WO2018076183A1 - 一种传输数据的方法、装置和系统 - Google Patents

一种传输数据的方法、装置和系统 Download PDF

Info

Publication number
WO2018076183A1
WO2018076183A1 PCT/CN2016/103301 CN2016103301W WO2018076183A1 WO 2018076183 A1 WO2018076183 A1 WO 2018076183A1 CN 2016103301 W CN2016103301 W CN 2016103301W WO 2018076183 A1 WO2018076183 A1 WO 2018076183A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
intermediate device
target data
preset identifier
data transmission
Prior art date
Application number
PCT/CN2016/103301
Other languages
English (en)
French (fr)
Inventor
韦安妮
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2016/103301 priority Critical patent/WO2018076183A1/zh
Priority to EP16920146.4A priority patent/EP3522473A4/en
Priority to CN201680090033.7A priority patent/CN109845214B/zh
Publication of WO2018076183A1 publication Critical patent/WO2018076183A1/zh
Priority to US16/392,364 priority patent/US20190268764A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0464—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/166—Implementing security features at a particular protocol layer at the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic

Definitions

  • the present invention relates to the field of Internet technologies, and in particular, to a method, an apparatus, and a system for transmitting data.
  • TLS Transport Layer Security
  • the data transmission process when the transmission data needs to be encrypted is generally: the terminal can first establish a TCP (Transmission Control Protocol) connection with the server, and then, a TLS connection can be established, wherein the process of establishing a TLS connection is a terminal and The process of the server negotiating the key, and finally, the terminal and the server perform data transmission, wherein the terminal and the server can encrypt and decrypt the transmitted data by using the negotiated key during data transmission.
  • TCP Transmission Control Protocol
  • the intermediate device with the service optimization function may be used in the transmission process (for example, it may be a firewall device or an intermediate device provided by the operator for video optimization), that is, during data transmission.
  • the intermediate device needs to perform data processing on the transmitted data.
  • the intermediate device can perform viewing processing or other data processing on the data transmitted by the server or the terminal, that is, the intermediate device can perform data according to itself.
  • Processing function to process data transmitted by the server or terminal
  • more and more servers require data to be transmitted with the terminal to be encrypted.
  • the encrypted data passes through the intermediate device, the data is negotiated through the terminal and the server. If the key is encrypted, the intermediate device does not know the key, and the intermediate device cannot read the data transmitted by the terminal and the server, thereby causing the intermediate device to fail to work normally.
  • the embodiment of the present invention provides a method, device and system for transmitting data. Place The technical solutions are as follows:
  • a method of ultimately transmitting data comprising:
  • the first device acquires target data to be transmitted to the second device
  • the first device performs encryption processing on the target data based on the first encryption key negotiated by the first device and the intermediate device, to obtain a One data
  • the first device sends a first data transmission message carrying the first data to the intermediate device.
  • the target data to be transmitted can be obtained.
  • the first device may determine whether the target data allows data read by the intermediate device. If the target data is data that is allowed to be read by the intermediate device, the first device may be based on the first encryption key stored in advance.
  • the first device may further store an encryption algorithm (which may be referred to as a first encryption algorithm), that is, the first device may negotiate with the intermediate device based on the first device.
  • the first encryption key and the first encryption algorithm perform encryption processing on the target data to obtain the first data.
  • the data transmission message ie, the first data transmission message
  • the intermediate device where the first data transmission message may also carry the first data.
  • the first data transmission message further includes a first preset identifier, where the first preset identifier is used to indicate that the The intermediate device reads the target data.
  • the method further includes:
  • the first device encrypts the target data based on a third encryption key negotiated by the first device and the second device. Processing to obtain third data;
  • the first device sends a third data transmission message carrying the third data and the second preset identifier to the intermediate device, where the second preset identifier is used to indicate that the intermediate device is not allowed to read Take the target data.
  • the first device may determine whether the target data allows data read by the intermediate device. If the target data is data that is not allowed to be read by the intermediate device, the target may be based on the third encryption key stored in advance.
  • the data is subjected to an encryption process to obtain a third data, wherein the first device may further store an encryption algorithm (which may be referred to as a third encryption algorithm), that is, the first device may negotiate with the second device based on the first device.
  • the third encryption key and the third encryption algorithm encrypt the target data to obtain the third data.
  • the first data transmission message carries the first preset identifier, and when the first device determines that the target data is data that is not allowed to be read by the intermediate device, Sending, to the intermediate device, a third data transmission message carrying the third data and the second preset identifier, where the second preset identifier may be used to indicate that the intermediate device is not allowed to read the target data.
  • the first device may perform integrity protection processing on the second preset identifier.
  • the intermediate device can be operated normally if the target data is data that is allowed to be read by the intermediate device, and the security of the target data can be ensured if the target data is data that is not allowed to be read by the intermediate device.
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS packet header; or,
  • the first preset identifier or the second preset identifier is set in a low latency internet transport layer QUIC header based on a user datagram protocol.
  • the method further includes:
  • the first device sends a verification indication message to the intermediate device, where the verification indication message is used to instruct the intermediate device to send a verification request for verifying the legality of the intermediate device to the second device;
  • the first device negotiates the first encryption key and the corresponding first decryption key for data transmission with the intermediate device.
  • the data may be transmitted based on the TLS protocol, or may be transmitted based on the QUIC protocol.
  • the first device and the second device may establish a TCP (Transmission Control Protocol) connection before the data is transmitted, that is, the first device performs a TCP three-way handshake with the second device, and then, Establish a TLS connection, which
  • the process of establishing a TLS connection is a process in which the first device negotiates a key with the second device, that is, negotiates a third encryption key and a corresponding third decryption key for data transmission involved in the following processing.
  • the first device and the second device may establish a QUIC connection before transmitting data.
  • the first device may send a verification indication message to the intermediate device, where the verification indication message may be used to instruct the intermediate device to send the verification for verifying the legality of the intermediate device to the second device.
  • the verification indication message may be sent during the TLS establishment process, or may be transmitted for the QUIC-based transmission target after the TLS connection is established.
  • the verification indication message may be in the process of establishing the QUIC connection, or may be limited in the embodiment of the present invention after the QUIC connection is established.
  • the device information of the intermediate device may be preset in the first device, where the device information of the intermediate device may be the device identifier of the intermediate device (may be the device name of the intermediate device, or may be the MAC address of the intermediate device, or The IP (Internet Protocol) address of the intermediate device, the data processing function information (which may be text information indicating the data processing function of the intermediate device), and the certificate.
  • the verification indication message may carry the intermediate device.
  • the device information of the intermediate device may not be pre-configured in the first device, which is not limited in the embodiment of the present invention.
  • the verification indication message sent by the first device may be transmitted in a clear text manner.
  • the intermediate device may send an authentication request for verifying the legality of the intermediate device to the second device.
  • the intermediate device may send the intermediate device to the first device to indicate the middle.
  • the first device may receive a feedback message sent by the intermediate device to indicate that the intermediate device is legal, and further, may negotiate with the intermediate device a first encryption key for data transmission and a corresponding first decryption key. .
  • the legality of the intermediate device is verified first, and the first encryption key and the corresponding first decryption key are negotiated on the basis of the legality of the intermediate device, thereby preventing the target data from being malicious (ie, an illegal intermediate device). Read, in turn, to ensure the security of the target data.
  • a method of transmitting data comprising:
  • the intermediate device receives the first data transmission message that is sent by the first device and carries the first data, where the first data is target data that is encrypted by the first encryption key;
  • the intermediate device is based on a first decryption key negotiated by the intermediate device with the first device, Decrypting the first data to obtain the target data, and performing preset data processing on the target data;
  • the intermediate device performs encryption processing on the data processed target data based on the second encryption key negotiated by the intermediate device and the second device to obtain second data;
  • the intermediate device sends a second data transmission message carrying the second data to the second device.
  • the intermediate device may receive the first data transmission message sent by the first device, and may parse the first data transmission message, where the first data is The target data encrypted by the first encryption key. After obtaining the target data, the intermediate device may perform preset data processing on the obtained target data according to the data processing function that the intermediate device has. Specifically, the intermediate device may have a preset data processing function, wherein the preset data processing function It can be a statistical data function. In this case, the intermediate device can read the target data of the first device to be transmitted to the second device, so as to perform statistics without changing the target data, and the preset data processing function may also be video optimization.
  • the intermediate device can read the target data of the first device to be transmitted to the second device, and change the target data based on the preset data processing function, for example, the first device is a server, and the video optimization function is The HD video data is changed to standard definition video data.
  • the intermediate device can read the high-definition video data (ie, target data) sent by the server to the terminal, and further, the target data can be changed to the standard definition video data. That is to say, after the intermediate device performs preset data processing on the target data, the obtained data may be the same as or different from the target data.
  • the second encryption key stored in advance may be acquired, and the target data processed by the data is encrypted according to the second encryption key to obtain second data, where
  • An encryption algorithm (which may be referred to as a second encryption algorithm) may also be pre-stored in the device, that is, the intermediate device may perform the data processing target based on the second encryption key and the second encryption algorithm negotiated by the intermediate device with the second device.
  • the data is encrypted to obtain the second data.
  • the data transmission message ie, the second data transmission message
  • the second data transmission message may be sent to the second device, where the second data transmission message may carry the second data.
  • the first data transmission message further carries a first preset identifier, where the first preset identifier is used to indicate that the middle is allowed
  • the device reads the target data
  • the intermediate device decrypts the first data based on the first decryption key negotiated by the intermediate device with the first device, obtains the target data, and presets the target data.
  • Data processing including:
  • the intermediate device determines that the first data identifier is carried in the first data transmission message, the intermediate device is based on the first decryption key negotiated by the intermediate device with the first device, Decoding the first data to obtain the target data, and performing preset data processing on the target data;
  • the intermediate device sends a second data transmission message carrying the second data and the first preset identifier to the second device.
  • the intermediate device may determine whether the first data transmission message carries the first preset identifier. When determining that the first data transmission message carries the first preset identifier, the intermediate device may be based on the intermediate device.
  • the first decryption key negotiated by the first device decrypts the first data to obtain target data, and performs preset data processing on the target data.
  • the second data transmission message sent by the intermediate device to the second device may also carry the first preset identifier, that is, the second data transmission message carries the first Two data and a first preset identifier.
  • the corresponding preset identifier can be carried in the data transmission message, so that the intermediate device and the second device can easily obtain the encryption key based on the first data sent by the first device, thereby improving the decryption key. effectiveness.
  • the method further includes:
  • the intermediate device receives a third data transmission message that is sent by the first device and carries the third data and the second preset identifier, where the second preset identifier is used to indicate that the intermediate device is not allowed to read.
  • the target data, the third data is target data encrypted by a third encryption key;
  • the intermediate device determines that the second preset identifier is carried in the third data transmission message, the intermediate device sends the third data transmission message to the second device.
  • the intermediate device may receive the third data transmission message sent by the first device, and may parse the data transmission device to obtain the third data transmission message.
  • the carried third data and the second preset identifier, wherein the third data is target data encrypted by the third encryption key.
  • the intermediate device may determine whether the second data transmission message carries the second preset identifier, and when determining the third data transmission message, When the second preset identifier is carried, that is, when the target data is data that is not allowed to be read by the intermediate device, the third data transmission message may be forwarded to the second device without performing any processing on the third data.
  • the intermediate device can be operated normally if the target data is data that is allowed to be read by the intermediate device, and the security of the target data can be ensured if the target data is data that is not allowed to be read by the intermediate device.
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS packet header; or,
  • the first preset identifier or the second preset identifier is set in a low latency internet transport layer QUIC header based on a user datagram protocol.
  • the method further includes:
  • the intermediate device receives a feedback message sent by the second device to indicate that the intermediate device is legal, and sends a feedback message sent by the second device to indicate that the intermediate device is legal to the first device;
  • the intermediate device negotiates the first encryption key and the first decryption key for data transmission with the first device, and negotiates the second encryption for data transmission with the second device Key and corresponding second decryption key.
  • the intermediate device may receive the verification indication message sent by the first device. If the verification indication message carries the device information of the intermediate device, after receiving the verification indication message, the intermediate device may It is parsed to obtain device information of the intermediate device carried therein.
  • the intermediate device may obtain the device information of the intermediate device carried in the verification indication message after receiving the verification indication message sent by the first device, and may send the device information to the second device.
  • a verification request carrying device information of the intermediate device In the case that the device information of the intermediate device is not carried in the verification indication message, that is, the device information of the intermediate device is not pre-configured in the first device, the intermediate device may obtain the localization information after receiving the verification indication message sent by the first device. Pre-stored device information of the intermediate device, and send a verification request carrying the device information of the intermediate device to the second device.
  • the verification request sent by the intermediate device can be taken Transfer in clear text.
  • the second device may verify the legality of the intermediate device.
  • the second device may send a feedback message indicating that the intermediate device is legal to the intermediate device, and then the intermediate device may receive the a feedback message sent by the second device to indicate that the intermediate device is legal, and may send a feedback message sent by the second device to indicate that the intermediate device is legal, and then the intermediate device may negotiate with the first device for use. And transmitting a first encryption key and a first decryption key, and negotiating, with the second device, a second encryption key for data transmission and a corresponding second decryption key.
  • the legality of the intermediate device is verified first, and the first encryption key and the corresponding first decryption key are negotiated on the basis of the legality of the intermediate device, thereby preventing the target data from being malicious (ie, an illegal intermediate device). Read, in turn, to ensure the security of the target data.
  • a method of transmitting data comprising:
  • the second device receives the second data transmission message that is sent by the intermediate device and carries the second data, where the second data is data obtained by encrypting the target data processed by the intermediate device data;
  • the second device decrypts the second data based on a second decryption key negotiated by the second device with the intermediate device to obtain target data processed by the intermediate device data.
  • the second device may receive the second data transmission message sent by the intermediate device, and parse the second data transmission message to obtain the second data carried therein.
  • the second data is the target data processed by the intermediate device data, and then the data encrypted by the second encryption key.
  • the decryption key (ie, the second decryption key) negotiated by the second device with the intermediate device may be pre-stored in the second device, where the second decryption key may be used to decrypt the second data sent by the intermediate device.
  • the second device may determine whether the target data is data that is allowed to be read by the intermediate device, that is, determine whether the second data is an intermediate device that performs predetermined data processing on the target data, and encrypts the data.
  • Data when the second device determines that the target data is data that is allowed to be read by the intermediate device, the second data may be decrypted based on the second decryption key to obtain target data processed by the intermediate device, wherein the second device
  • the obtained data may be consistent with the target data, or may be inconsistent with the target data, and whether it is the same depends on whether the data processing of the target data by the intermediate device changes the target data.
  • the second device may further store a decryption algorithm (which may be referred to as a second decryption algorithm), that is, after the second device acquires the second data, the second decryption key negotiated with the intermediate device by the second device may be used. And a second decryption algorithm for the second data The line decryption process obtains target data processed by the intermediate device data.
  • a decryption algorithm which may be referred to as a second decryption algorithm
  • the second data transmission message further includes a first preset identifier, where the first preset identifier is used to indicate permission
  • the intermediate device reads the target data
  • the second device performs decryption processing on the second data based on the second decryption key negotiated by the second device and the intermediate device, and obtains target data processed by the intermediate device, including:
  • the second device determines that the second data transmission message carries the first preset identifier
  • the second device is based on a second decryption key negotiated by the second device with the intermediate device, Decrypting the second data to obtain target data processed by the intermediate device data.
  • the second device may determine whether the second data transmission message carries the first preset identifier, and when determining that the second data transmission message carries the first preset identifier, When the second data carried in the data transmission message is the data obtained by the target device data processed by the intermediate device, the second data may be decrypted based on the second decryption key negotiated by the second device and the intermediate device. , get the target data processed by the intermediate device data.
  • the corresponding preset identifier can be carried in the data transmission message, so that the intermediate device and the second device can easily obtain the encryption key based on the first data sent by the first device, thereby improving the decryption key. effectiveness.
  • the method further includes:
  • the second device Receiving, by the second device, a third data transmission message that is sent by the intermediate device and that carries the third data and the second preset identifier, where the second preset identifier is used to indicate that the intermediate device is not allowed to read
  • the target data, the third data is target data encrypted by a third encryption key
  • the second device determines that the second data transmission message carries the second preset identifier
  • the second device is based on the third decryption key negotiated by the second device with the first device. Decrypting the third data to obtain the target data.
  • the second device may receive the third data transmission message sent by the intermediate device, and may parse the data transmission device to obtain the third data transmission message.
  • the carried third data and the second preset identifier, wherein the third data is target data encrypted by the third encryption key.
  • the decryption key (ie, the third decryption key) negotiated by the second device with the first device may be pre-stored in the second device, where the third decryption key may be used for the first
  • the device performs decryption processing through the third data sent by the intermediate device.
  • the second device may determine whether the second data transmission message carries the second preset identifier, and when determining that the third data transmission message carries the second preset identifier, determining the third
  • the third data carried in the data transmission message is data obtained by the first device encrypting the target data based on the third encryption key.
  • the second device may be based on the second device and the second device.
  • the third decryption key negotiated by the device decrypts the third data to obtain the target data.
  • the second device may further store a decryption algorithm (which may be referred to as a third decryption algorithm), that is, when determining that the third data transmission message carries the second preset identifier, the second device may be based on the second device.
  • the third decryption key and the third decryption algorithm negotiated with the first device perform decryption processing on the third data to obtain target data.
  • the intermediate device can be operated normally if the target data is data that is allowed to be read by the intermediate device, and the security of the target data can be ensured if the target data is data that is not allowed to be read by the intermediate device.
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS packet header; or,
  • the first preset identifier or the second preset identifier is set in a low latency internet transport layer QUIC header based on a user datagram protocol.
  • the method further includes:
  • the second device verifies the legality of the intermediate device according to the device information of the intermediate device
  • the second device sends a feedback message indicating that the intermediate device is legal to the first device by using the intermediate device, and negotiates with the intermediate device for the data transmission.
  • the second decryption key and the corresponding second encryption key are the second decryption key and the corresponding second encryption key.
  • the second device may receive the verification request sent by the intermediate device, and may parse the device to obtain the device information of the intermediate device carried therein.
  • the second device can verify the legality of the intermediate device according to the preset processing policy. Specifically, after obtaining the device information of the intermediate device, the device identifier and the data processing function information of the intermediate device are obtained (may be a text representing the data processing function of the intermediate device) After the information and the certificate, the certificate is issued by the specific organization for the intermediate device, and may be obtained by encrypting the data processing function information of the intermediate device based on the private key, and the second device may obtain the public key of the corresponding intermediate device. And decrypting the certificate based on the obtained public key.
  • the second device can determine that the intermediate device is legal.
  • the second device may further store the operation that the second device allows the intermediate device to perform. On the basis of the foregoing determination, the legality of the intermediate device is verified by combining the operations performed by the intermediate device by the second device.
  • the second device may send, by using the intermediate device, a feedback message corresponding to the verification request sent by the intermediate device to the first device, where the feedback message may be used to indicate the intermediate device. legitimate.
  • the second device may send a feedback message corresponding to the verification request sent by the intermediate device to the intermediate device, where the feedback message may carry the device identifier of the legal intermediate device.
  • the second device can perform integrity protection processing on the feedback message.
  • the second device may also negotiate with the intermediate device a second decryption key for data transmission and a corresponding second encryption key.
  • the legality of the intermediate device is verified first, and the first encryption key and the corresponding first decryption key are negotiated on the basis of the legality of the intermediate device, thereby preventing the target data from being malicious (ie, an illegal intermediate device). Read, in turn, to ensure the security of the target data.
  • a first device comprising a processor and a transmitter, wherein:
  • the processor is configured to acquire target data to be transmitted to the second device; if the target data is data that is allowed to be read by the intermediate device, based on the first encryption key negotiated by the first device with the intermediate device Key, encrypting the target data to obtain first data;
  • the transmitter is configured to send, to the intermediate device, a first data transmission message that carries the first data.
  • the first data transmission message further includes a first preset identifier, where the first preset identifier is used to indicate permission
  • the intermediate device reads the target data.
  • the processor is further configured to:
  • the target data is data that is not allowed to be read by the intermediate device, based on the first setting And a third encryption key negotiated with the second device, performing encryption processing on the target data to obtain third data;
  • the transmitter is also used to:
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS packet header; or,
  • the first preset identifier or the second preset identifier is set in a low latency internet transport layer QUIC header based on a user datagram protocol.
  • the transmitter is further configured to:
  • the first device further includes:
  • a receiver configured to receive a feedback message sent by the intermediate device to indicate that the intermediate device is legal
  • the processor is further configured to:
  • the first encryption key and the corresponding first decryption key for data transmission are negotiated with the intermediate device.
  • an intermediate device comprising a receiver, a processor, and a transmitter, wherein:
  • the receiver is configured to receive a first data transmission message that is sent by the first device and that carries the first data, where the first data is target data that is encrypted by using the first encryption key;
  • the processor is configured to perform decryption processing on the first data based on a first decryption key negotiated by the intermediate device with the first device, obtain the target data, and perform pre-processing on the target data.
  • Data processing performing encryption processing on the data processed target data based on the second encryption key negotiated by the intermediate device and the second device to obtain second data;
  • the transmitter is configured to send, to the second device, a second data packet carrying the second data Lose the message.
  • the first data transmission message further carries a first preset identifier, where the first preset identifier is used to indicate that the middle is allowed
  • the device reads the target data
  • the processor is specifically configured to:
  • the processor determines that the first data identifier is carried in the first data transmission message, the first data is compared based on a first decryption key negotiated by the intermediate device with the first device Performing a decryption process to obtain the target data, and performing preset data processing on the target data;
  • the transmitter is specifically configured to:
  • the receiver is further configured to:
  • the third data is target data encrypted by a third encryption key
  • the transmitter is also used to:
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS packet header; or,
  • the first preset identifier or the second preset identifier is set in a low latency internet transport layer QUIC header based on a user datagram protocol.
  • the receiver is further configured to:
  • the transmitter is also used to:
  • the receiver is further configured to:
  • the transmitter is also used to:
  • the processor is further configured to:
  • a second device comprising a receiver, a processor, wherein:
  • the receiver is configured to receive a second data transmission message that is sent by the intermediate device and that carries the second data, where the second data is data obtained by encrypting the target data processed by the intermediate device data;
  • the processor is configured to perform decryption processing on the second data based on a second decryption key negotiated by the second device with the intermediate device to obtain target data processed by the intermediate device data.
  • the second data transmission message further includes a first preset identifier, where the first preset identifier is used to indicate permission
  • the intermediate device reads the target data
  • the processor is specifically configured to:
  • the processor determines that the second data transmission message carries the first preset identifier
  • the second data is based on a second decryption key negotiated by the second device with the intermediate device. Decryption processing is performed to obtain target data processed by the intermediate device data.
  • the receiver is further configured to:
  • the third data is target data encrypted by a third encryption key
  • the processor is further configured to:
  • the processor determines that the second data identifier carries the second preset identifier, the third decryption key negotiated by the second device with the first device, and the third Data processing Decryption processing to obtain the target data.
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS packet header; or,
  • the first preset identifier or the second preset identifier is set in a low latency internet transport layer QUIC header based on a user datagram protocol.
  • the receiver is further configured to:
  • the processor is further configured to:
  • the second device further includes:
  • a transmitter configured to send, by the intermediate device, a feedback message indicating that the intermediate device is legal, if the intermediate device is legal;
  • the processor is further configured to:
  • the second decryption key and the corresponding second encryption key for data transmission are negotiated with the intermediate device.
  • a first device where the first device includes:
  • the acquiring module is specifically implemented by the processor, and is configured to acquire target data to be transmitted to the second device;
  • the cryptographic module is specifically implemented by the processor, if the target data is data that is allowed to be read by the intermediate device, and the target data is based on the first encryption key negotiated by the first device with the intermediate device. Performing encryption processing to obtain first data;
  • the sending module is specifically implemented by the transmitter, and is configured to send, to the intermediate device, a first data transmission message carrying the first data.
  • the first data transmission message further includes a first preset identifier, where the first preset identifier is used to indicate permission
  • the intermediate device reads the target data.
  • the cryptographic module is further configured to:
  • the target data is data that is not allowed to be read by the intermediate device, based on the first setting And a third encryption key negotiated with the second device, performing encryption processing on the target data to obtain third data;
  • the sending module is further configured to:
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS packet header; or,
  • the first preset identifier or the second preset identifier is set in a low latency internet transport layer QUIC header based on a user datagram protocol.
  • the sending module is further configured to:
  • the first device further includes:
  • a receiving module configured to receive a feedback message sent by the intermediate device to indicate that the intermediate device is legal
  • a negotiation module configured to negotiate, with the intermediate device, the first encryption key and the corresponding first decryption key for data transmission.
  • an intermediate device comprising:
  • the receiving module is specifically implemented by the receiver, and is configured to receive a first data transmission message that is sent by the first device and that carries the first data, where the first data is target data that is encrypted by using the first encryption key;
  • the decryption module is specifically implemented by the processor, configured to decrypt the first data based on the first decryption key negotiated by the intermediate device with the first device, obtain the target data, and obtain the target data Target data is subjected to preset data processing;
  • the encryption module is specifically implemented by the processor, and is configured to perform encryption processing on the target data processed by the data according to the second encryption key negotiated by the intermediate device and the second device to obtain the second data.
  • the sending module is specifically implemented by the transmitter, and configured to send the second device to carry the first The second data transmission message of the second data.
  • the first data transmission message further carries a first preset identifier, where the first preset identifier is used to indicate that the middle is allowed
  • the device reads the target data
  • the decryption module is specifically configured to:
  • the first data is decrypted according to the first decryption key negotiated by the intermediate device and the first device, Obtaining the target data, and performing preset data processing on the target data;
  • the sending module is specifically configured to:
  • the receiving module is further configured to:
  • the third data is target data encrypted by a third encryption key
  • the sending module is further configured to:
  • the third data transmission message is sent to the second device.
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS packet header; or,
  • the first preset identifier or the second preset identifier is set in a low latency internet transport layer QUIC header based on a user datagram protocol.
  • the receiving module is further configured to:
  • the sending module is further configured to:
  • the receiving module is further configured to:
  • the sending module is further configured to:
  • the intermediate device further includes:
  • a negotiation module configured to negotiate the first encryption key and the first decryption key for data transmission with the first device, and negotiate the second for data transmission with the second device The encryption key and the corresponding second decryption key.
  • a second device comprising:
  • the receiving module is specifically implemented by the receiver, and is configured to receive a second data transmission message that is sent by the intermediate device and carries the second data, where the second data is obtained by encrypting the target data processed by the intermediate device data.
  • the data ;
  • the decryption module is specifically implemented by the processor, configured to perform decryption processing on the second data based on a second decryption key negotiated by the second device with the intermediate device, to obtain a target processed by the intermediate device data.
  • the second data transmission message further includes a first preset identifier, where the first preset identifier is used to indicate that the permission is The intermediate device reads the target data;
  • the decryption module is specifically configured to:
  • the receiving module is further configured to:
  • the third data is target data encrypted by a third encryption key
  • the decryption module is further configured to:
  • the target data is obtained.
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS header; or,
  • the first preset identifier or the second preset identifier is set in a low latency internet transport layer QUIC header based on a user datagram protocol.
  • the receiving module is further configured to:
  • the second device further includes:
  • a verification module configured to verify validity of the intermediate device according to device information of the intermediate device
  • a sending module configured to send, by the intermediate device, a feedback message for indicating that the intermediate device is legal, if the intermediate device is legal;
  • a negotiation module configured to negotiate, with the intermediate device, the second decryption key and the corresponding second encryption key for data transmission.
  • a system for transmitting data comprising a first device, an intermediate device, and a second device, wherein:
  • the first device is configured to acquire target data to be transmitted to the second device, and if the target data is data that is allowed to be read by the intermediate device, negotiate with the intermediate device based on the first device a first encryption key, performing encryption processing on the target data to obtain first data, and transmitting, to the intermediate device, a first data transmission message carrying the first data;
  • the intermediate device is configured to receive a first data transmission message that is sent by the first device and that carries the first data, and is based on a first decryption key that is negotiated by the intermediate device with the first device. Decoding the first data to obtain the target data, and performing preset data processing on the target data, based on the second encryption key negotiated by the intermediate device and the second device, on the data processed target The data is encrypted, and the second data is obtained, and the second data transmission message carrying the second data is sent to the second device;
  • the second device is configured to receive a second data transmission message that is sent by the intermediate device and that carries the second data, based on a second decryption key that is negotiated by the second device with the intermediate device, The second data is decrypted to obtain target data processed by the intermediate device.
  • the first device when the first device sends the second device target data to be encrypted, the first device may encrypt the target data by using the first encryption key negotiated by the first device and the intermediate device, and then send the target data.
  • the intermediate device receives the target data encrypted by the first device and is encrypted by the first device, the intermediate device decrypts the first decryption key negotiated by the intermediate device with the first device to obtain the target data, and obtains the target data. Performing preset data processing on the target data.
  • the data processed target data may be encrypted by using the second encryption key negotiated by the intermediate device and the second device, and sent to the second device, where the second device receives
  • the second decryption key negotiated by the second device and the intermediate device may be used for decryption processing to obtain a target device that is processed by the intermediate device.
  • the intermediate device can decrypt the data sent by the first device based on the decryption key negotiated in advance with the first device, and can read the data that the first device is to send to the second device, and further, the target data can be preset. The data is processed so that the intermediate device can work properly.
  • FIG. 1 is a schematic diagram of a system framework provided by an embodiment of the present invention.
  • FIG. 2 is a schematic structural diagram of a first device according to an embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of an intermediate device according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a second device according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of a method for transmitting data according to an embodiment of the present invention.
  • FIG. 6 is a flowchart of a method for negotiating a key according to an embodiment of the present invention.
  • FIG. 7 is a flowchart of a method for transmitting data according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a first device according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of a first device according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of an intermediate device according to an embodiment of the present invention.
  • FIG. 11 is a schematic structural diagram of an intermediate device according to an embodiment of the present invention.
  • FIG. 12 is a schematic structural diagram of a second device according to an embodiment of the present disclosure.
  • FIG. 13 is a schematic structural diagram of a second device according to an embodiment of the present invention.
  • An embodiment of the present invention provides a method for transmitting data, which may be implemented by a first device, an intermediate device, and a second device.
  • the first device and the second device may be any one of a terminal and a server, where the terminal may be a mobile terminal such as a mobile phone or a tablet computer, or may be a PC (Personal Computer), and the server may be connected to the terminal.
  • the server of the communication may be a background server of a service, such as a website server.
  • the first device is a terminal
  • the second device is a server.
  • the following process is that the terminal sends the target data to the server.
  • the first device is a server
  • the second device is a terminal.
  • the intermediate device may be a device in a transmission path for transmitting data between the first device and the second device, where the intermediate device has a preset data processing function, and may perform preset data processing on data transmitted by the first device and the second device. .
  • the target data may be encrypted based on the first encryption key negotiated by the first device and the intermediate device to obtain the first data, and the first device is sent to the intermediate device.
  • a first data transmission message of the data after receiving the first data transmission message that is sent by the first device and carrying the first data, the intermediate device may perform the first data according to the first decryption key negotiated by the intermediate device with the first device.
  • Decrypting to obtain target data and further, performing preset data processing on the target data, and encrypting the target data processed by the intermediate device based on the second encryption key negotiated by the intermediate device and the second device, to obtain the first
  • the second device may be based on the second decryption key negotiated by the intermediate device and the second device, The second data is decrypted, and the target data processed by the intermediate device is obtained.
  • the schematic diagram of the system is shown in FIG. 1 .
  • the second device may also send the target data to the first device, and the processing procedure is the same as the process for the first device to send the target data to the second device.
  • the other cases are similar and will not be elaborated.
  • the first device may include a processor 210, a transmitter 220, a receiver 230, and the receiver 230 and the transmitter 220 may be respectively coupled to the processor 210, as shown in FIG.
  • Receiver 230 can be configured to receive messages or data
  • receiver 230 can include, but is not limited to, at least one amplifier, tuner, one or The plurality of oscillators, couplers, LNAs (Low Noise Amplifiers), duplexers, etc.
  • the transmitter 220 can be used to transmit messages or data, that is, the first data transmission message carrying the first data can be transmitted.
  • the processor 210 may be a control center of the first device, connecting various parts of the entire first device, such as the receiver 230 and the transmitter 220, using various interfaces and lines.
  • the processor 210 may be configured to perform encryption processing on the target data.
  • the processor 210 may include one or more processing units; preferably, the processor 210 may integrate the application processor and the modulation and demodulation processing.
  • the application processor mainly processes an operating system
  • the modem processor mainly processes wireless communication.
  • Processor 210 can also be a digital signal processor, an application specific integrated circuit, a field programmable gate array, or other programmable logic device or the like.
  • the first device may also include a memory usable to store the software program and the module, and the processor 210 performs various functional applications and data processing of the first device by reading the software code and the module stored in the memory.
  • the intermediate device can include a receiver 310, a processor 320, a transmitter 330, and a transmitter 330 and a receiver 310 can be coupled to the processor 320, respectively, as shown in FIG.
  • the transmitter 330 can be configured to transmit a message or data.
  • the transmitter 330 can be configured to transmit a second data transmission message carrying the second data.
  • the transmitter 330 can include, but is not limited to, at least one amplifier, a tuner, and a Or a plurality of oscillators, couplers, LNAs (Low Noise Amplifiers), duplexers, etc., similar to the structure of the transmitter 330, and the receiver 310 may also include but is not limited to an antenna, at least one amplifier, and a tuner.
  • the processor 320 may include one or more processing units; the processor 320 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP Processor, etc.), and the like. Signal processor (DSP), application specific integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device.
  • the program can include program code, the program code including computer operating instructions.
  • the intermediate device can also include a memory that can be used to store software programs and modules, and the processor 320 performs various functional applications and data processing of the intermediate devices by reading software code and modules stored in the memory.
  • the second device can include a receiver 410, a processor 420, a transmitter 430, and the transmitter 430 and the receiver 410 can be coupled to the processor 420, respectively, as shown in FIG.
  • the transmitter 430 can be used to transmit messages or data, and the transmitter 430 can include, but is not limited to, at least one amplifier, a tuner, one or more oscillators, a coupler, an LNA (Low Noise Amplifier), a duplexer. Wait, Similar to the structure of the transmitter 430, the receiver 410 may also include, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a coupler, an LNA (Low Noise Amplifier), a duplexer.
  • the receiver 410 can be configured to receive a second data transmission message that is sent by the intermediate device and carries the second data.
  • the processor 420 may include one or more processing units; the processor 420 may be a general-purpose processor, including a central processing unit (CPU), a network processor (Network Processor, NP for short, etc.; Signal processor (DSP), application specific integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device.
  • the program can include program code, the program code including computer operating instructions.
