WO2017181691A1

WO2017181691A1 - Secure communication method and device, system, and secure server

Info

Publication number: WO2017181691A1
Application number: PCT/CN2016/108763
Authority: WO
Inventors: 徐大昭
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-04-22
Filing date: 2016-12-07
Publication date: 2017-10-26
Also published as: CN107306258A

Abstract

The present invention provides a secure communication method and device, a system, and a secure server. The method comprises: receiving communication information and first biological template data sent by a first terminal, wherein the first biological template data is identification data having biological features acquired by the first terminal, the communication information is information for communication between the first terminal and a second terminal, and the first terminal and the second terminal are terminals having a biometric identification function; verifying the first biological template data according to biological template data corresponding to the first terminal pre-stored in a database; and sending the communication information to the second terminal when the verification is successful. The present invention solves the problem in the related art of being unable to determine whether an operation is performed by a sender during communication between terminals, thereby improving communication security.

Description

Secure communication method and device, system and security server

Technical field

The present invention relates to the field of secure communications, and in particular to a secure communication method and apparatus, system and security server.

Background technique

The secure communication in the related art is to implement secure communication between two terminals through a conventional encryption technology. The sender sends a message and can directly send the message to send it. After the receiver receives the message, enter the traditional password to view the message.

In view of the secure communication method in the related art, there are mainly the following defects:

1. The two terminals communicate, and it is impossible to determine whether the sender is the person. The sender can forge a message by voice, text, etc., and send it to another communication terminal.

2. Traditional terminal communication, the terminal communication receiver can view the message of the sender as long as the password is entered correctly, and cannot be viewed by himself.

In view of the above technical problems in the related art, an effective solution has not yet been proposed.

Summary of the invention

The embodiments of the present invention provide a secure communication method, apparatus, system, and security server, so as to solve at least the problem that the sender cannot operate by itself when communicating between terminals in the related art.

According to an embodiment of the present invention, a secure communication method is provided, including: receiving communication information sent by a first terminal and first biometric template data; wherein the first biometric template data is biometrically collected by the first terminal The identification information; the communication information is information that the first terminal communicates with the second terminal; the first terminal and the second terminal are terminals with biometric functions; and the biometric template corresponding to the first terminal pre-stored in the database Data, the first bio-template data is verified; in the case of successful verification, the communication information is sent to the second terminal.

In the embodiment of the present invention, after the first biometric template data is verified according to the biometric template data corresponding to the first terminal stored in the database, the method further includes: in the case that the verification is successful, according to the communication information, Querying the second biometric template data corresponding to the second terminal in the database; sending the second biometric template data to the second terminal, where the second biometric template data is used by the second terminal after receiving the communication information Have the right to view communication information for verification.

In the embodiment of the present invention, after the second terminal receives the communication information, verifying whether the second terminal has the right to view the communication information includes: performing, by the second terminal, the biological template data collected by the second terminal according to the second biological template data. Verification; wherein, in case the verification is successful, determining that the second terminal has the authority; and/or, if the verification is unsuccessful, determining that the second terminal does not have the right.

In the embodiment of the present invention, before receiving the communication information and the bio-template data sent by the first terminal, the method further includes: encrypting the bio-template data corresponding to the first terminal and the registration information of the first terminal, and saving the data in the database. And the second biometric template data corresponding to the second terminal and the registration information of the second terminal are encrypted and saved in the database.

In an embodiment of the invention, the biometrics include at least one of the following: a fingerprint feature, an eye mark feature, an iris feature, and a face feature.

According to another embodiment of the present invention, a secure communication apparatus is provided, including: a receiving module, configured to receive communication information sent by a first terminal and first biometric template data; wherein the first biometric template data is a first terminal The collected biometric identification data; the communication information is information that the first terminal communicates with the second terminal; the first terminal and the second terminal are terminals with biometric functions; and the verification module is set to be pre-stored according to The biometric template data corresponding to the first terminal in the database is used to verify the first biometric template data; and the sending module is configured to send the communication information to the second terminal if the verification is successful.

