WO2020007308A1 - 报文处理方法以及接收端服务器 - Google Patents

报文处理方法以及接收端服务器 Download PDF

Info

Publication number
WO2020007308A1
WO2020007308A1 PCT/CN2019/094453 CN2019094453W WO2020007308A1 WO 2020007308 A1 WO2020007308 A1 WO 2020007308A1 CN 2019094453 W CN2019094453 W CN 2019094453W WO 2020007308 A1 WO2020007308 A1 WO 2020007308A1
Authority
WO
WIPO (PCT)
Prior art keywords
tenant
key
receiving server
receiving
machine device
Prior art date
Application number
PCT/CN2019/094453
Other languages
English (en)
French (fr)
Inventor
孙应孔
胡红山
李剑彪
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2020007308A1 publication Critical patent/WO2020007308A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords

Definitions

  • the present application relates to communication technologies, and in particular, to a message processing method and a receiving server.
  • the sender server can use the tenant key as an output parameter to calculate it.
  • the encrypted value is encrypted and then sent to the receiving server, so the receiving server needs the tenant key when decrypting.
  • the tenant key needs to be provided to the receiving server. Because the tenant key is directly stored in the server, the tenant key may be stolen or tampered with, so that the tenant key obtained by the receiving server is tampered Excessive phenomenon, resulting in low security for users to transmit data through the multi-tenant network.
  • the embodiments of the present application provide a message processing method and a receiving server, which are used to improve the confidentiality of tenant keys, thereby improving the security of data transmitted on the network.
  • the first aspect of the embodiments of the present application provides a message processing method, including:
  • the sender server calculates the encrypted value of the target tenant's tenant key as an output parameter through a preset negotiation method, and then encrypts the encrypted value.
  • the value-encrypted message obtains the target message, and then sends the target message to the receiving server; after the receiving server receives the target message, it receives the tenant key of the target tenant sent by the first encryptor device, where:
  • the first encryption machine device is a device storing a tenant key corresponding to the user; then the receiving server may calculate the tenant key as an output parameter according to a preset negotiation method to obtain a decrypted value; then the receiving server may The decrypted value decrypts the target message to obtain the original message.
  • the tenant key of the target tenant is provided through the first encryption machine device.
  • the tenant key is provided to the receiving server only when the receiving server needs to calculate and use the receiving server.
  • the tenant key is calculated to obtain the decrypted value, so as to achieve the decryption of the target message. Therefore, the confidentiality and security of tenant keys are improved, thereby improving the security of data transmitted over the network. For a hacker attack or administrator treason, since the tenant key is provided through the first encryption device, and the tenant key is only in the server where the receiving server needs to use the decryption message, therefore, for a hacker attack or administrator The probability of a mutiny attack will decrease.
  • the receiving-end server receiving the tenant key sent by the first encryption machine device may include: the receiving-end server may receive the encrypted tenant key sent by the first encryption machine device, and the encrypted tenant key A key obtained by using the tenant public key corresponding to the target user for the first encryption machine device to perform encryption.
  • the first encryption machine device may provide the encrypted tenant key to the receiving server, and the encrypted tenant is obtained by the first encryption machine device using the tenant public key corresponding to the target user for encryption. Therefore, transmitting the tenant key to the receiving server in an encrypted manner improves the security and confidentiality of transmitting the tenant key.
  • the receiving server calculates the tenant key as an output parameter according to a preset negotiation mode.
  • the method may further include: the receiving server may send the encrypted tenant key to a second encryption machine device, where the second encryption machine device is a device storing a tenant private key corresponding to the user The second encryption machine device is configured to use the tenant private key corresponding to the target user to decrypt the encrypted tenant key; and then the receiving server can receive the decrypted tenant key sent by the second encryption machine device, The decrypted tenant key is a key obtained by the second encryption machine device according to the tenant private key corresponding to the target user.
  • the receiving-end server when the receiving-end server receives the encrypted tenant key, it may send the encrypted tenant key to the second encryption machine device, and then let the second encryption machine device decrypt it through the tenant private key. Therefore, the reversible decryption method and the second encryption machine device are used to decrypt the tenant key, which improves the security of the tenant key in the process of providing it. Only trusted hardware devices can decrypt the tenant key. , Thereby improving the security of the tenant key obtained by the server.
  • the method may further include: the receiving server A request message may be sent to the first encryption machine device, where the request message is a message that the receiving server requests the tenant key.
