WO2019109533A1 - 安全通信方法、装置、计算机设备及存储介质 - Google Patents

安全通信方法、装置、计算机设备及存储介质 Download PDF

Info

Publication number
WO2019109533A1
WO2019109533A1 PCT/CN2018/078327 CN2018078327W WO2019109533A1 WO 2019109533 A1 WO2019109533 A1 WO 2019109533A1 CN 2018078327 W CN2018078327 W CN 2018078327W WO 2019109533 A1 WO2019109533 A1 WO 2019109533A1
Authority
WO
WIPO (PCT)
Prior art keywords
root certificate
private key
receiving end
signed
self
Prior art date
Application number
PCT/CN2018/078327
Other languages
English (en)
French (fr)
Inventor
吴贞海
Original Assignee
深圳壹账通智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳壹账通智能科技有限公司 filed Critical 深圳壹账通智能科技有限公司
Publication of WO2019109533A1 publication Critical patent/WO2019109533A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the present application relates to the field of computer technology, and in particular, to a secure communication method, apparatus, computer device, and storage medium.
  • the security in the communication process is jointly guaranteed by the communication server and the communication party, that is, the communication server side can see the communication content of the communication parties, so that the communication server can obtain the communication content, which may cause the communication content to leak.
  • the communication client applies to the authoritative certificate provider CA to issue a certificate, and uses the issued certificate to ensure the dual transmission.
  • information security is completely dependent on the certificate provider, and once the certificate provider leaks the certificate, the communication content will still be leaked.
  • a secure communication method includes: acquiring a receiver identifier, where the receiver identifier can uniquely determine a receiver; and querying, by the receiver identifier, a self-signed first root certificate generated by the receiver; The first certificate encrypts the communication data; the encrypted communication data is sent to the receiving end, so that the receiving end decrypts the communication data by using a first private key, the first private key Corresponding to the first root certificate.
  • a secure communication device comprising:
  • a receiving end identifier obtaining module configured to acquire a receiving end identifier, where the receiving end identifier can uniquely determine the receiving end;
  • a querying module configured to query, according to the receiving end identifier, a self-signed first root certificate generated by the receiving end;
  • a first encryption module configured to encrypt the communication data by using the first root certificate
  • a sending module configured to send the encrypted communication data to the receiving end, so that the receiving end decrypts the communication data by using a first private key, the first private key and the first The root certificate corresponds.
  • a computer device comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, the processor executing the computer program to: obtain a receiver identifier, the receiver identifier
  • the receiving end may be uniquely determined; the self-signed first root certificate generated by the receiving end is queried according to the receiving end identifier; the communication data is encrypted by the first root certificate; and the encrypted communication data is sent to the Determining the receiving end, so that the receiving end decrypts the communication data by using a first private key, where the first private key corresponds to the first root certificate.
  • a computer readable storage medium having stored thereon a computer program, the computer program being executed by the processor, the following steps are performed: obtaining a receiving end identifier, the receiving end identifier can uniquely determine a receiving end; and querying according to the receiving end identifier a self-signed first root certificate generated by the receiving end; encrypting the communication data by using the first root certificate; and transmitting the encrypted communication data to the receiving end, so that the receiving end passes the first
  • the private key decrypts the communication data, and the first private key corresponds to the first root certificate.
  • the above-mentioned secure communication method, device, computer device and storage medium send a self-signed root certificate to the communicating party, for example, the receiving end sends a self-signed root certificate to the transmitting end, so that the transmitting end can self-sign the root certificate according to the receiving end.
  • the communication data is signed, so that only the terminal having the corresponding private key, that is, the receiving end can obtain the plaintext of the communication data, can prevent the communication server from obtaining the plaintext of the communication data, and ensure the security of the private key, thereby improving the communication.
  • the security of the data is signed, so that only the terminal having the corresponding private key, that is, the receiving end can obtain the plaintext of the communication data, can prevent the communication server from obtaining the plaintext of the communication data, and ensure the security of the private key, thereby improving the communication.
  • the security of the data is signed, so that only the terminal having the corresponding private key, that is, the receiving end can obtain the plaintext of the communication data, can prevent the communication server from obtaining the
  • 1 is an application environment diagram of a secure communication method in an embodiment
  • FIG. 2 is a flow chart of a secure communication method in an embodiment
  • 3 is a timing diagram of data flow in an embodiment
  • Figure 5 is a flow chart showing the installation steps in an embodiment
  • FIG. 6 is a schematic diagram of a mail sending interface in an embodiment
  • FIG. 7 is a schematic diagram of a mail receiving interface in an embodiment
  • FIG. 8 is a schematic diagram of a password input interface in an embodiment
  • FIG. 9 is a schematic diagram of a certificate storage path interface in an embodiment
  • FIG. 10 is a schematic diagram of a second certificate installation interface in an embodiment
  • FIG. 11 is a schematic diagram of an encrypted mail in an embodiment
  • Figure 12 is a schematic diagram of a secure communication device in an embodiment
  • Figure 13 is a diagram showing the internal structure of a computer device in an embodiment.
  • the secure communication method provided by the present application can be applied to an application environment as shown in FIG. 1.
  • the transmitting end is connected to the receiving end through a network, wherein the sending end and the receiving end may be, but are not limited to, various personal computers, notebook computers, smart phones, tablet computers, and portable wearable devices.
  • the communication between the sender and the receiver may be short message communication or communication through a communication client installed therein, such as a mail client, WeChat, QQ, etc., even a communication client.
  • a secure communication method is provided.
  • the method is applied to the sending end in FIG. 1 as an example, and includes the following steps:
  • S202 Acquire a receiving end identifier, where the receiving end identifier can uniquely determine the receiving end.
  • the receiving end identifier may uniquely determine the receiving end, which may be a username of the receiving end, an account of the receiving end, and the like.
  • S204 Query the self-signed first root certificate generated by the receiving end according to the identifier of the receiving end.
  • the first root certificate is generated by the receiving end, and the receiving end generates the self-signed first root certificate and the first private key, and installs the first root certificate and the first private key, so that only the receiving end authorization is performed.
  • the sender can use the first root certificate to encrypt the communication data, so that only the receiving end can see the plaintext of the communication data.
  • S206 Encrypt the communication data by using the first root certificate.
  • the communication data is encrypted by using the first root certificate, so that only the receiving end having the first private key corresponding to the first root certificate can obtain the
  • the clear text of the communication data ensures the security of the communication data.
  • the data is encrypted by the first certificate sent to the sending end, instead of being encrypted by the second private key of the sending end, so that only the receiving end having the first private key can obtain the plaintext of the communication data. Further guarantee the security of the data.
  • S208 Send the encrypted communication data to the receiving end, so that the receiving end decrypts the communication data by using the first private key, and the first private key corresponds to the first root certificate.
  • the communication data encrypted by the first root certificate is sent to the receiving end, and the receiving end can decrypt the encrypted communication data by using the installed first private key, so that the plaintext can be seen, and in the sending process, the communication server is The plaintext of the communication data cannot be seen because the communication server does not have a corresponding first private key, thereby ensuring the security of the communication data.
  • the above secure communication method by sending a self-signed root certificate to the communicating party, enables the transmitting end to sign the communication data according to the root certificate issued by the receiving end, so that only the terminal having the corresponding private key can prevent the communication server from acquiring.
  • the security of the communication data is improved by the clear text of the communication data and the security of the private key.
  • the secure communication method may further include a pre-processing step, which may be performed before the embodiment shown in FIG. 2, the pre-processing step may include: generating a self-signed second a root certificate and a second private key corresponding to the second root certificate; installing the self-signed second root certificate and the second private key; sending the self-signed second root certificate to the receiving end, so that the receiving end installs the second root certificate.
  • the self-signed root certificate is sent to the authorized communication terminal, so that only the communication terminal having the private key can see the communication data encrypted by the root certificate, thereby improving The security of communication data.
  • the secure communication method further includes a double layer encryption step, the step of double layer encryption may be performed after the step of encrypting the communication data by the first root certificate, the double layer encryption
  • the step may include: encrypting the communication data encrypted by the first root certificate by using the second private key.