  • the second device can also include a memory for storing software programs and modules, and the processor 420 executing various functional applications and data processing of the second device by reading the software code and modules stored in the memory.
  • Step 501 The first device acquires target data to be transmitted to the second device.
  • the first device and the second device may be any one of a terminal and a server, the first device may be a terminal, the second device may be a server, and the target data may be service data to be transmitted by the first device.
  • TLS protocol In order to ensure the security of data transmission, more and more servers require data to be transmitted with the terminal to be encrypted, that is, TLS protocol or Quic (Quick UDP (User Datagram Protocol) Internet Connection)
  • Quic Quick UDP (User Datagram Protocol) Internet Connection
  • the UDP-based low-latency Internet transport layer protocol is widely used.
  • the target data to be transmitted can be obtained.
  • Step 502 If the target data is data that is allowed to be read by the intermediate device, the first device performs encryption processing on the target data based on the first encryption key negotiated by the first device and the intermediate device to obtain the first data.
  • the intermediate device may be a device with a preset data processing function, and may be a device in a transmission path when the first device and the second device transmit data.
  • the first device may be pre-stored with the first determining policy, where the first determining policy may be used by the first device to determine whether the target data to be transmitted to the second device allows the intermediate device to read, in the first device.
  • a list of data types that allow data read by the intermediate device may be stored, and/or a list of data types that may not allow data read by the intermediate device may be stored, for example, the first device is a terminal, When the target data is the password input by the user, the intermediate device is not allowed to read. When the data is video, the intermediate device is allowed to read.
  • the first device may also pre-store an encryption key (ie, a first encryption key) negotiated by the first device and the intermediate device, where the first encryption key may be used to perform encryption processing on the target data.
  • the first device may determine whether the target data allows data read by the intermediate device. If the target data is data that is allowed to be read by the intermediate device, the first device may be based on the first encryption key stored in advance. Encrypting the target data to obtain the first data, wherein the first device may further store an encryption algorithm (which may be referred to as a first encryption algorithm), that is, the first device may negotiate with the intermediate device based on the first device. The first encryption key and the first encryption algorithm perform encryption processing on the target data to obtain the first data.
  • an encryption algorithm which may be referred to as a first encryption algorithm
  • Step 503 The first device sends a first data transmission message carrying the first data to the intermediate device.
  • the data transmission message (ie, the first data transmission message) may be sent to the intermediate device, where the first data transmission message may further carry the first data.
  • the first data transmission message further carries a first preset identifier, where the first preset identifier is used to indicate that the intermediate device is allowed to read the target data.
  • the first data transmission message sent by the first device to the intermediate device may also be carried to indicate that the intermediate device is allowed to read the target data.
  • the preset identifier ie, the first preset identifier
  • the first data transmission message may carry the A identifier, that is, when the first data transmission message carries the A identifier, the target data to be transmitted by the first device is Data that is allowed to be read by the intermediate device.
  • the first preset identifier can be integrity protected without encryption processing.
  • the first preset identifier may be set in the TLS header or the QUIC header. Specifically, the first preset identifier is set in the transport layer control TLS header; or the first preset identifier is set on the user datagram.
  • the protocol's low latency Internet transport layer is in the QUIC header.
  • the target data when the first device and the second device transmit the target data, the target data may be transmitted according to the TLS protocol, or the target data may be transmitted based on the QUIC protocol, and the first preset identifier may be set in the TLS header for different situations. Or, set in the QUIC header.
  • the intermediate device receives the first data transmission message that is sent by the first device and carries the first data, where the first data is the target data encrypted by the first encryption key.
  • the intermediate device may receive the first data transmission message sent by the first device, and may parse the The first data, wherein the first data is target data encrypted by the first encryption key.
  • the first data transmission message sent by the first device carries the first preset identifier
  • the first data transmission message received by the intermediate device may further carry the first preset identifier, where the first pre- The flag is used to indicate that the intermediate device is allowed to read the target data.
  • the first device can perform integrity protection processing on the first preset identifier, and does not perform encryption processing, that is, the intermediate device can read the first preset identifier, and cannot change it.
  • the first preset identifier may be set in the TLS header or the QUIC header. Specifically, the first preset identifier is set in the transport layer control TLS header; or the first preset identifier is set on the user datagram.
  • the protocol's low latency Internet transport layer is in the QUIC header.
  • the target data when the first device and the second device transmit the target data, the target data may be transmitted according to the TLS protocol, or the target data may be transmitted based on the QUIC protocol, and the first preset identifier may be set in the TLS header for different situations. Or, set in the QUIC header.
  • Step 504 The intermediate device decrypts the first data based on the first decryption key negotiated by the intermediate device with the first device, obtains target data, and performs preset data processing on the target data.
  • the intermediate device may pre-store a decryption key (ie, a first decryption key) negotiated by the intermediate device with the first device, where the first decryption key may be used for the first data sent by the first device. Decryption processing. After obtaining the first data, the intermediate device may determine whether the target data is data that is allowed to be read by the intermediate device. When the target data is data that is allowed to be read by the intermediate device, the intermediate device may negotiate with the first device based on the pre-stored intermediate device.
  • a decryption key ie, a first decryption key
  • the first decryption key the first data is decrypted and the target data is obtained, wherein the intermediate device may further store a decryption algorithm (which may be referred to as a first decryption algorithm), that is, the intermediate device may be based on the first device.
  • the first decryption key negotiated with the intermediate device and the first decryption algorithm decrypt the first data to obtain target data.
  • the intermediate device may perform preset data processing on the obtained target data according to the data processing function that the intermediate device has.
  • the intermediate device may have a preset data processing function, wherein the preset data processing function It can be a statistical data function.
  • the intermediate device can read the target data of the first device to be transmitted to the second device, so as to perform statistics without changing the target data, and the preset data processing function may also be video optimization.
  • the intermediate device can read the target data of the first device to be transmitted to the second device, and change the target data based on the preset data processing function, for example, the first device is a server, and the video optimization function is The HD video data is changed to standard definition video data.
  • the intermediate device can read the high-definition video data (ie, target data) sent by the server to the terminal, and further, the target data can be changed to the standard definition video data. That is to say, after the intermediate device performs preset data processing on the target data, the obtained data may be the same as or different from the target data.
  • the process of step 504 may be as follows: when the intermediate device determines that the first data identifier is carried in the first data transmission message, the middle The device decrypts the first data based on the first decryption key negotiated by the intermediate device with the first device, obtains target data, and performs preset data processing on the target data.
  • the intermediate device may determine whether the first data transmission message carries the first preset identifier, and when the intermediate device determines that the first data transmission message carries the first preset identifier, The first data may be processed according to the processing procedure described in the foregoing step 504, that is, the first data is decrypted according to the first decryption key negotiated by the intermediate device with the first device, the target data is obtained, and the target data is obtained. Preset data processing.
  • Step 505 The intermediate device performs encryption processing on the target data processed by the data according to the second encryption key negotiated by the intermediate device and the second device to obtain the second data.
  • an intermediate device may pre-store an encryption key (ie, a second encryption key) negotiated by the intermediate device with the second device, where the second encryption key may be used to encrypt the data processed target data. deal with.
  • the second encryption key stored in advance may be acquired, and the target data processed by the data is encrypted according to the second encryption key to obtain second data, where
  • An encryption algorithm (which may be referred to as a second encryption algorithm) may also be pre-stored in the device, that is, the intermediate device may perform the data processing target based on the second encryption key and the second encryption algorithm negotiated by the intermediate device with the second device. The data is encrypted to obtain the second data.
  • Step 506 The intermediate device sends a second data transmission message carrying the second data to the second device.
  • the data transmission message (ie, the second data transmission message) may be sent to the second device, where the second data transmission message may carry the second data.
  • the processing of step 507 may be as follows: the intermediate device sends, to the second device, the second data that carries the second data and the first preset identifier. Data transfer message.
  • the second data transmission message sent by the intermediate device to the second device may also carry the first preset identifier, that is, the second data transmission message.
  • the second data and the first preset identifier are carried in the middle.
  • the second device receives the second data transmission that is sent by the intermediate device and carries the second data.
  • Information wherein the second data is data obtained by encrypting the target data processed by the intermediate device data.
  • the second device may receive the second data transmission message sent by the intermediate device, and parse the information to obtain the The second data, wherein the second data is the target data processed by the intermediate device data, and then the data encrypted by the second encryption key.
  • the second data transmission message sent by the intermediate device carries the first preset identifier
  • the second data transmission message received by the second device may further carry the first preset identifier, where A preset identifier is used to indicate that the intermediate device is allowed to read the target data.
  • the first preset identifier may be set in the TLS header or the QUIC header. Specifically, the first preset identifier is set in the transport layer control TLS header; or the first preset identifier is set on the user datagram.
  • the protocol's low latency Internet transport layer is in the QUIC header.
  • the target data when the first device and the second device transmit the target data, the target data may be transmitted according to the TLS protocol, or the target data may be transmitted based on the QUIC protocol, and the first preset identifier may be set in the TLS header for different situations. Or, set in the QUIC header.
  • Step 507 The second device decrypts the second data based on the second decryption key negotiated by the second device with the intermediate device, to obtain target data processed by the intermediate device.
  • a decryption key (ie, a second decryption key) negotiated by the second device with the intermediate device may be pre-stored in the second device, where the second decryption key may be used for the second data sent by the intermediate device. Decryption processing. After receiving the second data, the second device may determine whether the target data is data that is allowed to be read by the intermediate device, that is, determine whether the second data is an intermediate device that performs predetermined data processing on the target data, and encrypts the data.
  • the second data when the second device determines that the target data is data that is allowed to be read by the intermediate device, the second data may be decrypted based on the second decryption key to obtain target data processed by the intermediate device, wherein the second device
  • the obtained data may be consistent with the target data, or may be inconsistent with the target data, and whether it is the same depends on whether the data processing of the target data by the intermediate device changes the target data.
  • the second device may further store a decryption algorithm (which may be referred to as a second decryption algorithm), that is, after the second device acquires the second data, the second decryption key negotiated with the intermediate device by the second device may be used. And the second decryption algorithm, the second data is decrypted, and the target data processed by the intermediate device is obtained.
  • the processing of step 507 may be as follows: when the second device determines that the second data transmission message carries the first When a preset identifier is used, the second device decrypts the second data based on the second decryption key negotiated by the second device with the intermediate device to obtain target data processed by the intermediate device.
  • the second device may determine whether the second data transmission message carries the first preset identifier, and when the second device determines that the second data transmission message carries the first preset
  • the identifier is determined, that is, when the second data carried in the second data transmission message is determined to be the data obtained by the intermediate device data processing
  • the second data is processed according to the processing procedure described in step 507 above. That is, based on the second decryption key negotiated by the second device and the intermediate device, the second data is decrypted to obtain target data processed by the intermediate device.
  • the first device, the intermediate device, and the second device may negotiate the foregoing key before the target data is transmitted.
  • a method for negotiating a key is also provided, as shown in FIG.
  • the device and the second device can apply the method to negotiate the encryption key and the decryption key described above.
  • Step 601 The first device sends a verification indication message to the intermediate device, where the verification indication message is used to instruct the intermediate device to send a verification request for verifying the legality of the intermediate device to the second device.
  • the data when the first device and the second device transmit data, the data may be transmitted based on the TLS protocol, or may be transmitted based on the QUIC protocol.
  • the first device and the second device may establish a TCP (Transmission Control Protocol) connection before the data is transmitted, that is, the first device performs a TCP three-way handshake with the second device, and then, Establishing a TLS connection, wherein the process of establishing a TLS connection is a process in which the first device negotiates a key with the second device, that is, negotiates a third encryption key for data transmission and a corresponding third involved in the following processing. Decrypt the key.
  • the first device and the second device may establish a QUIC connection before transmitting data.
  • the first device may send a verification indication message to the intermediate device, where the verification indication message may be used to instruct the intermediate device to send the verification for verifying the legality of the intermediate device to the second device.
  • the verification indication message may be sent during the TLS establishment process, or may be transmitted for the QUIC-based transmission target after the TLS connection is established.
  • the verification indication message may be in the process of establishing the QUIC connection, or may be limited in the embodiment of the present invention after the QUIC connection is established.
  • the first device may be pre-configured with an intermediate device Device information, where the device information of the intermediate device may be the device identifier of the intermediate device (may be the device name of the intermediate device, or the MAC address of the intermediate device, or the IP address of the intermediate device)
  • the data processing function information (which may be text information indicating the data processing function of the intermediate device) and the certificate.
  • the device information of the intermediate device may be carried in the verification indication message.
  • the device information of the intermediate device may not be pre-configured in the first device, which is not limited in the embodiment of the present invention.
  • the verification indication message sent by the first device may be transmitted in a clear text manner.
  • the intermediate device receives the verification indication message sent by the first device.
  • the intermediate device may receive the verification indication message sent by the first device, where the intermediate device receives the verification indication, where the verification indication message carries the device information of the intermediate device. After the message is received, it can be parsed to obtain the device information of the intermediate device carried in it.
  • Step 602 The intermediate device sends, to the second device, an authentication request that carries device information of the intermediate device.
  • the intermediate device may obtain the device information of the intermediate device carried in the verification indication message, and The second device sends a verification request carrying the device information of the intermediate device.
  • the intermediate device may obtain the localization information after receiving the verification indication message sent by the first device. Pre-stored device information of the intermediate device, and send a verification request carrying the device information of the intermediate device to the second device.
  • the verification request sent by the intermediate device can be transmitted in plain text.
  • the second device receives the verification request of the device information carrying the intermediate device sent by the intermediate device.
  • the second device may receive the verification request sent by the intermediate device, and parse the device to obtain the device information of the intermediate device carried therein.
  • Step 603 The second device verifies the legality of the intermediate device according to the device information of the intermediate device.
  • the second device may verify the legality of the intermediate device according to the preset processing policy. Specifically, after acquiring the device information of the intermediate device, the second device acquires the device identifier and data processing function information of the intermediate device (which may be text information indicating a data processing function of the intermediate device) and a certificate, where the certificate is By specific organization
  • the device may be obtained by encrypting the data processing function information of the intermediate device based on the private key by the specific organization, and the second device may obtain the public key of the corresponding intermediate device, and decrypt the certificate based on the obtained public key, if If the data processing function information obtained by the decryption is the same as the data processing function information carried in the verification request, the second device may determine that the intermediate device is legal.
  • the second device may further store an operation that the second device allows the intermediate device to perform.
  • the second device allows the operation performed by the intermediate device to verify the legality of the intermediate device, for example, the intermediate device.
  • the data processing function is optimized for the video. If the second device pre-stores the data processing of the transmitted data by the intermediate device that allows the video optimization function, the data processing function carried in the decrypted data processing function information and the verification request On the basis of the same information, the second device may determine that the intermediate device is legal.
  • the second device does not pre-store the intermediate device that does not allow the video optimization function to perform data processing on the transmitted data, even if the decrypted data processing function information is The data processing function information carried in the verification request is the same, and the second device also determines that the intermediate device is invalid.
  • Step 604 If the intermediate device is legal, the second device sends, by using the intermediate device, a feedback message indicating that the intermediate device is legal to the first device.
  • the second device may send, by using the intermediate device, a feedback message corresponding to the verification request sent by the intermediate device to the first device, where the feedback is The message can be used to indicate that the intermediate device is legitimate.
  • the second device may send a feedback message corresponding to the verification request sent by the intermediate device to the intermediate device, where the feedback message may carry the device identifier of the legal intermediate device.
  • the second device can perform integrity protection processing on the feedback message.
  • Step 605 The intermediate device receives a feedback message sent by the second device to indicate that the intermediate device is legal, and sends a feedback message sent by the second device to indicate that the intermediate device is legal.
  • the intermediate device may receive the feedback message sent by the second device, where the feedback message may be used to indicate that the intermediate device is legal, and, in turn, may send the second device to the first device. A feedback message sent by the device to indicate that the intermediate device is legitimate.
  • the first device receives a feedback message sent by the intermediate device to indicate that the intermediate device is legal.
  • the first device may receive the feedback message.
  • the first device may send an acknowledgement message corresponding to the feedback message to the second device by using the intermediate device, so as to notify the second device that the first device has received the indication for the intermediate device. Prepare legal feedback messages.
  • Step 606 The intermediate device negotiates a first encryption key and a first decryption key for data transmission with the first device, and negotiates, with the second device, a second encryption key for data transmission and a corresponding second decryption key. key.
  • the first device, the intermediate device, and the second device may negotiate the encryption key and the decryption key mentioned above, that is, on the basis of the legality of the intermediate device, the first device, the intermediate device, and The second device can negotiate the encryption key and the decryption key mentioned above.
  • the intermediate device may negotiate a first encryption key and a first decryption key for data transmission with the first device, and negotiate a second encryption key and a corresponding second decryption for data transmission with the second device.
  • the intermediate device when the intermediate device negotiates the first encryption key and the corresponding first decryption key for data transmission with the first device, the first device may be initiated by the first device, or may be initiated by the intermediate device, and the intermediate device and the first device
  • the second device negotiates the second encryption key and the corresponding second decryption key for data transmission, it may be initiated by the second device or may be initiated by the intermediate device, which is not limited by the embodiment of the present invention.
  • the intermediate device may further negotiate the first encryption algorithm and the first decryption algorithm with the first device, and negotiate the second encryption algorithm and the corresponding second decryption algorithm with the second device.
  • the first device, the intermediate device, and the second device may also negotiate an encryption key and a decryption key required when the second device sends data to the first device through the intermediate device.
  • first encryption key and the second encryption key may be the same or different, and the first decryption key and the second decryption key may be the same or different.
  • the embodiments of the present invention are not limited thereto.
  • a method for transmitting data is also provided, as shown in FIG. 7.
  • Step 701 The first device acquires target data to be transmitted to the second device.
  • TLS protocol In order to ensure the security of data transmission, more and more servers require data to be transmitted with the terminal to be encrypted, that is, TLS protocol or Quic (Quick UDP (User Datagram Protocol) Internet Connection)
  • Quic Quick UDP (User Datagram Protocol) Internet Connection
  • the UDP-based low-latency Internet transport layer protocol is widely used.
  • the target data to be transmitted can be obtained.
  • Step 702 If the target data is data that is not allowed to be read by the intermediate device, the first device is based on The third encryption key negotiateed by the first device and the second device performs encryption processing on the target data to obtain third data.
  • the first device may be pre-stored with the first determining policy, where the first determining policy may be used by the first device to determine whether the target data to be transmitted to the second device allows the intermediate device to read, in the first device.
  • a list of data types that allow data read by the intermediate device may be stored, and/or a list of data types that may not be read by the intermediate device may be stored, for example, when the first device is a terminal and the target data is a password input by the user.
  • the intermediate device is not allowed to read.
  • the first device may also pre-store an encryption key (ie, a third encryption key) negotiated by the first device and the second device, where the third encryption key may be used to perform encryption processing on the target data.
  • the first device may determine whether the target data allows data read by the intermediate device. If the target data is data that is not allowed to be read by the intermediate device, the first device may be based on the third encryption key stored in advance. Encrypting the target data to obtain the third data, wherein the first device may further store an encryption algorithm (which may be referred to as a third encryption algorithm), that is, the first device may be based on the first device and the second device. The negotiated third encryption key and the third encryption algorithm encrypt the target data to obtain the third data.
  • an encryption algorithm which may be referred to as a third encryption algorithm
  • Step 703 The first device sends a third data transmission message carrying the third data and the second preset identifier to the intermediate device, where the second preset identifier is used to indicate that the intermediate device is not allowed to read the target data.
  • the first data transmission message carries the first preset identifier
  • the first device determines that the target data is not allowed to be read by the intermediate device
  • the third data transmission message carrying the third data and the second preset identifier may be sent to the intermediate device, where the second preset identifier may be used to indicate that the intermediate device is not allowed to read the target data.
  • the first device may perform integrity protection processing on the second preset identifier.
  • the second preset identifier may be set in the TLS header or the QUIC header. Specifically, the second preset identifier is set in the transport layer control TLS header; or the second preset identifier is set based on the user datagram.
  • the protocol's low latency Internet transport layer is in the QUIC header.
  • the target data when the first device and the second device transmit the target data, the target data may be transmitted according to the TLS protocol, or the target data may be transmitted based on the QUIC protocol, and the second preset identifier may be set in the TLS header for different situations. Or, set in the QUIC header.
  • the intermediate device receives the third data transmission message that is sent by the first device and carries the third data and the second preset identifier, where the second preset identifier is used to indicate that the intermediate device is not allowed to read the target number.
  • the third data the target data encrypted by the third encryption key.
  • the intermediate device may receive the third data transmission message sent by the first device, and parse the third data transmission message. And acquiring the third data and the second preset identifier carried therein, wherein the third data is the target data encrypted by the third encryption key.
  • Step 704 When the intermediate device determines that the third data transmission message carries the second preset identifier, the intermediate device sends the third data transmission message to the second device.
  • the intermediate device may determine whether the second data transmission message carries the second preset identifier, where the intermediate device determines that the third data transmission message carries the second preset identifier. That is, when the target data is data that is not allowed to be read by the intermediate device, the intermediate device may forward the third data transmission message to the second device without performing any processing on the third data.
  • the second preset identifier may be set in the TLS header or the QUIC header. Specifically, the second preset identifier is set in the transport layer control TLS header; or the second preset identifier is set based on the user datagram.
  • the protocol's low latency Internet transport layer is in the QUIC header.
  • the target data when the first device and the second device transmit the target data, the target data may be transmitted according to the TLS protocol, or the target data may be transmitted based on the QUIC protocol, and the second preset identifier may be set in the TLS header for different situations. Or, set in the QUIC header.
  • the second device receives the third data transmission message that is sent by the intermediate device and carries the third data and the second preset identifier, where the second preset identifier is used to indicate that the intermediate device is not allowed to read the target data, and the third The data is target data encrypted by a third encryption key.
  • the second device may receive the third data transmission message sent by the intermediate device, and parse the third data transmission message And acquiring the third data and the second preset identifier carried therein, wherein the third data is the target data encrypted by the third encryption key.
  • the second preset identifier may be set in the TLS header or the QUIC header. Specifically, the second preset identifier is set in the transport layer control TLS header; or the second preset identifier is set based on the user datagram.
  • the protocol's low latency Internet transport layer is in the QUIC header.
  • the target data when the first device and the second device transmit the target data, the target data may be transmitted according to the TLS protocol, or the target data may be transmitted based on the QUIC protocol, and the second preset identifier may be set in the TLS header for different situations. Or, set in the QUIC header.
  • Step 705 when the second device determines that the third data transmission message carries the second preset identifier, The second device decrypts the third data based on the third decryption key negotiated by the second device with the first device to obtain target data.
  • a decryption key (ie, a third decryption key) negotiated by the second device with the first device may be pre-stored in the second device, where the third decryption key may be used to pass the intermediate device to the first device.
  • the transmitted third data is decrypted.
  • the second device may determine whether the second data transmission message carries the second preset identifier, and when the second device determines that the third data transmission message carries the second preset identifier, Determining that the third data carried in the third data transmission message is data obtained by the first device encrypting the target data based on the third encryption key, and when the intermediate device does not perform any processing on the target data, the second device may be based on the second The third decryption key negotiated by the device with the first device decrypts the third data to obtain target data.
  • the second device may further store a decryption algorithm (which may be referred to as a third decryption algorithm), that is, when the second device determines that the third data transmission message carries the second preset identifier, the second device may be based on The third decryption key and the third decryption algorithm negotiated by the second device with the first device perform decryption processing on the third data to obtain target data.
  • a decryption algorithm which may be referred to as a third decryption algorithm
  • the first device when the first device sends the second device target data to be encrypted, the first device may encrypt the target data by using the first encryption key negotiated by the first device and the intermediate device, and then send the target data.
  • the intermediate device receives the target data encrypted by the first device and is encrypted by the first device, the intermediate device decrypts the first decryption key negotiated by the intermediate device with the first device to obtain the target data, and obtains the target data. Performing preset data processing on the target data.
  • the data processed target data may be encrypted by using the second encryption key negotiated by the intermediate device and the second device, and sent to the second device, where the second device receives
  • the second decryption key negotiated by the second device and the intermediate device may be used for decryption processing to obtain a target device that is processed by the intermediate device.
  • the intermediate device can decrypt the data sent by the first device based on the decryption key negotiated in advance with the first device, and can read the data that the first device is to send to the second device, and further, the target data can be preset. The data is processed so that the intermediate device can work properly.
  • the embodiment of the present invention further provides a first device.
  • the first device provided in this embodiment can implement the processes of the embodiments shown in FIG. 5, FIG. 6, and FIG.
  • the first device includes a processor 210 and a transmitter 220, wherein:
  • the processor 210 is configured to acquire target data to be transmitted to the second device, if the target The data is the data that is allowed to be read by the intermediate device, and the target data is encrypted according to the first encryption key negotiated by the first device and the intermediate device to obtain the first data;
  • the transmitter 220 is configured to send, to the intermediate device, a first data transmission message that carries the first data.
  • the first device and the second device may be any one of a terminal and a server, the first device may be a terminal, the second device may be a server, and the target data may be service data to be transmitted by the first device.
  • the intermediate device may be a device having a preset data processing function, and may be a device in a transmission path when the first device and the second device transmit data.
  • the processor 210 can acquire the target data to be transmitted.
  • the first device may be pre-stored with a first determining policy, where the first determining policy may be used by the first device to determine whether the target data to be transmitted to the second device allows the intermediate device to read, and the first device may store the permission. a list of data types of data read by the intermediate device, and/or a list of data types of data that is not allowed to be read by the intermediate device. For example, when the first device is a terminal and the target data is a password input by the user, the middle is not allowed. The device reads, and when the data is video, the intermediate device is allowed to read.
  • the first device may also pre-store an encryption key (ie, a first encryption key) negotiated by the first device and the intermediate device, where the first encryption key may be used to perform encryption processing on the target data.
  • the processor 210 may determine whether the target data allows data read by the intermediate device. If the target data is data that is allowed to be read by the intermediate device, the processor 210 may be based on the first encryption key stored in advance. Encrypting the target data to obtain the first data, wherein the first device may further store an encryption algorithm (which may be referred to as a first encryption algorithm), that is, the processor 210 may negotiate with the intermediate device based on the first device. The first encryption key and the first encryption algorithm perform encryption processing on the target data to obtain the first data.
  • an encryption algorithm which may be referred to as a first encryption algorithm
  • the transmitter 220 may send a data transmission message (ie, a first data transmission message) to the intermediate device, where the first data transmission message may further carry the first data.
  • a data transmission message ie, a first data transmission message
  • the first data transmission message further carries a first preset identifier, where the first preset identifier is used to indicate that the intermediate device is allowed to read the target data.
  • the first data transmission message sent by the transmitter 220 to the intermediate device may also carry a preset for indicating that the intermediate device is allowed to read the target data.
  • the identifier ie, the first preset identifier
  • the first data transmission message may carry the A identifier, that is, when the first data transmission message carries the A identifier, the target data to be transmitted by the first device is the allowed intermediate device. Read data.
  • the first preset identifier can be integrity protected without encryption processing.
  • processor 210 is further configured to:
  • the target data is data that is not allowed to be read by the intermediate device, encrypting the target data based on a third encryption key negotiated by the first device and the second device to obtain a third data;
  • the transmitter 220 is further configured to:
  • the first device may be pre-stored with the first determining policy, where the first determining policy may be used by the first device to determine whether the target data to be transmitted to the second device allows the intermediate device to read, in the first device.
  • a list of data types that allow data read by the intermediate device may be stored, and/or a list of data types that may not be read by the intermediate device may be stored, for example, when the first device is a terminal and the target data is a password input by the user.
  • the intermediate device is not allowed to read.
  • the first device may also pre-store an encryption key (ie, a third encryption key) negotiated by the first device and the second device, where the third encryption key may be used to perform encryption processing on the target data.
  • the processor 210 may determine whether the target data allows data read by the intermediate device. If the target data is data that is not allowed to be read by the intermediate device, the processor 210 may be based on the third encryption key stored in advance. Encrypting the target data to obtain the third data, wherein the first device may further store an encryption algorithm (which may be referred to as a third encryption algorithm), that is, the processor 210 may be based on the first device and the second device. The negotiated third encryption key and the third encryption algorithm encrypt the target data to obtain the third data.
  • an encryption algorithm which may be referred to as a third encryption algorithm
  • the first data transmission message carries the first preset identifier
  • the transmitter transmits
  • the device 220 may send the third data and the second preset identifier to the intermediate device.
  • the third data transmission message wherein the second preset identifier is used to indicate that the intermediate device is not allowed to read the target data.
  • the first device may perform integrity protection processing on the second preset identifier.
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS header;
  • the first preset identifier or the second preset identifier is set in a low latency internet transport layer QUIC header based on a user datagram protocol.
  • the target data when the first device and the second device transmit the target data, the target data may be transmitted according to the TLS protocol, or the target data may be transmitted based on the QUIC protocol, and the first preset identifier or the second preset identifier may be respectively used for different situations. Can be set in the TLS header, or set in the QUIC header.
  • the transmitter 220 is further configured to:
  • the first device further includes:
  • the receiver 230 is configured to receive a feedback message sent by the intermediate device to indicate that the intermediate device is legal;
  • the processor 210 is further configured to:
  • the first encryption key and the corresponding first decryption key for data transmission are negotiated with the intermediate device.
  • the data when the first device and the second device transmit data, the data may be transmitted based on the TLS protocol, or may be transmitted based on the QUIC protocol.
  • the first device and the second device may establish a TCP (Transmission Control Protocol) connection before the data is transmitted, that is, the first device performs a TCP three-way handshake with the second device, and then, Establishing a TLS connection, wherein the process of establishing a TLS connection is a process in which the first device negotiates a key with the second device, that is, negotiates a third encryption key for data transmission and a corresponding third involved in the following processing. Decrypt the key.
  • the first device and the second device may establish a QUIC connection before transmitting data.
  • the transmitter 220 may send a verification indication message to the intermediate device, where the verification indication message may be used to instruct the intermediate device to send the verification for verifying the legality of the intermediate device to the second device.
  • the verification indication message may be sent during the TLS establishment process, or may be transmitted for the QUIC-based transmission target after the TLS connection is established.
  • the verification indication message may be in the process of establishing a QUIC connection, or may be limited in the embodiment of the present invention after the QUIC connection is established.
  • the device information of the intermediate device may be preset in the first device, where the device information of the intermediate device may be the device identifier of the intermediate device (may be the device name of the intermediate device, or may be the MAC address of the intermediate device, or The IP (Internet Protocol) address of the intermediate device, the data processing function information (which may be text information indicating the data processing function of the intermediate device), and the certificate.
  • the verification indication message may carry the intermediate device.
  • the device information of the intermediate device may not be pre-configured in the first device, which is not limited in the embodiment of the present invention.
  • the verification indication message sent by the first device may be transmitted in a clear text manner.
  • the intermediate device may send an authentication request for verifying the legality of the intermediate device to the second device.
  • the device may send the device to the first device through the intermediate device.
  • the receiver 230 may receive a feedback message sent by the intermediate device to indicate that the intermediate device is legal, and the processor 210 may negotiate with the intermediate device for the first encryption key and the corresponding data for data transmission. The first decryption key.
  • the embodiment of the present invention further provides an intermediate device.
  • the intermediate device provided in this embodiment can implement the processes of the embodiments shown in FIG. 5, FIG. 6, and FIG.
  • the intermediate device includes a receiver 310, a processor 320, and a transmitter 330, wherein:
  • the receiver 310 is configured to receive, by the first device, a first data transmission message that carries the first data, where the first data is target data that is encrypted by using the first encryption key;
  • the processor 320 is configured to perform decryption processing on the first data based on a first decryption key negotiated by the intermediate device with the first device, obtain the target data, and perform the target data. Pre-determined data processing; performing encryption processing on the data-processed target data based on the second encryption key negotiated by the intermediate device and the second device to obtain second data;
  • the transmitter 330 is configured to send, to the second device, a second data transmission message that carries the second data.
  • the receiver 310 may receive the first data transmission message sent by the first device, and the processor 320 may parse the first data.
  • the first data is target data encrypted by the first encryption key.
  • the decryption key (ie, the first decryption key) negotiated by the intermediate device with the first device may be pre-stored in the intermediate device, where the first decryption key may be used to solve the first data sent by the first device. Dense processing. After the processor 320 obtains the first data, it may be determined whether the target data is data that is allowed to be read by the intermediate device.
  • the processor 320 may be based on the pre-stored intermediate device and the first The first decryption key negotiated by the device, the first data is decrypted to obtain the target data, wherein the intermediate device may further store a decryption algorithm (which may be referred to as a first decryption algorithm), that is, the processor 320 may be based on The first decryption key negotiated by the first device and the intermediate device and the first decryption algorithm perform decryption processing on the first data to obtain target data.
  • a decryption algorithm which may be referred to as a first decryption algorithm
  • the processor 320 may perform preset data processing on the obtained target data according to the data processing function that the processor 320 has.
  • the intermediate device may have a preset data processing function, wherein the preset data processing The function may be a statistical data function.
  • the processor 320 may read the target data of the first device to be transmitted to the second device, so as to perform statistics without changing the target data, and the preset data processing function may also be The video optimization function, in this case, the processor 320 can read the target data of the first device to be transmitted to the second device, and change the target data based on the preset data processing function, for example, the first device is a server,
  • the video optimization function is to change the high-definition video data into standard definition video data.
  • the processor 320 can read the high-definition video data (ie, target data) sent by the server to the terminal, and further, the target data can be changed to the standard definition video data. . That is to say, after the processor 320 performs preset data processing on the target data, the obtained data may be the same as or different from the target data.
  • An encryption key (ie, a second encryption key) negotiated between the intermediate device and the second device may be pre-stored in the intermediate device, where the second encryption key may be used to perform encryption processing on the data processed target data.
  • the processor 320 may obtain a second encryption key that is stored in advance, and perform encryption processing on the data processed target data based on the second encryption key to obtain the second data, where
  • An encryption algorithm (which may be referred to as a second encryption algorithm) may also be pre-stored in the intermediate device, that is, the processor 320 may process the data based on the second encryption key and the second encryption algorithm negotiated by the intermediate device with the second device.
  • the target data is encrypted to obtain the second data.
  • the transmitter 330 may send a data transmission message (ie, a second data transmission message) to the second device, where the second data transmission message may carry the second data.
  • the first data transmission message further includes a first preset identifier, where the first preset identifier is used to indicate that the intermediate device is allowed to read the target data.
  • the processor 320 is specifically configured to:
  • the processor determines that the first data identifier is carried in the first data transmission message, Decrypting the first data based on the first decryption key negotiated by the intermediate device with the first device, obtaining the target data, and performing preset data processing on the target data;
  • the transmitter 330 is specifically configured to:
  • the processor 320 may determine whether the first data transmission message carries the first preset identifier, and when determining that the first data transmission message carries the first preset At the time of the identification, the processor 320 may process the first data according to the processing procedure described in the above step 504, that is, decrypt the first data based on the first decryption key negotiated by the intermediate device with the first device, to obtain target data. Pre-set data processing of target data.