  • the receiving server receives the target message sent by the sending server, before the receiving server receives the tenant key sent by the first encryption machine device, the method may further include: the receiving server A request message may be sent to the first encryption machine device, where the request message is a message that the receiving server requests the tenant key.
  • the receiving server calculates the tenant key as an output parameter according to a preset negotiation method, and after obtaining the decrypted value, the method may further include: the receiving server may use the tenant key delete.
  • the receiving server releases the tenant key immediately after calculating the decrypted value, that is, the tenant key is stored in the server only during the negotiation calculation process, which reduces hacker attacks or administrator treason attacks. Probability.
  • the second aspect of the embodiments of the present application provides a receiving server, and the receiving server has a function for realizing the behavior of the receiving server of the second aspect, and the function may be implemented by hardware or corresponding software by hardware execution.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • a third aspect of the embodiments of the present application provides a receiving server.
  • the receiving server includes: a processor, a memory, an input-output device, and a bus; the processor, the memory, and an input-output device are respectively connected to the bus, and the memory Computer instructions are stored in the processor; when the processor executes the computer instructions in the memory, the memory stores computer instructions; when the processor executes the computer instructions in the memory, the processor is configured to implement any one of the first aspect Method to realize.
  • a fourth aspect of the embodiments of the present application provides a chip system.
  • the chip system includes a processor, and is configured to support a network device to implement the functions involved in the first aspect, for example, sending or processing data involved in the foregoing method. And / or information.
  • the chip system further includes a memory, and the memory is configured to store program instructions and data necessary for the network device.
  • the chip system may be composed of chips, and may also include chips and other discrete devices.
  • a fifth aspect of the embodiments of the present application provides a computer program product including instructions, which is characterized in that when it is run on a computer, the computer is caused to execute an implementation manner as in any of the first aspect.
  • a sixth aspect of the embodiments of the present application provides a computer-readable storage medium, which is characterized in that it includes instructions that, when the instructions run on a computer, cause the computer to execute any implementation manner as in the first aspect.
  • the receiving server receives the target message sent by the sending server, and the target message is a message obtained by the sending server encrypting according to the encrypted value, and the encrypted value is preset by the sending server
  • the negotiation method uses the tenant key corresponding to the target user as the output parameter to calculate the encrypted value; then the receiving server can receive the tenant key sent by the first encryption machine device, which stores the first encryption machine device.
  • the device of the tenant key corresponding to the user; the receiving server calculates the tenant key as an output parameter according to a preset negotiation method to obtain a decryption value, and then the receiving server decrypts the target message according to the decrypted value. Get the original message.
  • the first encryption machine device when the receiving server receives the target message, the first encryption machine device is used to provide the tenant key of the target tenant.
  • the tenant key is only the first time when the receiving server needs to calculate and use the first key. Only the encryption device is provided to the receiving server, which improves the confidentiality of the tenant key and thus improves the security of data transmitted on the network. For a hacker attack or administrator treason, since the tenant key is provided through the first encryption device, and the tenant key is only in the server where the receiving server needs to use the decryption message, therefore, for a hacker attack or administrator The probability of a mutiny attack will decrease.
  • FIG. 1 is a schematic diagram of an application scenario frame according to an embodiment of the present application.
  • FIG. 2 is a schematic diagram of an embodiment of a message processing method according to an embodiment of the present application.
  • FIG. 3 is a schematic diagram of another embodiment of a message processing method according to an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of a receiving server according to an embodiment of the present application.
  • FIG. 5 is another schematic structural diagram of a receiving server in an embodiment of the present application.
  • the embodiments of the present application provide a message processing method and a receiving server, which are used to improve the confidentiality and security of tenant keys, thereby improving the security of data transmitted on the network.
  • FIG. 1 is a schematic diagram of an application scenario according to an embodiment of the present application.
  • the application scenario may be a public cloud Internet Protocol (IPsec) network, or other types of multi-tenant networks.
  • IPsec Internet Protocol
  • the sender server is used to send data packets to be transmitted by the user on network 1 to network 2.
  • Network 1 and network 2 belong to networks of different tenants; the receiver server is used to receive encrypted messages sent by the sender server; and the first
  • the encryption machine device is a trusted third-party hardware device on the user side, which is used to provide multi-tenant tenant keys and encrypt the tenant keys.
  • the second encryption machine device is used to provide multi-tenant tenant private keys. This function is used to decrypt the tenant key through the tenant private key.
  • the second encryption device is deployed in the user area, and the second encryption device may also be deployed in the data center.