In the embodiment of the present invention, the device further includes: a query module, configured to query, in the case that the verification is successful, the second bio-template data corresponding to the second terminal in the database according to the communication information; and the sending module is further configured to Sending the second biometric template data to the second terminal, where After the second terminal receives the communication information, the second biometric template data verifies whether the second terminal has the right to view the communication information.

In the embodiment of the present invention, the device further includes: a storage module, configured to encrypt the biometric template data corresponding to the first terminal and the registration information of the first terminal, and save the data in the database, and the second biometric corresponding to the second terminal The template data and the registration information of the second terminal are encrypted and saved in the database.

In accordance with another embodiment of the present invention, a security server is provided, including the apparatus described above.

According to another embodiment of the present invention, a secure communication system is provided, including the above-mentioned security server and a second terminal; wherein the second terminal is configured to be based on the case where the security server successfully authenticates the first biometric template data, according to And verifying, by the second biometric template data corresponding to the second terminal, the biometric template data collected by the second terminal, where the verification succeeds, determining that the second terminal has the right to view the communication information; and Or, if the verification is unsuccessful, it is determined that the second terminal does not have the right.

According to still another embodiment of the present invention, a storage medium is also provided. The storage medium is configured to store program code for performing the following steps: receiving communication information sent by the first terminal and first biometric template data; wherein the first biometric template data is biometric identification data collected by the first terminal The communication information is information for the first terminal to communicate with the second terminal; the first terminal and the second terminal are terminals with a biometric function; and according to the biometric template data corresponding to the first terminal pre-stored in the database, The first biometric template data is verified; in the case where the verification is successful, the communication information is transmitted to the second terminal.

In the embodiment of the present invention, the storage medium is further configured to store program code for performing the following steps: in case the verification is successful, querying, in the database, the second bio-template data corresponding to the second terminal according to the communication information; The second biometric template data is sent to the second terminal, where the second biometric template data is used by the second terminal after receiving the communication information Check the permissions of the communication information for verification.

In the embodiment of the present invention, the storage medium is further configured to store program code for performing the following steps: encrypting the bio-template data corresponding to the first terminal and the registration information of the first terminal, and saving the data in the database, and the second The second bio-template data corresponding to the terminal and the registration information of the second terminal are encrypted and saved in the database.

According to the present invention, when the first terminal transmits the communication information to the second terminal, the first biometric template data collected by the first terminal is verified by the bio-template data corresponding to the first terminal stored in the database in advance, and the verification is performed. In the case of success, the communication information is sent to the second terminal. Since the first biometric template data is biometric identification data, the first biometric template data is verified to send the communication information. Whether the party is verified by himself or not, and thus solves the problem that the sender cannot operate by itself when communicating between terminals in the related art, and the communication security is improved.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a block diagram showing the hardware structure of a computer terminal of a secure communication method according to an embodiment of the present invention;

2 is a schematic diagram of a network architecture according to an embodiment of the present invention;

3 is a flowchart 1 of a secure communication method according to an embodiment of the present invention;

4 is a second flowchart of a secure communication method according to an embodiment of the present invention;

FIG. 5 is a third flowchart of a secure communication method according to an embodiment of the present invention; FIG.

FIG. 6 is a schematic flowchart of terminal information registration according to a preferred embodiment of the present invention; FIG.

7 is a flow chart showing communication between terminals according to a preferred embodiment of the present invention;

FIG. 8 is a structural block diagram 1 of a secure communication device according to an embodiment of the present invention; FIG.

9 is a structural block diagram 2 of a secure communication device according to an embodiment of the present invention;

Figure 10 is a block diagram 3 of the structure of a secure communication device in accordance with an embodiment of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

It is to be understood that the terms "first", "second" and the like in the specification and claims of the present invention are used to distinguish similar objects, and are not necessarily used to describe a particular order or order.