  • the second data transmission message sent by the transmitter 330 to the second device may also carry the first preset identifier, that is, the second data transmission message carries The second data and the first preset identifier.
  • the receiver 310 is further configured to:
  • the third data is target data encrypted by a third encryption key
  • the transmitter 330 is further configured to:
  • the receiver 310 may receive the third data transmission message sent by the first device, where the processor 320 may The third data and the second preset identifier carried therein are obtained, where the third data is target data encrypted by the third encryption key. After receiving the third data transmission message, the receiver 310 may determine whether the second data transmission message carries the second preset identifier, and when determining that the third data transmission message carries the second preset identifier, that is, when the target data is In order to prevent data read by the intermediate device, the transmitter 330 may forward the third data transmission message to the second device without performing any processing on the third data.
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS header;
  • the delay internet transport layer is in the QUIC header.
  • the receiver 310 is further configured to:
  • the transmitter 330 is further configured to:
  • the receiver 310 is further configured to:
  • the transmitter 330 is further configured to:
  • the processor 320 is further configured to:
  • the receiver 310 may receive the verification indication message sent by the first device, where the receiver 310 receives the device information of the intermediate device in the verification indication message.
  • the processor 320 can parse the device information of the intermediate device carried therein.
  • the processor 310 may obtain the device information of the intermediate device carried in the verification indication message, and the transmitter 330 is received by the receiver 310.
  • the verification request carrying the device information of the intermediate device may be sent to the second device.
  • the processor 320 After the receiver 310 receives the verification indication message sent by the first device, the processor 320 The device information of the intermediate device pre-stored in the local device may be acquired, and the transmitter 330 transmits a verification request carrying the device information of the intermediate device to the second device.
  • the verification request sent by the intermediate device can be transmitted in plain text.
  • the second device can verify the legality of the intermediate device.
  • the second device can send a feedback message to the intermediate device to indicate that the intermediate device is legal.
  • the receiver 310 can receive the feedback message.
  • the feedback message sent by the second device is used to indicate that the intermediate device is legal.
  • the transmitter 330 may send, to the first device, a feedback message sent by the second device to indicate that the intermediate device is legal.
  • the device negotiates a first encryption key for data transmission and First decrypting the key and negotiating with the second device a second encryption key for data transmission and a corresponding second decryption key.
  • the embodiment of the present invention further provides a second device.
  • the second device provided in this embodiment can implement the embodiments shown in FIG. 5, FIG. 6, and FIG.
  • the second device includes a receiver 410 and a processor 420, where:
  • the receiver 410 is configured to receive a second data transmission message that is sent by the intermediate device and that carries the second data, where the second data is data obtained by encrypting the target data processed by the intermediate device data.
  • the processor 420 is configured to perform decryption processing on the second data based on a second decryption key negotiated by the second device with the intermediate device to obtain target data processed by the intermediate device.
  • the receiver 410 may receive the second data transmission message sent by the intermediate device, and the processor 420 may parse the data transmission message.
  • the second data carried, wherein the second data is the target data processed by the intermediate device data, and then the data encrypted by the second encryption key.
  • the decryption key (ie, the second decryption key) negotiated by the second device with the intermediate device may be pre-stored in the second device, where the second decryption key may be used to decrypt the second data sent by the intermediate device.
  • the processor 420 may determine whether the target data is data that is allowed to be read by the intermediate device, that is, whether the second data is an intermediate device that performs preset data processing on the target data, and Performing the encrypted data, when determining that the target data is data that is allowed to be read by the intermediate device, the second data may be decrypted based on the second decryption key to obtain target data processed by the intermediate device, wherein the second device
  • the obtained data may be consistent with the target data, or may be inconsistent with the target data, and whether it is the same depends on whether the data processing of the target data by the intermediate device changes the target data.
  • the second device may further store a decryption algorithm (which may be referred to as a second decryption algorithm), that is, after the second data is acquired by the processor 420, the second decryption key negotiated with the intermediate device by the second device may be used. And the second decryption algorithm, the second data is decrypted, and the target data processed by the intermediate device is obtained.
  • a decryption algorithm which may be referred to as a second decryption algorithm
  • the second data transmission message further includes a first preset identifier, where the first preset identifier is used to indicate that the intermediate device is allowed to read the target data.
  • the processor 420 is specifically configured to:
  • the processor determines that the second data transmission message carries the first preset identifier
  • the second data is based on a second decryption key negotiated by the second device with the intermediate device. Decryption processing is performed to obtain target data processed by the intermediate device data.
  • the processor 420 may determine whether the second data transmission message carries the first preset identifier, and when determining that the second data transmission message carries the first preset
  • the identifier is determined, that is, when the second data carried in the second data transmission message is determined to be the data obtained by the intermediate device data processing
  • the second data is processed according to the processing procedure described in step 507 above. That is, based on the second decryption key negotiated by the second device and the intermediate device, the second data is decrypted to obtain target data processed by the intermediate device.
  • the receiver 410 is further configured to:
  • the third data is target data encrypted by a third encryption key
  • the processor 420 is further configured to:
  • the processor determines that the second data identifier carries the second preset identifier, the third decryption key negotiated by the second device with the first device, and the third The data is decrypted to obtain the target data.
  • the receiver 410 may receive the third data transmission message sent by the intermediate device, where the processor 420 may It performs parsing to obtain the third data and the second preset identifier carried therein, wherein the third data is the target data encrypted by the third encryption key.
  • the decryption key ie, the third decryption key
  • the decryption key negotiated by the second device with the first device may be pre-stored in the second device, where the third decryption key may be used to send the third device to the third device through the intermediate device.
  • the data is decrypted.
  • the processor 410 may determine whether the second data transmission message carries the second preset identifier, and when determining that the third data transmission message carries the second preset identifier, Determining that the third data carried in the third data transmission message is data obtained by the first device encrypting the target data based on the third encryption key, and the intermediate device does not perform any processing on the target data, the processor 420 may be based on the second The third decryption key negotiated by the device with the first device decrypts the third data to obtain target data.
  • the second device may further store a decryption algorithm (which may be referred to as a third decryption algorithm), that is, when determining that the third data transmission message carries the second preset identifier, the processor 420 may be based on the second device.
  • a third decryption key and a third decryption negotiated with the first device The algorithm performs decryption processing on the third data to obtain target data.
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS header;
  • the first preset identifier or the second preset identifier is set in a low latency internet transport layer QUIC header based on a user datagram protocol.
  • the receiver 410 is further configured to:
  • the processor 420 is further configured to:
  • the second device further includes:
  • a transmitter 430 configured to send, by the intermediate device, a feedback message for indicating that the intermediate device is legal, if the intermediate device is legal;
  • the processor 420 is further configured to:
  • the second decryption key and the corresponding second encryption key for data transmission are negotiated with the intermediate device.
  • the receiver 410 may receive the verification request sent by the intermediate device, and the processor 420 may parse the device to obtain the device information of the intermediate device carried therein.
  • the processor 420 can verify the legality of the intermediate device according to the preset processing policy. Specifically, after acquiring the device information of the intermediate device, the processor 420 obtains the device identifier of the intermediate device, the data processing function information (which may be text information indicating the data processing function of the intermediate device), and the certificate, where the certificate is The specific device is issued by the intermediate device, which may be obtained by encrypting the data processing function information of the intermediate device based on the private key, obtaining the public key of the corresponding intermediate device, and decrypting the certificate based on the obtained public key, if it is correct Decrypted, and the decrypted data processing function information is the same as the data processing function information carried in the verification request, and the processor 420 can determine that the intermediate device is legal.
  • the processor 420 can verify the legality of the intermediate device according to the preset processing policy. Specifically, after acquiring the device information of the intermediate device, the processor 420 obtains the device identifier of the intermediate device, the data processing function information (which may be text
  • the second device may further store an operation that the second device allows the intermediate device to perform.
  • the second device allows the operation performed by the intermediate device to verify the legality of the intermediate device, for example, the intermediate device.
  • the data processing function is optimized for the video. If the second device pre-stores the data processing of the transmitted data by the intermediate device that allows the video optimization function, the data processing function carried in the decrypted data processing function information and the verification request Based on the same information, the processor 420 can determine that the intermediate device is legitimate.
  • the processor 420 is the same even if the data processing function information obtained by the decryption is the same as the data processing function information carried in the verification request. Make sure the intermediate device is not legal.
  • the transmitter 430 may send, by using the intermediate device, a feedback message corresponding to the verification request sent by the intermediate device to the first device, where the feedback message may be used. Indicates that the intermediate device is legal. Specifically, the transmitter 430 may send a feedback message corresponding to the verification request sent by the intermediate device to the intermediate device, where the feedback message may carry the device identifier of the legal intermediate device.
  • the second device can perform integrity protection processing on the feedback message.
  • the processor 420 can also negotiate a second decryption key and a corresponding second encryption key for data transmission with the intermediate device.
  • the first device when the first device sends the second device target data to be encrypted, the first device may encrypt the target data by using the first encryption key negotiated by the first device and the intermediate device, and then send the target data.
  • the intermediate device receives the target data encrypted by the first device and is encrypted by the first device, the intermediate device decrypts the first decryption key negotiated by the intermediate device with the first device to obtain the target data, and obtains the target data. Performing preset data processing on the target data.
  • the data processed target data may be encrypted by using the second encryption key negotiated by the intermediate device and the second device, and sent to the second device, where the second device receives
  • the second decryption key negotiated by the second device and the intermediate device may be used for decryption processing to obtain a target device that is processed by the intermediate device.
  • the intermediate device can decrypt the data sent by the first device based on the decryption key negotiated in advance with the first device, and can read the data that the first device is to send to the second device, and further, the target data can be preset. The data is processed so that the intermediate device can work properly.
  • the embodiment of the present invention provides a first device.
  • the first device provided in this embodiment can implement the processes of the embodiments shown in FIG. 5, FIG. 6, and FIG.
  • the first device includes:
  • An obtaining module 810 configured to acquire target data to be transmitted to the second device
  • the encryption module 820 is configured to: if the target data is data that is allowed to be read by the intermediate device, perform encryption processing on the target data based on the first encryption key negotiated by the first device and the intermediate device, to obtain First data;
  • the sending module 830 is configured to send, to the intermediate device, first data that carries the first data. Transfer the message.
  • the first device and the second device may be any one of a terminal and a server, the first device may be a terminal, the second device may be a server, and the target data may be service data to be transmitted by the first device.
  • the intermediate device may be a device having a preset data processing function, and may be a device in a transmission path when the first device and the second device transmit data.
  • the obtaining module 810 can obtain the target data to be transmitted.
  • the first device may be pre-stored with a first determining policy, where the first determining policy may be used by the first device to determine whether the target data to be transmitted to the second device allows the intermediate device to read, and the first device may store the permission. a list of data types of data read by the intermediate device, and/or a list of data types of data that is not allowed to be read by the intermediate device. For example, when the first device is a terminal and the target data is a password input by the user, the middle is not allowed. The device reads, and when the data is video, the intermediate device is allowed to read.
  • the first device may also pre-store an encryption key (ie, a first encryption key) negotiated by the first device and the intermediate device, where the first encryption key may be used to perform encryption processing on the target data.
  • the encryption module 820 may target the target data based on the first encryption key stored in advance. Performing an encryption process to obtain the first data, wherein the first device may further store an encryption algorithm (which may be referred to as a first encryption algorithm), that is, the encryption module 820 may perform the first encryption based on the first device and the intermediate device. The key and the first encryption algorithm encrypt the target data to obtain the first data.
  • an encryption algorithm which may be referred to as a first encryption algorithm
  • the sending module 830 may send a data transmission message (ie, the first data transmission message) to the intermediate device, where the first data transmission message may further carry the first data.
  • the first data transmission message further carries a first preset identifier, where the first preset identifier is used to indicate that the intermediate device is allowed to read the target data.
  • the encryption module 820 is further configured to:
  • the target data is data that is not allowed to be read by the intermediate device, encrypting the target data based on a third encryption key negotiated by the first device and the second device, to obtain Third data;
  • the sending module 830 is further configured to:
  • the first device may be pre-stored with the first determining policy, where the first determining policy may be used by the first device to determine whether the target data to be transmitted to the second device allows the intermediate device to read, in the first device.
  • a list of data types that allow data read by the intermediate device may be stored, and/or a list of data types that may not be read by the intermediate device may be stored, for example, when the first device is a terminal and the target data is a password input by the user.
  • the intermediate device is not allowed to read.
  • the first device may also pre-store an encryption key (ie, a third encryption key) negotiated by the first device and the second device, where the third encryption key may be used to perform encryption processing on the target data.
  • the encryption module 820 may perform the target based on the third encryption key stored in advance.
  • the data is subjected to an encryption process to obtain a third data, wherein the first device may further store an encryption algorithm (which may be referred to as a third encryption algorithm), that is, the encryption module 820 may negotiate with the second device based on the first device.
  • the third encryption key and the third encryption algorithm encrypt the target data to obtain the third data.
  • the first data transmission message carries the first preset identifier.
  • the sending module 830 may Sending, to the intermediate device, a third data transmission message carrying the third data and the second preset identifier, where the second preset identifier may be used to indicate that the intermediate device is not allowed to read the target data.
  • the first device may perform integrity protection processing on the second preset identifier.
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS header;
  • the first preset identifier or the second preset identifier is set in a low latency internet transport layer QUIC header based on a user datagram protocol.
  • the sending module 830 is further configured to:
  • the first device further includes:
  • the receiving module 840 is configured to receive a feedback message sent by the intermediate device to indicate that the intermediate device is legal;
  • the negotiation module 850 is configured to negotiate, with the intermediate device, the first encryption key and the corresponding first decryption key for data transmission.
  • the data when the first device and the second device transmit data, the data may be transmitted based on the TLS protocol, or may be transmitted based on the QUIC protocol.
  • the first device and the second device may establish a TCP (Transmission Control Protocol) connection before the data is transmitted, that is, the first device performs a TCP three-way handshake with the second device, and then, Establishing a TLS connection, wherein the process of establishing a TLS connection is a process in which the first device negotiates a key with the second device, that is, negotiates a third encryption key for data transmission and a corresponding third involved in the following processing. Decrypt the key.
  • the first device and the second device may establish a QUIC connection before transmitting data.
  • the sending module 830 may send the verification indication message to the intermediate device, where the verification indication message may be used to instruct the intermediate device to send the verification for verifying the legality of the intermediate device to the second device.
  • the verification indication message may be sent during the TLS establishment process, or may be transmitted for the QUIC-based transmission target after the TLS connection is established.
  • the verification indication message may be in the process of establishing the QUIC connection, or may be limited in the embodiment of the present invention after the QUIC connection is established.
  • the device information of the intermediate device may be preset in the first device, where the device information of the intermediate device may be the device identifier of the intermediate device (may be the device name of the intermediate device, or may be the MAC address of the intermediate device, or The IP (Internet Protocol) address of the intermediate device, the data processing function information (which may be text information indicating the data processing function of the intermediate device), and the certificate.
  • the verification indication message may carry the intermediate device.
  • the device information of the intermediate device may not be pre-configured in the first device, which is not limited in the embodiment of the present invention.
  • the verification indication message sent by the first device may be transmitted in a clear text manner.
  • the intermediate device may send an authentication request for verifying the legality of the intermediate device to the second device, and after the second device verifies that the intermediate device is legal, the device may send the device to the first device through the intermediate device.
  • the receiving module 840 may receive a feedback message sent by the intermediate device to indicate that the intermediate device is legal, and then negotiate Module 850 can negotiate a first encryption key and a corresponding first decryption key for data transmission with the intermediary device.
  • the embodiment of the present invention further provides an intermediate device.
  • the intermediate device provided in this embodiment can implement the processes of the embodiments shown in FIG. 5, FIG. 6, and FIG.
  • the intermediate device includes:
  • the receiving module 1010 is configured to receive a first data transmission message that is sent by the first device and that carries the first data, where the first data is target data that is encrypted by using the first encryption key.
  • the decryption module 1020 is configured to perform decryption processing on the first data based on the first decryption key negotiated by the intermediate device with the first device, obtain the target data, and preset the target data. Data processing;
  • the encryption module 1030 is configured to perform encryption processing on the data processed target data based on the second encryption key negotiated by the intermediate device and the second device to obtain second data.
  • the sending module 1040 is configured to send, to the second device, a second data transmission message that carries the second data.
  • the receiving module 1010 may receive the first data transmission message sent by the first device, and the intermediate device may parse the first data, and obtain the first data carried therein.
  • the first data is target data encrypted by the first encryption key.
  • the decryption key (ie, the first decryption key) negotiated by the intermediate device with the first device may be pre-stored in the intermediate device, wherein the first decryption key may be used to perform decryption processing on the first data sent by the first device.
  • the decryption module 1020 may negotiate with the first device based on the pre-stored intermediate device.
  • the intermediate device may further store a decryption algorithm (which may be referred to as a first decryption algorithm), that is, the decryption module 1020 may be based on the first device.
  • the first decryption key negotiated with the intermediate device and the first decryption algorithm decrypt the first data to obtain target data.
  • the decryption module 1020 may perform preset data processing on the obtained target data according to a preset data processing function.
  • the intermediate device may have a preset data processing function, wherein the preset data processing The function may be a statistical data function.
  • the processor 320 may read the target data of the first device to be transmitted to the second device, so as to perform statistics without changing the target data, and the preset data processing function may also be Video optimization function, in this case, decrypt The module 1020 can read the target data of the first device to be transmitted to the second device, and change the target data based on the preset data processing function.
  • the first device is a server
  • the video optimization function is to change the high-definition video data to The definition video data
  • the decryption module 1020 can read the high-definition video data (ie, target data) sent by the server to the terminal, and further, the target data can be changed to the standard definition video data. That is to say, after the decryption module 1020 performs preset data processing on the target data, the obtained data may be the same as or different from the target data.
  • An encryption key (ie, a second encryption key) negotiated between the intermediate device and the second device may be pre-stored in the intermediate device, where the second encryption key may be used to perform encryption processing on the data processed target data.
  • the encryption module 1030 may acquire the second encryption key stored in advance, and perform encryption processing on the data processed target data based on the second encryption key to obtain the second data, where
  • An encryption algorithm (which may be referred to as a second encryption algorithm) may also be pre-stored in the intermediate device, that is, the encryption module 1030 may process the data based on the second encryption key and the second encryption algorithm negotiated by the intermediate device with the second device.
  • the target data is encrypted to obtain the second data.
  • the sending module 1040 may send a data transmission message (ie, a second data transmission message) to the second device, where the second data transmission message may carry the second data.
  • the first data transmission message further includes a first preset identifier, where the first preset identifier is used to indicate that the intermediate device is allowed to read the target data.
  • the decryption module 1020 is specifically configured to:
  • the first data is decrypted according to the first decryption key negotiated by the intermediate device and the first device, Obtaining the target data, and performing preset data processing on the target data;
  • the sending module 1040 is specifically configured to:
  • the intermediate device may determine whether the first data identifier is carried in the first data transmission message, and the first data transmission message carries the first preset identifier.
  • the decryption module 1020 may process the first data according to the processing procedure described in the above step 504, that is, decrypt the first data based on the first decryption key negotiated by the intermediate device with the first device, to obtain target data, and Pre-set data processing on target data.
  • the sending module 1040 sends the second data to the second device.
  • the second data transmission message may further carry the first preset identifier, that is, the second data transmission message carries the second data and the first preset identifier.
  • the receiving module 1010 is further configured to:
  • the third data is target data encrypted by a third encryption key
  • the sending module 1040 is further configured to:
  • the third data transmission message is sent to the second device.
  • the receiving module 1010 may receive the third data transmission message sent by the first device, where the intermediate device may It performs parsing to obtain the third data and the second preset identifier carried therein, wherein the third data is the target data encrypted by the third encryption key. After receiving the third data transmission message, it may be determined whether the third data transmission message carries the second preset identifier, and when it is determined that the third data transmission message carries the second preset identifier, that is, when the target data is not allowed When the data is read by the intermediate device, the sending module 1040 may forward the third data transmission message to the second device without performing any processing on the third data.
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS header;
  • the first preset identifier or the second preset identifier is set in a low latency internet transport layer QUIC header based on a user datagram protocol.
  • the receiving module 1010 is further configured to:
  • the sending module 1040 is further configured to:
  • the receiving module 1010 is further configured to:
  • the sending module 1040 is further configured to:
  • the intermediate device further includes:
  • the negotiation module 1150 is configured to negotiate, with the first device, the first encryption key and the first decryption key for data transmission, and negotiate with the second device for the data transmission.
  • the second encryption key and the corresponding second decryption key are configured to negotiate, with the first device, the first encryption key and the first decryption key for data transmission, and negotiate with the second device for the data transmission. The second encryption key and the corresponding second decryption key.
  • the receiving module 1010 may receive the verification indication message sent by the first device, where the receiving module 1010 receives the device information of the intermediate device.
  • the intermediate device can parse the device and obtain the device information of the intermediate device carried in the intermediate device.
  • the device information of the intermediate device carried in the verification indication message is obtained after the verification indication message carries the device information of the intermediate device, and the sending module 1040 may send the device information to the second device.
  • a verification request carrying device information of the intermediate device In the case that the device information of the intermediate device is not carried in the verification indication message, that is, the device information of the intermediate device is not pre-configured in the first device, after the receiving module 1010 receives the verification indication message sent by the first device, the intermediate device may The device information of the intermediate device pre-stored in the local device is obtained, and the sending module 1040 sends a verification request for the device information carrying the intermediate device to the second device.
  • the verification request sent by the intermediate device can be transmitted in plain text.
  • the second device may verify the legality of the intermediate device.
  • the second device may send a feedback message to the intermediate device to indicate that the intermediate device is legal.
  • the receiving module 1010 may receive the The sending module 1040 sends a feedback message for indicating that the intermediate device is legal.
  • the sending module 1040 may send a feedback message sent by the second device to indicate that the intermediate device is legal, and the negotiation module 1050 may be the first The device negotiates a first encryption key and a first decryption key for data transmission, and negotiates a second encryption key and a corresponding second decryption key for data transmission with the second device.
  • the embodiment of the present invention provides a second device.
  • the second device provided in this embodiment can implement the processes of the embodiments shown in FIG. 5, FIG. 6, and FIG.
  • the second device includes:
  • the receiving module 1210 is configured to receive, by the intermediate device, a second data transmission message that carries the second data, where the second data is data obtained by encrypting the target data processed by the intermediate device data;
  • the decryption module 1220 is configured to perform decryption processing on the second data based on a second decryption key negotiated by the second device with the intermediate device, to obtain a target number processed by the intermediate device data. according to.
  • the receiving module 1210 may receive the second data transmission message sent by the intermediate device, where the second device may parse the data transmission message.
  • the second data carried, wherein the second data is the target data processed by the intermediate device data, and then the data encrypted by the second encryption key.
  • the decryption key (ie, the second decryption key) negotiated by the second device with the intermediate device may be pre-stored in the second device, where the second decryption key may be used to decrypt the second data sent by the intermediate device.
  • the decrypting module 1220 can determine whether the target data is data that is allowed to be read by the intermediate device, that is, whether the second data is an intermediate device that performs preset data processing on the target data, and Encrypting the data, when the target data is determined to be the data that is allowed to be read by the intermediate device, the decrypting module 1220 may perform the decryption process on the second data based on the second decryption key to obtain the target data processed by the intermediate device data, where The data obtained by the second device may be consistent with the target data, or may be inconsistent with the target data, and whether it is the same depends on whether the data processing of the target data by the intermediate device changes the target data.
  • the second device may further store a decryption algorithm (which may be referred to as a second decryption algorithm), that is, after acquiring the second data, the decryption module 1220 may perform a second decryption key negotiated with the intermediate device based on the second device. And the second decryption algorithm, the second data is decrypted, and the target data processed by the intermediate device is obtained.
  • a decryption algorithm which may be referred to as a second decryption algorithm
  • the second data transmission message further includes a first preset identifier, where the first preset identifier is used to indicate that the intermediate device is allowed to read the target data.
  • the decryption module 1220 is specifically configured to:
  • the decryption module 1220 may determine whether the second data transmission message carries the first preset identifier, and when determining that the second data transmission message carries the first preset When the identifier is determined, that is, when the second data carried in the second data transmission message is determined to be the data obtained by the intermediate device data processing, the second data is processed according to the processing procedure described in step 507 above. That is, the decryption module 1220 decrypts the second data based on the second decryption key negotiated by the second device with the intermediate device to obtain target data processed by the intermediate device.
  • the receiving module 1210 is further configured to:
  • the third data is target data encrypted by a third encryption key
  • the decryption module 1220 is further configured to:
  • the target data is obtained.
  • the receiving module 1210 may receive the third data transmission message sent by the intermediate device, where the second device may It performs parsing to obtain the third data and the second preset identifier carried therein, wherein the third data is the target data encrypted by the third encryption key.
  • the decryption key ie, the third decryption key
  • the decryption key negotiated by the second device with the first device may be pre-stored in the second device, where the third decryption key may be used to send the third device to the third device through the intermediate device.
  • the data is decrypted.
  • the decryption module 1220 may determine whether the second data transmission message carries the second preset identifier, and when determining that the third data transmission message carries the second preset identifier, Determining that the third data carried in the third data transmission message is data obtained by the first device encrypting the target data based on the third encryption key, and the intermediate device does not perform any processing on the target data, the decrypting module 1220 may be based on the second The third decryption key negotiated by the device with the first device decrypts the third data to obtain target data.
  • the second device may further store a decryption algorithm (which may be referred to as a third decryption algorithm), that is, when determining that the third data transmission message carries the second preset identifier, the decryption module 1220 may be based on the second device.
  • the third decryption key and the third decryption algorithm negotiated with the first device perform decryption processing on the third data to obtain target data.
  • the first preset identifier or the second preset identifier is set in a transport layer security TLS header;
  • the first preset identifier or the second preset identifier is set in a low latency internet transport layer QUIC header based on a user datagram protocol.
  • the receiving module 1210 is further configured to:
  • the second device further includes:
  • the verification module 1230 is configured to verify the legality of the intermediate device according to the device information of the intermediate device.
  • the sending module 1240 is configured to send, by the intermediate device, a feedback message for indicating that the intermediate device is legal, if the intermediate device is legal;
  • the negotiation module 1250 is configured to negotiate, with the intermediate device, the second decryption key and the corresponding second encryption key for data transmission.
  • the receiving module 1210 may receive the verification request sent by the intermediate device, and the second device may parse the device to obtain the device information of the intermediate device carried therein.
  • the verification module 1230 can verify the legality of the intermediate device according to the preset processing policy. Specifically, after obtaining the device information of the intermediate device, the device identifier and the data processing function information (which may be text information representing the data processing function of the intermediate device) and the certificate are obtained, wherein the certificate is determined by the specific organization. The data is sent to the intermediate device, and the data processing function information of the intermediate device is encrypted based on the private key. The decryption module 1220 can obtain the public key of the corresponding intermediate device, and decrypt the certificate based on the obtained public key.
  • the decryption, and the decrypted data processing function information is the same as the data processing function information carried in the verification request, and the verification module 1230 can determine that the intermediate device is legal.
  • the second device may further store an operation that the second device allows the intermediate device to perform. On the basis of the foregoing determining, the second device allows the operation performed by the intermediate device to verify the legality of the intermediate device, for example, the intermediate device.
  • the data processing function is optimized for the video. If the second device pre-stores the data processing of the transmitted data by the intermediate device that allows the video optimization function, the data processing function carried in the decrypted data processing function information and the verification request On the basis of the same information, the verification module 1230 may determine that the intermediate device is legal.
  • the intermediate device in the second device does not allow the intermediate device having the video optimization function to perform data processing on the transmitted data, even if the decrypted data processing function information is The data processing function information carried in the verification request is the same, and the verification module 1230 also determines that the intermediate device is invalid.
  • the sending module 1240 may send, by using the intermediate device, a feedback message corresponding to the verification request sent by the intermediate device to the first device, where the feedback message may be used. Indicates that the intermediate device is legal. Specifically, the sending module 1240 may send a feedback message corresponding to the verification request sent by the intermediate device to the intermediate device, where the feedback message may carry the device identifier of the legal intermediate device. In addition, the second device can perform integrity protection processing on the feedback message.
  • the negotiation module 1250 can also negotiate a second decryption key and a corresponding second encryption key for data transmission with the intermediate device.
  • the first The device may encrypt the target data by using the first encryption key negotiated by the first device and the intermediate device, and then send the target data to the intermediate device, where the intermediate device receives the target encrypted by the first device and encrypted by the first encryption key.
  • the intermediate device can decrypt the first decryption key negotiated with the first device to obtain the target data, and perform preset data processing on the target data, and then, the intermediate device can negotiate with the second device.
  • the second encryption key encrypts the data processed target data and sends the data to the second device.
  • the second device may use the second decryption key negotiated by the second device with the intermediate device.
  • the key is decrypted to obtain a target device that is processed by the intermediate device.
  • the intermediate device can decrypt the data sent by the first device based on the decryption key negotiated in advance with the first device, and can read the data that the first device is to send to the second device, and further, the target data can be preset.
  • the data is processed so that the intermediate device can work properly.
  • the embodiment of the present invention further provides a system for transmitting data.
  • the system provided in this embodiment can implement the process of the embodiment shown in FIG. 5, FIG. 6 and FIG. 7, and the first device is implemented as shown in FIG. 2, FIG.
  • the first device of the example, the intermediate device is the intermediate device of the embodiment shown in FIG. 3, 10, and 11, and the second device is the second device of the embodiment shown in FIG. 4, 12, and 13, the system includes the first device, Intermediate device and second device, wherein:
  • the first device is configured to acquire target data to be transmitted to the second device, and if the target data is data that is allowed to be read by the intermediate device, negotiate with the intermediate device based on the first device a first encryption key, performing encryption processing on the target data to obtain first data, and transmitting, to the intermediate device, a first data transmission message carrying the first data;
  • the intermediate device is configured to receive a first data transmission message that is sent by the first device and that carries the first data, and is based on a first decryption key that is negotiated by the intermediate device with the first device. Decoding the first data to obtain the target data, and performing preset data processing on the target data, based on the second encryption key negotiated by the intermediate device and the second device, on the data processed target The data is encrypted, and the second data is obtained, and the second data transmission message carrying the second data is sent to the second device;
  • the second device is configured to receive a second data transmission message that is sent by the intermediate device and that carries the second data, based on a second decryption key that is negotiated by the second device with the intermediate device, The second data is decrypted to obtain target data processed by the intermediate device.
  • the transmitted data needs to be encrypted, that is, the TLS protocol or Quic (Quick UDP (User Datagram Protocol) Internet Connection, UDP-based low-latency Internet transport layer) protocol is widely used.
  • the target data to be transmitted may be acquired. After acquiring the target data, the first device may determine whether the target data allows data read by the intermediate device. If the target data is data that is allowed to be read by the intermediate device, the first device may be based on the first encryption key stored in advance.
  • the first device may further store an encryption algorithm (which may be referred to as a first encryption algorithm), that is, the first device may negotiate with the intermediate device based on the first device.
  • the first encryption key and the first encryption algorithm perform encryption processing on the target data to obtain the first data.
  • the data transmission message ie, the first data transmission message
  • the intermediate device where the first data transmission message may also carry the first data.
  • the intermediate device may receive the first data transmission message sent by the first device, and may parse the first data transmission message, where the first data is The target data encrypted by the first encryption key. After obtaining the target data, the intermediate device may perform preset data processing on the obtained target data according to the data processing function that the intermediate device has. Specifically, the intermediate device may have a preset data processing function, wherein the preset data processing function It can be a statistical data function. In this case, the intermediate device can read the target data of the first device to be transmitted to the second device, so as to perform statistics without changing the target data, and the preset data processing function may also be video optimization.
  • the intermediate device can read the target data of the first device to be transmitted to the second device, and change the target data based on the preset data processing function, for example, the first device is a server, and the video optimization function is The HD video data is changed to standard definition video data.
  • the intermediate device can read the high-definition video data (ie, target data) sent by the server to the terminal, and further, the target data can be changed to the standard definition video data. That is to say, after the intermediate device performs preset data processing on the target data, the obtained data may be the same as or different from the target data.
  • the second encryption key stored in advance may be acquired, and the target data processed by the data is encrypted according to the second encryption key to obtain second data, where
  • An encryption algorithm (which may be referred to as a second encryption algorithm) may also be pre-stored in the device, that is, the intermediate device may perform the data processing target based on the second encryption key and the second encryption algorithm negotiated by the intermediate device with the second device.
  • the data is encrypted to obtain the second data.
  • the data transmission message ie, the second data transmission message
  • the second data transmission message may be sent to the second device, where the second data transmission message may carry the second data.
  • the second device may receive the second data transmission message sent by the intermediate device, and parse the second data transmission message to obtain the second data carried therein.
  • the second data is the target data processed by the intermediate device data, and then the data encrypted by the second encryption key.
  • the decryption key (ie, the second decryption key) negotiated by the second device with the intermediate device may be pre-stored in the second device, where the second decryption key may be used to decrypt the second data sent by the intermediate device.
  • the second device may determine whether the target data is data that is allowed to be read by the intermediate device, that is, determine whether the second data is an intermediate device that performs predetermined data processing on the target data, and encrypts the data.
  • Data when the second device determines that the target data is data that is allowed to be read by the intermediate device, the second data may be decrypted based on the second decryption key to obtain target data processed by the intermediate device, wherein the second device
  • the obtained data may be consistent with the target data, or may be inconsistent with the target data, and whether it is the same depends on whether the data processing of the target data by the intermediate device changes the target data.
  • the second device may further store a decryption algorithm (which may be referred to as a second decryption algorithm), that is, after the second device acquires the second data, the second decryption key negotiated with the intermediate device by the second device may be used. And the second decryption algorithm, the second data is decrypted, and the target data processed by the intermediate device is obtained.
  • a decryption algorithm which may be referred to as a second decryption algorithm
  • the first device when the first device sends the second device target data to be encrypted, the first device may encrypt the target data by using the first encryption key negotiated by the first device and the intermediate device, and then send the target data.
  • the intermediate device receives the target data encrypted by the first device and is encrypted by the first device, the intermediate device decrypts the first decryption key negotiated by the intermediate device with the first device to obtain the target data, and obtains the target data. Performing preset data processing on the target data.
  • the data processed target data may be encrypted by using the second encryption key negotiated by the intermediate device and the second device, and sent to the second device, where the second device receives
  • the second decryption key negotiated by the second device and the intermediate device may be used for decryption processing to obtain a target device that is processed by the intermediate device.
  • the intermediate device can decrypt the data sent by the first device based on the decryption key negotiated in advance with the first device, and can read the data that the first device is to send to the second device, and further, the target data can be preset. The data is processed so that the intermediate device can work properly.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明实施例公开了一种传输数据的方法、装置和系统，属于互联网技术领域。所述方法包括：中间设备接收第一设备发送的携带有第一数据的第一数据传输消息，其中，所述第一数据为经过第一加密密钥加密的目标数据；所述中间设备基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；所述中间设备基于所述中间设备与第二设备协商的第二加密密钥，对经过数据处理的目标数据进行加密处理，得到第二数据；所述中间设备向所述第二设备发送携带有所述第二数据的第二数据传输消息。采用本发明，可以使得中间设备能够正常工作。