  • a corresponding second encryption machine device is deployed on each user side.
  • a corresponding second encryption machine device is deployed on both the sending server and the receiving server.
  • the first encryption machine device and the second encryption machine device are trusted third-party hardware devices on the user side.
  • the first encryption machine device and the second encryption machine device are used to transmit the tenant key to the receiving server to guarantee the tenant key. Confidentiality improves the security of data transmitted by users in a multi-tenant network.
  • an embodiment of the message processing method in the embodiment of the present application includes:
  • the receiving server receives a target message sent by the sending server.
  • a multi-tenant network system such as a public cloud network or a multi-tenant network that belongs to different data centers
  • two users who belong to different tenants transmit data in the multi-tenant network system
  • the two users transmit encrypted packets, then this
  • the sender server in the user area is required to encrypt the transmitted original message
  • the sender server can negotiate and calculate the encrypted value obtained by obtaining the tenant key to which the sender belongs, and then use the encrypted value to encrypt the original message.
  • the text is encrypted to obtain the target message, and then the target message is sent to the receiving server, and then the receiving server can receive the target message sent by the sending server.
  • the receiving server receives the tenant key sent by the first encryption machine device.
  • the receiving server can receive the tenant key sent by the first encryption machine device, where the first encryption machine device stores the tenant key corresponding to the user. device. It should be noted that the receiving end server may receive the tenant key sent by the first encryption machine device. The receiving end server may request the first encryption machine device to obtain the tenant key of the user, or the first encryption machine device may determine to receive the tenant key. When the end server receives the target message, the first encryptor device may actively send the user's tenant key to the receiving end server, which is not limited in this application.
  • the receiving server calculates the tenant key as an output parameter according to a preset negotiation mode to obtain a decrypted value.
  • the receiving server After the receiving server obtains the tenant key of the target user, it can use the tenant key as an output parameter and calculate it according to a preset negotiation method to obtain a decrypted value. Specifically, in the public cloud IPsec network, the receiving server can use the tenant key as the output material of the Internet Key Exchange (IKE) negotiation, and obtain the Security Association (SA) through the IKE negotiation calculation, that is, Decrypted value.
  • IKE Internet Key Exchange
  • SA Security Association
  • the receiving server decrypts the target message according to the decrypted value to obtain the original message.
  • the receiving server can decrypt the target message by using the decrypted value to obtain the original message.
  • the target message can be decrypted through the SA.
  • the original message can be sent to the receiving virtual machine in the receiving server and then transmitted to the user client. end.
  • the receiving server receives a target message sent by the sending server, where the target message is a message obtained by the sending server encrypting according to an encrypted value, and the encrypted value is the preset value of the sending server according to a preset
  • the negotiation mode the encrypted value calculated by using the tenant key corresponding to the target user as an output parameter
  • the receiving server can receive the tenant key sent by the first encryption machine device, which stores the user.
  • the corresponding device of the tenant key the receiving server calculates the tenant key as an output parameter according to a preset negotiation method to obtain a decrypted value, and then the receiving server decrypts the target message according to the decrypted value to obtain The original message.
  • the first encryption machine device when the receiving server receives the target message, the first encryption machine device is used to provide the tenant key of the target tenant.
  • the tenant key is only the first time when the receiving server needs to calculate and use the first key. Only the encryption device is provided to the receiving server, which improves the confidentiality and security of the tenant key, thereby improving the security of data transmitted over the network.
  • the tenant key is provided through the first encryption device, and the tenant key is only in the server where the receiving server needs to use the decryption message, therefore, for a hacker attack or administrator The probability of a mutiny attack will decrease.
  • the receiving server may receive the tenant key of the target user sent by the first encryption machine device, or the receiving server may receive the encrypted tenant key of the target user sent by the first encryption machine device.
  • the application is not limited, and in the following embodiments, description is made only by using the receiving server to receive the encrypted tenant key sent by the first encryption machine device as an example.
  • the receiving server may send a request message to the first encryption machine device, where the request message is used by the receiving server to request
  • the tenant key of the target user may also be the first encryption device that actively sends the tenant of the target user to the receiving server when it is determined that the receiving server receives the target message sent by the sending server corresponding to the target user.
  • the key is not limited in this application.
  • the receiving server sends a request message to the first encryption machine device first, and then receives a tenant key sent by the first encryption machine device as an example.