Example 1

The method embodiment provided by Embodiment 1 of the present application can be executed in a mobile terminal, a computer terminal or the like. Taking a computer terminal as an example, FIG. 1 is a block diagram showing the hardware structure of a computer terminal of a secure communication method according to an embodiment of the present invention. As shown in FIG. 1, computer terminal 10 may include one or more (only one shown) processor 102 (processor 102 may include, but is not limited to, a Microcontroller Unit (MCU) or a programmable logic device. A processing device such as a Field Programmable Gate Array (FPGA), a memory 104 for storing data, and a transmission device 106 for a communication function. It will be understood by those skilled in the art that the structure shown in FIG. 1 is merely illustrative and does not limit the structure of the above electronic device. For example, computer terminal 10 may also include more or fewer components than those shown in FIG. 1, or have a different configuration than that shown in FIG.

The memory 104 can be used to store software programs and modules of application software, such as program instructions/modules corresponding to the secure communication method in the embodiment of the present invention, and the processor 102 executes various programs by running software programs and modules stored in the memory 104. Functional application and data processing, that is, the above method is implemented. Memory 104 may include high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory. In some examples, memory 104 may further include memory remotely located relative to processor 102, which may be coupled to computer terminal 10 via a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combination.

Transmission device 106 is for receiving or transmitting data via a network. The network specific examples described above may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet. In one example, the transmission device 106 can be a Radio Frequency (RF) module for communicating with the Internet wirelessly.

The embodiment of the present application can also be run on the network architecture shown in FIG. 2. FIG. 2 is a schematic diagram of a network architecture according to an embodiment of the present invention. As shown in FIG. 2, the network architecture includes: a first terminal 22, a security server 24, and a The second terminal 26, wherein the first terminal 22 is a sender of communication information, the second terminal 26 is a receiver of communication information, and the first terminal 22 and the second terminal 26 communicate via the security server 24.

It should be noted that the above two scenarios may also be combined. For example, the security server shown in FIG. 2 may also be the computer terminal 10 shown in FIG. 1, and is not limited thereto.

In this embodiment, a secure communication method running on the mobile terminal or the network architecture is provided. FIG. 3 is a flowchart 1 of a secure communication method according to an embodiment of the present invention. As shown in FIG. 3, the process includes the following steps. :

Step S302: Receive communication information and first biometric template data sent by the first terminal, where the first biometric template data is biometric identification data collected by the first terminal, and the communication information is performed by the first terminal and the second terminal. Communication information; the first terminal and the second terminal are terminals with biometric functions;

Step S304, verifying the first bio-template data according to the bio-template data corresponding to the first terminal stored in the database in advance;

Step S306, if the verification is successful, the communication information is sent to the second terminal.

The first biometric template data collected by the first terminal is verified by the first terminal when the communication information is sent to the second terminal by using the biometric template data corresponding to the first terminal stored in the database. In case of success, the communication information is sent to The second terminal, because the first bio-template data is biometric-identified identification data, is verified by verifying the first bio-template data to verify whether the sender of the communication information is the person, thereby solving the correlation When communicating between terminals in the technology, it is impossible to determine whether the sender is an operation of the user, and the security of the communication is improved.

It should be noted that the above biometrics may be fingerprint features, eye pattern features, iris features, face features, etc., but are not limited thereto. Taking the fingerprint feature as an example, the first biometric template data may be fingerprint template data corresponding to the fingerprint. Since these biometrics can reflect the characteristics of the user, it is possible to determine whether the communication information is sent by the user himself or herself by the verification of the first biometric template data, thereby avoiding the defect that the criminals are unsafe by the forgery of the information.