Description

一种传输数据的方法、装置和系统 技术领域
本发明涉及互联网技术领域，特别涉及一种传输数据的方法、装置和系统。
背景技术
为保证数据传输的安全性，越来越多的服务器要求与终端进行传输的数据需要进行加密处理，即TLS(Transport Layer Security，传输层安全)协议的应用得到了广泛的普及，例如，TLS协议已被广泛应用于浏览器与网站服务器之间的安全通信。
需要对传输数据进行加密时的数据传输过程一般是：终端首先可以与服务器建立TCP(Transmission Control Protocol，传输控制协议)连接，然后，可以建立TLS连接，其中，建立TLS连接的过程即是终端与服务器协商密钥的过程，最后，终端与服务器进行数据传输，其中，在数据传输时终端与服务器可以利用协商好的密钥对传输的数据进行加密、解密处理。
在实现本发明的过程中，发明人发现现有技术至少存在以下问题：
终端与服务器传输数据时，传输过程中可能会经过具有业务优化功能的中间设备(比如，可以是防火墙设备、运营商提供的用于视频优化的设备等中间设备)，即在数据传输过程中可能需要中间设备对传输的数据进行数据处理(服务器或终端传输的数据到达中间设备时，中间设备可以对服务器或终端传输的数据进行查看处理或其他数据处理，即中间设备可以根据自身可实现的数据处理功能，对服务器或终端传输的数据进行数据处理)。然而，随着TLS协议的广泛应用，越来越多的服务器要求与终端进行传输的数据需要进行加密处理，然而，进行加密过的数据经过中间设备时，由于数据是通过终端与服务器进行协商好的密钥进行加密的，中间设备并不知道密钥，导致中间设备无法读取终端与服务器进行传输的数据，从而，导致中间设备无法正常工作。
发明内容
为了实现在第一设备与第二设备传输的数据加密的情况下，中间设备可以正常工作的目的，本发明实施例提供了一种传输数据的方法、装置和系统。所 述技术方案如下：
第一方面，提供了一终传输数据的方法，所述方法包括：
第一设备获取待传输至第二设备的目标数据；
如果所述目标数据为允许中间设备读取的数据，则所述第一设备基于所述第一设备与所述中间设备协商的第一加密密钥，对所述目标数据进行加密处理，得到第一数据；
所述第一设备向所述中间设备发送携带有所述第一数据的第一数据传输消息。
为保证数据传输的安全性，越来越多的服务器要求与终端进行传输的数据需要进行加密处理，即TLS协议或者Quic(Quick UDP(User Datagram Protocol，用户数据报协议)Internet Connection，基于UDP的低时延互联网传输层)协议得到了广泛应用，此种情况下，第一设备将要向第二设备发送数据时，可以获取待传输的目标数据。第一设备获取到目标数据后，可以判断该目标数据是否允许中间设备读取的数据，如果目标数据为允许中间设备读取的数据，则第一设备可以基于预先存储的第一加密密钥，对目标数据进行加密处理，得到第一数据，其中，第一设备中还可以预先存储有加密算法(可以称为第一加密算法)，即，第一设备可以基于第一设备与中间设备协商的第一加密密钥和第一加密算法，对目标数据进行加密处理，得到第一数据。第一设备得到第一数据后，可以向中间设备发送数据传输消息(即第一数据传输消息)，其中，第一数据传输消息中还可以携带有第一数据。
结合第一方面，在该第一方面的第一种可能实现方式中，所述第一数据传输消息中还携带有第一预设标识，其中，所述第一预设标识用于指示允许所述中间设备读取所述目标数据。
结合第一方面的第一种可能实现方式，在该第一方面的第二种可能实现方式中，所述方法还包括：
如果所述目标数据为不允许所述中间设备读取的数据，则所述第一设备基于所述第一设备与所述第二设备协商的第三加密密钥，对所述目标数据进行加密处理，得到第三数据；
所述第一设备向所述中间设备发送携带有所述第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据。
第一设备获取到目标数据后，可以判断该目标数据是否允许中间设备读取的数据，如果目标数据为不允许中间设备读取的数据，则可以基于预先存储的第三加密密钥，对目标数据进行加密处理，得到第三数据，其中，第一设备中还可以预先存储有加密算法(可以称为第三加密算法)，即，第一设备可以基于第一设备与第二设备协商的第三加密密钥和第三加密算法，对目标数据进行加密处理，得到第三数据。
针对如果目标数据为允许中间设备读取的数据，则第一数据传输消息中携带有第一预设标识的情况，当第一设备确定出目标数据为不允许中间设备读取的数据时，可以向中间设备发送携带有第三数据和第二预设标识的第三数据传输消息，其中，第二预设标识可以用于指示不允许中间设备读取目标数据。另外，第一设备可以对第二预设标识进行完整性保护处理。
这样，既可以在目标数据为允许中间设备读取的数据的情况下，使得中间设备能够正常工作，又可以在目标数据为不允许中间设备读取的数据的情况下，保证目标数据的安全性。
结合第一方面的第二种可能实现方式，在该第一方面的第三种可能实现方式中，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
结合第一方面，在该第一方面的第四种可能实现方式中，所述方法还包括：
所述第一设备向所述中间设备发送验证指示消息，其中，所述验证指示消息用于指示所述中间设备向所述第二设备发送用于验证所述中间设备合法性的验证请求；
所述第一设备接收所述中间设备发送的用于指示所述中间设备合法的反馈消息；
所述第一设备与所述中间设备协商用于数据传输的所述第一加密密钥和对应的第一解密密钥。
第一设备与第二设备传输数据时，可以基于TLS协议传输数据，也可以基于QUIC协议传输数据。当基于TLS协议传输数据时，第一设备与第二设备在传输数据前，可以先建立TCP(Transmission Control Protocol，传输控制协议)连接，即第一设备与第二设备进行TCP三次握手，然后，建立TLS连接，其 中，建立TLS连接的过程即是第一设备与第二设备协商密钥的过程，即协商下述处理过程中涉及的用于数据传输的第三加密密钥和对应的第三解密密钥。当基于QUIC协议传输数据时，第一设备与第二设备在传输数据前，可以先建立QUIC连接。
第一设备与第二设备传输目标数据时，第一设备可以向中间设备发送验证指示消息，其中，该验证指示消息可以用于指示中间设备向第二设备发送用于验证中间设备合法性的验证请求，其中，对于上述提及的两种情况，针对基于TLS协议传输目标数据的情况，该验证指示消息可以在TLS建立的过程中发送，也可以在TLS连接建立后，针对基于QUIC协议传输目标数据的情况，该验证指示消息可以在QUIC连接的建立过程中，也可以在QUIC连接建立后，本发明实施例不对其进行限定。另外，第一设备中可以预先设置有中间设备的设备信息，其中，中间设备的设备信息可以是中间设备的设备标识(可以是中间设备的设备名称，也可以是中间设备的MAC地址，也可以是中间设备的IP(Internet Protocol，网络协议)地址)、数据处理功能信息(可以是表述中间设备的数据处理功能的文本信息)以及证书，此种情况下，验证指示消息中可以携带有中间设备的设备信息。第一设备中也可以不预先配置有中间设备的设备信息，本发明实施例不对其进行限定。此外，第一设备发送的验证指示消息可以采用明文的方式进行传输。
向中间设备发送验证指示消息后，中间设备可以向第二设备发送用于验证中间设备合法性的验证请求，第二设备验证中间设备合法后，可以通过中间设备向第一设备发送用于指示中间设备合法的反馈消息，第一设备可以接收中间设备发送的用于指示中间设备合法的反馈消息，进而，可以与中间设备协商用于数据传输的第一加密密钥和对应的第一解密密钥。
这样，先验证中间设备的合法性，在中间设备合法的基础上再协商第一加密密钥和对应的第一解密密钥，从而，可以防止目标数据被恶意设备(即不合法的中间设备)读取，进而，可以保证目标数据的安全性。
第二方面，提供了一种传输数据的方法，所述方法包括：
中间设备接收第一设备发送的携带有第一数据的第一数据传输消息，其中，所述第一数据为经过第一加密密钥加密的目标数据；
所述中间设备基于所述中间设备与所述第一设备协商的第一解密密钥，对 所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；
所述中间设备基于所述中间设备与第二设备协商的第二加密密钥，对经过数据处理的目标数据进行加密处理，得到第二数据；
所述中间设备向所述第二设备发送携带有所述第二数据的第二数据传输消息。
第一设备向中间设备发送第一数据传输消息后，中间设备可以接收第一设备发送的第一数据传输消息，可以对其进行解析，获取其中携带的第一数据，其中，第一数据为经过第一加密密钥加密的目标数据。中间设备得到目标数据后，可以按照自身具有的数据处理功能，对得到的目标数据进行预设的数据处理，具体的，中间设备可以具有预设的数据处理功能，其中，预设的数据处理功能可以是统计数据功能，此种情况下，中间设备可以读取第一设备待传输至第二设备的目标数据，以便于进行统计，不改变目标数据，预设的数据处理功能也可以是视频优化功能，此种情况下，中间设备可以读取第一设备待传输至第二设备的目标数据，并基于预设的数据处理功能对目标数据进行改变，例如，第一设备为服务器，视频优化功能是将高清视频数据改变为标清视频数据，此种情况下，中间设备可以读取服务器发送至终端的高清视频数据(即目标数据)，进而，可以将目标数据改变为标清视频数据。也就是说，中间设备对目标数据进行预设的数据处理后，得到的数据可能与目标数据相同，也可能不同。中间设备对目标数据进行预设的数据处理后，可以获取预先存储的第二加密密钥，并基于第二加密密钥对经过数据处理的目标数据进行加密处理，得到第二数据，其中，中间设备中还可以预先存储有加密算法(可以称为第二加密算法)，即，中间设备可以基于中间设备与第二设备协商的第二加密密钥和第二加密算法，对经过数据处理的目标数据进行加密处理，得到第二数据。中间设备得到第二数据后，可以向第二设备发送数据传输消息(即第二数据传输消息)，其中，第二数据传输消息中可以携带有第二数据。
结合第二方面，在该第二方面的第一种可能实现方式中，所述第一数据传输消息中还携带有第一预设标识，所述第一预设标识用于指示允许所述中间设备读取所述目标数据；
所述中间设备基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设 的数据处理，包括：
当所述中间设备确定所述第一数据传输消息中携带有所述第一预设标识时，所述中间设备基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；
所述中间设备向所述第二设备发送携带有所述第二数据的第二数据传输消息，包括：
所述中间设备向所述第二设备发送携带有所述第二数据和所述第一预设标识的第二数据传输消息。
中间设备获取到第一数据传输消息后，可以判断第一数据传输消息中是否携带有第一预设标识，当确定第一数据传输消息中携带有第一预设标识时，可以基于中间设备与第一设备协商的第一解密密钥，对第一数据进行解密处理，得到目标数据，并对目标数据进行预设的数据处理。当第一数据传输消息中携带有第一预设标识时，中间设备发送至第二设备的第二数据传输消息中还可以携带有第一预设标识，即第二数据传输消息中携带有第二数据和第一预设标识。
这样，可以在数据传输消息中携带相应的预设标识，从而，可以使得中间设备和第二设备方便获知第一设备发送的第一数据基于的加密密钥，从而，可以提高确定解密密钥的效率。
结合第二方面的第一种可能实现方式，在该第二方面的第二种可能实现方式中，所述方法还包括：
所述中间设备接收所述第一设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据，所述第三数据为经过第三加密密钥加密的目标数据；
当所述中间设备确定所述第三数据传输消息中携带有所述第二预设标识时，所述中间设备向所述第二设备发送所述第三数据传输消息。
第一设备向中间设备发送携带有第三数据和第二预设标识的第三数据传输消息后，中间设备可以接收第一设备发送的第三数据传输消息，并可以对其进行解析，获取其中携带的第三数据和第二预设标识，其中，第三数据为经过第三加密密钥加密的目标数据。接收到第三数据传输消息后，中间设备可以判断第三数据传输消息中是否携带有第二预设标识，当确定第三数据传输消息中 携带有第二预设标识时，即当目标数据为不允许中间设备读取的数据时，可以将第三数据传输消息转发至第二设备，并不对第三数据进行任何处理。
这样，既可以在目标数据为允许中间设备读取的数据的情况下，使得中间设备能够正常工作，又可以在目标数据为不允许中间设备读取的数据的情况下，保证目标数据的安全性。
结合第二方面的第二种可能实现方式，在该第二方面的第三种可能实现方式中，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
结合第二方面，在该第二方面的第四种可能实现方式中，所述方法还包括：
所述中间设备接收所述第一设备发送的验证指示消息；
所述中间设备向所述第二设备发送携带有所述中间设备的设备信息的验证请求；
所述中间设备接收所述第二设备发送的用于指示所述中间设备合法的反馈消息，向所述第一设备发送所述第二设备发送的用于指示所述中间设备合法的反馈消息；
所述中间设备与所述第一设备协商用于数据传输的所述第一加密密钥和所述第一解密密钥，并与所述第二设备协商用于数据传输的所述第二加密密钥和对应的第二解密密钥。
第一设备向中间设备发送验证指示消息后，中间设备可以接收第一设备发送的验证指示消息，针对验证指示消息中携带有中间设备的设备信息的情况，接收到验证指示消息后，中间设备可以对其进行解析，获取其中携带的中间设备的设备信息。
针对验证指示消息中携带有中间设备的设备信息的情况，中间设备接收到第一设备发送的验证指示消息后，可以获取验证指示消息中携带的中间设备的设备信息，并可以向第二设备发送携带有中间设备的设备信息的验证请求。针对验证指示消息中未携带有中间设备的设备信息的情况，即第一设备中未预先配置中间设备的设备信息的情况，中间设备接收到第一设备发送的验证指示消息后，可以获取本地中预先存储的中间设备的设备信息，并向第二设备发送携带有中间设备的设备信息的验证请求。此外，中间设备发送的验证请求可以采 用明文的方式进行传输。第二设备接收到验证请求后，可以对中间设备的合法性进行验证，当中间设备合法时，第二设备可以向中间设备发送用于指示中间设备合法的反馈消息，进而，中间设备可以接收第二设备发送的用于指示所述中间设备合法的反馈消息，并可以向第一设备发送第二设备发送的用于指示中间设备合法的反馈消息，然后，中间设备可以与第一设备协商用于数据传输的第一加密密钥和第一解密密钥，并与第二设备协商用于数据传输的第二加密密钥和对应的第二解密密钥。
这样，先验证中间设备的合法性，在中间设备合法的基础上再协商第一加密密钥和对应的第一解密密钥，从而，可以防止目标数据被恶意设备(即不合法的中间设备)读取，进而，可以保证目标数据的安全性。
第三方面，提供了一种传输数据的方法，所述方法包括：
第二设备接收中间设备发送的携带有第二数据的第二数据传输消息，其中，所述第二数据为经过所述中间设备数据处理的目标数据再进行加密得到的数据；
所述第二设备基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
中间设备向第二设备发送携带有第二数据的第二数据传输消息后，第二设备可以接收中间设备发送的第二数据传输消息，并对其进行解析，获取其中携带的第二数据，其中，第二数据为经过中间设备数据处理的目标数据，再经过第二加密密钥加密的数据。第二设备中可以预先存储有第二设备与中间设备协商的解密密钥(即第二解密密钥)，其中，第二解密密钥可以用于对中间设备发送的第二数据进行解密处理。第二设备接收到第二数据后，可以判断目标数据是否为允许中间设备读取的数据，即判断第二数据是否是中间设备对目标数据进行过预设的数据处理，并对其进行加密的数据，当第二设备确定目标数据为允许中间设备读取的数据时，可以基于第二解密密钥，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据，其中，第二设备得到的数据可能与目标数据一致，也可能与目标数据不一致，是否相同取决于中间设备对目标数据的数据处理是否改变了目标数据。另外，第二设备中还可以预先存储有解密算法(可以称为第二解密算法)，即，第二设备获取到第二数据后，可以基于第二设备与中间设备协商的第二解密密钥和第二解密算法，对第二数据进 行解密处理，得到经过中间设备数据处理的目标数据。
结合第三方面，在该第三方面的第一种可能实现方式中，所述第二数据传输消息中还携带有第一预设标识，其中，所述第一预设标识用于指示允许所述中间设备读取所述目标数据；
所述第二设备基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据，包括：
当所述第二设备确定所述第二数据传输消息中携带有所述第一预设标识时，所述第二设备基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
第二设备获取到第二数据传输消息后，可以判断第二数据传输消息中是否携带有第一预设标识，当确定第二数据传输消息中携带有第一预设标识时，即当确定第二数据传输消息中携带的第二数据是经过中间设备数据处理的目标数据再进行加密得到的数据时，可以基于第二设备与中间设备协商的第二解密密钥，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据。
这样，可以在数据传输消息中携带相应的预设标识，从而，可以使得中间设备和第二设备方便获知第一设备发送的第一数据基于的加密密钥，从而，可以提高确定解密密钥的效率。
结合第三方面的第一种可能实现方式，在该第三方面的第二种可能实现方式中，所述方法还包括：
所述第二设备接收所述中间设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据，所述第三数据为经过第三加密密钥加密的目标数据；
当所述第二设备确定所述第三数据传输消息中携带有所述第二预设标识时，所述第二设备基于所述第二设备与所述第一设备协商的第三解密密钥，对所述第三数据进行解密处理，得到所述目标数据。
中间设备向第二设备发送携带有第三数据和第二预设标识的第三数据传输消息后，第二设备可以接收中间设备发送的第三数据传输消息，并可以对其进行解析，获取其中携带的第三数据和第二预设标识，其中，第三数据为经过第三加密密钥加密的目标数据。第二设备中可以预先存储有第二设备与第一设备协商的解密密钥(即第三解密密钥)，其中，第三解密密钥可以用于对第一 设备通过中间设备发送的第三数据进行解密处理。接收到第三数据传输消息后，第二设备可以判断第三数据传输消息中是否携带有第二预设标识，当确定第三数据传输消息中携带有第二预设标识时，即确定第三数据传输消息中携带的第三数据是第一设备基于第三加密密钥对目标数据进行加密得到的数据，中间设备并没有对目标数据进行任何处理时，第二设备可以基于第二设备与第一设备协商的第三解密密钥，对第三数据进行解密处理，得到目标数据。另外，第二设备中还可以预先存储有解密算法(可以称为第三解密算法)，即，当确定第三数据传输消息中携带有第二预设标识时，第二设备可以基于第二设备与第一设备协商的第三解密密钥和第三解密算法，对第三数据进行解密处理，得到目标数据。
这样，既可以在目标数据为允许中间设备读取的数据的情况下，使得中间设备能够正常工作，又可以在目标数据为不允许中间设备读取的数据的情况下，保证目标数据的安全性。
结合第三方面的第二种可能实现方式，在该第三方面的第三种可能实现方式中，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
结合第三方面，在该第三方面的第四种可能实现方式中，所述方法还包括：
所述第二设备接收所述中间设备发送的携带有所述中间设备的设备信息的验证请求；
所述第二设备根据所述中间设备的设备信息，验证所述中间设备的合法性；
如果所述中间设备合法，则所述第二设备通过所述中间设备向第一设备发送用于指示所述中间设备合法的反馈消息，并与所述中间设备协商用于数据传输的所述第二解密密钥和对应的第二加密密钥。
中间设备向第二设备发送验证请求后，第二设备可以接收中间设备发送的验证请求，并可以对其进行解析，获取其中携带的中间设备的设备信息。
获取到中间设备的设备信息后，第二设备可以根据预设的处理策略，验证中间设备的合法性。具体的，获取到中间设备的设备信息后，即获取到中间设备的设备标识、数据处理功能信息(可以是表述中间设备的数据处理功能的文 本信息)以及证书后，其中，证书是由特定机构为中间设备颁发的，可以是基于私钥对中间设备的数据处理功能信息进行加密得到的，第二设备可以获取对应中间设备的公钥，并基于获取的公钥对证书进行解密，如果可以正确解密，且解密得到的数据处理功能信息与验证请求中携带的数据处理功能信息相同，则第二设备可以确定中间设备合法。另外，第二设备中还可以存储有该第二设备允许中间设备进行的操作，在上述判断的基础上，结合第二设备允许中间设备进行的操作，验证中间设备的合法性。
对中间设备的合法性进行验证后，如果中间设备合法，则第二设备可以通过中间设备向第一设备发送对应中间设备发送的验证请求的反馈消息，其中，该反馈消息可以用于指示中间设备合法。具体的，第二设备可以向中间设备发送对应中间设备发送的验证请求的反馈消息，其中，反馈消息中可以携带有合法的中间设备的设备标识。另外，第二设备可以对反馈消息做完整性保护处理。第二设备还可以与中间设备协商用于数据传输的第二解密密钥和对应的第二加密密钥。
这样，先验证中间设备的合法性，在中间设备合法的基础上再协商第一加密密钥和对应的第一解密密钥，从而，可以防止目标数据被恶意设备(即不合法的中间设备)读取，进而，可以保证目标数据的安全性。
第四方面，提供了一种第一设备，所述第一设备包括处理器、发射器，其中：
所述处理器，用于获取待传输至第二设备的目标数据；如果所述目标数据为允许中间设备读取的数据，则基于所述第一设备与所述中间设备协商的第一加密密钥，对所述目标数据进行加密处理，得到第一数据；
所述发射器，用于向所述中间设备发送携带有所述第一数据的第一数据传输消息。
结合第四方面，在该第四方面的第一种可能实现方式中，所述第一数据传输消息中还携带有第一预设标识，其中，所述第一预设标识用于指示允许所述中间设备读取所述目标数据。
结合第四方面的第一种可能实现方式，在该第四方面的第二种可能实现方式中，所述处理器，还用于：
如果所述目标数据为不允许所述中间设备读取的数据，则基于所述第一设 备与所述第二设备协商的第三加密密钥，对所述目标数据进行加密处理，得到第三数据；
所述发射器，还用于：
向所述中间设备发送携带有所述第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据。
结合第四方面的第二种可能实现方式，在该第四方面的第三种可能实现方式中，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
结合第四方面，在该第四方面的第四种可能实现方式中，所述发射器，还用于：
向所述中间设备发送验证指示消息，其中，所述验证指示消息用于指示所述中间设备向所述第二设备发送用于验证所述中间设备合法性的验证请求；
所述第一设备还包括：
接收器，用于接收所述中间设备发送的用于指示所述中间设备合法的反馈消息；
所述处理器，还用于：
与所述中间设备协商用于数据传输的所述第一加密密钥和对应的第一解密密钥。
第五方面，提供了一种中间设备，所述中间设备包括接收器、处理器、发射器，其中：
所述接收器，用于接收第一设备发送的携带有第一数据的第一数据传输消息，其中，所述第一数据为经过第一加密密钥加密的目标数据；
所述处理器，用于基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；基于所述中间设备与第二设备协商的第二加密密钥，对经过数据处理的目标数据进行加密处理，得到第二数据；
所述发射器，用于向所述第二设备发送携带有所述第二数据的第二数据传 输消息。
结合第五方面，在该第五方面的第一种可能实现方式中，所述第一数据传输消息中还携带有第一预设标识，所述第一预设标识用于指示允许所述中间设备读取所述目标数据；
所述处理器，具体用于：
当所述处理器确定所述第一数据传输消息中携带有所述第一预设标识时，基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；
所述发射器，具体用于：
向所述第二设备发送携带有所述第二数据和所述第一预设标识的第二数据传输消息。
结合第五方面的第一种可能实现方式，在该第五方面的第二种可能实现方式中，所述接收器，还用于：
接收所述第一设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据，所述第三数据为经过第三加密密钥加密的目标数据；
所述发射器，还用于：
当所述处理器确定所述第三数据传输消息中携带有所述第二预设标识时，向所述第二设备发送所述第三数据传输消息。
结合第五方面的第二种可能实现方式，在该第五方面的第三种可能实现方式中，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
结合第五方面，在该第五方面的第四种可能实现方式中，所述接收器，还用于：
接收所述第一设备发送的验证指示消息；
所述发射器，还用于：
向所述第二设备发送携带有所述中间设备的设备信息的验证请求；
所述接收器，还用于：
接收所述第二设备发送的用于指示所述中间设备合法的反馈消息；
所述发射器，还用于：
向所述第一设备发送所述第二设备发送的用于指示所述中间设备合法的反馈消息；
所述处理器，还用于：
与所述第一设备协商用于数据传输的所述第一加密密钥和所述第一解密密钥，并与所述第二设备协商用于数据传输的所述第二加密密钥和对应的第二解密密钥。
第六方面，提供了一种第二设备，所述第二设备包括接收器、处理器，其中：
所述接收器，用于接收中间设备发送的携带有第二数据的第二数据传输消息，其中，所述第二数据为经过所述中间设备数据处理的目标数据再进行加密得到的数据；
所述处理器，用于基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
结合第六方面，在该第六方面的第一种可能实现方式中，所述第二数据传输消息中还携带有第一预设标识，其中，所述第一预设标识用于指示允许所述中间设备读取所述目标数据；
所述处理器，具体用于：
当所述处理器确定所述第二数据传输消息中携带有所述第一预设标识时，基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
结合第六方面的第一种可能实现方式，在该第六方面的第二种可能实现方式中，所述接收器，还用于：
接收所述中间设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据，所述第三数据为经过第三加密密钥加密的目标数据；
所述处理器，还用于：
当所述处理器确定所述第三数据传输消息中携带有所述第二预设标识时，基于所述第二设备与所述第一设备协商的第三解密密钥，对所述第三数据进行 解密处理，得到所述目标数据。
结合第六方面的第二种可能实现方式，在该第六方面的第三种可能实现方式中，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
结合第六方面，在该第六方面的第四种可能实现方式中，所述接收器，还用于：
接收所述中间设备发送的携带有所述中间设备的设备信息的验证请求；
所述处理器，还用于：
根据所述中间设备的设备信息，验证所述中间设备的合法性；
所述第二设备还包括：
发射器，用于如果所述中间设备合法，则通过所述中间设备向第一设备发送用于指示所述中间设备合法的反馈消息；
所述处理器，还用于：
与所述中间设备协商用于数据传输的所述第二解密密钥和对应的第二加密密钥。
第七方面，提供了一种第一设备，所述第一设备包括：
获取模块，具体可由处理器实现，用于获取待传输至第二设备的目标数据；
加密模块，具体可由处理器实现，用于如果所述目标数据为允许中间设备读取的数据，则基于所述第一设备与所述中间设备协商的第一加密密钥，对所述目标数据进行加密处理，得到第一数据；
发送模块，具体可由发射器实现，用于向所述中间设备发送携带有所述第一数据的第一数据传输消息。
结合第七方面，在该第七方面的第一种可能实现方式中，所述第一数据传输消息中还携带有第一预设标识，其中，所述第一预设标识用于指示允许所述中间设备读取所述目标数据。
结合第七方面的第一种可能实现方式，在该第七方面的第二种可能实现方式中，所述加密模块，还用于：
如果所述目标数据为不允许所述中间设备读取的数据，则基于所述第一设 备与所述第二设备协商的第三加密密钥，对所述目标数据进行加密处理，得到第三数据；
所述发送模块，还用于：
向所述中间设备发送携带有所述第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据。
结合第七方面的第二种可能实现方式，在该第七方面的第三种可能实现方式中，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
结合第七方面，在该第七方面的第四种可能实现方式中，所述发送模块，还用于：
向所述中间设备发送验证指示消息，其中，所述验证指示消息用于指示所述中间设备向所述第二设备发送用于验证所述中间设备合法性的验证请求；
所述第一设备还包括：
接收模块，用于接收所述中间设备发送的用于指示所述中间设备合法的反馈消息；
协商模块，用于与所述中间设备协商用于数据传输的所述第一加密密钥和对应的第一解密密钥。
第八方面，提供了一种中间设备，所述中间设备包括：
接收模块，具体可由接收器实现，用于接收第一设备发送的携带有第一数据的第一数据传输消息，其中，所述第一数据为经过第一加密密钥加密的目标数据；
解密模块，具体可由处理器实现，用于基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；
加密模块，具体可由处理器实现，用于基于所述中间设备与第二设备协商的第二加密密钥，对经过数据处理的目标数据进行加密处理，得到第二数据；
发送模块，具体可由发射器实现，用于向所述第二设备发送携带有所述第 二数据的第二数据传输消息。
结合第八方面，在该第八方面的第一种可能实现方式中，所述第一数据传输消息中还携带有第一预设标识，所述第一预设标识用于指示允许所述中间设备读取所述目标数据；
所述解密模块，具体用于：
当确定所述第一数据传输消息中携带有所述第一预设标识时，基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；
所述发送模块，具体用于：
向所述第二设备发送携带有所述第二数据和所述第一预设标识的第二数据传输消息。
结合第八方面的第一种可能实现方式，在该第八方面的第二种可能实现方式中，所述接收模块，还用于：
接收所述第一设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据，所述第三数据为经过第三加密密钥加密的目标数据；
所述发送模块，还用于：
当确定所述第三数据传输消息中携带有所述第二预设标识时，向所述第二设备发送所述第三数据传输消息。
结合第八方面的第二种可能实现方式，在该第八方面的第三种可能实现方式中，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
结合第八方面，在该第八方面的第四种可能实现方式中，所述接收模块，还用于：
接收所述第一设备发送的验证指示消息；
所述发送模块，还用于：
向所述第二设备发送携带有所述中间设备的设备信息的验证请求；
所述接收模块，还用于：
接收所述第二设备发送的用于指示所述中间设备合法的反馈消息；
所述发送模块，还用于：
向所述第一设备发送所述第二设备发送的用于指示所述中间设备合法的反馈消息；
所述中间设备还包括：
协商模块，用于与所述第一设备协商用于数据传输的所述第一加密密钥和所述第一解密密钥，并与所述第二设备协商用于数据传输的所述第二加密密钥和对应的第二解密密钥。
第九方面，提供了一种第二设备，所述第二设备包括：
接收模块，具体可由接收器实现，用于接收中间设备发送的携带有第二数据的第二数据传输消息，其中，所述第二数据为经过所述中间设备数据处理的目标数据再进行加密得到的数据；
解密模块，具体可由处理器实现，用于基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
结合第九方面，在该第九方面的第一种可能实现方式中，所述第二数据传输消息中还携带有第一预设标识，其中，所述第一预设标识用于指示允许所述中间设备读取所述目标数据；
所述解密模块，具体用于：
当确定所述第二数据传输消息中携带有所述第一预设标识时，基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
结合第九方面的第一种可能实现方式，在该第九方面的第二种可能实现方式中，所述接收模块，还用于：
接收所述中间设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据，所述第三数据为经过第三加密密钥加密的目标数据；
所述解密模块，还用于：
当确定所述第三数据传输消息中携带有所述第二预设标识时，基于所述第二设备与所述第一设备协商的第三解密密钥，对所述第三数据进行解密处理，得到所述目标数据。
结合第九方面的第二种可能实现方式，在该第九方面的第三种可能实现方式中，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
结合第九方面，在该第九方面的第四种可能实现方式中，所述接收模块，还用于：
接收所述中间设备发送的携带有所述中间设备的设备信息的验证请求；
所述第二设备还包括：
验证模块，用于根据所述中间设备的设备信息，验证所述中间设备的合法性；
发送模块，用于如果所述中间设备合法，则通过所述中间设备向第一设备发送用于指示所述中间设备合法的反馈消息；
协商模块，用于与所述中间设备协商用于数据传输的所述第二解密密钥和对应的第二加密密钥。
第十方面，提供了一种传输数据的系统，所述系统包括第一设备、中间设备和第二设备，其中：
所述第一设备，用于获取待传输至所述第二设备的目标数据，如果所述目标数据为允许所述中间设备读取的数据，则基于所述第一设备与所述中间设备协商的第一加密密钥，对所述目标数据进行加密处理，得到第一数据，向所述中间设备发送携带有所述第一数据的第一数据传输消息；
所述中间设备，用于接收所述第一设备发送的携带有所述第一数据的第一数据传输消息，基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理，基于所述中间设备与第二设备协商的第二加密密钥，对经过数据处理的目标数据进行加密处理，得到第二数据，向所述第二设备发送携带有所述第二数据的第二数据传输消息；
所述第二设备，用于接收所述中间设备发送的携带有所述第二数据的第二数据传输消息，基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
本发明实施例提供的技术方案带来的有益效果是：
本发明实施例中，第一设备发送至第二设备目标数据需要进行加密时，第一设备可以采用第一设备与中间设备协商的第一加密密钥对目标数据进行加密处理，然后将其发送至中间设备，中间设备接收到第一设备发送的经过第一加密密钥加密的目标数据后，可以采用中间设备与第一设备协商的第一解密密钥对其进行解密，得到目标数据，并对目标数据进行预设的数据处理，进而，可以采用中间设备与第二设备协商的第二加密密钥对经过数据处理的目标数据进行加密，并将其发送至第二设备，第二设备接收到中间设备发送的数据后，可以采用第二设备与中间设备协商的第二解密密钥进行解密处理，得到经过中间设备数据处理的目标设备。这样，中间设备可以基于预先与第一设备协商的解密密钥对第一设备发送的数据进行解密，可以读取第一设备将要发送至第二设备的数据，进而，可以对目标数据进行预设的数据处理，从而，可以使得中间设备能够正常工作。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例提供的一种系统框架示意图；
图2是本发明实施例提供的一种第一设备的结构示意图；
图3是本发明实施例提供的一种中间设备的结构示意图；
图4是本发明实施例提供的一种第二设备的结构示意图；
图5是本发明实施例提供的一种传输数据的方法的流程图；
图6是本发明实施例提供的一种协商密钥的方法的流程图；
图7是本发明实施例提供的一种传输数据的方法的流程图；
图8是本发明实施例提供的一种第一设备结构示意图；
图9是本发明实施例提供的一种第一设备结构示意图；
图10是本发明实施例提供的一种中间设备结构示意图；
图11是本发明实施例提供的一种中间设备结构示意图；
图12是本发明实施例提供的一种第二设备结构示意图；
图13是本发明实施例提供的一种第二设备结构示意图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
本发明实施例提供了一种传输数据的方法，该方法可以由第一设备、中间设备和第二设备共同实现。第一设备和第二设备可以分别是终端和服务器中的任意一者，其中，终端可以是手机、平板电脑等移动终端，也可以是PC(Personal Computer，个人电脑)，服务器可以是与终端进行通信的服务器，可以是某服务的后台服务器，比如可以是网站服务器，当第一设备是终端时，第二设备是服务器，此种情况下，下述处理过程即是终端向服务器发送目标数据的过程，当第一设备是服务器时，第二设备是终端，此种情况下，下述处理过程即是服务器向终端发送目标数据的过程。中间设备可以是第一设备与第二设备传输数据的传输路径中的设备，其中，中间设备具有预设的数据处理功能，可以对第一设备与第二设备传输的数据进行预设的数据处理。
第一设备获取到待传输至第二设备的目标数据后，可以基于第一设备与中间设备协商的第一加密密钥，对目标数据进行加密，得到第一数据，向中间设备发送携带有第一数据的第一数据传输消息，中间设备接收第一设备发送的携带有第一数据的第一数据传输消息后，可以基于中间设备与第一设备协商的第一解密密钥，对第一数据进行解密，得到目标数据，进而，可以对目标数据进行预设的数据处理，并基于中间设备与第二设备协商的第二加密密钥，对经过中间设备数据处理的目标数据进行加密，得到第二数据，向第二设备发送携带有第二数据的第二数据传输消息，第二设备接收到第二数据传输消息后，可以基于中间设备与第二设备协商的第二解密密钥，对第二数据进行解密，得到经过中间设备数据处理的目标数据，系统示意图如图1所示。另外，第二设备也可以向第一设备发送目标数据，其处理过程与第一设备向第二设备发送目标数据的处理过程相同，本发明实施例以第一设备向第二设备发送目标数据为例进行表述，其他情况与之类似，不再进行阐述。
第一设备可以包括处理器210、发射器220、接收器230，接收器230和发射器220可以分别与处理器210连接，如图2所示。接收器230可以用于接收消息或数据，接收器230可以包括但不限于至少一个放大器、调谐器、一个或 多个振荡器、耦合器、LNA(Low Noise Amplifier，低噪声放大器)、双工器等，发射器220可以用于发送消息或数据，即可以发送携带有第一数据的第一数据传输消息。处理器210可以是第一设备的控制中心，利用各种接口和线路连接整个第一设备的各个部分，如接收器230和发射器220等。在本发明中，处理器210可以用于对目标数据进行加密处理，可选的，处理器210可以包括一个或多个处理单元；优选的，处理器210可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统，调制解调处理器主要处理无线通信。处理器210还可以是数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件等。第一设备还可以包括存储器，存储器可用于存储软件程序以及模块，处理器210通过读取存储在存储器的软件代码以及模块，从而执行第一设备的各种功能应用以及数据处理。