  • the step of transmitting the encrypted communication data to the receiving end, so that the receiving end decrypts the communication data by using the first private key may include: transmitting the communication data encrypted by the first root certificate and the second private key to the receiving end. End, so that the receiving end decrypts the communication data by using the second certificate and the first private key.
  • FIG. 3 is a timing diagram of data flow in an embodiment.
  • the sender generates and installs a self-signed second root certificate and a second private key, and sends the second root certificate to the receiving.
  • the installation is performed; the receiving end generates and installs the self-signed first root certificate and the first private key, and sends the first root certificate to the sending end for installation.
  • the transmitting end when the transmitting end needs to send the communication data to the receiving end, first query the first root certificate corresponding to the identifier of the receiving end, encrypt the communication data by using the first root certificate, and then generate the self-signed first generated by the sending end.
  • the second private key encrypts the encrypted communication data again, and the double-layer encryption method can increase the security of the data, and send the double-encrypted communication data to the receiving end.
  • the receiving end After receiving the communication data, the receiving end first performs an inquiry according to the identifier of the sending end, obtains a second root certificate, decrypts the double-layer encrypted communication data through the second root certificate, and then obtains the second installed version of the receiving end.
  • a private key is decrypted by the first private key to obtain a plaintext of the communication data and displayed.
  • the communication data is encrypted by double-layer encryption, thereby further ensuring the security of the communication data.
  • FIG. 4 is a flowchart of a key generation step in an embodiment, where the key generation step is to generate a self-signed second root certificate and corresponding to the second root certificate.
  • the step of the second private key may include:
  • S402 Generate a public and private key of the second root certificate by using an open source tool.
  • S406 Generate a self-signed second root certificate according to the user information and the public and private keys.
  • S410 Generate a second private key corresponding to the second root certificate according to the first password.
  • the second root certificate and the second private key contain user information, ensuring the uniqueness of the second root certificate and the second private key, and setting a first password to the second private key, further ensuring the first The security of the second private key.
  • FIG. 5 is a flowchart of an installation step in an embodiment, where the step of installing the self-signed second root certificate and the second private key may include:
  • S502 Store the self-signed second root certificate and the second private key to the communication client.
  • the communication client of the sending end for example, a mailbox client or an instant messaging client installed to the sending end.
  • the mail client is used as an example for description.
  • the third terminal can log in to the email client, and then send the second root certificate and the second private key to the mailbox client in the third terminal, for example, for example, Send in the form of an attachment, as shown in Figure 6.
  • the mail client at the sending end then receives the mail to implement storage of the second root certificate and the second private key, as shown in FIG.
  • the communication client may be an instant messaging client, which may also send the second root certificate and the second private key through the third terminal, so that the second root certificate and the second private key are received at the transmitting end.
  • S504 Receive a first installation instruction for the second private key and a second password corresponding to the first installation instruction.
  • the user may send a first installation instruction for the second private key to the sender by clicking the second private key in the communication client, and when the sender receives the first installation instruction, the password input interface is displayed. As shown in FIG. 8, the user inputs a second password to the password input interface, so that the sender can receive the second password.
  • the sending end compares the second password with the first password, and only installs the second private key when the first password and the second password are the same, so that the second password can be guaranteed.
  • the security of the second private key Referring to FIG. 9, after the second private key is installed, the second private key of the installation may be viewed, and the specific path is: Settings -> General -> Description File and Configuration Management.
  • the sending end installs the second root certificate, as shown in FIG. 10, so that the second root certificate and the second private key are deployed on the sending end.
  • the process of deploying the first root certificate and the first private key of the receiving end refer to the process of deploying the second root certificate and the second private key on the sending end, and details are not described herein again.
  • the second private key is protected by the password to ensure the security of the second private key, thereby improving the security of the communication data.
  • the method for secure communication may further include: receiving a self-signed first root certificate encrypted by the second root certificate sent by the receiving end; and decrypting the encrypted first root certificate by using the second private key Obtain the decrypted first root certificate; install the decrypted first root certificate.
  • the first certificate is encrypted by the self-signed second certificate of the sending end, thereby ensuring the security of the first root certificate during the transmission process, thereby ensuring the security of the subsequent transmission process.
  • the method further includes: receiving, by the third terminal, the first root certificate that is self-signed by the receiving end; When the first root certificate sent by the third terminal and signed by the receiving end is the same as the first root certificate after decryption, the first root certificate is installed.
  • the third terminal may be a terminal such as a USB flash drive.
  • the security of the first root certificate sent by the terminal such as the USB flash drive is ensured, that is, the self-signed first root certificate received by the third terminal is not encrypted. In the case of transmission, it is easily falsified, etc.
  • the first root certificate can be transmitted once by encryption, that is, the receiving end encrypts the first root certificate through the second root certificate. And sending the first root certificate to the sending end, after receiving the encrypted first root certificate, the sending end decrypts the second root key to obtain the first root certificate, and then passes the first root certificate to the third terminal.
  • the first root certificate sent is compared, and only the two are the same, the first root certificate will be installed.
  • an identifier can be set at the sender's location, and a tick symbol is shown in FIG.
  • the email is an email encrypted by the second certificate. You can click the symbol to further view the details of the first certificate. For example, you can click the “Show Certificate” button to view the identifier of the first certificate and determine the number. Whether the identifier of a certificate is consistent with the identifier of the first certificate obtained through a channel such as a USB flash drive. If the identifier is the same, the first root certificate can be installed.
  • the first root certificate is further verified to ensure the security of the first root certificate, which further lays a foundation for subsequent secure communication.
  • a secure communication device comprising:
  • the receiving end identifier obtaining module 100 is configured to obtain the receiving end identifier, and the receiving end identifier can uniquely determine the receiving end.
  • the query module 200 is configured to query, according to the identifier of the receiver, the self-signed first root certificate generated by the receiving end.
  • the first encryption module 300 is configured to encrypt the communication data by using the first root certificate.
  • the communication data sending module 400 is configured to send the encrypted communication data to the receiving end, so that the receiving end decrypts the communication data by using the first private key, and the first private key corresponds to the first root certificate.
  • the secure communication device may further include: a generating module, configured to generate a self-signed second root certificate and a second private key corresponding to the second root certificate.
  • the first installation module is configured to install the self-signed second root certificate and the second private key.
  • the certificate sending module is configured to send the self-signed second root certificate to the receiving end, so that the receiving end installs the second root certificate.
  • the secure communication device may further include: a second encryption module, configured to encrypt the communication after the first root certificate by using the second private key after encrypting the communication data by using the first root certificate
  • the data is encrypted.
  • the communication data sending module is further configured to send the communication data encrypted by the first root certificate and the second private key to the receiving end, so that the receiving end decrypts the communication data by using the second certificate and the first private key.
  • the generating module may include: a public-private key generating unit configured to generate a public-private key of the second root certificate through the open source tool.
  • the user information obtaining unit is configured to acquire user information corresponding to the second root certificate.
  • the root certificate generating unit is configured to generate a self-signed second root certificate according to the user information and the public and private keys.
  • the password obtaining unit is configured to acquire a first password corresponding to the second private key.
  • the private key generating unit is configured to generate a second private key corresponding to the second root certificate according to the first password.
  • the first installation module may include: a storage unit, configured to store the self-signed second root certificate and the second private key to the communication client.
  • the first installation instruction receiving unit is configured to receive a first installation instruction for the second private key and a second password corresponding to the first installation instruction.
  • the first installation unit is configured to install the second private key when the second password is the same as the first password.