It should be noted that the verification in the above step S304 may be performed by comparing the bio-template data corresponding to the first terminal stored in the database in advance with the first bio-template data, and the two are consistent. Next, it is considered that the verification is successful. It should be noted that the two can be consistently displayed. If the same data exceeds a predetermined threshold, it can be considered that the two are consistent, but not limited thereto. The predetermined threshold may be based on The actual situation is set. Of course, the higher the predetermined threshold is set, the more accurate the verification result may be, and the more secure the communication may be, but sometimes the user's biometrics (such as fingerprints) may receive certain wear and the like, and thus may If the predetermined threshold is set to a high level, the original verification result may be the person, and the misjudgment is not the person, thereby affecting the normal communication. Therefore, in actual applications, according to actual needs, Set a reasonable predetermined threshold to get reliable verification results.

In an embodiment of the present invention, if the verification in step S304 is unsuccessful, the communication information is returned to the first terminal, indicating that the communication information is not a message sent by the first terminal itself.

It should be noted that the first terminal and the second terminal may implement a biometric function through a certain sensor. For example, the fingerprint recognition sensor may be used to identify the fingerprint, but is not limited thereto. The foregoing communication information may be content information that is communicated by the first terminal and the second terminal, where The communication information may carry the identifiers of the first terminal and the second terminal, but is not limited thereto.

In an embodiment of the present invention, receiving the communication information and the first biometric template data sent by the first terminal may be performed by: receiving the foregoing communication information and the first biometric template data respectively, or by carrying the first biometric template data in The above communication information is received together, but is not limited thereto.

In an embodiment of the present invention, FIG. 4 is a flowchart of a secure communication method according to an embodiment of the present invention. As shown in FIG. 4, after the step S304, the method may further include:

Step S402, in the case that the verification is successful, query the second bio-template data corresponding to the second terminal in the database according to the communication information;

Step S404: Send the second biometric template data to the second terminal, where the second biometric template data is used to verify whether the second terminal has the right to view the communication information after receiving the communication information by the second terminal.

It should be noted that, after the second terminal receives the communication information, verifying whether the second terminal has the right to view the communication information may be performed by: the second terminal performing, according to the second bio-template data, the bio-template data collected by the second terminal. Verification; wherein, in case the verification is successful, determining that the second terminal has the authority; and/or, if the verification is unsuccessful, determining that the second terminal does not have the right.

And verifying, by the second terminal, the biometric template data collected by the second terminal according to the received second biometric template data, and determining whether the second terminal has the right to view the communication information, where the second biometric template data reflects the receiving The identity information of the party, and thus, whether the recipient is the person, and thus the second terminal can receive the communication information, only the person can view the communication information, thereby further ensuring the security of the communication.

It should be noted that the foregoing step S404 may be performed before step S306, or step S404 may be performed at the same time as step S306, or may be performed after step S306 is performed. It should be noted that the step S404 is performed at the step of performing step S306. The second biometric template data and the communication information may be sent to the second terminal at the same time. Specifically, the second biometric template data is carried in the communication information and sent to the second terminal, but is not limited thereto.

It should be noted that FIG. 4 shows a schematic diagram of step S404 performed before step S306.

It should be noted that, after the step S306, the method may further include: receiving biometric template data collected by the second terminal sent by the second terminal; and according to the second biometric template data corresponding to the second terminal in the pre-stored database The biometric template data collected by the second terminal is verified, and in the case that the verification is successful, an indication signal for instructing the second terminal to allow the second terminal to view the communication information is sent to the second terminal; and/or, in the case that the verification is unsuccessful, the The second terminal sends a prohibition signal for instructing the second terminal to view the communication information. The above method can also be used to verify whether the second terminal has the right to view the communication information.

In an embodiment of the present invention, FIG. 5 is a flowchart of a secure communication method according to an embodiment of the present invention. As shown in FIG. 5, before the step S302, the method may further include: step S502, The bio-template data corresponding to the terminal and the registration information of the first terminal are encrypted and stored in the database, and the second bio-template data corresponding to the second terminal and the registration information of the second terminal are encrypted and stored in the database.