中间设备可以包括接收器310、处理器320、发射器330，发射器330和接收器310可以分别与处理器320连接，如图3所示。发射器330可以用于发送消息或数据，本发明中，发射器330可以用于发送携带有第二数据的第二数据传输消息，发射器330可以包括但不限于至少一个放大器、调谐器、一个或多个振荡器、耦合器、LNA(Low Noise Amplifier，低噪声放大器)、双工器等，与发射器330的结构类似，接收器310也可以包括但不限于天线、至少一个放大器、调谐器、一个或多个振荡器、耦合器、LNA(Low Noise Amplifier，低噪声放大器)、双工器等，可以用于接收数据或消息，本发明中，接收器310可以用于接收第一设备发送的携带有第一数据的第一数据传输消息。处理器320可以包括一个或多个处理单元；处理器320可以是通用处理器，包括中央处理器(Central Processing Unit，简称CPU)、网络处理器(Network Processor，简称NP)等；还可以是数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件等。具体地，程序可以包括程序代码，程序代码包括计算机操作指令。中间设备还可以包括存储器，存储器可用于存储软件程序以及模块，处理器320通过读取存储在存储器的软件代码以及模块，从而执行中间设备的各种功能应用以及数据处理。
第二设备可以包括接收器410、处理器420、发射器430，发射器430和接收器410可以分别与处理器420连接，如图4所示。发射器430可以用于发送消息或数据，发射器430可以包括但不限于至少一个放大器、调谐器、一个或多个振荡器、耦合器、LNA(Low Noise Amplifier，低噪声放大器)、双工器等， 与发射器430的结构类似，接收器410也可以包括但不限于天线、至少一个放大器、调谐器、一个或多个振荡器、耦合器、LNA(Low Noise Amplifier，低噪声放大器)、双工器等，可以用于接收数据或消息，本发明中，接收器410可以用于接收中间设备发送的携带有第二数据的第二数据传输消息。处理器420可以包括一个或多个处理单元；处理器420可以是通用处理器，包括中央处理器(Central Processing Unit，简称CPU)、网络处理器(Network Processor，简称NP)等；还可以是数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件等。具体地，程序可以包括程序代码，程序代码包括计算机操作指令。第二设备还可以包括存储器，存储器可用于存储软件程序以及模块，处理器420通过读取存储在存储器的软件代码以及模块，从而执行第二间设备的各种功能应用以及数据处理。
下面将结合具体实施方式，对图5所示的处理流程进行详细的说明，内容可以如下：
步骤501，第一设备获取待传输至第二设备的目标数据。
其中，第一设备和第二设备可以是终端和服务器中的任意一个，第一设备可以是终端，第二设备可以是服务器，目标数据可以是第一设备待传输的业务数据。
在实施中，为保证数据传输的安全性，越来越多的服务器要求与终端进行传输的数据需要进行加密处理，即TLS协议或者Quic(Quick UDP(User Datagram Protocol，用户数据报协议)Internet Connection，基于UDP的低时延互联网传输层)协议得到了广泛应用，此种情况下，第一设备将要向第二设备发送数据时，可以获取待传输的目标数据。
步骤502，如果目标数据为允许中间设备读取的数据，则第一设备基于第一设备与中间设备协商的第一加密密钥，对目标数据进行加密处理，得到第一数据。
其中，中间设备可以是具有预设数据处理功能的设备，可以是第一设备与第二设备传输数据时的传输路径中的设备。
在实施中，第一设备中可以预先存储有第一判断策略，其中，第一判断策略可以用于第一设备确定待传输至第二设备的目标数据是否允许中间设备读取，第一设备中可以存储有允许中间设备读取的数据的数据类型列表，和/或可以存储有不允许中间设备读取的数据的数据类型列表，例如，第一设备为终端， 目标数据为用户输入的密码时，不允许中间设备读取，数据为视频时，允许中间设备读取。第一设备中还可以预先存储有第一设备与中间设备协商的加密密钥(即第一加密密钥)，其中，第一加密密钥可以用于对目标数据进行加密处理。
第一设备获取到目标数据后，可以判断该目标数据是否允许中间设备读取的数据，如果目标数据为允许中间设备读取的数据，则第一设备可以基于预先存储的第一加密密钥，对目标数据进行加密处理，得到第一数据，其中，第一设备中还可以预先存储有加密算法(可以称为第一加密算法)，即，第一设备可以基于第一设备与中间设备协商的第一加密密钥和第一加密算法，对目标数据进行加密处理，得到第一数据。
步骤503，第一设备向中间设备发送携带有第一数据的第一数据传输消息。
在实施中，第一设备得到第一数据后，可以向中间设备发送数据传输消息(即第一数据传输消息)，其中，第一数据传输消息中还可以携带有第一数据。
可选的，第一数据传输消息中还携带有第一预设标识，其中，第一预设标识用于指示允许中间设备读取目标数据。
在实施中，当第一设备确定出目标数据为允许中间设备读取的数据时，第一设备发送至中间设备的第一数据传输消息中，还可以携带有用于指示允许中间设备读取目标数据的预设标识(即第一预设标识)，例如，第一数据传输消息中可以携带有A标识，即第一数据传输消息中携带有A标识时，说明第一设备待传输的目标数据为允许中间设备读取的数据。另外，第一预设标识可以做完整性保护，不进行加密处理。
可选的，第一预设标识可以设置在TLS包头中或者QUIC包头中，具体的，第一预设标识设置于传输层控制TLS包头中；或者，第一预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
在实施中，第一设备与第二设备传输目标数据时，可以基于TLS协议传输目标数据，也可以基于QUIC协议传输目标数据，分别针对不同的情况，第一预设标识可以设置在TLS包头中，或者，设置在QUIC包头中。
相应的，中间设备接收第一设备发送的携带有第一数据的第一数据传输消息，其中，第一数据为经过第一加密密钥加密的目标数据。
在实施中，第一设备向中间设备发送第一数据传输消息后，中间设备可以接收第一设备发送的第一数据传输消息，可以对其进行解析，获取其中携带的 第一数据，其中，第一数据为经过第一加密密钥加密的目标数据。
可选的，针对第一设备发送的第一数据传输消息中携带有第一预设标识的情况，中间设备接收到的第一数据传输消息中还可以携带有第一预设标识，第一预设标识用于指示允许中间设备读取目标数据。另外，第一设备可以对第一预设标识做完整性保护处理，不进行加密处理，即中间设备可以读取该第一预设标识，不能对其进行更改。
可选的，第一预设标识可以设置在TLS包头中或者QUIC包头中，具体的，第一预设标识设置于传输层控制TLS包头中；或者，第一预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
在实施中，第一设备与第二设备传输目标数据时，可以基于TLS协议传输目标数据，也可以基于QUIC协议传输目标数据，分别针对不同的情况，第一预设标识可以设置在TLS包头中，或者，设置在QUIC包头中。
步骤504，中间设备基于中间设备与第一设备协商的第一解密密钥，对第一数据进行解密处理，得到目标数据，并对目标数据进行预设的数据处理。
在实施中，中间设备中可以预先存储有中间设备与第一设备协商的解密密钥(即第一解密密钥)，其中，第一解密密钥可以用于对第一设备发送的第一数据进行解密处理。中间设备获取到第一数据后，可以判断目标数据是否为允许中间设备读取的数据，当目标数据为允许中间设备读取的数据时，中间设备可以基于预先存储的中间设备与第一设备协商的第一解密密钥，对第一数据进行解密处理，得到目标数据，其中，中间设备中还可以预先存储有解密算法(可以称为第一解密算法)，即，中间设备可以基于第一设备与中间设备协商的第一解密密钥和第一解密算法，对第一数据进行解密处理，得到目标数据。
中间设备得到目标数据后，可以按照自身具有的数据处理功能，对得到的目标数据进行预设的数据处理，具体的，中间设备可以具有预设的数据处理功能，其中，预设的数据处理功能可以是统计数据功能，此种情况下，中间设备可以读取第一设备待传输至第二设备的目标数据，以便于进行统计，不改变目标数据，预设的数据处理功能也可以是视频优化功能，此种情况下，中间设备可以读取第一设备待传输至第二设备的目标数据，并基于预设的数据处理功能对目标数据进行改变，例如，第一设备为服务器，视频优化功能是将高清视频数据改变为标清视频数据，此种情况下，中间设备可以读取服务器发送至终端的高清视频数据(即目标数据)，进而，可以将目标数据改变为标清视频数据。 也就是说，中间设备对目标数据进行预设的数据处理后，得到的数据可能与目标数据相同，也可能不同。
可选的，针对第一数据传输消息中还携带有第一预设标识的情况，步骤504的处理过程可以如下：当中间设备确定第一数据传输消息中携带有第一预设标识时，中间设备基于中间设备与第一设备协商的第一解密密钥，对第一数据进行解密处理，得到目标数据，并对目标数据进行预设的数据处理。
在实施中，中间设备获取到第一数据传输消息后，可以判断第一数据传输消息中是否携带有第一预设标识，当中间设备确定第一数据传输消息中携带有第一预设标识时，可以按照上述步骤504表述的处理过程对第一数据进行处理，即基于中间设备与第一设备协商的第一解密密钥，对第一数据进行解密处理，得到目标数据，并对目标数据进行预设的数据处理。
步骤505，中间设备基于中间设备与第二设备协商的第二加密密钥，对经过数据处理的目标数据进行加密处理，得到第二数据。
在实施中，中间设备中可以预先存储有中间设备与第二设备协商的加密密钥(即第二加密密钥)，其中，第二加密密钥可以用于对经过数据处理的目标数据进行加密处理。中间设备对目标数据进行预设的数据处理后，可以获取预先存储的第二加密密钥，并基于第二加密密钥对经过数据处理的目标数据进行加密处理，得到第二数据，其中，中间设备中还可以预先存储有加密算法(可以称为第二加密算法)，即，中间设备可以基于中间设备与第二设备协商的第二加密密钥和第二加密算法，对经过数据处理的目标数据进行加密处理，得到第二数据。
步骤506，中间设备向第二设备发送携带有第二数据的第二数据传输消息。
在实施中，中间设备得到第二数据后，可以向第二设备发送数据传输消息(即第二数据传输消息)，其中，第二数据传输消息中可以携带有第二数据。
可选的，针对第一数据传输消息中携带有第一预设标识的情况，步骤507的处理过程可以如下：中间设备向第二设备发送携带有第二数据和第一预设标识的第二数据传输消息。
在实施中，当第一数据传输消息中携带有第一预设标识时，中间设备发送至第二设备的第二数据传输消息中还可以携带有第一预设标识，即第二数据传输消息中携带有第二数据和第一预设标识。
相应的，第二设备接收中间设备发送的携带有第二数据的第二数据传输消 息，其中，第二数据为经过中间设备数据处理的目标数据再进行加密得到的数据。
在实施中，中间设备向第二设备发送携带有第二数据的第二数据传输消息后，第二设备可以接收中间设备发送的第二数据传输消息，并对其进行解析，获取其中携带的第二数据，其中，第二数据为经过中间设备数据处理的目标数据，再经过第二加密密钥加密的数据。
可选的，针对中间设备发送的第二数据传输消息中携带有第一预设标识的情况，第二设备接收到的第二数据传输消息中还可以携带有第一预设标识，其中，第一预设标识用于指示允许中间设备读取目标数据。
可选的，第一预设标识可以设置在TLS包头中或者QUIC包头中，具体的，第一预设标识设置于传输层控制TLS包头中；或者，第一预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
在实施中，第一设备与第二设备传输目标数据时，可以基于TLS协议传输目标数据，也可以基于QUIC协议传输目标数据，分别针对不同的情况，第一预设标识可以设置在TLS包头中，或者，设置在QUIC包头中。
步骤507，第二设备基于第二设备与中间设备协商的第二解密密钥，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据。
在实施中，第二设备中可以预先存储有第二设备与中间设备协商的解密密钥(即第二解密密钥)，其中，第二解密密钥可以用于对中间设备发送的第二数据进行解密处理。第二设备接收到第二数据后，可以判断目标数据是否为允许中间设备读取的数据，即判断第二数据是否是中间设备对目标数据进行过预设的数据处理，并对其进行加密的数据，当第二设备确定目标数据为允许中间设备读取的数据时，可以基于第二解密密钥，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据，其中，第二设备得到的数据可能与目标数据一致，也可能与目标数据不一致，是否相同取决于中间设备对目标数据的数据处理是否改变了目标数据。另外，第二设备中还可以预先存储有解密算法(可以称为第二解密算法)，即，第二设备获取到第二数据后，可以基于第二设备与中间设备协商的第二解密密钥和第二解密算法，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据。
可选的，针对第二数据传输消息中还携带有第一预设标识的情况，相应的，步骤507的处理过程可以如下：当第二设备确定第二数据传输消息中携带有第 一预设标识时，第二设备基于第二设备与中间设备协商的第二解密密钥，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据。
在实施中，第二设备获取到第二数据传输消息后，可以判断第二数据传输消息中是否携带有第一预设标识，当第二设备确定第二数据传输消息中携带有第一预设标识时，即当确定第二数据传输消息中携带的第二数据是经过中间设备数据处理的目标数据再进行加密得到的数据时，可以按照上述步骤507表述的处理过程对第二数据进行处理，即基于第二设备与中间设备协商的第二解密密钥，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据。
第一设备、中间设备和第二设备可以在目标数据传输前，协商上述密钥，本发明实施例中，还提供了一种协商密钥的方法，如图6所示，第一设备、中间设备和第二设备可以应用该方法协商上述讲述的加密密钥和解密密钥。
下面将结合具体实施方式，对图6所示的处理流程进行详细的说明，内容可以如下：
步骤601，第一设备向中间设备发送验证指示消息，其中，验证指示消息用于指示中间设备向第二设备发送用于验证中间设备合法性的验证请求。
在实施中，第一设备与第二设备传输数据时，可以基于TLS协议传输数据，也可以基于QUIC协议传输数据。当基于TLS协议传输数据时，第一设备与第二设备在传输数据前，可以先建立TCP(Transmission Control Protocol，传输控制协议)连接，即第一设备与第二设备进行TCP三次握手，然后，建立TLS连接，其中，建立TLS连接的过程即是第一设备与第二设备协商密钥的过程，即协商下述处理过程中涉及的用于数据传输的第三加密密钥和对应的第三解密密钥。当基于QUIC协议传输数据时，第一设备与第二设备在传输数据前，可以先建立QUIC连接。
第一设备与第二设备传输目标数据时，第一设备可以向中间设备发送验证指示消息，其中，该验证指示消息可以用于指示中间设备向第二设备发送用于验证中间设备合法性的验证请求，其中，对于上述提及的两种情况，针对基于TLS协议传输目标数据的情况，该验证指示消息可以在TLS建立的过程中发送，也可以在TLS连接建立后，针对基于QUIC协议传输目标数据的情况，该验证指示消息可以在QUIC连接的建立过程中，也可以在QUIC连接建立后，本发明实施例不对其进行限定。另外，第一设备中可以预先设置有中间设备的 设备信息，其中，中间设备的设备信息可以是中间设备的设备标识(可以是中间设备的设备名称，也可以是中间设备的MAC地址，也可以是中间设备的IP(Internet Protocol，网络协议)地址)、数据处理功能信息(可以是表述中间设备的数据处理功能的文本信息)以及证书，此种情况下，验证指示消息中可以携带有中间设备的设备信息。第一设备中也可以不预先配置有中间设备的设备信息，本发明实施例不对其进行限定。此外，第一设备发送的验证指示消息可以采用明文的方式进行传输。
相应的，中间设备接收第一设备发送的验证指示消息。
在实施中，第一设备向中间设备发送验证指示消息后，中间设备可以接收第一设备发送的验证指示消息，针对验证指示消息中携带有中间设备的设备信息的情况，中间设备接收到验证指示消息后，可以对其进行解析，获取其中携带的中间设备的设备信息。
步骤602，中间设备向第二设备发送携带有中间设备的设备信息的验证请求。
在实施中，针对验证指示消息中携带有中间设备的设备信息的情况，中间设备接收到第一设备发送的验证指示消息后，可以获取验证指示消息中携带的中间设备的设备信息，并向第二设备发送携带有中间设备的设备信息的验证请求。针对验证指示消息中未携带有中间设备的设备信息的情况，即第一设备中未预先配置中间设备的设备信息的情况，中间设备接收到第一设备发送的验证指示消息后，可以获取本地中预先存储的中间设备的设备信息，并向第二设备发送携带有中间设备的设备信息的验证请求。此外，中间设备发送的验证请求可以采用明文的方式进行传输。
相应的，第二设备接收中间设备发送的携带有中间设备的设备信息的验证请求。
在实施中，中间设备向第二设备发送验证请求后，第二设备可以接收中间设备发送的验证请求，并对其进行解析，获取其中携带的中间设备的设备信息。
步骤603，第二设备根据中间设备的设备信息，验证中间设备的合法性。
在实施中，第二设备获取到中间设备的设备信息后，可以根据预设的处理策略，验证中间设备的合法性。具体的，第二设备获取到中间设备的设备信息后，即获取到中间设备的设备标识、数据处理功能信息(可以是表述中间设备的数据处理功能的文本信息)以及证书后，其中，证书是由特定机构为中间设 备颁发的，可以是由特定机构基于私钥对中间设备的数据处理功能信息进行加密得到的，第二设备可以获取对应中间设备的公钥，并基于获取的公钥对证书进行解密，如果可以正确解密，且解密得到的数据处理功能信息与验证请求中携带的数据处理功能信息相同，则第二设备可以确定中间设备合法。另外，第二设备中还可以存储有该第二设备允许中间设备进行的操作，在上述判断的基础上，结合第二设备允许中间设备进行的操作，验证中间设备的合法性，例如，中间设备的数据处理功能为视频优化，如果第二设备中预先存储有允许具有视频优化功能的中间设备对传输的数据进行数据处理，则在解密得到的数据处理功能信息与验证请求中携带的数据处理功能信息相同的基础上，第二设备可以确定中间设备合法，如果第二设备中预先存储有不允许具有视频优化功能的中间设备对传输的数据进行数据处理，则即使解密得到的数据处理功能信息与验证请求中携带的数据处理功能信息相同，第二设备也确定中间设备不合法。
步骤604，如果中间设备合法，则第二设备通过中间设备向第一设备发送用于指示中间设备合法的反馈消息。
在实施中，第二设备对中间设备的合法性进行验证后，如果中间设备合法，则第二设备可以通过中间设备向第一设备发送对应中间设备发送的验证请求的反馈消息，其中，该反馈消息可以用于指示中间设备合法。具体的，第二设备可以向中间设备发送对应中间设备发送的验证请求的反馈消息，其中，反馈消息中可以携带有合法的中间设备的设备标识。另外，第二设备可以对反馈消息做完整性保护处理。
步骤605，中间设备接收第二设备发送的用于指示中间设备合法的反馈消息，向第一设备发送第二设备发送的用于指示中间设备合法的反馈消息。
在实施中，第二设备向中间设备发送反馈消息后，中间设备可以接收第二设备发送的反馈消息，其中，还反馈消息可以用于指示中间设备合法，进而，可以向第一设备发送第二设备发送的用于指示中间设备合法的反馈消息。
相应的，第一设备接收中间设备发送的用于指示中间设备合法的反馈消息。
在实施中，中间设备向第一设备发送用于指示中间设备合法的反馈消息后，第一设备可以接收该反馈消息。
另外，第一设备接收到反馈消息后，可以通过中间设备向第二设备发送对应反馈消息的确认消息，以便通知第二设备第一设备已接收到用于指示中间设 备合法的反馈消息。
步骤606，中间设备与第一设备协商用于数据传输的第一加密密钥和第一解密密钥，并与第二设备协商用于数据传输的第二加密密钥和对应的第二解密密钥。
在实施中，如果中间设备合法，则第一设备、中间设备和第二设备可以协商上述提及的加密密钥和解密密钥，即在中间设备合法的基础上，第一设备、中间设备和第二设备可以协商上述提及的加密密钥和解密密钥。具体的，中间设备可以与第一设备协商用于数据传输的第一加密密钥和第一解密密钥，并与第二设备协商用于数据传输的第二加密密钥和对应的第二解密密钥，其中，中间设备与第一设备协商用于数据传输的第一加密密钥和对应的第一解密密钥时，可以由第一设备发起，也可以由中间设备发起，中间设备与第二设备协商用于数据传输的第二加密密钥和对应的第二解密密钥时，可以由第二设备发起，也可以由中间设备发起，本发明实施例不对其进行限定。另外，中间设备还可以与第一设备协商第一加密算法和第一解密算法，并与第二设备协商第二加密算法和对应的第二解密算法。此外，在验证中间设备合法的基础上，第一设备、中间设备和第二设备还可以协商第二设备通过中间设备向第一设备发送数据时，需要的加密密钥和解密密钥。
另外，第一加密密钥、第二加密密钥可以相同，也可以不同，第一解密密钥、第二解密密钥可以相同，也可以不同。本发明实施例不对其进行限定。
本发明实施例中，针对目标数据为不允许中间设备读取的数据的情况，还提供了一种传输数据的方法，如图7所示。
下面将结合具体实施方式，对图7所示的处理流程进行详细的说明，内容可以如下：
步骤701，第一设备获取待传输至第二设备的目标数据。
在实施中，为保证数据传输的安全性，越来越多的服务器要求与终端进行传输的数据需要进行加密处理，即TLS协议或者Quic(Quick UDP(User Datagram Protocol，用户数据报协议)Internet Connection，基于UDP的低时延互联网传输层)协议得到了广泛应用，此种情况下，第一设备将要向第二设备发送数据时，可以获取待传输的目标数据。
步骤702，如果目标数据为不允许中间设备读取的数据，则第一设备基于 第一设备与第二设备协商的第三加密密钥，对目标数据进行加密处理，得到第三数据。
在实施中，第一设备中可以预先存储有第一判断策略，其中，第一判断策略可以用于第一设备确定待传输至第二设备的目标数据是否允许中间设备读取，第一设备中可以存储有允许中间设备读取的数据的数据类型列表，和/或可以存储有不允许中间设备读取的数据的数据类型列表，例如，第一设备为终端，目标数据为用户输入的密码时，不允许中间设备读取，数据为视频时，允许中间设备读取。第一设备中还可以预先存储有第一设备与第二设备协商的加密密钥(即第三加密密钥)，其中，第三加密密钥可以用于对目标数据进行加密处理。
第一设备获取到目标数据后，可以判断该目标数据是否允许中间设备读取的数据，如果目标数据为不允许中间设备读取的数据，则第一设备可以基于预先存储的第三加密密钥，对目标数据进行加密处理，得到第三数据，其中，第一设备中还可以预先存储有加密算法(可以称为第三加密算法)，即，第一设备可以基于第一设备与第二设备协商的第三加密密钥和第三加密算法，对目标数据进行加密处理，得到第三数据。
步骤703，第一设备向中间设备发送携带有第三数据和第二预设标识的第三数据传输消息，其中，第二预设标识用于指示不允许中间设备读取目标数据。
在实施中，针对如果目标数据为允许中间设备读取的数据，则第一数据传输消息中携带有第一预设标识的情况，当第一设备确定出目标数据为不允许中间设备读取的数据时，可以向中间设备发送携带有第三数据和第二预设标识的第三数据传输消息，其中，第二预设标识可以用于指示不允许中间设备读取目标数据。另外，第一设备可以对第二预设标识进行完整性保护处理。
可选的，第二预设标识可以设置在TLS包头中或者QUIC包头中，具体的，第二预设标识设置于传输层控制TLS包头中；或者，第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
在实施中，第一设备与第二设备传输目标数据时，可以基于TLS协议传输目标数据，也可以基于QUIC协议传输目标数据，分别针对不同的情况，第二预设标识可以设置在TLS包头中，或者，设置在QUIC包头中。
相应的，中间设备接收第一设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，第二预设标识用于指示不允许中间设备读取目标数 据，第三数据为经过第三加密密钥加密的目标数据。
在实施中，第一设备向中间设备发送携带有第三数据和第二预设标识的第三数据传输消息后，中间设备可以接收第一设备发送的第三数据传输消息，并对其进行解析，获取其中携带的第三数据和第二预设标识，其中，第三数据为经过第三加密密钥加密的目标数据。
步骤704，当中间设备确定第三数据传输消息中携带有第二预设标识时，中间设备向第二设备发送第三数据传输消息。
在实施中，中间设备接收到第三数据传输消息后，可以判断第三数据传输消息中是否携带有第二预设标识，当中间设备确定第三数据传输消息中携带有第二预设标识时，即当目标数据为不允许中间设备读取的数据时，中间设备可以将第三数据传输消息转发至第二设备，并不对第三数据进行任何处理。
可选的，第二预设标识可以设置在TLS包头中或者QUIC包头中，具体的，第二预设标识设置于传输层控制TLS包头中；或者，第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
在实施中，第一设备与第二设备传输目标数据时，可以基于TLS协议传输目标数据，也可以基于QUIC协议传输目标数据，分别针对不同的情况，第二预设标识可以设置在TLS包头中，或者，设置在QUIC包头中。
相应的，第二设备接收中间设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，第二预设标识用于指示不允许中间设备读取目标数据，第三数据为经过第三加密密钥加密的目标数据。
在实施中，中间设备向第二设备发送携带有第三数据和第二预设标识的第三数据传输消息后，第二设备可以接收中间设备发送的第三数据传输消息，并对其进行解析，获取其中携带的第三数据和第二预设标识，其中，第三数据为经过第三加密密钥加密的目标数据。
可选的，第二预设标识可以设置在TLS包头中或者QUIC包头中，具体的，第二预设标识设置于传输层控制TLS包头中；或者，第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
在实施中，第一设备与第二设备传输目标数据时，可以基于TLS协议传输目标数据，也可以基于QUIC协议传输目标数据，分别针对不同的情况，第二预设标识可以设置在TLS包头中，或者，设置在QUIC包头中。
步骤705，当第二设备确定第三数据传输消息中携带有第二预设标识时， 第二设备基于第二设备与第一设备协商的第三解密密钥，对第三数据进行解密处理，得到目标数据。
在实施中，第二设备中可以预先存储有第二设备与第一设备协商的解密密钥(即第三解密密钥)，其中，第三解密密钥可以用于对第一设备通过中间设备发送的第三数据进行解密处理。第二设备接收到第三数据传输消息后，可以判断第三数据传输消息中是否携带有第二预设标识，当第二设备确定第三数据传输消息中携带有第二预设标识时，即确定第三数据传输消息中携带的第三数据是第一设备基于第三加密密钥对目标数据进行加密得到的数据，中间设备并没有对目标数据进行任何处理时，第二设备可以基于第二设备与第一设备协商的第三解密密钥，对第三数据进行解密处理，得到目标数据。另外，第二设备中还可以预先存储有解密算法(可以称为第三解密算法)，即，当第二设备确定第三数据传输消息中携带有第二预设标识时，第二设备可以基于第二设备与第一设备协商的第三解密密钥和第三解密算法，对第三数据进行解密处理，得到目标数据。
本发明实施例中，第一设备发送至第二设备目标数据需要进行加密时，第一设备可以采用第一设备与中间设备协商的第一加密密钥对目标数据进行加密处理，然后将其发送至中间设备，中间设备接收到第一设备发送的经过第一加密密钥加密的目标数据后，可以采用中间设备与第一设备协商的第一解密密钥对其进行解密，得到目标数据，并对目标数据进行预设的数据处理，进而，可以采用中间设备与第二设备协商的第二加密密钥对经过数据处理的目标数据进行加密，并将其发送至第二设备，第二设备接收到中间设备发送的数据后，可以采用第二设备与中间设备协商的第二解密密钥进行解密处理，得到经过中间设备数据处理的目标设备。这样，中间设备可以基于预先与第一设备协商的解密密钥对第一设备发送的数据进行解密，可以读取第一设备将要发送至第二设备的数据，进而，可以对目标数据进行预设的数据处理，从而，可以使得中间设备能够正常工作。
基于相同的构思，本发明实施例还提供了一种第一设备，如图2所示，本实施例提供的第一设备可以实现本发明图5、图6和图7所示实施例的流程，该第一设备包括处理器210、发射器220，其中：
所述处理器210，用于获取待传输至第二设备的目标数据；如果所述目标 数据为允许中间设备读取的数据，则基于所述第一设备与所述中间设备协商的第一加密密钥，对所述目标数据进行加密处理，得到第一数据；
所述发射器220，用于向所述中间设备发送携带有所述第一数据的第一数据传输消息。
其中，第一设备和第二设备可以是终端和服务器中的任意一个，第一设备可以是终端，第二设备可以是服务器，目标数据可以是第一设备待传输的业务数据。中间设备可以是具有预设数据处理功能的设备，可以是第一设备与第二设备传输数据时的传输路径中的设备。
在实施中，为保证数据传输的安全性，越来越多的服务器要求与终端进行传输的数据需要进行加密处理，即TLS协议或者Quic(Quick UDP(User Datagram Protocol，用户数据报协议)Internet Connection，基于UDP的低时延互联网传输层)协议得到了广泛应用，此种情况下，第一设备将要向第二设备发送数据时，处理器210可以获取待传输的目标数据。
第一设备中可以预先存储有第一判断策略，其中，第一判断策略可以用于第一设备确定待传输至第二设备的目标数据是否允许中间设备读取，第一设备中可以存储有允许中间设备读取的数据的数据类型列表，和/或可以存储有不允许中间设备读取的数据的数据类型列表，例如，第一设备为终端，目标数据为用户输入的密码时，不允许中间设备读取，数据为视频时，允许中间设备读取。第一设备中还可以预先存储有第一设备与中间设备协商的加密密钥(即第一加密密钥)，其中，第一加密密钥可以用于对目标数据进行加密处理。
处理器210获取到目标数据后，可以判断该目标数据是否允许中间设备读取的数据，如果目标数据为允许中间设备读取的数据，则处理器210可以基于预先存储的第一加密密钥，对目标数据进行加密处理，得到第一数据，其中，第一设备中还可以预先存储有加密算法(可以称为第一加密算法)，即，处理器210可以基于第一设备与中间设备协商的第一加密密钥和第一加密算法，对目标数据进行加密处理，得到第一数据。
处理器210得到第一数据后，发射器220可以向中间设备发送数据传输消息(即第一数据传输消息)，其中，第一数据传输消息中还可以携带有第一数据。
可选的，所述第一数据传输消息中还携带有第一预设标识，其中，所述第一预设标识用于指示允许所述中间设备读取所述目标数据。
在实施中，当确定出目标数据为允许中间设备读取的数据时，发射器220发送至中间设备的第一数据传输消息中，还可以携带有用于指示允许中间设备读取目标数据的预设标识(即第一预设标识)，例如，第一数据传输消息中可以携带有A标识，即第一数据传输消息中携带有A标识时，说明第一设备待传输的目标数据为允许中间设备读取的数据。另外，第一预设标识可以做完整性保护，不进行加密处理。
可选的，所述处理器210，还用于：
如果所述目标数据为不允许所述中间设备读取的数据，则基于所述第一设备与所述第二设备协商的第三加密密钥，对所述目标数据进行加密处理，得到第三数据；
所述发射器220，还用于：
向所述中间设备发送携带有所述第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据。
在实施中，第一设备中可以预先存储有第一判断策略，其中，第一判断策略可以用于第一设备确定待传输至第二设备的目标数据是否允许中间设备读取，第一设备中可以存储有允许中间设备读取的数据的数据类型列表，和/或可以存储有不允许中间设备读取的数据的数据类型列表，例如，第一设备为终端，目标数据为用户输入的密码时，不允许中间设备读取，数据为视频时，允许中间设备读取。第一设备中还可以预先存储有第一设备与第二设备协商的加密密钥(即第三加密密钥)，其中，第三加密密钥可以用于对目标数据进行加密处理。
处理器210获取到目标数据后，可以判断该目标数据是否允许中间设备读取的数据，如果目标数据为不允许中间设备读取的数据，则处理器210可以基于预先存储的第三加密密钥，对目标数据进行加密处理，得到第三数据，其中，第一设备中还可以预先存储有加密算法(可以称为第三加密算法)，即，处理器210可以基于第一设备与第二设备协商的第三加密密钥和第三加密算法，对目标数据进行加密处理，得到第三数据。
针对如果目标数据为允许中间设备读取的数据，则第一数据传输消息中携带有第一预设标识的情况，当处理器210确定出目标数据为不允许中间设备读取的数据时，发射器220可以向中间设备发送携带有第三数据和第二预设标识 的第三数据传输消息，其中，第二预设标识可以用于指示不允许中间设备读取目标数据。另外，第一设备可以对第二预设标识进行完整性保护处理。
可选的，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
在实施中，第一设备与第二设备传输目标数据时，可以基于TLS协议传输目标数据，也可以基于QUIC协议传输目标数据，分别针对不同的情况，第一预设标识或第二预设标识可以设置在TLS包头中，或者，设置在QUIC包头中。
可选的，所述发射器220，还用于：
向所述中间设备发送验证指示消息，其中，所述验证指示消息用于指示所述中间设备向所述第二设备发送用于验证所述中间设备合法性的验证请求；
所述第一设备还包括：
接收器230，用于接收所述中间设备发送的用于指示所述中间设备合法的反馈消息；
所述处理器210，还用于：
与所述中间设备协商用于数据传输的所述第一加密密钥和对应的第一解密密钥。
在实施中，第一设备与第二设备传输数据时，可以基于TLS协议传输数据，也可以基于QUIC协议传输数据。当基于TLS协议传输数据时，第一设备与第二设备在传输数据前，可以先建立TCP(Transmission Control Protocol，传输控制协议)连接，即第一设备与第二设备进行TCP三次握手，然后，建立TLS连接，其中，建立TLS连接的过程即是第一设备与第二设备协商密钥的过程，即协商下述处理过程中涉及的用于数据传输的第三加密密钥和对应的第三解密密钥。当基于QUIC协议传输数据时，第一设备与第二设备在传输数据前，可以先建立QUIC连接。
第一设备与第二设备传输目标数据时，发射器220可以向中间设备发送验证指示消息，其中，该验证指示消息可以用于指示中间设备向第二设备发送用于验证中间设备合法性的验证请求，其中，对于上述提及的两种情况，针对基于TLS协议传输目标数据的情况，该验证指示消息可以在TLS建立的过程中发送，也可以在TLS连接建立后，针对基于QUIC协议传输目标数据的情况， 该验证指示消息可以在QUIC连接的建立过程中，也可以在QUIC连接建立后，本发明实施例不对其进行限定。另外，第一设备中可以预先设置有中间设备的设备信息，其中，中间设备的设备信息可以是中间设备的设备标识(可以是中间设备的设备名称，也可以是中间设备的MAC地址，也可以是中间设备的IP(Internet Protocol，网络协议)地址)、数据处理功能信息(可以是表述中间设备的数据处理功能的文本信息)以及证书，此种情况下，验证指示消息中可以携带有中间设备的设备信息。第一设备中也可以不预先配置有中间设备的设备信息，本发明实施例不对其进行限定。此外，第一设备发送的验证指示消息可以采用明文的方式进行传输。
发射器220向中间设备发送验证指示消息后，中间设备可以向第二设备发送用于验证中间设备合法性的验证请求，第二设备验证中间设备合法后，可以通过中间设备向第一设备发送用于指示中间设备合法的反馈消息，接收器230可以接收中间设备发送的用于指示中间设备合法的反馈消息，进而，处理器210可以与中间设备协商用于数据传输的第一加密密钥和对应的第一解密密钥。
基于相同的技术构思，本发明实施例还提供了一种中间设备，如图3所示，本实施例提供的中间设备可以实现本发明图5、图6和图7所示实施例的流程，所述中间设备包括接收器310、处理器320、发射器330，其中：
所述接收器310，用于接收第一设备发送的携带有第一数据的第一数据传输消息，其中，所述第一数据为经过第一加密密钥加密的目标数据；
所述处理器320，用于基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；基于所述中间设备与第二设备协商的第二加密密钥，对经过数据处理的目标数据进行加密处理，得到第二数据；
所述发射器330，用于向所述第二设备发送携带有所述第二数据的第二数据传输消息。
在实施中，第一设备向中间设备发送第一数据传输消息后，接收器310可以接收第一设备发送的第一数据传输消息，处理器320可以对其进行解析，获取其中携带的第一数据，其中，第一数据为经过第一加密密钥加密的目标数据。
中间设备中可以预先存储有中间设备与第一设备协商的解密密钥(即第一解密密钥)，其中，第一解密密钥可以用于对第一设备发送的第一数据进行解 密处理。处理器320获取到第一数据后，可以判断目标数据是否为允许中间设备读取的数据，当目标数据为允许中间设备读取的数据时，处理器320可以基于预先存储的中间设备与第一设备协商的第一解密密钥，对第一数据进行解密处理，得到目标数据，其中，中间设备中还可以预先存储有解密算法(可以称为第一解密算法)，即，处理器320可以基于第一设备与中间设备协商的第一解密密钥和第一解密算法，对第一数据进行解密处理，得到目标数据。
处理器320得到目标数据后，可以按照自身具有的数据处理功能，对得到的目标数据进行预设的数据处理，具体的，中间设备可以具有预设的数据处理功能，其中，预设的数据处理功能可以是统计数据功能，此种情况下，处理器320可以读取第一设备待传输至第二设备的目标数据，以便于进行统计，不改变目标数据，预设的数据处理功能也可以是视频优化功能，此种情况下，处理器320可以读取第一设备待传输至第二设备的目标数据，并基于预设的数据处理功能对目标数据进行改变，例如，第一设备为服务器，视频优化功能是将高清视频数据改变为标清视频数据，此种情况下，处理器320可以读取服务器发送至终端的高清视频数据(即目标数据)，进而，可以将目标数据改变为标清视频数据。也就是说，处理器320对目标数据进行预设的数据处理后，得到的数据可能与目标数据相同，也可能不同。
中间设备中可以预先存储有中间设备与第二设备协商的加密密钥(即第二加密密钥)，其中，第二加密密钥可以用于对经过数据处理的目标数据进行加密处理。处理器320对目标数据进行预设的数据处理后，可以获取预先存储的第二加密密钥，并基于第二加密密钥对经过数据处理的目标数据进行加密处理，得到第二数据，其中，中间设备中还可以预先存储有加密算法(可以称为第二加密算法)，即，处理器320可以基于中间设备与第二设备协商的第二加密密钥和第二加密算法，对经过数据处理的目标数据进行加密处理，得到第二数据。处理器320得到第二数据后，发射器330可以向第二设备发送数据传输消息(即第二数据传输消息)，其中，第二数据传输消息中可以携带有第二数据。
可选的，所述第一数据传输消息中还携带有第一预设标识，所述第一预设标识用于指示允许所述中间设备读取所述目标数据；
所述处理器320，具体用于：
当所述处理器确定所述第一数据传输消息中携带有所述第一预设标识时， 基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；
所述发射器330，具体用于：
向所述第二设备发送携带有所述第二数据和所述第一预设标识的第二数据传输消息。