  • a second installation instruction receiving unit configured to receive a second installation instruction for the second root certificate.
  • a second installation unit configured to install the second root certificate according to the second installation instruction.
  • the secure communication device may further include: a first receiving module, configured to receive a self-signed first root certificate that is sent by the receiving end and encrypted by the second root certificate. And a decryption module, configured to decrypt the encrypted first root certificate by using the second private key to obtain the decrypted first root certificate.
  • the second installation module is configured to install the decrypted first root certificate.
  • the secure communication device may further include: a second receiving module, configured to receive, by the third terminal, the first root certificate that is self-signed by the receiving end.
  • the second installation module is further configured to: when the received first certificate sent by the third terminal and signed by the receiving end is the same as the decrypted first root certificate, install the first root certificate.
  • Each of the above-described secure communication devices may be implemented in whole or in part by software, hardware, and combinations thereof.
  • Each of the above modules may be embedded in or independent of the processor in the computer device, or may be stored in a memory in the computer device in a software form, so that the processor invokes the operations corresponding to the above modules.
  • a computer device which may be a terminal, and its internal structure diagram may be as shown in FIG.
  • the computer device includes a processor, memory, network interface, display screen, and input device connected by a system bus.
  • the processor of the computer device is used to provide computing and control capabilities.
  • the memory of the computer device includes a non-volatile storage medium, an internal memory.
  • the non-volatile storage medium stores an operating system and a computer program.
  • the internal memory provides an environment for operation of an operating system and computer programs in a non-volatile storage medium.
  • the network interface of the computer device is used to communicate with an external terminal via a network connection.
  • the computer program is executed by the processor to implement a secure communication method.
  • the display screen of the computer device may be a liquid crystal display or an electronic ink display screen
  • the input device of the computer device may be a touch layer covered on the display screen, or may be a button, a trackball or a touchpad provided on the computer device casing.
  • FIG. 13 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation of the computer device to which the solution of the present application is applied.
  • the specific computer device may It includes more or fewer components than those shown in the figures, or some components are combined, or have different component arrangements.
  • a computer apparatus comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor performing the following steps: obtaining the receiving end identifier, receiving The end identifier may uniquely determine the receiving end; query the self-signed first root certificate generated by the receiving end according to the receiving end identifier; encrypt the communication data by using the first root certificate; and send the encrypted communication data to the receiving end, so that The receiving end decrypts the communication data by using the first private key, and the first private key corresponds to the first root certificate.
  • the processor further implements the steps of: generating a self-signed second root certificate and a second private key corresponding to the second root certificate; installing the self-signed second root certificate and the second The private key; the self-signed second root certificate is sent to the receiving end, so that the receiving end installs the second root certificate.
  • the method further includes: encrypting, by the second private key, the communication data encrypted by the first root certificate. Encrypting; the step of transmitting the encrypted communication data to the receiving end by the processor when the processor executes the computer program, so that the receiving end decrypts the communication data by using the first private key, may include: passing the first root certificate The communication data encrypted with the second private key is sent to the receiving end, so that the receiving end decrypts the communication data by using the second certificate and the first private key.
  • the step of generating the self-signed second root certificate and the second private key corresponding to the second root certificate implemented by the processor when executing the computer program may include: generating the second root certificate by using the open source tool a public-private key; obtaining user information corresponding to the second root certificate; generating a self-signed second root certificate according to the user information and the public-private key; acquiring a first password corresponding to the second private key; generating and the second root according to the first password The second private key corresponding to the certificate.
  • the step of installing the self-signed second root certificate and the second private key implemented by the processor when executing the computer program may include: storing the self-signed second root certificate and the second private key to the communication a client; receiving a first installation instruction for the second private key and a second password corresponding to the first installation instruction; when the second password is the same as the first password, installing the second private key; receiving the second root certificate The second installation instruction; installing the second root certificate according to the second installation instruction.
  • the processor may further implement the following steps: receiving a self-signed first root certificate encrypted by the second root certificate sent by the receiving end; and encrypting the first root by the second private key pair The certificate is decrypted to obtain the decrypted first root certificate; the first root certificate after decryption is installed.
  • the method may further include: receiving, by the third terminal, the first root certificate that is self-signed by the receiving end; When the first root certificate self-signed by the receiving end sent by the third terminal is the same as the first root certificate after decryption, the step of installing the first root certificate is continued.
  • a computer readable storage medium on which a computer program is stored, and when the computer program is executed by the processor, the following steps are performed: obtaining a receiving end identifier, and the receiving end identifier can uniquely determine the receiving end; The receiving end identifier queries the self-signed first root certificate generated by the receiving end; encrypts the communication data by using the first root certificate; and sends the encrypted communication data to the receiving end, so that the receiving end communicates through the first private key pair The data is decrypted.
  • the computer program is further executed by the processor to: generate a self-signed second root certificate and a second private key corresponding to the second root certificate; install the self-signed second root certificate and the first The second private key is sent to the receiving end, so that the receiving end installs the second root certificate.
  • the method further includes: encrypting the communication after the first root certificate by using the second private key The data is encrypted; and the step of transmitting the encrypted communication data to the receiving end by the processor when the processor executes the computer program, so that the receiving end decrypts the communication data by using the first private key may include: passing the first root The encrypted data encrypted by the certificate and the second private key is sent to the receiving end, so that the receiving end decrypts the communication data by using the second certificate and the first private key.
  • the step of generating the self-signed second root certificate and the second private key corresponding to the second root certificate implemented by the processor when the computer program is executed may include: generating a second root certificate by using an open source tool a public-private key; obtaining user information corresponding to the second root certificate; generating a self-signed second root certificate according to the user information and the public-private key; acquiring a first password corresponding to the second private key; generating and second according to the first password The second private key corresponding to the root certificate.
  • the step of installing the self-signed second root certificate and the second private key implemented by the processor when executed by the processor may include storing the self-signed second root certificate and the second private key to a communication client; receiving a first installation instruction for the second private key and a second password corresponding to the first installation instruction; when the second password is the same as the first password, installing the second private key; receiving the second password The second installation instruction of the certificate; installing the second root certificate according to the second installation instruction.
  • the following steps may be further implemented: receiving a self-signed first root certificate encrypted by the second root certificate sent by the receiving end; and encrypting the first one by the second private key pair The root certificate is decrypted to obtain the decrypted first root certificate; the first root certificate after decryption is installed.
  • the method before the step of installing the first root certificate implemented by the processor, the method further includes: receiving the first root certificate sent by the third terminal and being self-signed by the receiving end; When the first root certificate self-signed by the receiving end sent by the third terminal is the same as the first root certificate after decryption, the step of installing the first root certificate is continued.
  • Non-volatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory.
  • Volatile memory can include random access memory (RAM) or external cache memory.
  • RAM is available in a variety of formats, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronization chain. Synchlink, DRAM (SLDRAM), Memory Bus (Rambus) Direct RAM (RDRAM), Direct Memory Bus Dynamic RAM (DRDRAM), and Memory Bus Dynamic RAM (RDRAM).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请涉及一种安全通信方法、装置、计算机设备及存储介质，该方法包括获取接收端标识；根据接收端标识查询由接收端生成的自签名的第一根证书；通过第一根证书对通信数据进行加密；将加密后通信数据发送至接收端，以使接收端通过第一私钥对通信数据进行解密，第一私钥与第一根证书相对应。上述安全通信方法、装置、计算机设备及存储介质，通过向通信的对方发送自签名的根证书，例如接收端向发送端发送自签名的根证书，从而发送端可以根据接收端自签名的根证书对通信数据进行签名，这样只有拥有对应的私钥的终端，即接收端才能够获取到通信数据的明文，可以防止通信服务器获取到通信数据的明文，以及保证私钥的安全性，提高了通信数据的安全性。