The biometric template data is stored in the database by encrypting the biometric template data of the first terminal and the second terminal in the database, and the first terminal and the second terminal do not store the fingerprint template information locally. In contrast, the control of the terminal is saved, and the database is protected from being attacked by encrypting the biometric template data, thereby increasing the security of the information.

It should be noted that the bio-template data stored in the database is the bio-template data that has been encrypted, and further, in order to maintain consistency in the verification process, the bio-template data collected by the first terminal may be encrypted. And then sent to the server to directly match the two encrypted bio-template data, or the first terminal directly sends the collected bio-template data to the server, and the server first decrypts the stored encrypted bio-template data, and then If the two are matched, the first terminal directly sends the collected biological template data to the server, and the server encrypts the data, and then matches the stored encrypted biological template data, and may also be the first terminal to use the biological template. After the data is encrypted, it is sent to the server, and the server decrypts it. At the same time, the server decrypts the encrypted bio-template data and then decrypts it twice. The biotemplate data is matched, but is not limited thereto. It should be noted that the verification process performed on the receiving side (second terminal) is similar to that here, and will not be described again.

It should be noted that, before the foregoing step S502, the first terminal and the second terminal may be registered first, and the first terminal is registered, and the biometric is a fingerprint feature, for example, the user may open the terminal program, and the user first Fill in the necessary account information of the user; after completing the account information, the first terminal collects the fingerprint of the user; after collecting the fingerprint, the registration information (account information) is uploaded to the server together with the fingerprint template information to complete the user registration process.

Optionally, the execution entity of the foregoing step may be a security server, where the database is located in the security server, but is not limited thereto.

For a better understanding of the invention, the invention is further explained in conjunction with the preferred embodiments.

The preferred embodiment of the present invention can be operated in a system comprising a terminal with biometric identification (fingerprint recognition, eye pattern recognition, iris recognition, face recognition, etc., taking fingerprint as an example) (corresponding to the first terminal described above) And the second terminal) and the security server are composed of two parts, which can be used for biometric identification between the one-to-one (single call) and one-to-many (group call) between the communication record and the communication group to achieve secure communication (hereinafter One-to-one communication is an example).

A biometric terminal, such as a mobile phone with fingerprint recognition (not limited to a mobile phone). The security server is used to store fingerprint template data, to be responsible for forwarding data between terminals, and for authenticating the sender of the information. The secure communication method of the preferred embodiment of the present invention may include the following steps:

The first step: fill in the account information, collect fingerprints. The account information is sent along with the fingerprint template data to the secure server for registration.

Step 2: The user can communicate with other registered users through the terminal (you can contact one-to-one or group communication).

Step 3: Before the user initiates the message, the finger can be sent to the fingerprint recognition sensor to send a message (only the fingerprint sensor can be sent to ensure that the server authenticates your fingerprint).

Step 4: The receiver needs to identify the authentication through the fingerprint identification sensor before viewing the information.

Specifically, the following process may be included: a process of registering terminal information and a process of communication between terminals; wherein FIG. 6 is a schematic flowchart of terminal information registration according to a preferred embodiment of the present invention. As shown in FIG. 6, the registration process includes :

Step S601: The user opens the terminal program, and the user first fills in the account information necessary for the user.

Step S602: The user needs to collect fingerprints in the last step of completing the account information.

Step S603: After collecting the fingerprint, the user uploads the registration information together with the fingerprint template information to the server to complete the user registration process, and the server encrypts and stores the fingerprint template data and the user registration information to the database (corresponding to step S502 in the above embodiment). The fingerprint template data is not stored locally by the terminal.

FIG. 7 is a schematic flowchart of inter-terminal communication according to a preferred embodiment of the present invention. As shown in FIG. 7, the process includes:

Step S701: The program for opening the terminal Si (corresponding to the first terminal in the above embodiment) is ready to communicate with the Ri terminal (corresponding to the second terminal in the above embodiment), and the Si enters a message (text, multimedia, etc.) to be transmitted. (corresponds to the communication information in the above embodiment). Then touch the fingerprint sensor, and the fingerprint template data of Si is collected and sent to the server S along with the message entered by Si. The fingerprint sensor has two functions in this process. On the one hand, the fingerprint sensor collects the fingerprint template data of Si; the effect of the Si message transmission is that only the fingerprint sensor can be pressed to send the message.

