不止一个时，如 果所有的安全区域均返回了表示解密成功的所述解密数据标记位，则从任意一个所述安全区域读取解密后的所述数据。
  7. 根据权利要求6所述的方法，其中，所述安全区域包括安全文件系统SFS区域和回访保护存储块RPMB区域。
  8. 根据权利要求1所述的方法，其中，所述方法还包括：
    所述发送端与所述接收端之间协商所述ID信息，并分别将协商结果存储在本地的安全区域。
  9. 一种设置为加密通讯的接收端装置，所述接收端装置包括：接收模块、存取模块、以及解密模块；其中，
    所述接收模块，设置为接收来自发送端的密钥和数据，所述密钥为所述发送端根据与所述接收端装置协商的身份ID信息创建的密钥，所述数据为所述发送端通过所述密钥加密后的数据；
    存取模块，设置为将所述接收模块接收的所述密钥存储在安全区域，将所述接收模块接收的所述数据存储在普通区域，所述安全区域仅能够被解密操作单进程访问，所述普通区域为所述接收端上除所述安全区域以外的任意存储区域；
    解密模块，设置为根据所述存储在安全区域的密钥对所述数据进行解密。
  10. 根据权利要求9所述的接收端装置，其中，所述存取模块，设置为将所述密钥与所述发送端的ID信息对应存储在所述安全区域。
  11. 根据权利要求9所述的接收端装置，其中，所述解密模块，还设置为根据所述接收端装置与所述发送端协商的ID信息对所述发送端进行验证，获取所述安全区域的访问权限。
  12. 根据权利要求9或11所述的接收端装置，其中，所述解密模块，设置为获取所述安全区域的访问权限后，从所述安全区域读取所述密钥，并在所述普通区域通过所述密钥对所述数据进行解密。
  13. 根据权利要求9或11所述的接收端装置，其中，所述解密模块，设置为获取所述安全区域的访问权限后，通过所述存取模块从所述普通区域读取所述数据并送到所述安全区域；以及，设置为在所述安全区域通过所述密 钥对所述数据进行解密并返回解密数据标记位，如果所述解密数据标记位表示解密成功，则通过所述存取模块从所述安全区域读取解密后的所述数据。
  14. 根据权利要求13所述的接收端装置，其中，所述解密模块，设置为在所述安全区域不止一个时，如果所有的安全区域均返回了表示解密成功的所述解密数据标记位，则从任意一个所述安全区域读取解密后的所述数据。
  15. 根据权利要求14所述的接收端装置，其中，所述安全区域包括安全文件系统SFS区域和回访保护存储块RPMB区域。
  16. 一种加密通讯的方法，包括：
    发送端根据与接收端协商的身份ID信息创建密钥；
    发送端通过所述密钥对数据进行加密；
    发送端将所述密钥和加密后的数据发送给所述接收端。
  17. 根据权利要求16所述的方法，其中，所述根据与接收端协商的身份ID信息创建密钥，包括：
    将发送端的ID信息与接收端的ID信息合并形成加密数，以该加密数的二进制数据作为加密唯一识别数据放入加密算法生成密钥；
    或者，发送端与接收端之间协商抽取规则，根据所述抽取规则从发送端的ID信息和接收端的ID信息中分别抽取ID信息字段，将抽取的ID信息字段合并形成加密数，以该加密数的二进制数据作为加密唯一识别数据放入加密算法生成密钥；所述抽取规则表示从ID信息的指定可抽取字段中抽取指定起始数位起的指定段位。
  18. 根据权利要求17所述的方法，其中，所述将抽取的ID信息字段合并形成加密数，为：
    所述ID信息字段合并得到的数据字段不满足加密算法要求时，将抽取的ID信息字段合并后添加随机数，以形成所述加密数。
  19. 一种设置为加密通讯的发送端装置，所述发送端装置包括：第一创建模块、第一加密模块和第一发送模块；其中，
    第一创建模块，设置为根据与接收端协商的身份ID信息创建密钥；
    第一加密模块，设置为通过所述第一创建模块创建的密钥对数据进行加密；