Description

安全通信方法、装置、计算机设备及存储介质
本申请申明享有2017年12月8日递交的申请号为201711293155.9、名称为“安全通信方法、装置、计算机设备及存储介质”的中国专利申请的优先权，该中国专利申请的整体内容以参考的方式结合在本申请中。
技术领域
本申请涉及计算机技术领域，特别是涉及一种安全通信方法、装置、计算机设备及存储介质。
背景技术
通常通信过程中的安全是由通信服务器和通信双方共同保证的，即通信服务器端是可以看到通信双方的通信内容的，从而通信服务器端可以获取到通信内容，这样会导致通信内容泄露。传统上，为了避免这种情况，通信客户端向权威的证书提供商CA来申请签发证书，并用该签发的证书来保证通信双发。但是在该种情况下，信息安全完全依赖于证书提供商，一旦证书提供商将证书泄露，则仍旧会造成通信内容泄露。
发明内容
基于此，有必要针对上述通信内容泄露的问题，提供一种安全通信方法、装置、计算机设备及存储介质。
一种安全通信方法，所述方法包括：获取接收端标识，所述接收端标识可以唯一确定接收端；根据所述接收端标识查询由接收端生成的自签名的第一根证书；通过所述第一根证书对通信数据进行加密；将加密后的所述通信数据发送至所述接收端，以使所述接收端通过第一私钥对所述通信数据进行解密，所述第一私钥与所述第一根证书相对应。
一种安全通信装置，所述装置包括：
接收端标识获取模块，用于获取接收端标识，所述接收端标识可以唯一确定接收端；
查询模块，用于根据所述接收端标识查询由接收端生成的自签名的第一根证书；
第一加密模块，用于通过所述第一根证书对通信数据进行加密；
发送模块，用于将加密后的所述通信数据发送至所述接收端，以使所述接收端通过第一私钥对所述通信数据进行解密，所述第一私钥与所述第一根证书相对应。
一种计算机设备，包括存储器、处理器以及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现以下步骤：获取接收端标识，所述接收端标识可以唯一确定接收端；根据所述接收端标识查询由接收端生成的自签名的第一根证书；通过所述第一根证书对通信数据进行加密；将加密后的所述通信数据发送至所述接收端，以使所述接收端通过第一私钥对所述通信数据进行解密，所述第一私钥与所述第一根证书相对应。
一种计算机可读存储介质，其上存储有计算机程序，该计算机程序被处理器执行时实现以下步骤：获取接收端标识，所述接收端标识可以唯一确定接收端；根据所述接收端标识查询由接收端生成的自签名的第一根证书；通过所述第一根证书对通信数据进行加密；将加密后的所述通信数据发送至所述接收端，以使所述接收端通过第一私钥对所述通信数据进行解密，所述第一私钥与所述第一根证书相对应。
上述安全通信方法、装置、计算机设备及存储介质，通过向通信的对方发送自签名的根证书，例如接收端向发送端发送自签名的根证书，从而发送端可以根据接收端自签名的根证书对通信数据进行签名，这样只有拥有对应的私钥的终端，即接收端才能够获取到通信数据的明文，可以防止通信服务 器获取到通信数据的明文，以及保证私钥的安全性，提高了通信数据的安全性。
附图说明
图1为一实施例中安全通信方法的应用环境图；
图2为一实施例中的安全通信方法的流程图；
图3为一实施例中数据流向的时序图；
图4为一实施例中的密钥生成步骤的流程图；
图5为一实施例中的安装步骤的流程图；
图6为一实施例中邮件发送界面的示意图；
图7为一实施例中邮件接收界面的示意图；
图8为一实施例中密码输入界面的示意图；
图9为一实施例中证书存储路径界面的示意图；
图10为一实施例中第二根证书安装界面的示意图；
图11为一实施例中加密邮件的示意图；
图12为一实施例中的安全通信装置的示意图；
图13为一实施例中的计算机设备的内部结构图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用于解释本申请，并不用于限定本申请。
在详细说明根据本申请的实施例前，应该注意到的是，所述的实施例主要在于与安全通信方法、装置、计算机设备及存储介质相关的步骤和系统组件的组合。因此，所属系统组件和方法步骤已经在附图中通过常规符号在适当的位置表示出来了，并且只示出了与理解本申请的实施例有关的细节，以 免因对于得益于本申请的本领域普通技术人员而言显而易见的那些细节模糊了本申请的公开内容。
本申请提供的安全通信方法，可以应用于如图1所示的应用环境中。其中，发送端通过网络与接收端相连接，其中发送端和接收端可以是但不限于是各种个人计算机、笔记本电脑、智能手机、平板电脑和便携式可穿戴设备。其中发送端和接收端的通信可以是短信通信或者是通过其中安装的通信客户端进行通信，例如邮件客户端、微信、QQ等即使通信客户端。
在一个实施例中，如图2所示，提供了一种安全通信方法，以该方法应用于图1中的发送端为例进行说明，包括以下步骤：
S202：获取接收端标识，接收端标识可以唯一确定接收端。
具体地，接收端标识可以唯一地确定接收端，其可以是接收端的用户名、接收端的账号等。
S204：根据接收端标识查询由接收端生成的自签名的第一根证书。
具体地，第一根证书是由接收端生成的，接收端生成自签名的第一根证书和第一私钥，并将第一根证书和第一私钥进行安装，保证了只有接收端授权的发送端才可以使用该第一根证书对通信数据进行加密，从而保证只有接收端才能看到通信数据的明文。
S206：通过第一根证书对通信数据进行加密。
具体地，发送端通过接收端标识获取到第一根证书后，则通过第一根证书对通信数据进行加密，从而保证只有具有与第一根证书对应的第一私钥的接收端才可以获取到通信数据的明文，保证了通信数据的安全性。且通过下发到发送端的第一根证书对数据进行加密，而不是通过发送端本身的第二私钥进行加密，可以保证只有具有第一私钥的接收端才可以获取到通信数据的明文，进一步保障了数据的安全性。
S208：将加密后的通信数据发送至接收端，以使接收端通过第一私钥对通信数据进行解密，第一私钥与第一根证书相对应。
具体地，将通过第一根证书加密的通信数据发送至接收端，接收端通过已安装的第一私钥对加密的通信数据进行解密即可以看到明文，且在发送过程中，通信服务器是无法看到该通信数据的明文的，因为通信服务器并没有相应的第一私钥，从而保证了通信数据的安全性。
上述安全通信方法，通过向通信的对方发送自签名的根证书，使得发送端可以根据接收端自签名的根证书对通信数据进行签名，这样只有拥有对应的私钥的终端，可以防止通信服务器获取到通信数据的明文，以及保证私钥的安全性，提高了通信数据的安全性。
在其中一个实施例中，上述安全通信方法还可以包括一预处理步骤，该预处理步骤可以是在图2所示的实施例之前被执行，该预处理步骤可以包括：生成自签名的第二根证书以及与第二根证书对应的第二私钥；安装自签名的第二根证书以及第二私钥；将自签名的第二根证书发送至接收端，以使接收端安装第二根证书。
上述实施例中，通过生成自签名的根证书和私钥，将自签名的根证书发送给授权的通信终端，可以保证只有拥有私钥的通信终端可以看到通过根证书加密的通信数据，提高了通信数据的安全性。
在其中一个实施例中，上述安全通信方法还包括一双层加密的步骤，该双层加密的步骤可以是在通过第一根证书对通信数据进行加密的步骤之后被执行，该双层加密的步骤可以包括：通过第二私钥对经过第一根证书加密后的通信数据进行加密。从而将加密后的通信数据发送至接收端，以使接收端通过第一私钥对通信数据进行解密的步骤可以包括：将经过第一根证书和第二私钥加密后的通信数据发送至接收端，以使接收端通过第二证书以及第一私钥对通信数据进行解密。
参见图3，图3为一实施例中数据流向的时序图，在该实施例中，发送端生成并安装自签名的第二根证书和第二私钥，并将第二根证书发送至接收端进行安装；接收端生成并安装自签名的第一根证书和第一私钥，并将第一 根证书发送至发送端进行安装。