Step S702: The server S receives the message of Si (corresponding to step S302 in the above embodiment), the server S queries the fingerprint template data of the Si from the database, and transmits the fingerprint template data with the Si (corresponding to the above embodiment). The first biometric template data is verified (corresponding to step S304 in the above embodiment), and if the verification fails, the message is returned, indicating that the message is not sent by Si himself. If the verification is passed, the fingerprint template data of Ri (corresponding to the second bio-template data in the above embodiment) is queried according to the Ri information carried by Si (corresponding to step S402 in the above embodiment).

Step S703: The server S sends the information of the Si (the fingerprint template data not including Si at this time) and the fingerprint template data of the Ri to the Ri (corresponding to the steps in the above embodiment). S306 and step S404 are performed simultaneously).

Step S704: After the terminal Ri receives the information of step S203, Ri puts the fingerprint into the fingerprint sensor and the fingerprint template data of the Ri carried in the message of step S703 for authentication. After the authentication is passed, the Ri can view the message carried by the Si. Otherwise, the authentication fails, indicating that the person cannot view the data to achieve secure communication.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.

Example 2

In the embodiment, a secure communication device is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and has not been described again. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

FIG. 8 is a structural block diagram 1 of a secure communication apparatus according to an embodiment of the present invention. As shown in FIG. 8, the apparatus includes:

The receiving module 82 is configured to receive the communication information and the first biometric template data sent by the first terminal, where the first biometric template data is the biometric identification data collected by the first terminal; the communication information is the first terminal and the first The information that the second terminal performs communication; the first terminal and the second terminal are terminals with biometric functions;

The verification module 84 is connected to the receiving module 82, and configured to verify the first bio-template data according to the bio-template data corresponding to the first terminal stored in the database;

The sending module 86 is connected to the verification module 84, and is configured to send the communication information to the second terminal if the verification is successful.

The first biometric template data collected by the first terminal is verified by the verification module 84 according to the biometric template data corresponding to the first terminal stored in the database. If the verification is successful, the sending module 86 The communication information is sent to the second terminal. Since the first biometric template data is biometric identification data, whether the sender of the communication information is verified by verifying the first biometric template data. Furthermore, the problem of whether the sender is an operation of the sender cannot be determined when the communication between the terminals in the related art is improved, and the security of the communication is improved.

For the explanation of the verification by the verification module 84 and the other (such as the communication information, the first terminal, the second terminal, etc.), reference may be made to the corresponding explanation in the foregoing solution embodiment, and details are not described herein again.

FIG. 9 is a block diagram showing the structure of a secure communication device according to an embodiment of the present invention. As shown in FIG. 9, the device includes, in addition to all the modules shown in FIG.

The query module 92 is connected to the verification module 84, and is configured to query, in the database, the second bio-template data corresponding to the second terminal in the database according to the communication information;

The sending module 86 is further configured to send the second biometric template data to the second terminal, where the second biometric template data is used after the second terminal receives the communication information, and whether the second terminal has the right to view the communication information. verification.

It should be noted that after the second terminal receives the communication information, verifying whether the second terminal has the right to view the communication information may be performed as follows: the second terminal is configured according to the second biometric template. The biometric template data collected by the second terminal is verified; wherein, in case the verification is successful, determining that the second terminal has the authority; and/or, if the verification is unsuccessful, determining that the second terminal does not have the authority.

The second biometric template data is sent to the second terminal by the sending module 86, so that the second terminal can verify the biometric template data collected by the second terminal according to the received second biometric template data, thereby determining whether the second terminal is Having the right to view the communication information, since the second bio-template data reflects the identity information of the recipient, it can be determined whether the recipient is the person, and thus, when the second terminal receives the communication information, only the present Talents can view the communication information to further ensure the security of the communication.