  • the receiving server after the receiving server decrypts the target message according to the decrypted value and obtains the original message, the receiving server can immediately delete the tenant key, that is, release the tenant key in the receiving server. Tenant key. Therefore, when the receiving server uses the tenant key of the target user, it only needs to use the tenant key to be stored in plain text at the moment of obtaining the decrypted value. At other times, the tenant key can be set to the cipher text state, so , To improve the security of tenant keys, to a certain extent, reduce the attack surface of hacking or administrator defence.
  • the receiving server needs to decrypt the tenant key.
  • the receiving server can send the encrypted tenant key to the second encryption machine device, and the second encryption machine device can decrypt the tenant key.
  • Another embodiment of the message processing method in this embodiment of the application includes:
  • the sending server sends a target message to the receiving server.
  • Step 301 is similar to step 201 in FIG. 2 described above, and details are not described herein again.
  • the receiving server sends a request message to the first encryption machine device.
  • the receiving server After the receiving server receives the target message sent by the sending server, it can send a request message to the first encryption machine device.
  • the request message is the receiving server requesting the tenant key corresponding to the target user.
  • the first encryption machine device is a storage device. Devices with tenant keys corresponding to users can provide multi-tenant tenant public keys to encrypt tenant keys.
  • the receiving server uses IKE negotiation to obtain the SA to decrypt the message.
  • the receiving server uses the pre-shared-key of the tenant corresponding to the target user.
  • the key is used as the output parameter of the IKE negotiation, and then the SA, that is, the decrypted value, is calculated. Therefore, the receiving server obtains the pre-shared-key of the target tenant from the first encryption machine device.
  • the Datagram Transport Layer Security (DTLS) network uses other negotiation methods to obtain the decryption key.
  • DTLS Datagram Transport Layer Security
  • the first encryption machine device may be a user-side security basic device or a third-party trusted hardware terminal. Therefore, the user side or a trusted third party to manipulate the tenant key can improve the security of the user's access to the data center.
  • the first encryptor device encrypts the tenant key using the tenant public key corresponding to the target user to obtain the encrypted tenant key.
  • the first encryption machine device may use the tenant public key corresponding to the target tenant to encrypt the tenant key to obtain the encrypted tenant key.
  • the first encryption machine The device can use the public key of the target tenant to encrypt the pre-shared-key of the target tenant.
  • the first encryption machine device sends the encrypted tenant key to the receiving server.
  • the first encryption machine device may send the encrypted tenant key to the receiving server. Specifically, in the public cloud IPsec network, the first encryption machine device sends the encrypted pre-shared-key corresponding to the target tenant to the receiving server.
  • the receiving server sends the encrypted tenant key to the second encryption machine device.
  • the receiving server may send the encrypted tenant key to a second encryptor device, where the second encryptor device provides a multi-tenant private key, which is used to encrypt the encrypted tenant key through the private key.
  • the tenant key is decrypted.
  • the following description is made through a public cloud IPsec network.
  • the second encryption machine device can be deployed in the user area, and the second encryption machine device can also be deployed on the data center side of the IPsec network.
  • the second encryption machine device uses the tenant private key corresponding to the target user to decrypt the encrypted tenant key to obtain the decrypted tenant key.
  • the second encryption machine device may use the tenant private key corresponding to the target user to decrypt the encrypted tenant key to obtain the decrypted tenant key. For example, in a public cloud IPsec network, the second encryptor device decrypts the target tenant's pre-shared-key by using the private key of the target tenant to obtain the decrypted pre-shared-key.
  • the second encryptor device sends the decrypted tenant key to the receiving server.
  • the second encryption machine device After the second encryption machine device obtains the decrypted tenant key, it sends the tenant key to the receiving server. Specifically, for example, in a public cloud IPsec network, after the second encryption machine device obtains the decrypted pre-shared-key, it will send the pre-shared-key to the receiving server.
  • the receiving server calculates the decrypted tenant key as an output parameter according to a preset negotiation mode to obtain a decrypted value.
  • the receiving server can use the decrypted tenant key as an output parameter, and then calculate the corresponding negotiation mode to obtain the decrypted value.
  • the receiving server uses the IKE negotiation method to take the decrypted pre-shared-key as the output parameter, and then calculates to obtain the SA of the decrypted target message.
  • the receiving server uses the end-to-end negotiation method to calculate. The application does not limit this.
  • the receiving server deletes the decrypted tenant key.
  • the receiving server can delete the decrypted tenant key. Specifically, in the public cloud IPsec network, after the receiving end calculates the SA through IKE negotiation, it can immediately delete the decrypted pre-shared-key. This can make the decrypted pre-shared-key stay on the server only during IKE negotiation, and release the pre-shared-key immediately after use, reducing the attack probability of hacking or administrator treason.