具体地，当发送端需要向接收端发送通信数据时，首先查询与接收端标识对应的第一根证书，并通过第一根证书对通信数据进行加密，然后通过发送端生成的自签名的第二私钥对该加密后的通信数据再进行一次加密，双层加密的方式可以增加数据的安全性，将经过双层加密后的通信数据发送给接收端。接收端接收到该通信数据后，首先根据发送端标识进行查询，获取到第二根证书，通过该第二根证书对该双层加密后的通信数据进行解密；然后获取到接收端安装的第一私钥，再通过第一私钥进行解密后得到通信数据的明文并显示。
该实施例中，通过双层加密的方式对通信数据进行加密，进一步保证了通信数据的安全性。
在其中一个实施例中，参见图4，图4为一实施例中的密钥生成步骤的流程图，该密钥生成步骤，即生成自签名的第二根证书以及与第二根证书对应的第二私钥的步骤可以包括：
S402：通过开源工具生成第二根证书的公私钥。
S404：获取与第二根证书对应的用户信息。
S406：根据用户信息和公私钥生成自签名的第二根证书。
S408：获取与第二私钥对应的第一密码。
S410：根据第一密码生成与第二根证书对应的第二私钥。
上述实施例中，第二根证书和第二私钥包含了用户信息，保证了第二根证书和第二私钥的唯一性，另外给第二私钥设置了第一密码，进一步保证了第二私钥的安全性。
在其中一个实施例中，参见图5，图5为一实施例中的安装步骤的流程图，该安装步骤，即安装自签名的第二根证书以及第二私钥的步骤可以包括：
S502：将自签名的第二根证书以及第二私钥存储至通信客户端。
具体地，为了将第二根证书和第二私钥安装到发送端的通信客户端中， 例如安装到发送端的邮箱客户端或即时通信客户端等。其中以邮件客户端为例进行说明，可以通过第三终端登录邮箱客户端，然后将该第二根证书和第二私钥通过该第三终端中的邮箱客户端发送到自己的邮箱中，例如以附件的形式进行发送，如图6所示。然后在发送端的邮箱客户端接收到该邮件以实现对第二根证书和第二私钥的存储，如图7所示。在其他实施例中通信客户端可以是即时通信客户端，其也可以通过第三终端发送该第二根证书和第二私钥，从而在发送端接收到该第二根证书和第二私钥，以实现将第二根证书和第二私钥存储至通信终端。
S504：接收针对第二私钥的第一安装指令以及与第一安装指令对应的第二密码。
具体地，用户可以通过点击通信客户端中的第二私钥以向发送端发送针对第二私钥的第一安装指令，当发送端接收到该第一安装指令时，则显示密码输入界面，如图8所示，用户向该密码输入界面输入第二密码，从而发送端可以接收到该第二密码。
S506：当第二密码与第一密码相同时，则安装第二私钥。
具体地，发送端在接收到该第二密码后，则将第二密码与第一密码进行比较，只有当第一密码和第二密码相同时，才会安装第二私钥，这样可以保证第二私钥的安全性。参阅图9，在安装完该第二私钥后，可以查看该安装的第二私钥，具体路径为：设置->通用->描述文件与配置管理。
S508：接收针对第二根证书的第二安装指令；根据第二安装指令安装第二根证书
具体地，在安装完第二私钥后，发送端再对第二根证书进行安装，如图10所示，从而将该第二根证书和第二私钥部署在发送端。对于接收端的第一根证书和第一私钥的部署过程可以参见上文中在发送端部署第二根证书和第二私钥的过程，在此不再赘述。
上述实施例中，对第二私钥通过密码进行了保护，保证了第二私钥的安 全性，从而可以提高通信数据的安全性。
在其中一个实施例中，该安全通信的方法还可以包括：接收接收端发送的通过第二根证书加密的自签名的第一根证书；通过第二私钥对加密的第一根证书进行解密得到解密后的第一根证书；安装解密后的第一根证书。
上述实施例中，通过发送端的自签名的第二证书来对第一根证书进行加密，保证了第一根证书在传输过程中的安全性，从而可以保证后续传输过程的安全性。
在其中一个实施例中，为了保证第一根证书的安全性，安装第一根证书的步骤之前，还可以包括：接收第三终端发送的由接收端自签名的第一根证书；当所接收的第三终端发送的由接收端自签名的第一根证书与解密后的第一根证书相同时，则安装第一根证书。
其中该第三终端可以是U盘等终端，此处是为了保证通过U盘等终端发送的第一根证书的安全性，即通过第三终端接收的自签名的第一根证书是没有进行加密传输的，其极易被篡改等，为了保证此种情况下第一根证书的安全性，可以再通过加密的方式传输一次第一根证书，即接收端通过第二根证书加密第一根证书，并将第一根证书发送至发送端，发送端接收到该加密的第一根证书后，通过第二私钥进行解密得到第一根证书，再将该第一根证书与通过第三终端发送的第一根证书进行比较，只有两者相同，才会安装该第一根证书。参见图11，在实际应用中，以邮箱客户端为例，发送端接收到电子邮件后，电子邮件的发件人的位置处可以设置一个标识，图11中为一个打钩的符号，这个符号说明该电子邮件是经过第二根证书加密的电子邮件，可以通过点击该符号进一步查看第一根证书的详细信息，例如还可以点击“显示证书”按钮查看到第一根证书的标识并判断该第一根证书的标识与通过U盘等渠道获取到的第一根证书的标识是否一致，如果一致，则可以安装该第一根证书。
上述实施例中，通过对第一根证书进行了进一步地验证，保证了第一根 证书的安全性，进一步为后续安全通信奠定了基础。
应该理解的是，虽然图2-5的流程图中的各个步骤按照箭头的指示依次显示，但是这些步骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，图2-5中的至少一部分步骤可以包括多个子步骤或者多个阶段，这些子步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些子步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤的子步骤或者阶段的至少一部分轮流或者交替地执行。
在一个实施例中，如图12所示，提供了一种安全通信装置，装置包括：
接收端标识获取模块100，用于获取接收端标识，接收端标识可以唯一确定接收端。查询模块200，用于根据接收端标识查询由接收端生成的自签名的第一根证书。第一加密模块300，用于通过第一根证书对通信数据进行加密。通信数据发送模块400，用于将加密后的通信数据发送至接收端，以使接收端通过第一私钥对通信数据进行解密，第一私钥与第一根证书相对应。
在其中一个实施例中，该安全通信装置还可以包括：生成模块，用于生成自签名的第二根证书以及与第二根证书对应的第二私钥。第一安装模块，用于安装自签名的第二根证书以及第二私钥。证书发送模块，用于将自签名的第二根证书发送至接收端，以使接收端安装第二根证书。
在其中一个实施例中，该安全通信装置还可以包括：第二加密模块，用于在通过第一根证书对通信数据进行加密后，通过第二私钥对经过第一根证书加密后的通信数据进行加密。通信数据发送模块还用于将经过第一根证书和第二私钥加密后的通信数据发送至接收端，以使接收端通过第二证书以及第一私钥对通信数据进行解密。
在其中一个实施例中，生成模块可以包括：公私钥生成单元，用于通过 开源工具生成第二根证书的公私钥。用户信息获取单元，用于获取与第二根证书对应的用户信息。根证书生成单元，用于根据用户信息和公私钥生成自签名的第二根证书。密码获取单元，用于获取与第二私钥对应的第一密码。私钥生成单元，用于根据第一密码生成与第二根证书对应的第二私钥。
在其中一个实施例中，第一安装模块可以包括：存储单元，用于将自签名的第二根证书以及第二私钥存储至通信客户端。第一安装指令接收单元，用于接收针对第二私钥的第一安装指令以及与第一安装指令对应的第二密码。第一安装单元，用于当第二密码与第一密码相同时，则安装第二私钥。第二安装指令接收单元，用于接收针对第二根证书的第二安装指令。第二安装单元，用于根据第二安装指令安装第二根证书。
在其中一个实施例中，该安全通信装置还可以包括：第一接收模块，用于接收接收端发送的通过第二根证书加密的自签名的第一根证书。解密模块，用于通过第二私钥对加密的第一根证书进行解密得到解密后的第一根证书。第二安装模块，用于安装解密后的第一根证书。
在其中一个实施例中，该安全通信装置还可以包括：第二接收模块，用于接收第三终端发送的由接收端自签名的第一根证书。第二安装模块还用于当所接收的第三终端发送的由接收端自签名的第一根证书与解密后的第一根证书相同时，则安装第一根证书。