It should be noted that the receiving module 82 is further configured to receive the biometric template data collected by the second terminal sent by the second terminal; the verification module 84 is further configured to: according to the second biometric corresponding to the second terminal in the pre-stored database. The template data is used to verify the biometric template data collected by the second terminal. The sending module 86 is further configured to send, to the second terminal, an indication signal for instructing the second terminal to view the communication information, and/or In case the verification is unsuccessful, a prohibition signal for instructing the second terminal to prohibit the communication information from being viewed is sent to the second terminal. The device can also verify whether the second terminal has the right to view the communication information.

The process of verifying that the second terminal is authenticated by having the right to view the communication information may be implemented in the second terminal, or may be implemented in the secure communication device in this embodiment.

FIG. 10 is a structural block diagram 3 of a secure communication device according to an embodiment of the present invention. As shown in FIG. 10, the device includes:

The storage module 1002 is connected to the receiving module 82, and is configured to encrypt the bio-template data corresponding to the first terminal and the registration information of the first terminal, and store the data in the database, and the second bio-template data corresponding to the second terminal. The registration information of the second terminal is encrypted and saved in the database.

The biometric template data of the first terminal and the second terminal are encrypted and stored in the database by the storage module 1002, and the first terminal and the second terminal do not store the fingerprint template information locally. Compared with the technology, the bio-template data is saved in the terminal, which saves the control of the terminal, and the database is encrypted by encrypting the bio-template data, thereby increasing the security of the information.

It should be noted that the foregoing apparatus may further include a registration module, and is connected to the storage module 1002, and is configured to register the first terminal and the second terminal. The specific registration process may refer to the corresponding method embodiment, where Narration.

It should be noted that the above device may be located in the security server, but is not limited thereto.

It should be noted that each of the above modules may be implemented by software or hardware. For the latter, the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination. The forms are located in different processors.

Example 3

In this embodiment, a security server is further provided, including the device shown in any one of the foregoing FIG. 8 to FIG. 10, and the security server may be the computer terminal shown in FIG. 1 in the foregoing Embodiment 1, but not Limited to this.

In this embodiment, a secure communication system is further provided, including the security server and the second terminal in the embodiment, wherein the second terminal is configured to be based on the case that the security server successfully authenticates the first biometric template data, according to The second biometric template data corresponding to the second terminal obtained from the database is used to verify the biometric template data collected by the second terminal; wherein, in the case that the verification is successful, determining that the second terminal has the authority; and/or, in the verification In the case of unsuccessful, it is determined that the second terminal does not have the authority.

For a detailed explanation of the security server and terminology, refer to the explanation of Embodiment 2, and details are not described herein again.

Example 4

Embodiments of the present invention also provide a storage medium. Optionally, in the embodiment, the foregoing storage medium may be configured to store program code for performing the following steps:

S1, receiving communication information sent by the first terminal and first biometric template data; wherein, first The biometric template data is biometric identification data collected by the first terminal; the communication information is information that the first terminal communicates with the second terminal; and the first terminal and the second terminal are terminals with biometric functions;

S2. Verify the first bio-template data according to the bio-template data corresponding to the first terminal that is pre-stored in the database.

S3. If the verification is successful, send the communication information to the second terminal.

Optionally, the storage medium is further arranged to store program code for performing the following steps:

S4, in the case that the verification is successful, querying, according to the communication information, the second bio-template data corresponding to the second terminal in the database;

S5. The second biometric template data is sent to the second terminal, where the second biometric template data is used to verify whether the second terminal has the right to view the communication information after receiving the communication information by the second terminal.

S6, the biometric template data corresponding to the first terminal and the registration information of the first terminal are encrypted and stored in the database, and the second biometric template data corresponding to the second terminal and the registration information of the second terminal are encrypted and saved in the database. in.