  • the receiving server decrypts the target message according to the decrypted value to obtain the original message.
  • Step 310 is similar to step 204 in FIG. 2 described above, and details are not described herein again.
  • the receiving server receives a target message sent by the sending server.
  • the target message is a message obtained by the sending server encrypting according to an encrypted value.
  • the encrypted value is the value sent by the sending server to the target user.
  • the corresponding tenant key is used as the encrypted value calculated by the output parameter; then the receiving server can receive the tenant key sent by the first encryption machine device, and the first encryption machine device stores the tenant key corresponding to the user.
  • the receiving server calculates the tenant key as an output parameter according to a preset negotiation method to obtain a decrypted value, and then the receiving server decrypts the target message according to the decrypted value to obtain the original message.
  • the first encryption machine device when the receiving server receives the target message, the first encryption machine device is used to provide the tenant key of the target tenant.
  • the tenant key is only the first time when the receiving server needs to calculate and use the first key. Only the encryption machine equipment will be provided to the receiving server, which improves the security of providing the tenant key. For hackers or administrators, the tenant key is provided through the first encryption machine device, and the tenant key is only for receiving. The end server needs to use the decrypted message before it will be in the server. Therefore, the probability of attacks on hacker attacks or administrator treason will be reduced.
  • an embodiment of the receiving server in the embodiments of the present application includes:
  • the first receiving unit 401 is configured to receive a target message sent by a sending server, where the target message is a message obtained by the sending server encrypting according to an encrypted value, and the encrypted value is a value negotiated by the sending server according to a preset negotiation.
  • a calculation unit 403 configured to calculate the tenant key as an output parameter according to the preset negotiation manner to obtain a decrypted value
  • the decryption unit 404 is configured to decrypt the target message according to the decrypted value to obtain an original message.
  • the second receiving unit 402 is specifically configured to:
  • the receiving server further includes:
  • a first sending unit 405 is configured to send the encrypted tenant key to the second encryption machine device, where the second encryption machine device is a device storing a tenant private key corresponding to the user, and the second encryption machine device is used for Decrypt the encrypted tenant key using the tenant private key corresponding to the target user;
  • the second receiving unit 402 is further configured to:
  • the decrypted tenant key sent by the second encryption machine device, and the decrypted tenant key is a key obtained by the second encryption machine device and decrypted according to the tenant private key corresponding to the target user.
  • the receiving server further includes:
  • the second sending unit 406 is configured to send a request message to the first encryption machine device, where the request message is a message that the receiving server requests the tenant key.
  • the receiving server further includes:
  • the deleting unit 407 is configured to delete the tenant key.
  • the first receiving unit 401 receives a target message sent by a sending server.
  • the target message is a message obtained by the sending server encrypting according to an encrypted value.
  • the encrypted value is a preset value of the sending server according to a preset.
  • the negotiation method uses the tenant key corresponding to the target user as an output parameter to calculate the encrypted value.
  • the second receiving unit 402 can receive the tenant key sent by the first encryption machine device, and the first encryption machine device is a storage device.
  • the present application further provides a receiving server 500.
  • a receiving server 500 Referring to FIG. 5, an embodiment of the receiving server in the embodiment of the present application includes:
  • a processor 501 a memory 502, an input-output device 503, and a bus 504;
  • the processor 501, the memory 502, and the input-output device 503 are respectively connected to the bus 504, and the memory stores computer instructions;
  • the processor 501 is configured to receive a target message sent by a sending server, where the target message is a message obtained by the sending server encrypting according to an encrypted value, where the encrypted value is Receiving the encryption value calculated by the tenant key corresponding to the target user as an output parameter; receiving the tenant key sent by the first encryption machine device; and calculating the tenant key as an output parameter according to the preset negotiation method, A decrypted value is obtained; the decrypted value decrypts the target message to obtain the original message.
  • the processor 501 is specifically configured to:
  • processor 501 is further configured to:
  • the second encryption machine device is a device that stores a tenant private key corresponding to the user, and the second encryption machine device is used to use the The private key of the tenant decrypts the encrypted tenant key;
  • the decrypted tenant key sent by the second encryption machine device, and the decrypted tenant key is a key obtained by the second encryption machine device and decrypted according to the tenant private key corresponding to the target user.