上述安全通信装置中的各个模块可全部或部分通过软件、硬件及其组合来实现。上述各模块可以硬件形式内嵌于或独立于计算机设备中的处理器中，也可以以软件形式存储于计算机设备中的存储器中，以便于处理器调用执行以上各个模块对应的操作。
在一个实施例中，提供了一种计算机设备，该计算机设备可以是终端，其内部结构图可以如图13所示。该计算机设备包括通过系统总线连接的处理器、存储器、网络接口、显示屏和输入装置。其中，该计算机设备的处理器用于提供计算和控制能力。该计算机设备的存储器包括非易失性存储介 质、内存储器。该非易失性存储介质存储有操作系统和计算机程序。该内存储器为非易失性存储介质中的操作系统和计算机程序的运行提供环境。该计算机设备的网络接口用于与外部的终端通过网络连接通信。该计算机程序被处理器执行时以实现一种安全通信方法。该计算机设备的显示屏可以是液晶显示屏或者电子墨水显示屏，该计算机设备的输入装置可以是显示屏上覆盖的触摸层，也可以是计算机设备外壳上设置的按键、轨迹球或触控板，还可以是外接的键盘、触控板或鼠标等
本领域技术人员可以理解，图13中示出的结构，仅仅是与本申请方案相关的部分结构的框图，并不构成对本申请方案所应用于其上的计算机设备的限定，具体的计算机设备可以包括比图中所示更多或更少的部件，或者组合某些部件，或者具有不同的部件布置。
在一个实施例中，提供了一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，处理器执行计算机程序时实现以下步骤：获取接收端标识，接收端标识可以唯一确定接收端；根据接收端标识查询由接收端生成的自签名的第一根证书；通过第一根证书对通信数据进行加密；将加密后的通信数据发送至接收端，以使接收端通过第一私钥对通信数据进行解密，第一私钥与第一根证书相对应。
在其中一个实施例中，处理器执行计算机程序时还实现以下步骤：生成自签名的第二根证书以及与第二根证书对应的第二私钥；安装自签名的第二根证书以及第二私钥；将自签名的第二根证书发送至接收端，以使接收端安装第二根证书。
在其中一个实施例中，处理器执行计算机程序时所实现的通过第一根证书对通信数据进行加密的步骤之后，还可以包括：通过第二私钥对经过第一根证书加密后的通信数据进行加密；从而处理器执行计算机程序时所实现的将加密后的通信数据发送至接收端，以使接收端通过第一私钥对通信数据进行解密的步骤，可以包括：将经过第一根证书和第二私钥加密后的通信数据 发送至接收端，以使接收端通过第二证书以及第一私钥对通信数据进行解密。
在其中一个实施例中，处理器执行计算机程序时所实现的生成自签名的第二根证书以及与第二根证书对应的第二私钥的步骤可以包括：通过开源工具生成第二根证书的公私钥；获取与第二根证书对应的用户信息；根据用户信息和公私钥生成自签名的第二根证书；获取与第二私钥对应的第一密码；根据第一密码生成与第二根证书对应的第二私钥。
在其中一个实施例中，处理器执行计算机程序时所实现的安装自签名的第二根证书以及第二私钥的步骤可以包括：将自签名的第二根证书以及第二私钥存储至通信客户端；接收针对第二私钥的第一安装指令以及与第一安装指令对应的第二密码；当第二密码与第一密码相同时，则安装第二私钥；接收针对第二根证书的第二安装指令；根据第二安装指令安装第二根证书。
在其中一个实施例中，处理器执行计算机程序时还可以实现以下步骤：接收接收端发送的通过第二根证书加密的自签名的第一根证书；通过第二私钥对加密的第一根证书进行解密得到解密后的第一根证书；安装解密后的第一根证书。
在其中一个实施例中，处理器执行计算机程序时所实现的安装第一根证书的步骤之前，还可以包括：接收第三终端发送的由接收端自签名的第一根证书；当所接收的第三终端发送的由接收端自签名的第一根证书与解密后的第一根证书相同时，则继续安装第一根证书的步骤。
在其中一个实施例中，提供了一种计算机可读存储介质，其上存储有计算机程序，计算机程序被处理器执行时实现以下步骤：获取接收端标识，接收端标识可以唯一确定接收端；根据接收端标识查询由接收端生成的自签名的第一根证书；通过第一根证书对通信数据进行加密；将加密后的通信数据发送至接收端，以使接收端通过第一私钥对通信数据进行解密。
在其中一个实施例中，计算机程序被处理器执行时还实现以下步骤：生 成自签名的第二根证书以及与第二根证书对应的第二私钥；安装自签名的第二根证书以及第二私钥；将自签名的第二根证书发送至接收端，以使接收端安装第二根证书。
在其中一个实施例中，计算机程序被处理器执行时所实现的通过第一根证书对通信数据进行加密的步骤之后，还可以包括：通过第二私钥对经过第一根证书加密后的通信数据进行加密；从而处理器执行计算机程序时所实现的将加密后的通信数据发送至接收端，以使接收端通过第一私钥对通信数据进行解密的步骤，可以包括：将经过第一根证书和第二私钥加密后的通信数据发送至接收端，以使接收端通过第二证书以及第一私钥对通信数据进行解密。
在其中一个实施例中，计算机程序被处理器执行时所实现的生成自签名的第二根证书以及与第二根证书对应的第二私钥的步骤可以包括：通过开源工具生成第二根证书的公私钥；获取与第二根证书对应的用户信息；根据用户信息和公私钥生成自签名的第二根证书；获取与第二私钥对应的第一密码；根据第一密码生成与第二根证书对应的第二私钥。
在其中一个实施例中，计算机程序被处理器执行时所实现的安装自签名的第二根证书以及第二私钥的步骤可以包括：将自签名的第二根证书以及第二私钥存储至通信客户端；接收针对第二私钥的第一安装指令以及与第一安装指令对应的第二密码；当第二密码与第一密码相同时，则安装第二私钥；接收针对第二根证书的第二安装指令；根据第二安装指令安装第二根证书。
在其中一个实施例中，计算机程序被处理器执行时还可以实现以下步骤：接收接收端发送的通过第二根证书加密的自签名的第一根证书；通过第二私钥对加密的第一根证书进行解密得到解密后的第一根证书；安装解密后的第一根证书。
在其中一个实施例中，计算机程序被处理器执行时所实现的安装第一根证书的步骤之前，还可以包括：接收第三终端发送的由接收端自签名的第一 根证书；当所接收的第三终端发送的由接收端自签名的第一根证书与解密后的第一根证书相同时，则继续安装第一根证书的步骤。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的计算机程序可存储于一非易失性计算机可读取存储介质中，该计算机程序在执行时，可包括如上述各方法的实施例的流程。其中，本申请所提供的各实施例中所使用的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和/或易失性存储器。非易失性存储器可包括只读存储器(ROM)、可编程ROM(PROM)、电可编程ROM(EPROM)、电可擦除可编程ROM(EEPROM)或闪存。易失性存储器可包括随机存取存储器(RAM)或者外部高速缓冲存储器。作为说明而非局限，RAM以多种形式可得，诸如静态RAM(SRAM)、动态RAM(DRAM)、同步DRAM(SDRAM)、双数据率SDRAM(DDRSDRAM)、增强型SDRAM(ESDRAM)、同步链路(Synchlink)、DRAM(SLDRAM)、存储器总线(Rambus)直接RAM(RDRAM)、直接存储器总线动态RAM(DRDRAM)、以及存储器总线动态RAM(RDRAM)等。
以上所述实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。
以上所述实施例仅表达了本申请的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对发明专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干变形和改进，这些都属于本申请的保护范围。因此，本申请专利的保护范围应以所附权利要求为准。