在实施中，接收器310获取到第一数据传输消息后，处理器320可以判断第一数据传输消息中是否携带有第一预设标识，当确定第一数据传输消息中携带有第一预设标识时，处理器320可以按照上述步骤504表述的处理过程对第一数据进行处理，即基于中间设备与第一设备协商的第一解密密钥，对第一数据进行解密处理，得到目标数据，并对目标数据进行预设的数据处理。当第一数据传输消息中携带有第一预设标识时，发射器330发送至第二设备的第二数据传输消息中还可以携带有第一预设标识，即第二数据传输消息中携带有第二数据和第一预设标识。
可选的，所述接收器310，还用于：
接收所述第一设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据，所述第三数据为经过第三加密密钥加密的目标数据；
所述发射器330，还用于：
当所述处理器确定所述第三数据传输消息中携带有所述第二预设标识时，向所述第二设备发送所述第三数据传输消息。
在实施中，第一设备向中间设备发送携带有第三数据和第二预设标识的第三数据传输消息后，接收器310可以接收第一设备发送的第三数据传输消息，处理器320可以对其进行解析，获取其中携带的第三数据和第二预设标识，其中，第三数据为经过第三加密密钥加密的目标数据。接收器310接收到第三数据传输消息后，可以判断第三数据传输消息中是否携带有第二预设标识，当确定第三数据传输消息中携带有第二预设标识时，即当目标数据为不允许中间设备读取的数据时，发射器330可以将第三数据传输消息转发至第二设备，并不对第三数据进行任何处理。
可选的，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低 时延互联网传输层QUIC包头中。
可选的，所述接收器310，还用于：
接收所述第一设备发送的验证指示消息；
所述发射器330，还用于：
向所述第二设备发送携带有所述中间设备的设备信息的验证请求；
所述接收器310，还用于：
接收所述第二设备发送的用于指示所述中间设备合法的反馈消息；
所述发射器330，还用于：
向所述第一设备发送所述第二设备发送的用于指示所述中间设备合法的反馈消息；
所述处理器320，还用于：
与所述第一设备协商用于数据传输的所述第一加密密钥和所述第一解密密钥，并与所述第二设备协商用于数据传输的所述第二加密密钥和对应的第二解密密钥。
在实施中，第一设备向中间设备发送验证指示消息后，接收器310可以接收第一设备发送的验证指示消息，针对验证指示消息中携带有中间设备的设备信息的情况，接收器310接收到验证指示消息后，处理器320可以对其进行解析，获取其中携带的中间设备的设备信息。
针对验证指示消息中携带有中间设备的设备信息的情况，接收器310接收到第一设备发送的验证指示消息后，处理器320可以获取验证指示消息中携带的中间设备的设备信息，发射器330可以向第二设备发送携带有中间设备的设备信息的验证请求。针对验证指示消息中未携带有中间设备的设备信息的情况，即第一设备中未预先配置中间设备的设备信息的情况，接收器310接收到第一设备发送的验证指示消息后，处理器320可以获取本地中预先存储的中间设备的设备信息，发射器330向第二设备发送携带有中间设备的设备信息的验证请求。此外，中间设备发送的验证请求可以采用明文的方式进行传输。第二设备接收到验证请求后，可以对中间设备的合法性进行验证，当中间设备合法时，第二设备可以向中间设备发送用于指示中间设备合法的反馈消息，进而，接收器310可以接收第二设备发送的用于指示所述中间设备合法的反馈消息，发射器330可以向第一设备发送第二设备发送的用于指示中间设备合法的反馈消息，进而，处理器320可以与第一设备协商用于数据传输的第一加密密钥和 第一解密密钥，并与第二设备协商用于数据传输的第二加密密钥和对应的第二解密密钥。
基于相同的技术构思，本发明实施例还提供了一种第二设备，如图4所示，本实施例提供的第二设备可以实现本发明图5、图6和图7所示实施例的流程，所述第二设备包括接收器410、处理器420，其中：
所述接收器410，用于接收中间设备发送的携带有第二数据的第二数据传输消息，其中，所述第二数据为经过所述中间设备数据处理的目标数据再进行加密得到的数据；
所述处理器420，用于基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
在实施中，中间设备向第二设备发送携带有第二数据的第二数据传输消息后，接收器410可以接收中间设备发送的第二数据传输消息，处理器420可以对其进行解析，获取其中携带的第二数据，其中，第二数据为经过中间设备数据处理的目标数据，再经过第二加密密钥加密的数据。
第二设备中可以预先存储有第二设备与中间设备协商的解密密钥(即第二解密密钥)，其中，第二解密密钥可以用于对中间设备发送的第二数据进行解密处理。接收器410接收到第二数据后，处理器420可以判断目标数据是否为允许中间设备读取的数据，即判断第二数据是否是中间设备对目标数据进行过预设的数据处理，并对其进行加密的数据，当确定目标数据为允许中间设备读取的数据时，可以基于第二解密密钥，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据，其中，第二设备得到的数据可能与目标数据一致，也可能与目标数据不一致，是否相同取决于中间设备对目标数据的数据处理是否改变了目标数据。另外，第二设备中还可以预先存储有解密算法(可以称为第二解密算法)，即，处理器420获取到第二数据后，可以基于第二设备与中间设备协商的第二解密密钥和第二解密算法，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据。
可选的，所述第二数据传输消息中还携带有第一预设标识，其中，所述第一预设标识用于指示允许所述中间设备读取所述目标数据；
所述处理器420，具体用于：
当所述处理器确定所述第二数据传输消息中携带有所述第一预设标识时，基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
在实施中，接收器410获取到第二数据传输消息后，处理器420可以判断第二数据传输消息中是否携带有第一预设标识，当确定第二数据传输消息中携带有第一预设标识时，即当确定第二数据传输消息中携带的第二数据是经过中间设备数据处理的目标数据再进行加密得到的数据时，可以按照上述步骤507表述的处理过程对第二数据进行处理，即基于第二设备与中间设备协商的第二解密密钥，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据。
可选的，所述接收器410，还用于：
接收所述中间设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据，所述第三数据为经过第三加密密钥加密的目标数据；
所述处理器420，还用于：
当所述处理器确定所述第三数据传输消息中携带有所述第二预设标识时，基于所述第二设备与所述第一设备协商的第三解密密钥，对所述第三数据进行解密处理，得到所述目标数据。
在实施中，中间设备向第二设备发送携带有第三数据和第二预设标识的第三数据传输消息后，接收器410可以接收中间设备发送的第三数据传输消息，处理器420可以对其进行解析，获取其中携带的第三数据和第二预设标识，其中，第三数据为经过第三加密密钥加密的目标数据。第二设备中可以预先存储有第二设备与第一设备协商的解密密钥(即第三解密密钥)，其中，第三解密密钥可以用于对第一设备通过中间设备发送的第三数据进行解密处理。接收器410接收到第三数据传输消息后，处理器410可以判断第三数据传输消息中是否携带有第二预设标识，当确定第三数据传输消息中携带有第二预设标识时，即确定第三数据传输消息中携带的第三数据是第一设备基于第三加密密钥对目标数据进行加密得到的数据，中间设备并没有对目标数据进行任何处理时，处理器420可以基于第二设备与第一设备协商的第三解密密钥，对第三数据进行解密处理，得到目标数据。另外，第二设备中还可以预先存储有解密算法(可以称为第三解密算法)，即，当确定第三数据传输消息中携带有第二预设标识时，处理器420可以基于第二设备与第一设备协商的第三解密密钥和第三解密 算法，对第三数据进行解密处理，得到目标数据。
可选的，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
可选的，所述接收器410，还用于：
接收所述中间设备发送的携带有所述中间设备的设备信息的验证请求；
所述处理器420，还用于：
根据所述中间设备的设备信息，验证所述中间设备的合法性；
所述第二设备还包括：
发射器430，用于如果所述中间设备合法，则通过所述中间设备向第一设备发送用于指示所述中间设备合法的反馈消息；
所述处理器420，还用于：
与所述中间设备协商用于数据传输的所述第二解密密钥和对应的第二加密密钥。
在实施中，中间设备向第二设备发送验证请求后，接收器410可以接收中间设备发送的验证请求，处理器420可以对其进行解析，获取其中携带的中间设备的设备信息。
处理器420获取到中间设备的设备信息后，可以根据预设的处理策略，验证中间设备的合法性。具体的，处理器420获取到中间设备的设备信息后，即获取到中间设备的设备标识、数据处理功能信息(可以是表述中间设备的数据处理功能的文本信息)以及证书后，其中，证书是由特定机构为中间设备颁发的，可以是基于私钥对中间设备的数据处理功能信息进行加密得到的，可以获取对应中间设备的公钥，并基于获取的公钥对证书进行解密，如果可以正确解密，且解密得到的数据处理功能信息与验证请求中携带的数据处理功能信息相同，则处理器420可以确定中间设备合法。另外，第二设备中还可以存储有该第二设备允许中间设备进行的操作，在上述判断的基础上，结合第二设备允许中间设备进行的操作，验证中间设备的合法性，例如，中间设备的数据处理功能为视频优化，如果第二设备中预先存储有允许具有视频优化功能的中间设备对传输的数据进行数据处理，则在解密得到的数据处理功能信息与验证请求中携带的数据处理功能信息相同的基础上，处理器420可以确定中间设备合法， 如果第二设备中预先存储有不允许具有视频优化功能的中间设备对传输的数据进行数据处理，则即使解密得到的数据处理功能信息与验证请求中携带的数据处理功能信息相同，处理器420也确定中间设备不合法。
处理器420对中间设备的合法性进行验证后，如果中间设备合法，则发射器430可以通过中间设备向第一设备发送对应中间设备发送的验证请求的反馈消息，其中，该反馈消息可以用于指示中间设备合法。具体的，发射器430可以向中间设备发送对应中间设备发送的验证请求的反馈消息，其中，反馈消息中可以携带有合法的中间设备的设备标识。另外，第二设备可以对反馈消息做完整性保护处理。处理器420还可以与中间设备协商用于数据传输的第二解密密钥和对应的第二加密密钥。
本发明实施例中，第一设备发送至第二设备目标数据需要进行加密时，第一设备可以采用第一设备与中间设备协商的第一加密密钥对目标数据进行加密处理，然后将其发送至中间设备，中间设备接收到第一设备发送的经过第一加密密钥加密的目标数据后，可以采用中间设备与第一设备协商的第一解密密钥对其进行解密，得到目标数据，并对目标数据进行预设的数据处理，进而，可以采用中间设备与第二设备协商的第二加密密钥对经过数据处理的目标数据进行加密，并将其发送至第二设备，第二设备接收到中间设备发送的数据后，可以采用第二设备与中间设备协商的第二解密密钥进行解密处理，得到经过中间设备数据处理的目标设备。这样，中间设备可以基于预先与第一设备协商的解密密钥对第一设备发送的数据进行解密，可以读取第一设备将要发送至第二设备的数据，进而，可以对目标数据进行预设的数据处理，从而，可以使得中间设备能够正常工作。
基于相同的技术构思，本发明实施例提供了一种第一设备，如图8所示，本实施例提供的第一设备可以实现本发明图5、图6和图7所示实施例的流程，所述第一设备包括：
获取模块810，用于获取待传输至第二设备的目标数据；
加密模块820，用于如果所述目标数据为允许中间设备读取的数据，则基于所述第一设备与所述中间设备协商的第一加密密钥，对所述目标数据进行加密处理，得到第一数据；
发送模块830，用于向所述中间设备发送携带有所述第一数据的第一数据 传输消息。
其中，第一设备和第二设备可以是终端和服务器中的任意一个，第一设备可以是终端，第二设备可以是服务器，目标数据可以是第一设备待传输的业务数据。中间设备可以是具有预设数据处理功能的设备，可以是第一设备与第二设备传输数据时的传输路径中的设备。
在实施中，为保证数据传输的安全性，越来越多的服务器要求与终端进行传输的数据需要进行加密处理，即TLS协议或者Quic(Quick UDP(User Datagram Protocol，用户数据报协议)Internet Connection，基于UDP的低时延互联网传输层)协议得到了广泛应用，此种情况下，第一设备将要向第二设备发送数据时，获取模块810可以获取待传输的目标数据。
第一设备中可以预先存储有第一判断策略，其中，第一判断策略可以用于第一设备确定待传输至第二设备的目标数据是否允许中间设备读取，第一设备中可以存储有允许中间设备读取的数据的数据类型列表，和/或可以存储有不允许中间设备读取的数据的数据类型列表，例如，第一设备为终端，目标数据为用户输入的密码时，不允许中间设备读取，数据为视频时，允许中间设备读取。第一设备中还可以预先存储有第一设备与中间设备协商的加密密钥(即第一加密密钥)，其中，第一加密密钥可以用于对目标数据进行加密处理。
获取到目标数据后，可以判断该目标数据是否允许中间设备读取的数据，如果目标数据为允许中间设备读取的数据，则加密模块820可以基于预先存储的第一加密密钥，对目标数据进行加密处理，得到第一数据，其中，第一设备中还可以预先存储有加密算法(可以称为第一加密算法)，即，加密模块820可以基于第一设备与中间设备协商的第一加密密钥和第一加密算法，对目标数据进行加密处理，得到第一数据。
加密模块820得到第一数据后，发送模块830可以向中间设备发送数据传输消息(即第一数据传输消息)，其中，第一数据传输消息中还可以携带有第一数据。
可选的，所述第一数据传输消息中还携带有第一预设标识，其中，所述第一预设标识用于指示允许所述中间设备读取所述目标数据。
可选的，所述加密模块820，还用于：
如果所述目标数据为不允许所述中间设备读取的数据，则基于所述第一设备与所述第二设备协商的第三加密密钥，对所述目标数据进行加密处理，得到 第三数据；
所述发送模块830，还用于：
向所述中间设备发送携带有所述第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据。
在实施中，第一设备中可以预先存储有第一判断策略，其中，第一判断策略可以用于第一设备确定待传输至第二设备的目标数据是否允许中间设备读取，第一设备中可以存储有允许中间设备读取的数据的数据类型列表，和/或可以存储有不允许中间设备读取的数据的数据类型列表，例如，第一设备为终端，目标数据为用户输入的密码时，不允许中间设备读取，数据为视频时，允许中间设备读取。第一设备中还可以预先存储有第一设备与第二设备协商的加密密钥(即第三加密密钥)，其中，第三加密密钥可以用于对目标数据进行加密处理。
获取到目标数据后，可以判断该目标数据是否允许中间设备读取的数据，如果目标数据为不允许中间设备读取的数据，则加密模块820可以基于预先存储的第三加密密钥，对目标数据进行加密处理，得到第三数据，其中，第一设备中还可以预先存储有加密算法(可以称为第三加密算法)，即，加密模块820可以基于第一设备与第二设备协商的第三加密密钥和第三加密算法，对目标数据进行加密处理，得到第三数据。
针对如果目标数据为允许中间设备读取的数据，则第一数据传输消息中携带有第一预设标识的情况，当确定出目标数据为不允许中间设备读取的数据时，发送模块830可以向中间设备发送携带有第三数据和第二预设标识的第三数据传输消息，其中，第二预设标识可以用于指示不允许中间设备读取目标数据。另外，第一设备可以对第二预设标识进行完整性保护处理。
可选的，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
可选的，所述发送模块830，还用于：
向所述中间设备发送验证指示消息，其中，所述验证指示消息用于指示所述中间设备向所述第二设备发送用于验证所述中间设备合法性的验证请求；
如图9所示，所述第一设备还包括：
接收模块840，用于接收所述中间设备发送的用于指示所述中间设备合法的反馈消息；
协商模块850，用于与所述中间设备协商用于数据传输的所述第一加密密钥和对应的第一解密密钥。
在实施中，第一设备与第二设备传输数据时，可以基于TLS协议传输数据，也可以基于QUIC协议传输数据。当基于TLS协议传输数据时，第一设备与第二设备在传输数据前，可以先建立TCP(Transmission Control Protocol，传输控制协议)连接，即第一设备与第二设备进行TCP三次握手，然后，建立TLS连接，其中，建立TLS连接的过程即是第一设备与第二设备协商密钥的过程，即协商下述处理过程中涉及的用于数据传输的第三加密密钥和对应的第三解密密钥。当基于QUIC协议传输数据时，第一设备与第二设备在传输数据前，可以先建立QUIC连接。
第一设备与第二设备传输目标数据时，发送模块830可以向中间设备发送验证指示消息，其中，该验证指示消息可以用于指示中间设备向第二设备发送用于验证中间设备合法性的验证请求，其中，对于上述提及的两种情况，针对基于TLS协议传输目标数据的情况，该验证指示消息可以在TLS建立的过程中发送，也可以在TLS连接建立后，针对基于QUIC协议传输目标数据的情况，该验证指示消息可以在QUIC连接的建立过程中，也可以在QUIC连接建立后，本发明实施例不对其进行限定。另外，第一设备中可以预先设置有中间设备的设备信息，其中，中间设备的设备信息可以是中间设备的设备标识(可以是中间设备的设备名称，也可以是中间设备的MAC地址，也可以是中间设备的IP(Internet Protocol，网络协议)地址)、数据处理功能信息(可以是表述中间设备的数据处理功能的文本信息)以及证书，此种情况下，验证指示消息中可以携带有中间设备的设备信息。第一设备中也可以不预先配置有中间设备的设备信息，本发明实施例不对其进行限定。此外，第一设备发送的验证指示消息可以采用明文的方式进行传输。
发送模块830向中间设备发送验证指示消息后，中间设备可以向第二设备发送用于验证中间设备合法性的验证请求，第二设备验证中间设备合法后，可以通过中间设备向第一设备发送用于指示中间设备合法的反馈消息，接收模块840可以接收中间设备发送的用于指示中间设备合法的反馈消息，进而，协商 模块850可以与中间设备协商用于数据传输的第一加密密钥和对应的第一解密密钥。
基于相同的技术构思，本发明实施例还提供了一种中间设备，如图10所示，本实施例提供的中间设备可以实现本发明图5、图6和图7所示实施例的流程，所述中间设备包括：
接收模块1010，用于接收第一设备发送的携带有第一数据的第一数据传输消息，其中，所述第一数据为经过第一加密密钥加密的目标数据；
解密模块1020，用于基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；
加密模块1030，用于基于所述中间设备与第二设备协商的第二加密密钥，对经过数据处理的目标数据进行加密处理，得到第二数据；
发送模块1040，用于向所述第二设备发送携带有所述第二数据的第二数据传输消息。
在实施中，第一设备向中间设备发送第一数据传输消息后，接收模块1010可以接收第一设备发送的第一数据传输消息，中间设备可以对其进行解析，获取其中携带的第一数据，其中，第一数据为经过第一加密密钥加密的目标数据。
中间设备中可以预先存储有中间设备与第一设备协商的解密密钥(即第一解密密钥)，其中，第一解密密钥可以用于对第一设备发送的第一数据进行解密处理。获取到第一数据后，可以判断目标数据是否为允许中间设备读取的数据，当目标数据为允许中间设备读取的数据时，解密模块1020可以基于预先存储的中间设备与第一设备协商的第一解密密钥，对第一数据进行解密处理，得到目标数据，其中，中间设备中还可以预先存储有解密算法(可以称为第一解密算法)，即，解密模块1020可以基于第一设备与中间设备协商的第一解密密钥和第一解密算法，对第一数据进行解密处理，得到目标数据。
解密模块1020得到目标数据后，可以按照预设的数据处理功能，对得到的目标数据进行预设的数据处理，具体的，中间设备可以具有预设的数据处理功能，其中，预设的数据处理功能可以是统计数据功能，此种情况下，处理器320可以读取第一设备待传输至第二设备的目标数据，以便于进行统计，不改变目标数据，预设的数据处理功能也可以是视频优化功能，此种情况下，解密 模块1020可以读取第一设备待传输至第二设备的目标数据，并基于预设的数据处理功能对目标数据进行改变，例如，第一设备为服务器，视频优化功能是将高清视频数据改变为标清视频数据，此种情况下，解密模块1020可以读取服务器发送至终端的高清视频数据(即目标数据)，进而，可以将目标数据改变为标清视频数据。也就是说，解密模块1020对目标数据进行预设的数据处理后，得到的数据可能与目标数据相同，也可能不同。
中间设备中可以预先存储有中间设备与第二设备协商的加密密钥(即第二加密密钥)，其中，第二加密密钥可以用于对经过数据处理的目标数据进行加密处理。对目标数据进行预设的数据处理后，加密模块1030可以获取预先存储的第二加密密钥，并基于第二加密密钥对经过数据处理的目标数据进行加密处理，得到第二数据，其中，中间设备中还可以预先存储有加密算法(可以称为第二加密算法)，即，加密模块1030可以基于中间设备与第二设备协商的第二加密密钥和第二加密算法，对经过数据处理的目标数据进行加密处理，得到第二数据。加密模块1030得到第二数据后，发送模块1040可以向第二设备发送数据传输消息(即第二数据传输消息)，其中，第二数据传输消息中可以携带有第二数据。
可选的，所述第一数据传输消息中还携带有第一预设标识，所述第一预设标识用于指示允许所述中间设备读取所述目标数据；
所述解密模块1020，具体用于：
当确定所述第一数据传输消息中携带有所述第一预设标识时，基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；
所述发送模块1040，具体用于：
向所述第二设备发送携带有所述第二数据和所述第一预设标识的第二数据传输消息。
在实施中，接收模块1010获取到第一数据传输消息后，中间设备可以判断第一数据传输消息中是否携带有第一预设标识，当确定第一数据传输消息中携带有第一预设标识时，解密模块1020可以按照上述步骤504表述的处理过程对第一数据进行处理，即基于中间设备与第一设备协商的第一解密密钥，对第一数据进行解密处理，得到目标数据，并对目标数据进行预设的数据处理。当第一数据传输消息中携带有第一预设标识时，发送模块1040发送至第二设 备的第二数据传输消息中还可以携带有第一预设标识，即第二数据传输消息中携带有第二数据和第一预设标识。
可选的，所述接收模块1010，还用于：
接收所述第一设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据，所述第三数据为经过第三加密密钥加密的目标数据；
所述发送模块1040，还用于：
当确定所述第三数据传输消息中携带有所述第二预设标识时，向所述第二设备发送所述第三数据传输消息。
在实施中，第一设备向中间设备发送携带有第三数据和第二预设标识的第三数据传输消息后，接收模块1010可以接收第一设备发送的第三数据传输消息，中间设备可以对其进行解析，获取其中携带的第三数据和第二预设标识，其中，第三数据为经过第三加密密钥加密的目标数据。接收到第三数据传输消息后，可以判断第三数据传输消息中是否携带有第二预设标识，当确定第三数据传输消息中携带有第二预设标识时，即当目标数据为不允许中间设备读取的数据时，发送模块1040可以将第三数据传输消息转发至第二设备，并不对第三数据进行任何处理。
可选的，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
可选的，所述接收模块1010，还用于：
接收所述第一设备发送的验证指示消息；
所述发送模块1040，还用于：
向所述第二设备发送携带有所述中间设备的设备信息的验证请求；
所述接收模块1010，还用于：
接收所述第二设备发送的用于指示所述中间设备合法的反馈消息；
所述发送模块1040，还用于：
向所述第一设备发送所述第二设备发送的用于指示所述中间设备合法的反馈消息；
如图11所示，所述中间设备还包括：
协商模块1150，用于与所述第一设备协商用于数据传输的所述第一加密密钥和所述第一解密密钥，并与所述第二设备协商用于数据传输的所述第二加密密钥和对应的第二解密密钥。
在实施中，第一设备向中间设备发送验证指示消息后，接收模块1010可以接收第一设备发送的验证指示消息，针对验证指示消息中携带有中间设备的设备信息的情况，接收模块1010接收到验证指示消息后，中间设备可以对其进行解析，获取其中携带的中间设备的设备信息。
针对验证指示消息中携带有中间设备的设备信息的情况，接收到第一设备发送的验证指示消息后，可以获取验证指示消息中携带的中间设备的设备信息，发送模块1040可以向第二设备发送携带有中间设备的设备信息的验证请求。针对验证指示消息中未携带有中间设备的设备信息的情况，即第一设备中未预先配置中间设备的设备信息的情况，接收模块1010接收到第一设备发送的验证指示消息后，中间设备可以获取本地中预先存储的中间设备的设备信息，发送模块1040向第二设备发送携带有中间设备的设备信息的验证请求。此外，中间设备发送的验证请求可以采用明文的方式进行传输。第二设备接收到验证请求后，可以对中间设备的合法性进行验证，当中间设备合法时，第二设备可以向中间设备发送用于指示中间设备合法的反馈消息，进而，接收模块1010可以接收第二设备发送的用于指示所述中间设备合法的反馈消息，发送模块1040可以向第一设备发送第二设备发送的用于指示中间设备合法的反馈消息，进而，协商模块1050可以与第一设备协商用于数据传输的第一加密密钥和第一解密密钥，并与第二设备协商用于数据传输的第二加密密钥和对应的第二解密密钥。
基于相同的技术构思，本发明实施例提供了一种第二设备，如图12所示，本实施例提供的第二设备可以实现本发明图5、图6和图7所示实施例的流程，所述第二设备包括：
接收模块1210，用于接收中间设备发送的携带有第二数据的第二数据传输消息，其中，所述第二数据为经过所述中间设备数据处理的目标数据再进行加密得到的数据；
解密模块1220，用于基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数 据。
在实施中，中间设备向第二设备发送携带有第二数据的第二数据传输消息后，接收模块1210可以接收中间设备发送的第二数据传输消息，第二设备可以对其进行解析，获取其中携带的第二数据，其中，第二数据为经过中间设备数据处理的目标数据，再经过第二加密密钥加密的数据。
第二设备中可以预先存储有第二设备与中间设备协商的解密密钥(即第二解密密钥)，其中，第二解密密钥可以用于对中间设备发送的第二数据进行解密处理。接收模块1210接收到第二数据后，解密模块1220可以判断目标数据是否为允许中间设备读取的数据，即判断第二数据是否是中间设备对目标数据进行过预设的数据处理，并对其进行加密的数据，当确定目标数据为允许中间设备读取的数据时，解密模块1220可以基于第二解密密钥，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据，其中，第二设备得到的数据可能与目标数据一致，也可能与目标数据不一致，是否相同取决于中间设备对目标数据的数据处理是否改变了目标数据。另外，第二设备中还可以预先存储有解密算法(可以称为第二解密算法)，即，获取到第二数据后，解密模块1220可以基于第二设备与中间设备协商的第二解密密钥和第二解密算法，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据。
可选的，所述第二数据传输消息中还携带有第一预设标识，其中，所述第一预设标识用于指示允许所述中间设备读取所述目标数据；
所述解密模块1220，具体用于：
当确定所述第二数据传输消息中携带有所述第一预设标识时，基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
在实施中，接收模块1210获取到第二数据传输消息后，解密模块1220可以判断第二数据传输消息中是否携带有第一预设标识，当确定第二数据传输消息中携带有第一预设标识时，即当确定第二数据传输消息中携带的第二数据是经过中间设备数据处理的目标数据再进行加密得到的数据时，可以按照上述步骤507表述的处理过程对第二数据进行处理，即解密模块1220基于第二设备与中间设备协商的第二解密密钥，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据。
可选的，所述接收模块1210，还用于：
接收所述中间设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据，所述第三数据为经过第三加密密钥加密的目标数据；
所述解密模块1220，还用于：
当确定所述第三数据传输消息中携带有所述第二预设标识时，基于所述第二设备与所述第一设备协商的第三解密密钥，对所述第三数据进行解密处理，得到所述目标数据。
在实施中，中间设备向第二设备发送携带有第三数据和第二预设标识的第三数据传输消息后，接收模块1210可以接收中间设备发送的第三数据传输消息，第二设备可以对其进行解析，获取其中携带的第三数据和第二预设标识，其中，第三数据为经过第三加密密钥加密的目标数据。第二设备中可以预先存储有第二设备与第一设备协商的解密密钥(即第三解密密钥)，其中，第三解密密钥可以用于对第一设备通过中间设备发送的第三数据进行解密处理。接收模块1210接收到第三数据传输消息后，解密模块1220可以判断第三数据传输消息中是否携带有第二预设标识，当确定第三数据传输消息中携带有第二预设标识时，即确定第三数据传输消息中携带的第三数据是第一设备基于第三加密密钥对目标数据进行加密得到的数据，中间设备并没有对目标数据进行任何处理时，解密模块1220可以基于第二设备与第一设备协商的第三解密密钥，对第三数据进行解密处理，得到目标数据。另外，第二设备中还可以预先存储有解密算法(可以称为第三解密算法)，即，当确定第三数据传输消息中携带有第二预设标识时，解密模块1220可以基于第二设备与第一设备协商的第三解密密钥和第三解密算法，对第三数据进行解密处理，得到目标数据。
可选的，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
可选的，所述接收模块1210，还用于：
接收所述中间设备发送的携带有所述中间设备的设备信息的验证请求；
如图13所示，所述第二设备还包括：
验证模块1230，用于根据所述中间设备的设备信息，验证所述中间设备的合法性；
发送模块1240，用于如果所述中间设备合法，则通过所述中间设备向第一设备发送用于指示所述中间设备合法的反馈消息；
协商模块1250，用于与所述中间设备协商用于数据传输的所述第二解密密钥和对应的第二加密密钥。
在实施中，中间设备向第二设备发送验证请求后，接收模块1210可以接收中间设备发送的验证请求，第二设备可以对其进行解析，获取其中携带的中间设备的设备信息。
获取到中间设备的设备信息后，验证模块1230可以根据预设的处理策略，验证中间设备的合法性。具体的，获取到中间设备的设备信息后，即获取到中间设备的设备标识、数据处理功能信息(可以是表述中间设备的数据处理功能的文本信息)以及证书后，其中，证书是由特定机构为中间设备颁发的，可以是基于私钥对中间设备的数据处理功能信息进行加密得到的，解密模块1220可以获取对应中间设备的公钥，并基于获取的公钥对证书进行解密，如果可以正确解密，且解密得到的数据处理功能信息与验证请求中携带的数据处理功能信息相同，则验证模块1230可以确定中间设备合法。另外，第二设备中还可以存储有该第二设备允许中间设备进行的操作，在上述判断的基础上，结合第二设备允许中间设备进行的操作，验证中间设备的合法性，例如，中间设备的数据处理功能为视频优化，如果第二设备中预先存储有允许具有视频优化功能的中间设备对传输的数据进行数据处理，则在解密得到的数据处理功能信息与验证请求中携带的数据处理功能信息相同的基础上，验证模块1230可以确定中间设备合法，如果第二设备中预先存储有不允许具有视频优化功能的中间设备对传输的数据进行数据处理，则即使解密得到的数据处理功能信息与验证请求中携带的数据处理功能信息相同，验证模块1230也确定中间设备不合法。
验证模块1230对中间设备的合法性进行验证后，如果中间设备合法，则发送模块1240可以通过中间设备向第一设备发送对应中间设备发送的验证请求的反馈消息，其中，该反馈消息可以用于指示中间设备合法。具体的，发送模块1240可以向中间设备发送对应中间设备发送的验证请求的反馈消息，其中，反馈消息中可以携带有合法的中间设备的设备标识。另外，第二设备可以对反馈消息做完整性保护处理。协商模块1250还可以与中间设备协商用于数据传输的第二解密密钥和对应的第二加密密钥。
本发明实施例中，第一设备发送至第二设备目标数据需要进行加密时，第 一设备可以采用第一设备与中间设备协商的第一加密密钥对目标数据进行加密处理，然后将其发送至中间设备，中间设备接收到第一设备发送的经过第一加密密钥加密的目标数据后，可以采用中间设备与第一设备协商的第一解密密钥对其进行解密，得到目标数据，并对目标数据进行预设的数据处理，进而，可以采用中间设备与第二设备协商的第二加密密钥对经过数据处理的目标数据进行加密，并将其发送至第二设备，第二设备接收到中间设备发送的数据后，可以采用第二设备与中间设备协商的第二解密密钥进行解密处理，得到经过中间设备数据处理的目标设备。这样，中间设备可以基于预先与第一设备协商的解密密钥对第一设备发送的数据进行解密，可以读取第一设备将要发送至第二设备的数据，进而，可以对目标数据进行预设的数据处理，从而，可以使得中间设备能够正常工作。
本发明实施例还提供了一种传输数据的系统，本实施例提供的系统可以实现本发明图5、6、7所示实施例的流程，第一设备为图2、8、9所示实施例的第一设备，中间设备为图3、10、11所示实施例的中间设备，第二设备为图4、12、13所示实施例的第二设备，所述系统包括第一设备、中间设备和第二设备，其中：
所述第一设备，用于获取待传输至所述第二设备的目标数据，如果所述目标数据为允许所述中间设备读取的数据，则基于所述第一设备与所述中间设备协商的第一加密密钥，对所述目标数据进行加密处理，得到第一数据，向所述中间设备发送携带有所述第一数据的第一数据传输消息；
所述中间设备，用于接收所述第一设备发送的携带有所述第一数据的第一数据传输消息，基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理，基于所述中间设备与第二设备协商的第二加密密钥，对经过数据处理的目标数据进行加密处理，得到第二数据，向所述第二设备发送携带有所述第二数据的第二数据传输消息；
所述第二设备，用于接收所述中间设备发送的携带有所述第二数据的第二数据传输消息，基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
在实施中，为保证数据传输的安全性，越来越多的服务器要求与终端进行 传输的数据需要进行加密处理，即TLS协议或者Quic(Quick UDP(User Datagram Protocol，用户数据报协议)Internet Connection，基于UDP的低时延互联网传输层)协议得到了广泛应用，此种情况下，第一设备将要向第二设备发送数据时，可以获取待传输的目标数据。第一设备获取到目标数据后，可以判断该目标数据是否允许中间设备读取的数据，如果目标数据为允许中间设备读取的数据，则第一设备可以基于预先存储的第一加密密钥，对目标数据进行加密处理，得到第一数据，其中，第一设备中还可以预先存储有加密算法(可以称为第一加密算法)，即，第一设备可以基于第一设备与中间设备协商的第一加密密钥和第一加密算法，对目标数据进行加密处理，得到第一数据。第一设备得到第一数据后，可以向中间设备发送数据传输消息(即第一数据传输消息)，其中，第一数据传输消息中还可以携带有第一数据。
第一设备向中间设备发送第一数据传输消息后，中间设备可以接收第一设备发送的第一数据传输消息，可以对其进行解析，获取其中携带的第一数据，其中，第一数据为经过第一加密密钥加密的目标数据。中间设备得到目标数据后，可以按照自身具有的数据处理功能，对得到的目标数据进行预设的数据处理，具体的，中间设备可以具有预设的数据处理功能，其中，预设的数据处理功能可以是统计数据功能，此种情况下，中间设备可以读取第一设备待传输至第二设备的目标数据，以便于进行统计，不改变目标数据，预设的数据处理功能也可以是视频优化功能，此种情况下，中间设备可以读取第一设备待传输至第二设备的目标数据，并基于预设的数据处理功能对目标数据进行改变，例如，第一设备为服务器，视频优化功能是将高清视频数据改变为标清视频数据，此种情况下，中间设备可以读取服务器发送至终端的高清视频数据(即目标数据)，进而，可以将目标数据改变为标清视频数据。也就是说，中间设备对目标数据进行预设的数据处理后，得到的数据可能与目标数据相同，也可能不同。中间设备对目标数据进行预设的数据处理后，可以获取预先存储的第二加密密钥，并基于第二加密密钥对经过数据处理的目标数据进行加密处理，得到第二数据，其中，中间设备中还可以预先存储有加密算法(可以称为第二加密算法)，即，中间设备可以基于中间设备与第二设备协商的第二加密密钥和第二加密算法，对经过数据处理的目标数据进行加密处理，得到第二数据。中间设备得到第二数据后，可以向第二设备发送数据传输消息(即第二数据传输消息)，其中，第二数据传输消息中可以携带有第二数据。
中间设备向第二设备发送携带有第二数据的第二数据传输消息后，第二设备可以接收中间设备发送的第二数据传输消息，并对其进行解析，获取其中携带的第二数据，其中，第二数据为经过中间设备数据处理的目标数据，再经过第二加密密钥加密的数据。第二设备中可以预先存储有第二设备与中间设备协商的解密密钥(即第二解密密钥)，其中，第二解密密钥可以用于对中间设备发送的第二数据进行解密处理。第二设备接收到第二数据后，可以判断目标数据是否为允许中间设备读取的数据，即判断第二数据是否是中间设备对目标数据进行过预设的数据处理，并对其进行加密的数据，当第二设备确定目标数据为允许中间设备读取的数据时，可以基于第二解密密钥，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据，其中，第二设备得到的数据可能与目标数据一致，也可能与目标数据不一致，是否相同取决于中间设备对目标数据的数据处理是否改变了目标数据。另外，第二设备中还可以预先存储有解密算法(可以称为第二解密算法)，即，第二设备获取到第二数据后，可以基于第二设备与中间设备协商的第二解密密钥和第二解密算法，对第二数据进行解密处理，得到经过中间设备数据处理的目标数据。
本发明实施例中，第一设备发送至第二设备目标数据需要进行加密时，第一设备可以采用第一设备与中间设备协商的第一加密密钥对目标数据进行加密处理，然后将其发送至中间设备，中间设备接收到第一设备发送的经过第一加密密钥加密的目标数据后，可以采用中间设备与第一设备协商的第一解密密钥对其进行解密，得到目标数据，并对目标数据进行预设的数据处理，进而，可以采用中间设备与第二设备协商的第二加密密钥对经过数据处理的目标数据进行加密，并将其发送至第二设备，第二设备接收到中间设备发送的数据后，可以采用第二设备与中间设备协商的第二解密密钥进行解密处理，得到经过中间设备数据处理的目标设备。这样，中间设备可以基于预先与第一设备协商的解密密钥对第一设备发送的数据进行解密，可以读取第一设备将要发送至第二设备的数据，进而，可以对目标数据进行预设的数据处理，从而，可以使得中间设备能够正常工作。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘 或光盘等。
以上所述仅为本发明的较佳实施例，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (31)