    第一发送模块，设置为将所述第一创建模块创建的密钥和所述第一加密模块加密后的数据发送给所述接收端。
  20. 根据权利要求19所述的发送端装置，其中，所述第一创建模块，是设置为：将发送端的ID信息与接收端的ID信息合并形成加密数，以该加密数的二进制数据作为加密唯一识别数据放入加密算法生成密钥；或者，根据发送端与接收端之间协商的抽取规则，从发送端的ID信息和接收端的ID信息中分别抽取ID信息字段，将抽取的ID信息字段合并形成加密数，以该加密数的二进制数据作为加密唯一识别数据放入加密算法生成密钥；所述抽取规则表示从ID信息的指定可抽取字段中抽取指定起始数位起的指定段位。
  21. 根据权利要求20所述的发送端装置，其中，所述第一创建模块设置为将抽取的ID信息字段合并形成加密数，为：
    所述ID信息字段合并得到的数据字段不满足加密算法要求时，将抽取的ID信息字段合并后添加随机数，以形成所述加密数。
  22. 一种加密通讯的方法，包括：
    发送端根据与接收端协商确定的ID信息，创建密钥；
    发送端将所述密钥与协商确定的ID信息一起发送给接收端；
    需发送数据时，发送端通过所述密钥加密数据并发送给所述接收端。
  23. 一种加密通讯的方法，包括：
    在要发送本次数据时，发送端根据与接收端协商确定的ID信息，创建密钥；
    发送端通过所述密钥加密要发送的本次数据；
    发送端将加密后的本次数据、协商确定的ID信息以及所述密钥一起发送给接收端。
  24. 根据权利要求23所述的方法，其中，所述密钥包含密钥主体和信息编号头文件，所述信息编码头文件包含标记本次数据的信息编号。
  25. 一种设置为加密通讯的发送端装置，包括：
    第二创建模块，设置为根据与接收端协商确定的ID信息，创建密钥；
    第二发送模块，设置为在所述第二创建模块创建密钥之后，将所述密钥与协商确定的ID信息一起发送给接收端；以及，设置为在需要发送数据时，将所述第二加密模块加密后的数据发送给接收端；
    第二加密模块，设置为通过所述密钥加密数据。
  26. 一种设置为加密通讯的发送端装置，其中，包括：
    第三创建模块，设置为在要发送本次数据时，根据与接收端协商确定的ID信息创建密钥；
    第三加密模块，设置为通过所述密钥加密要发送的本次数据；
    第三发送模块，设置为将所述第三加密模块加密后的本次数据、协商确定的ID信息以及所述第二创建模块创建的密钥一起发送给接收端。
  27. 一种设置为加密通讯的系统，所述系统包括如权利要求9至15任一项所述的接收端装置和权利要求19、20、21、25或26所述的发送端装置；
    所述发送端装置的发送模块，还设置为与所述接收端装置的接收模块交互，协商所述发送端装置与所述接收端装置的ID信息，并将协商结果存储在所述发送端装置本地；
    所述接收端装置的接收模块，还设置为与所述发送端装置的发送模块交互，协商所述发送端装置与所述接收端装置的ID信息，并将协商结果存储在所述接收端装置本地。
  28. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被处理器执行时实现权利要求1至8任一项所述的方法、或权利要求16至18任一项所述的方法、或权利要求22所述的方法、或权利要求23所述的方法。
PCT/CN2016/086902 2016-04-22 2016-06-23 一种加密通讯的方法及装置、系统 WO2017181518A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610257566.1 2016-04-22
CN201610257566.1A CN107306261B (zh) 2016-04-22 2016-04-22 一种加密通讯方法及装置、系统