Claims (20)

  1. 一种安全通信方法，其特征在于，所述方法包括：
    获取接收端标识，所述接收端标识可以唯一确定接收端；根据所述接收端标识查询由接收端生成的自签名的第一根证书；通过所述第一根证书对通信数据进行加密；将加密后的所述通信数据发送至所述接收端，以使所述接收端通过第一私钥对所述通信数据进行解密，所述第一私钥与所述第一根证书相对应。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：生成自签名的第二根证书以及与所述第二根证书对应的第二私钥；安装所述自签名的第二根证书以及所述第二私钥；将所述自签名的第二根证书发送至所述接收端，以使所述接收端安装所述第二根证书。
  3. 根据权利要求2所述的方法，其特征在于，所述通过所述第一根证书对通信数据进行加密的步骤之后，还包括：通过所述第二私钥对经过所述第一根证书加密后的通信数据进行加密；所述将加密后的所述通信数据发送至所述接收端，以使所述接收端通过第一私钥对所述通信数据进行解密的步骤，包括：将经过所述第一根证书和所述第二私钥加密后的所述通信数据发送至所述接收端，以使所述接收端通过所述第二证书以及第一私钥对所述通信数据进行解密。
  4. 根据权利要求2所述的方法，其特征在于，所述生成自签名的第二根证书以及与所述第二根证书对应的第二私钥的步骤，包括：通过开源工具生成第二根证书的公私钥；获取与所述第二根证书对应的用户信息；根据所述用户信息和所述公私钥生成自签名的第二根证书；获取与第二私钥对应的第一密码；根据所述第一密码生成与所述第二根证书对应的第二私钥。
  5. 根据权利要求4所述的方法，其特征在于，所述安装所述自签名的第二根证书以及所述第二私钥的步骤，包括：将所述自签名的第二根证书以 及所述第二私钥存储至通信客户端；接收针对所述第二私钥的第一安装指令以及与所述第一安装指令对应的第二密码；当所述第二密码与所述第一密码相同时，则安装所述第二私钥；接收针对所述第二根证书的第二安装指令；根据所述第二安装指令安装所述第二根证书。
  6. 根据权利要求2至5任一项所述的方法，其特征在于，所述方法还包括：接收所述接收端发送的通过所述第二根证书加密的自签名的第一根证书；通过所述第二私钥对加密的第一根证书进行解密得到解密后的第一根证书；安装所述解密后的第一根证书。
  7. 根据权利要求6所述的方法，其特征在于，所述安装所述第一根证书的步骤之前，还包括：接收第三终端发送的由所述接收端自签名的第一根证书；当所接收的第三终端发送的由所述接收端自签名的第一根证书与解密后的第一根证书相同时，则继续安装所述第一根证书的步骤。
  8. 一种安全通信装置，其特征在于，所述装置包括：
    接收端标识获取模块，用于获取接收端标识，所述接收端标识可以唯一确定接收端；查询模块，用于根据所述接收端标识查询由接收端生成的自签名的第一根证书；第一加密模块，用于通过所述第一根证书对通信数据进行加密；发送模块，用于将加密后的所述通信数据发送至所述接收端，以使所述接收端通过第一私钥对所述通信数据进行解密，所述第一私钥与所述第一根证书相对应。
  9. 一种计算机设备，包括存储器、处理器以及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现以下步骤：获取接收端标识，所述接收端标识可以唯一确定接收端；根据所述接收端标识查询由接收端生成的自签名的第一根证书；通过所述第一根证书对通信数据进行加密；将加密后的所述通信数据发送至所述接收端，以使所述接收端通过第一私钥对所述通信数据进行解密，所述第一私钥与所述第一根证书相对应。
  10. 根据权利要求9所述的计算机设备，其特征在于，所述处理器执行所述计算机程序时还实现以下步骤：生成自签名的第二根证书以及与所述第二根证书对应的第二私钥；安装所述自签名的第二根证书以及所述第二私钥；将所述自签名的第二根证书发送至所述接收端，以使所述接收端安装所述第二根证书。
  11. 根据权利要求10所述的计算机设备，其特征在于，所述通过所述第一根证书对通信数据进行加密的步骤之后，还包括：通过所述第二私钥对经过所述第一根证书加密后的通信数据进行加密；所述将加密后的所述通信数据发送至所述接收端，以使所述接收端通过第一私钥对所述通信数据进行解密的步骤，包括：将经过所述第一根证书和所述第二私钥加密后的所述通信数据发送至所述接收端，以使所述接收端通过所述第二证书以及第一私钥对所述通信数据进行解密。
  12. 根据权利要求10所述的计算机设备，其特征在于，所述生成自签名的第二根证书以及与所述第二根证书对应的第二私钥的步骤，包括：通过开源工具生成第二根证书的公私钥；获取与所述第二根证书对应的用户信息；根据所述用户信息和所述公私钥生成自签名的第二根证书；获取与第二私钥对应的第一密码；根据所述第一密码生成与所述第二根证书对应的第二私钥。
  13. 根据权利要求12所述的计算机设备，其特征在于，所述安装所述自签名的第二根证书以及所述第二私钥的步骤，包括：将所述自签名的第二根证书以及所述第二私钥存储至通信客户端；接收针对所述第二私钥的第一安装指令以及与所述第一安装指令对应的第二密码；当所述第二密码与所述第一密码相同时，则安装所述第二私钥；接收针对所述第二根证书的第二安装指令；根据所述第二安装指令安装所述第二根证书。
  14. 根据权利要求10-13中任一项所述的计算机设备，其特征在于，所述处理器执行所述计算机程序时还实现以下步骤：接收所述接收端发送的通 过所述第二根证书加密的自签名的第一根证书；通过所述第二私钥对加密的第一根证书进行解密得到解密后的第一根证书；接收第三终端发送的由所述接收端自签名的第一根证书；当所接收的第三终端发送的由所述接收端自签名的第一根证书与解密后的第一根证书相同时，则继续安装所述第一根证书的步骤。
  15. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，该计算机程序被处理器执行时实现以下步骤：获取接收端标识，所述接收端标识可以唯一确定接收端；根据所述接收端标识查询由接收端生成的自签名的第一根证书；通过所述第一根证书对通信数据进行加密；将加密后的所述通信数据发送至所述接收端，以使所述接收端通过第一私钥对所述通信数据进行解密，所述第一私钥与所述第一根证书相对应。
  16. 根据权利要求15所述的存储介质，其特征在于，该计算机程序被处理器执行时还实现以下步骤：生成自签名的第二根证书以及与所述第二根证书对应的第二私钥；安装所述自签名的第二根证书以及所述第二私钥；将所述自签名的第二根证书发送至所述接收端，以使所述接收端安装所述第二根证书。
  17. 根据权利要求16所述的存储介质，其特征在于，所述通过所述第一根证书对通信数据进行加密的步骤之后，还包括：通过所述第二私钥对经过所述第一根证书加密后的通信数据进行加密；所述将加密后的所述通信数据发送至所述接收端，以使所述接收端通过第一私钥对所述通信数据进行解密的步骤，包括：将经过所述第一根证书和所述第二私钥加密后的所述通信数据发送至所述接收端，以使所述接收端通过所述第二证书以及第一私钥对所述通信数据进行解密。
  18. 根据权利要求16所述的存储介质，其特征在于，所述生成自签名的第二根证书以及与所述第二根证书对应的第二私钥的步骤，包括：通过开源工具生成第二根证书的公私钥；获取与所述第二根证书对应的用户信息； 根据所述用户信息和所述公私钥生成自签名的第二根证书；获取与第二私钥对应的第一密码；根据所述第一密码生成与所述第二根证书对应的第二私钥。
  19. 根据权利要求18所述的存储介质，其特征在于，所述安装所述自签名的第二根证书以及所述第二私钥的步骤，包括：将所述自签名的第二根证书以及所述第二私钥存储至通信客户端；接收针对所述第二私钥的第一安装指令以及与所述第一安装指令对应的第二密码；当所述第二密码与所述第一密码相同时，则安装所述第二私钥；接收针对所述第二根证书的第二安装指令；根据所述第二安装指令安装所述第二根证书。
  20. 根据权利要求15-19中任一项所述的存储介质，其特征在于，所述处理器执行所述计算机程序时还实现以下步骤：接收所述接收端发送的通过所述第二根证书加密的自签名的第一根证书；通过所述第二私钥对加密的第一根证书进行解密得到解密后的第一根证书；接收第三终端发送的由所述接收端自签名的第一根证书；当所接收的第三终端发送的由所述接收端自签名的第一根证书与解密后的第一根证书相同时，则继续安装所述第一根证书的步骤。
PCT/CN2018/078327 2017-12-08 2018-03-07 安全通信方法、装置、计算机设备及存储介质 WO2019109533A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711293155.9A CN107959684A (zh) 2017-12-08 2017-12-08 安全通信方法、装置、计算机设备及存储介质
CN201711293155.9 2017-12-08