  1. 一种传输数据的方法，其特征在于，所述方法包括：
    第一设备获取待传输至第二设备的目标数据；
    如果所述目标数据为允许中间设备读取的数据，则所述第一设备基于所述第一设备与所述中间设备协商的第一加密密钥，对所述目标数据进行加密处理，得到第一数据；
    所述第一设备向所述中间设备发送携带有所述第一数据的第一数据传输消息。
  2. 根据权利要求1所述的方法，其特征在于，所述第一数据传输消息中还携带有第一预设标识，其中，所述第一预设标识用于指示允许所述中间设备读取所述目标数据。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    如果所述目标数据为不允许所述中间设备读取的数据，则所述第一设备基于所述第一设备与所述第二设备协商的第三加密密钥，对所述目标数据进行加密处理，得到第三数据；
    所述第一设备向所述中间设备发送携带有所述第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据。
  4. 根据权利要求3所述的方法，其特征在于，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
    所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
  5. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一设备向所述中间设备发送验证指示消息，其中，所述验证指示消息用于指示所述中间设备向所述第二设备发送用于验证所述中间设备合法性的验证请求；
    所述第一设备接收所述中间设备发送的用于指示所述中间设备合法的反馈消息；
    所述第一设备与所述中间设备协商用于数据传输的所述第一加密密钥和对应的第一解密密钥。
  6. 一种传输数据的方法，其特征在于，所述方法包括：
    中间设备接收第一设备发送的携带有第一数据的第一数据传输消息，其中，所述第一数据为经过第一加密密钥加密的目标数据；
    所述中间设备基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；
    所述中间设备基于所述中间设备与第二设备协商的第二加密密钥，对经过数据处理的目标数据进行加密处理，得到第二数据；
    所述中间设备向所述第二设备发送携带有所述第二数据的第二数据传输消息。
  7. 根据权利要求6所述的方法，其特征在于，所述第一数据传输消息中还携带有第一预设标识，所述第一预设标识用于指示允许所述中间设备读取所述目标数据；
    所述中间设备基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理，包括：
    当所述中间设备确定所述第一数据传输消息中携带有所述第一预设标识时，所述中间设备基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；
    所述中间设备向所述第二设备发送携带有所述第二数据的第二数据传输消息，包括：
    所述中间设备向所述第二设备发送携带有所述第二数据和所述第一预设标识的第二数据传输消息。
  8. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    所述中间设备接收所述第一设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据，所述第三数据为经过第三加密密钥加密的目标数据；
    当所述中间设备确定所述第三数据传输消息中携带有所述第二预设标识时，所述中间设备向所述第二设备发送所述第三数据传输消息。
  9. 根据权利要求8所述的方法，其特征在于，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
    所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
  10. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    所述中间设备接收所述第一设备发送的验证指示消息；
    所述中间设备向所述第二设备发送携带有所述中间设备的设备信息的验证请求；
    所述中间设备接收所述第二设备发送的用于指示所述中间设备合法的反馈消息，向所述第一设备发送所述第二设备发送的用于指示所述中间设备合法的反馈消息；
    所述中间设备与所述第一设备协商用于数据传输的所述第一加密密钥和所述第一解密密钥，并与所述第二设备协商用于数据传输的所述第二加密密钥和对应的第二解密密钥。
  11. 一种传输数据的方法，其特征在于，所述方法包括：
    第二设备接收中间设备发送的携带有第二数据的第二数据传输消息，其中，所述第二数据为经过所述中间设备数据处理的目标数据再进行加密得到的数据；
    所述第二设备基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
  12. 根据权利要求11所述的方法，其特征在于，所述第二数据传输消息中还携带有第一预设标识，其中，所述第一预设标识用于指示允许所述中间设备读取所述目标数据；
    所述第二设备基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据，包括：
    当所述第二设备确定所述第二数据传输消息中携带有所述第一预设标识时，所述第二设备基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
  13. 根据权利要求12所述的方法，其特征在于，所述方法还包括：
    所述第二设备接收所述中间设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据，所述第三数据为经过第三加密密钥加密的目标数据；
    当所述第二设备确定所述第三数据传输消息中携带有所述第二预设标识时，所述第二设备基于所述第二设备与所述第一设备协商的第三解密密钥，对所述第三数据进行解密处理，得到所述目标数据。
  14. 根据权利要求13所述的方法，其特征在于，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
    所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
  15. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    所述第二设备接收所述中间设备发送的携带有所述中间设备的设备信息的验证请求；
    所述第二设备根据所述中间设备的设备信息，验证所述中间设备的合法性；
    如果所述中间设备合法，则所述第二设备通过所述中间设备向第一设备发送用于指示所述中间设备合法的反馈消息，并与所述中间设备协商用于数据传输的所述第二解密密钥和对应的第二加密密钥。
  16. 一种第一设备，其特征在于，所述第一设备包括：
    获取模块，用于获取待传输至第二设备的目标数据；
    加密模块，用于如果所述目标数据为允许中间设备读取的数据，则基于所述第一设备与所述中间设备协商的第一加密密钥，对所述目标数据进行加密处理，得到第一数据；
    发送模块，用于向所述中间设备发送携带有所述第一数据的第一数据传输消息。
  17. 根据权利要求16所述的第一设备，其特征在于，所述第一数据传输消息中还携带有第一预设标识，其中，所述第一预设标识用于指示允许所述中间设备读取所述目标数据。
  18. 根据权利要求17所述的第一设备，其特征在于，所述加密模块，还用于：
    如果所述目标数据为不允许所述中间设备读取的数据，则基于所述第一设 备与所述第二设备协商的第三加密密钥，对所述目标数据进行加密处理，得到第三数据；
    所述发送模块，还用于：
    向所述中间设备发送携带有所述第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据。
  19. 根据权利要求18所述的第一设备，其特征在于，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
    所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
  20. 根据权利要求16所述的第一设备，其特征在于，所述发送模块，还用于：
    向所述中间设备发送验证指示消息，其中，所述验证指示消息用于指示所述中间设备向所述第二设备发送用于验证所述中间设备合法性的验证请求；
    所述第一设备还包括：
    接收模块，用于接收所述中间设备发送的用于指示所述中间设备合法的反馈消息；
    协商模块，用于与所述中间设备协商用于数据传输的所述第一加密密钥和对应的第一解密密钥。
  21. 一种中间设备，其特征在于，所述中间设备包括：
    接收模块，用于接收第一设备发送的携带有第一数据的第一数据传输消息，其中，所述第一数据为经过第一加密密钥加密的目标数据；
    解密模块，用于基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；
    加密模块，用于基于所述中间设备与第二设备协商的第二加密密钥，对经过数据处理的目标数据进行加密处理，得到第二数据；
    发送模块，用于向所述第二设备发送携带有所述第二数据的第二数据传输消息。
  22. 根据权利要求21所述的中间设备，其特征在于，所述第一数据传输消 息中还携带有第一预设标识，所述第一预设标识用于指示允许所述中间设备读取所述目标数据；
    所述解密模块，具体用于：
    当确定所述第一数据传输消息中携带有所述第一预设标识时，基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理；
    所述发送模块，具体用于：
    向所述第二设备发送携带有所述第二数据和所述第一预设标识的第二数据传输消息。
  23. 根据权利要求22所述的中间设备，其特征在于，所述接收模块，还用于：
    接收所述第一设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据，所述第三数据为经过第三加密密钥加密的目标数据；
    所述发送模块，还用于：
    当确定所述第三数据传输消息中携带有所述第二预设标识时，向所述第二设备发送所述第三数据传输消息。
  24. 根据权利要求23所述的中间设备，其特征在于，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
    所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
  25. 根据权利要求21所述的中间设备，其特征在于，所述接收模块，还用于：
    接收所述第一设备发送的验证指示消息；
    所述发送模块，还用于：
    向所述第二设备发送携带有所述中间设备的设备信息的验证请求；
    所述接收模块，还用于：
    接收所述第二设备发送的用于指示所述中间设备合法的反馈消息；
    所述发送模块，还用于：
    向所述第一设备发送所述第二设备发送的用于指示所述中间设备合法的反馈消息；
    所述中间设备还包括：
    协商模块，用于与所述第一设备协商用于数据传输的所述第一加密密钥和所述第一解密密钥，并与所述第二设备协商用于数据传输的所述第二加密密钥和对应的第二解密密钥。
  26. 一种第二设备，其特征在于，所述第二设备包括：
    接收模块，用于接收中间设备发送的携带有第二数据的第二数据传输消息，其中，所述第二数据为经过所述中间设备数据处理的目标数据再进行加密得到的数据；
    解密模块，用于基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
  27. 根据权利要求26所述的第二设备，其特征在于，所述第二数据传输消息中还携带有第一预设标识，其中，所述第一预设标识用于指示允许所述中间设备读取所述目标数据；
    所述解密模块，具体用于：
    当确定所述第二数据传输消息中携带有所述第一预设标识时，基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
  28. 根据权利要求27所述的第二设备，其特征在于，所述接收模块，还用于：
    接收所述中间设备发送的携带有第三数据和第二预设标识的第三数据传输消息，其中，所述第二预设标识用于指示不允许所述中间设备读取所述目标数据，所述第三数据为经过第三加密密钥加密的目标数据；
    所述解密模块，还用于：
    当确定所述第三数据传输消息中携带有所述第二预设标识时，基于所述第二设备与所述第一设备协商的第三解密密钥，对所述第三数据进行解密处理，得到所述目标数据。
  29. 根据权利要求28所述的第二设备，其特征在于，所述第一预设标识或所述第二预设标识设置于传输层安全TLS包头中；或者，
    所述第一预设标识或所述第二预设标识设置于基于用户数据报协议的低时延互联网传输层QUIC包头中。
  30. 根据权利要求26所述的第二设备，其特征在于，所述接收模块，还用于：
    接收所述中间设备发送的携带有所述中间设备的设备信息的验证请求；
    所述第二设备还包括：
    验证模块，用于根据所述中间设备的设备信息，验证所述中间设备的合法性；
    发送模块，用于如果所述中间设备合法，则通过所述中间设备向第一设备发送用于指示所述中间设备合法的反馈消息；
    协商模块，用于与所述中间设备协商用于数据传输的所述第二解密密钥和对应的第二加密密钥。
  31. 一种传输数据的系统，其特征在于，所述系统包括第一设备、中间设备和第二设备，其中：
    所述第一设备，用于获取待传输至所述第二设备的目标数据，如果所述目标数据为允许所述中间设备读取的数据，则基于所述第一设备与所述中间设备协商的第一加密密钥，对所述目标数据进行加密处理，得到第一数据，向所述中间设备发送携带有所述第一数据的第一数据传输消息；
    所述中间设备，用于接收所述第一设备发送的携带有所述第一数据的第一数据传输消息，基于所述中间设备与所述第一设备协商的第一解密密钥，对所述第一数据进行解密处理，得到所述目标数据，并对所述目标数据进行预设的数据处理，基于所述中间设备与第二设备协商的第二加密密钥，对经过数据处理的目标数据进行加密处理，得到第二数据，向所述第二设备发送携带有所述第二数据的第二数据传输消息；
    所述第二设备，用于接收所述中间设备发送的携带有所述第二数据的第二数据传输消息，基于所述第二设备与所述中间设备协商的第二解密密钥，对所述第二数据进行解密处理，得到经过所述中间设备数据处理的目标数据。
PCT/CN2016/103301 2016-10-25 2016-10-25 一种传输数据的方法、装置和系统 WO2018076183A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
PCT/CN2016/103301 WO2018076183A1 (zh) 2016-10-25 2016-10-25 一种传输数据的方法、装置和系统
EP16920146.4A EP3522473A4 (en) 2016-10-25 2016-10-25 DATA TRANSMISSION PROCESS, DEVICE AND SYSTEM
CN201680090033.7A CN109845214B (zh) 2016-10-25 2016-10-25 一种传输数据的方法、装置和系统
US16/392,364 US20190268764A1 (en) 2016-10-25 2019-04-23 Data transmission method, apparatus, and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/103301 WO2018076183A1 (zh) 2016-10-25 2016-10-25 一种传输数据的方法、装置和系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/392,364 Continuation US20190268764A1 (en) 2016-10-25 2019-04-23 Data transmission method, apparatus, and system