Optionally, in this embodiment, the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory. A variety of media that can store program code, such as a disc or a disc.

For example, the specific examples in this embodiment may refer to the examples described in the foregoing embodiments and the optional embodiments, and details are not described herein again.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they can be executed by computing devices The program code of the lines is implemented so that they can be stored in the storage device by the computing device, and in some cases, the steps shown or described can be performed in a different order than here, or they can be Each of the integrated circuit modules is fabricated separately, or a plurality of modules or steps thereof are fabricated into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

A secure communication method, including:

Receiving the communication information and the first biometric template data sent by the first terminal, where the first biometric template data is biometric identification data collected by the first terminal; the communication information is the first terminal Information for communicating with the second terminal; the first terminal and the second terminal are terminals with biometric functions;

The first biometric template data is verified according to the biometric template data corresponding to the first terminal pre-stored in the database;

In case the verification is successful, the communication information is sent to the second terminal.
The method according to claim 1, wherein after the first biometric template data is verified according to the biometric template data corresponding to the first terminal stored in the database, the method further includes:

If the verification is successful, querying, according to the communication information, the second bio-template data corresponding to the second terminal in the database;

Transmitting the second biometric template data to the second terminal, where the second biometric template data is used by the second terminal after receiving the communication information, and whether the second terminal has a viewing location The authority to communicate information is verified.
The method according to claim 2, wherein after the second terminal receives the communication information, verifying whether the second terminal has the right to view the communication information comprises:

The second terminal verifies the biometric template data collected by the second terminal according to the second biometric template data; wherein, if the verification is successful, determining that the second terminal has the permission; and/or If the verification is unsuccessful, it is determined that the second terminal does not have the permission.
The method of claim 1, wherein before receiving the communication information and the biometric template data sent by the first terminal, the method further comprises:

Encrypting the biometric template data corresponding to the first terminal and the registration information of the first terminal in the database, and second biometric template data and the second terminal corresponding to the second terminal The registration information is encrypted and saved in the database.
The method of claim 1, wherein the biometrics comprise at least one of: a fingerprint feature, an eye pattern feature, an iris feature, a face feature.
A secure communication device comprising:

The receiving module is configured to receive the communication information sent by the first terminal and the first biometric template data, where the first biometric template data is biometric identification data collected by the first terminal; the communication information is Information that the first terminal communicates with the second terminal; the first terminal and the second terminal are terminals with a biometric function;

The verification module is configured to verify the first bio-template data according to the bio-template data corresponding to the first terminal pre-stored in the database;

And a sending module, configured to send the communication information to the second terminal if the verification is successful.
The apparatus according to claim 6, wherein the apparatus further comprises: a query module configured to, in the case that the verification is successful, query the database for a number corresponding to the second terminal according to the communication information Second biological template data;

The sending module is further configured to send the second biometric template data to the second terminal, where the second biometric template data is used by the second terminal after receiving the communication information, Whether the second terminal has the right to view the communication information for verification.
The apparatus of claim 6 wherein said apparatus further comprises:

a storage module, configured to encrypt the biometric template data corresponding to the first terminal and the registration information of the first terminal, and save the data in the database, and the second terminal The second biometric template data corresponding to the end and the registration information of the second terminal are encrypted and saved in the database.
The apparatus of claim 6, wherein the biometrics comprise at least one of: a fingerprint feature, an eye pattern feature, an iris feature, and a face feature.
A security server comprising: the apparatus of any one of claims 6 to 9.
A secure communication system comprising the security server and the second terminal of claim 10; wherein the second terminal is configured to be based on the success of the security server verifying the first biometric template data The second biometric template data corresponding to the second terminal obtained in the database is used to verify the biometric template data collected by the second terminal; wherein, if the verification is successful, determining that the second terminal has the view The authority of the communication information; and/or, if the verification is unsuccessful, determining that the second terminal does not have the authority.