Publications (1)

Publication Number Publication Date
WO2019109533A1 true WO2019109533A1 (zh) 2019-06-13

Family

ID=61958339

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/078327 WO2019109533A1 (zh) 2017-12-08 2018-03-07 安全通信方法、装置、计算机设备及存储介质

Country Status (2)

Country Link
CN (1) CN107959684A (zh)
WO (1) WO2019109533A1 (zh)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108881257B (zh) * 2018-06-29 2021-09-28 北京奇虎科技有限公司 分布式搜索集群加密传输方法及加密传输分布式搜索集群
CN110677376B (zh) * 2018-07-03 2022-03-22 中国电信股份有限公司 认证方法、相关设备和系统及计算机可读存储介质
CN109359977A (zh) * 2018-09-10 2019-02-19 平安科技（深圳）有限公司 网络通信方法、装置、计算机设备和存储介质
US10873468B2 (en) * 2019-02-22 2020-12-22 Beyond Identity Inc. Legacy authentication for user authentication with self-signed certificate and identity verification
CN110601855B (zh) * 2019-09-20 2022-05-13 腾讯科技（深圳）有限公司 一种根证书管理方法、装置及电子设备、存储介质
CN111291369B (zh) * 2020-01-20 2022-05-20 北京无限光场科技有限公司 一种信息检测方法和电子设备
CN111541682B (zh) * 2020-04-17 2022-08-12 北京天融信网络安全技术有限公司 一种数据安全检测方法、装置、存储介质和电子设备
CN113221136B (zh) * 2021-04-25 2024-04-12 亿海蓝（北京）数据技术股份公司 Ais数据传输方法、装置、电子设备和存储介质

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060105741A1 (en) * 2004-11-18 2006-05-18 Samsung Electronics Co., Ltd. Method and apparatus for security of IP security tunnel using public key infrastructure in mobile communication network
CN101335627A (zh) * 2008-07-31 2008-12-31 中兴通讯股份有限公司 一种网络传真系统及其使用方法
CN101394280A (zh) * 2008-10-30 2009-03-25 深圳华为通信技术有限公司 移动终端及其数据业务消息的保护方法
CN101442409A (zh) * 2007-11-23 2009-05-27 东方钢铁电子商务有限公司 用于b2b数据交换的加密方法及系统
CN102104844A (zh) * 2009-12-16 2011-06-22 北京邮电大学 手机加密短信结构及应用该结构的手机加密短信收发方法
CN103684794A (zh) * 2013-12-25 2014-03-26 华南理工大学 一种基于des、rsa、sha-1加密算法的通信数据加解密方法
CN106790234A (zh) * 2017-01-18 2017-05-31 维沃移动通信有限公司 一种邮件发送方法、接收方法、第一终端和第二终端

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020144108A1 (en) * 2001-03-29 2002-10-03 International Business Machines Corporation Method and system for public-key-based secure authentication to distributed legacy applications
US7958543B2 (en) * 2005-07-12 2011-06-07 Microsoft Corporation Account synchronization for common identity in an unmanaged network
CN101247605A (zh) * 2008-03-25 2008-08-20 中兴通讯股份有限公司 短信息加密、签名方法、移动终端及短信息加密系统
CN102201919B (zh) * 2011-06-17 2013-07-10 深圳一卡通新技术有限公司 基于数字证书的移动终端实名信息传输系统与方法
US8925055B2 (en) * 2011-12-07 2014-12-30 Telefonaktiebolaget Lm Ericsson (Publ) Device using secure processing zone to establish trust for digital rights management
EP2905718A1 (en) * 2014-02-05 2015-08-12 Thomson Licensing Device and method certificate generation
US20150254423A1 (en) * 2014-03-05 2015-09-10 Peter Schaub Computer-based prescription system for medicaments
CN106385315B (zh) * 2016-08-30 2019-05-17 北京三未信安科技发展有限公司 一种数字证书管理方法及系统
CN106656955A (zh) * 2016-09-26 2017-05-10 山东浪潮商用系统有限公司 一种通信方法及系统、客户端

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060105741A1 (en) * 2004-11-18 2006-05-18 Samsung Electronics Co., Ltd. Method and apparatus for security of IP security tunnel using public key infrastructure in mobile communication network
CN101442409A (zh) * 2007-11-23 2009-05-27 东方钢铁电子商务有限公司 用于b2b数据交换的加密方法及系统
CN101335627A (zh) * 2008-07-31 2008-12-31 中兴通讯股份有限公司 一种网络传真系统及其使用方法
CN101394280A (zh) * 2008-10-30 2009-03-25 深圳华为通信技术有限公司 移动终端及其数据业务消息的保护方法
CN102104844A (zh) * 2009-12-16 2011-06-22 北京邮电大学 手机加密短信结构及应用该结构的手机加密短信收发方法
CN103684794A (zh) * 2013-12-25 2014-03-26 华南理工大学 一种基于des、rsa、sha-1加密算法的通信数据加解密方法
CN106790234A (zh) * 2017-01-18 2017-05-31 维沃移动通信有限公司 一种邮件发送方法、接收方法、第一终端和第二终端

Also Published As

Publication number Publication date
CN107959684A (zh) 2018-04-24

Similar Documents

Publication Publication Date Title
WO2019109533A1 (zh) 安全通信方法、装置、计算机设备及存储介质
US11516020B2 (en) Key management method, apparatus, and system, storage medium, and computer device
TWI641258B (zh) Data transmission method, device and system
US10116645B1 (en) Controlling use of encryption keys
US10142107B2 (en) Token binding using trust module protected keys
Sadeghi et al. Token-based cloud computing: secure outsourcing of data and arbitrary computations with lower latency
US8489889B1 (en) Method and apparatus for restricting access to encrypted data
US10880100B2 (en) Apparatus and method for certificate enrollment
AU2016218981A1 (en) Confidential communication management
JP7420779B2 (ja) 鍵保護処理方法、装置、機器及び記憶媒体
US10937339B2 (en) Digital cryptosystem with re-derivable hybrid keys
US10003467B1 (en) Controlling digital certificate use
WO2016026382A1 (zh) 一种密码的设置方法、装置和系统
US8732481B2 (en) Object with identity based encryption
CA3080448C (en) Devices and methods of managing data
Lai et al. Secure file storage on cloud using hybrid cryptography
US20230021749A1 (en) Wrapped Keys with Access Control Predicates
WO2019242163A1 (zh) 数据安全验证方法、装置、系统、计算机设备及存储介质
Senthil Kumari et al. Key derivation policy for data security and data integrity in cloud computing
Aloev et al. Development of the software cryptographic service provider on the basis of national standards
US9537842B2 (en) Secondary communications channel facilitating document security
CN109933994B (zh) 数据分级存储方法和装置以及计算设备
US20230239149A1 (en) Data storage method, data read method, electronic device, and program product
Zadka et al. Cryptography
Singh et al. Security of Data with 3DES & Watermarking Algorithm

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18887064

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 13/10/2020)

122 Ep: pct application non-entry in european phase

Ref document number: 18887064

Country of ref document: EP

Kind code of ref document: A1