Publications (1)

Publication Number Publication Date
WO2018076183A1 true WO2018076183A1 (zh) 2018-05-03

Family

ID=62024159

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/103301 WO2018076183A1 (zh) 2016-10-25 2016-10-25 一种传输数据的方法、装置和系统

Country Status (4)

Country Link
US (1) US20190268764A1 (zh)
EP (1) EP3522473A4 (zh)
CN (1) CN109845214B (zh)
WO (1) WO2018076183A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR3096532A1 (fr) * 2019-06-28 2020-11-27 Orange Procédé de gestion d’une communication entre terminaux dans un réseau de communication, et dispositifs et système pour la mise en œuvre du procédé
WO2021073247A1 (zh) * 2019-10-14 2021-04-22 上海哔哩哔哩科技有限公司 基于quic传输协议的通信方法和系统
US20220311746A1 (en) * 2019-06-28 2022-09-29 Orange Method for managing communication between terminals in a communication network, and devices for implementing the method
CN115208569A (zh) * 2022-09-15 2022-10-18 广州万协通信息技术有限公司 密钥动态分配的加密解密方法及装置

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR3067545A1 (fr) * 2017-06-21 2018-12-14 Orange Procede d'activation de traitements appliques a une session de donnees
FR3081653A1 (fr) * 2018-06-25 2019-11-29 Orange Procede de modification de messages par un equipement sur un chemin de communication etabli entre deux noeuds
US11632672B2 (en) * 2019-12-30 2023-04-18 Texas Instruments Incorporated Systems and methods to support data privacy over a multi-hop network
CN112333173B (zh) * 2020-03-11 2023-07-04 合肥达朴汇联科技有限公司 基于数据提供方的数据传送方法、系统、设备及存储介质
EP4222918A1 (en) * 2020-09-29 2023-08-09 Telefonaktiebolaget LM Ericsson (publ) Methods and apparatuses for providing communication between a server and a client device via a proxy node
CN114520730B (zh) * 2020-11-20 2023-06-20 腾讯科技（深圳）有限公司 数据传输方法、装置、系统、计算机设备和存储介质
EP4302457A1 (en) * 2021-03-01 2024-01-10 Telefonaktiebolaget LM Ericsson (publ) Traffic management with asymmetric traffic encryption in 5g networks
US20240031436A1 (en) * 2022-07-19 2024-01-25 Centurylink Intellectual Property Llc Dynamic storage and forwarding of data

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102088441A (zh) * 2009-12-08 2011-06-08 北京大学 消息中间件的数据加密传输方法和系统
US20120233453A1 (en) * 2007-03-22 2012-09-13 Cisco Technology, Inc. Reducing Processing Load in Proxies for Secure Communications
CN102948131A (zh) * 2010-04-21 2013-02-27 思杰系统有限公司 用于经由wan设备分离代理ssl的系统和方法
US20150229481A1 (en) * 2011-07-28 2015-08-13 Cloudflare, Inc. Supporting secure sessions in a cloud-based proxy service
CN105429962A (zh) * 2015-11-03 2016-03-23 清华大学 一种通用的面向加密数据的中间网络服务构建方法与体系
US9350715B1 (en) * 2003-02-13 2016-05-24 Cisco Technology, Inc. Methods and apparatus for network communications via a transparent security proxy
CN105794171A (zh) * 2013-11-28 2016-07-20 瑞典爱立信有限公司 用于握手期间中间节点发现的方法和装置
WO2016112580A1 (zh) * 2015-01-14 2016-07-21 华为技术有限公司 业务处理方法及装置
WO2016141513A1 (zh) * 2015-03-06 2016-09-15 华为技术有限公司 业务处理方法及装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7543146B1 (en) * 2004-06-18 2009-06-02 Blue Coat Systems, Inc. Using digital certificates to request client consent prior to decrypting SSL communications
US8190879B2 (en) * 2009-12-17 2012-05-29 Cisco Technology, Inc. Graceful conversion of a security to a non-security transparent proxy
US9124628B2 (en) * 2012-09-20 2015-09-01 Cisco Technology, Inc. Seamless engagement and disengagement of transport layer security proxy services

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9350715B1 (en) * 2003-02-13 2016-05-24 Cisco Technology, Inc. Methods and apparatus for network communications via a transparent security proxy
US20120233453A1 (en) * 2007-03-22 2012-09-13 Cisco Technology, Inc. Reducing Processing Load in Proxies for Secure Communications
CN102088441A (zh) * 2009-12-08 2011-06-08 北京大学 消息中间件的数据加密传输方法和系统
CN102948131A (zh) * 2010-04-21 2013-02-27 思杰系统有限公司 用于经由wan设备分离代理ssl的系统和方法
US20150229481A1 (en) * 2011-07-28 2015-08-13 Cloudflare, Inc. Supporting secure sessions in a cloud-based proxy service
CN105794171A (zh) * 2013-11-28 2016-07-20 瑞典爱立信有限公司 用于握手期间中间节点发现的方法和装置
WO2016112580A1 (zh) * 2015-01-14 2016-07-21 华为技术有限公司 业务处理方法及装置
WO2016141513A1 (zh) * 2015-03-06 2016-09-15 华为技术有限公司 业务处理方法及装置
CN105429962A (zh) * 2015-11-03 2016-03-23 清华大学 一种通用的面向加密数据的中间网络服务构建方法与体系

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3522473A4 *

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR3096532A1 (fr) * 2019-06-28 2020-11-27 Orange Procédé de gestion d’une communication entre terminaux dans un réseau de communication, et dispositifs et système pour la mise en œuvre du procédé
WO2020260825A1 (fr) * 2019-06-28 2020-12-30 Orange Procede de gestion d'une communication entre terminaux dans un reseau de communication, et dispositifs et systeme pour la mise en oeuvre du procede
US20220311746A1 (en) * 2019-06-28 2022-09-29 Orange Method for managing communication between terminals in a communication network, and devices for implementing the method
WO2021073247A1 (zh) * 2019-10-14 2021-04-22 上海哔哩哔哩科技有限公司 基于quic传输协议的通信方法和系统
CN115208569A (zh) * 2022-09-15 2022-10-18 广州万协通信息技术有限公司 密钥动态分配的加密解密方法及装置
CN115208569B (zh) * 2022-09-15 2022-12-20 广州万协通信息技术有限公司 密钥动态分配的加密解密方法及装置

Also Published As

Publication number Publication date
US20190268764A1 (en) 2019-08-29
EP3522473A4 (en) 2019-11-06
EP3522473A1 (en) 2019-08-07
CN109845214B (zh) 2020-10-16
CN109845214A (zh) 2019-06-04

Similar Documents

Publication Publication Date Title
WO2018076183A1 (zh) 一种传输数据的方法、装置和系统
US7685422B2 (en) Information processing apparatus, information processing method, and information processing program
CN110190955B (zh) 基于安全套接层协议认证的信息处理方法及装置
WO2018214777A1 (zh) 一种数据通信方法、装置、设备和存储介质
JP3819729B2 (ja) データ安全化通信装置及びその方法
US9055047B2 (en) Method and device for negotiating encryption information
US7584505B2 (en) Inspected secure communication protocol
US8788805B2 (en) Application-level service access to encrypted data streams
US11658949B2 (en) Secure publish-subscribe communication methods and apparatus
WO2018019069A1 (zh) 一种资源操作方法及装置
US8583809B2 (en) Destroying a secure session maintained by a server on behalf of a connection owner
WO2017215582A1 (zh) 加密内容检测的方法和设备
CN105337935B (zh) 一种建立客户端和服务端长连接的方法和装置
CN113225352B (zh) 一种数据传输方法、装置、电子设备及存储介质
US11736304B2 (en) Secure authentication of remote equipment
US20080109654A1 (en) System and method for RFID transfer of MAC, keys
CN111756529B (zh) 一种量子会话密钥分发方法及系统
WO2023241176A1 (zh) 通信方法、装置、设备、存储介质及程序产品
JP2012100206A (ja) 暗号通信中継システム、暗号通信中継方法および暗号通信中継用プログラム
JP2003143128A (ja) 通信システム及び通信方法
CN104243452A (zh) 一种云计算访问控制方法及系统
WO2023036348A1 (zh) 一种加密通信方法、装置、设备及介质
KR101881279B1 (ko) 보안 소켓 계층 통신을 이용하는 패킷을 검사하는 방법
WO2016176858A1 (zh) 一种传输请求的方法及客户端
WO2016003310A1 (en) Bootstrapping a device to a wireless network

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16920146

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2016920146

Country of ref document: EP

Effective date: 20190430