Publications (1)

Publication Number Publication Date
WO2017181518A1 true WO2017181518A1 (zh) 2017-10-26

Family

ID=60115508

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/086902 WO2017181518A1 (zh) 2016-04-22 2016-06-23 一种加密通讯的方法及装置、系统

Country Status (2)

Country Link
CN (1) CN107306261B (zh)
WO (1) WO2017181518A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112422223A (zh) * 2020-11-06 2021-02-26 华能新能源股份有限公司河北分公司 基于tcp/ip的对时装置、对时方法及时标监测系统
CN114239050A (zh) * 2021-11-12 2022-03-25 希姆通信息技术（上海）有限公司 基于Android系统秘钥文件安全存储的方法及系统

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113709123B (zh) * 2018-10-31 2023-07-28 百度在线网络技术（北京）有限公司 安全控制方法、装置和计算机设备
CN110011958B (zh) * 2018-12-13 2023-04-07 平安科技（深圳）有限公司 信息加密方法、装置、计算机设备及存储介质
CN109873700B (zh) * 2019-01-16 2023-10-10 内蒙古惠强科技有限公司 密钥生成方法、装置、计算机可读存储介质及终端设备
CN111162999A (zh) * 2019-12-30 2020-05-15 广东盈世计算机科技有限公司 一种基于即时聊天工具的消息处理方法及装置
CN111638866A (zh) * 2020-04-26 2020-09-08 北京中交兴路信息科技有限公司 随机数生成方法、装置、设备及存储介质
CN113099417B (zh) * 2021-03-23 2023-06-30 千寻位置网络（浙江）有限公司 差分数据播发方法、装置、电子设备及计算机存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101964805A (zh) * 2010-10-28 2011-02-02 北京握奇数据系统有限公司 一种数据安全发送与接收的方法、设备及系统
WO2012109526A1 (en) * 2011-02-12 2012-08-16 CertiVox Ltd. Use of non-interactive identity based key agreement derived secret keys with authenticated encryption
CN103763631A (zh) * 2014-01-07 2014-04-30 青岛海信信芯科技有限公司 认证方法、服务器和电视机
CN103986583A (zh) * 2014-05-29 2014-08-13 上海斐讯数据通信技术有限公司 一种动态加密方法及其加密通信系统

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101064595B (zh) * 2006-04-27 2011-07-27 联想(北京)有限公司 一种计算机网络安全输入认证系统和方法
CN101207919B (zh) * 2006-12-18 2012-05-23 松下电器产业株式会社 网络电话通信安全方法及其装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101964805A (zh) * 2010-10-28 2011-02-02 北京握奇数据系统有限公司 一种数据安全发送与接收的方法、设备及系统
WO2012109526A1 (en) * 2011-02-12 2012-08-16 CertiVox Ltd. Use of non-interactive identity based key agreement derived secret keys with authenticated encryption
CN103763631A (zh) * 2014-01-07 2014-04-30 青岛海信信芯科技有限公司 认证方法、服务器和电视机
CN103986583A (zh) * 2014-05-29 2014-08-13 上海斐讯数据通信技术有限公司 一种动态加密方法及其加密通信系统

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112422223A (zh) * 2020-11-06 2021-02-26 华能新能源股份有限公司河北分公司 基于tcp/ip的对时装置、对时方法及时标监测系统
CN112422223B (zh) * 2020-11-06 2022-06-03 华能新能源股份有限公司河北分公司 基于tcp/ip的对时装置、对时方法及时标监测系统
CN114239050A (zh) * 2021-11-12 2022-03-25 希姆通信息技术（上海）有限公司 基于Android系统秘钥文件安全存储的方法及系统

Also Published As

Publication number Publication date
CN107306261A (zh) 2017-10-31
CN107306261B (zh) 2021-09-07

Similar Documents

Publication Publication Date Title
WO2017181518A1 (zh) 一种加密通讯的方法及装置、系统
US9485096B2 (en) Encryption / decryption of data with non-persistent, non-shared passkey
US11880831B2 (en) Encryption system, encryption key wallet and method
US10693848B2 (en) Installation of a terminal in a secure system
KR101508360B1 (ko) 데이터 전송 장치 및 방법, 그리고 그 방법을 컴퓨터에서 실행시키기 위한 프로그램을 기록한 기록매체
CN107454079B (zh) 基于物联网平台的轻量级设备认证及共享密钥协商方法
EP3205048B1 (en) Generating a symmetric encryption key
WO2021114891A1 (zh) 密钥加密方法、解密方法及数据加密方法、解密方法
CN109150897B (zh) 一种端到端的通信加密方法及装置
US8433066B2 (en) Method for generating an encryption/decryption key
US10356090B2 (en) Method and system for establishing a secure communication channel
CN103546289A (zh) 一种基于USBKey的安全传输数据的方法及系统
CN114900304B (zh) 数字签名方法和装置、电子设备和计算机可读存储介质
TW201626775A (zh) 交互驗證
KR100668446B1 (ko) 안전한 인증정보 이동방법
KR20180113688A (ko) 장치 인증키를 이용한 데이터 암호화 방법 및 시스템
CN103873257A (zh) 密钥更新、数字签名及签名验证的方法及装置
CN105635141A (zh) 一种信息传送方法及装置
US9876774B2 (en) Communication security system and method
JP2014527786A (ja) 指紋情報による認証を行う通信システム及びその用途
KR20140033824A (ko) 스마트 디바이스에서 해쉬값 기반 대칭키 암호화 시스템 및 방법
CN112769783B (zh) 数据传输方法及云服务器、接收端和发送端
KR20080076399A (ko) 모바일 기기를 이용한 사용자와 서버간의 상호 인증시스템, 그 방법 및 기록매체
RU2275747C2 (ru) Полностью динамическая аутентификация без идентификатора
JP2017103710A (ja) 端末装置認証用のプログラム、端末装置認証方法、サーバ装置、および、認証システム

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16899105

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 16899105

Country of ref document: EP

Kind code of ref document: A1