  • processor 501 is further configured to:
  • processor 501 is further configured to:
  • the chip when the receiving server is a chip in a terminal, the chip includes a processing unit and a communication unit.
  • the processing unit may be a processor, for example, and the communication unit may be an input / output. Interface, pin, or circuit.
  • the processing unit may execute computer execution instructions stored in the storage unit, so that the chip in the terminal executes the message processing method of any one of the first aspects.
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc., and the storage unit may also be a storage unit located outside the chip in the terminal, such as a read-only memory (read -memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM), etc.
  • ROM read-only memory
  • RAM random access memory
  • the processor mentioned above may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more for controlling the above.
  • the first aspect of the message processing method is an integrated circuit for program execution.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be from a website site, a computer, a server, or a data center. Transmission via wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) to another website site, computer, server, or data center.
  • wired such as coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server, a data center, and the like that includes one or more available medium integration.
  • the available medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (Solid State Disk (SSD)), and the like.
  • the disclosed systems, devices, and methods may be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of the unit is only a logical function division.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, which may be electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objective of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each of the units may exist separately physically, or two or more units may be integrated into one unit.
  • the above integrated units can be implemented in the form of hardware or software functional units.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially a part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium , Including a number of instructions to enable a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application.
  • the foregoing storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)
  • Storage Device Security (AREA)

Abstract

本申请实施例公开了一种报文处理方法以及接收端服务器。本申请实施例方法包括：接收端服务器接收发送端服务器发送的目标报文，所述目标报文为所述发送端服务器根据加密值进行加密得到的报文，所述加密值为所述发送端服务器按照预设的协商方式将目标用户所对应的租户密钥作为输出参数计算得到的加密值；所述接收端服务器接收所述第一加密机设备发送的所述租户密钥，所述第一加密机设备为存储有用户所对应的租户密钥的设备；所述接收端服务器按照所述预设的协商方式将所述租户密钥作为输出参数进行计算，得到解密值；所述接收端服务器根据所述解密值对所述目标报文进行解密，得到原始报文。

Description

报文处理方法以及接收端服务器 技术领域
本申请涉及通信技术，尤其涉及一种报文处理方法以及接收端服务器。
背景技术
随着对系统资源利用率的要求不断提高，普通的独占性应用或者资源已经无法满足系统资源利用率的要求，因此，目前采用共享型应用或者资源尤为普遍，而共享型应用或者资源通过多租户网络来实现，通过多租户网络隔离实现用户自主配置和管理器虚拟网络环境，简化用户的网络部署。
目前，多租户网络系统中，例如公有云网络或者混合云网络等以及不同数据中心的多租户网络系统中，为了实现报文的加密传输，可以是发送端服务器以租户密钥为输出参数计算得到的加密值进行加密，然后再发送至接收端服务器，那么接收端服务器在解密时则需要该租户密钥。
因此，需要向接收端服务器提供租户密钥，由于将租户密钥直接存储于服务器当中，会导致租户密钥存在被盗取或者篡改的风险，使得接收端服务器获取到的租户密钥为被篡改过等现象，导致用户通过多租户网络传输数据的安全性较低。
发明内容
本申请实施例提供了一种报文处理方法以及接收端服务器，用于提升租户密钥的保密性，从而提高网络传输数据的安全性。
本申请实施例第一方面提供了一种报文处理方法，包括：
在多租户网络系统中，两个归属不同租户的用户进行传输加密报文时，发送端服务器会通过预设的协商方式将目标租户的租户密钥作为输出参数进行计算得到加密值，然后根据加密值加密报文得到目标报文，然后向接收端服务器发送该目标报文；接收端服务器接收到该目标报文之后，再接收第一加密机设备发送的该目标租户的租户密钥，其中，该第一加密机设备为存储有用户所对应的租户密钥的设备；然后接收端服务器可以按照预设的协商方式将租户密钥作为输出参数进行计算，得到解密值；然后接收端服务器可以根据该解密值对该目标报文进行解密，得到原始报文。
本实施例中，通过第一加密机设备来提供目标租户的租户密钥，租户密钥只有在接收端服务器需要计算使用时第一加密机设备才会向接收端服务器提供，然后接收端服务器根据该租户密钥计算得到解密值，从而实现对目标报文的解密。因此，提升了租户密钥的保密性和安全性，从而提高了网络传输数据的安全性。针对黑客攻击或者管理员叛变，由于该租户密钥为通过第一加密机设备提供，且租户密钥只在于接收端服务器要使用解密报文才会在服务器当中，因此，对于黑客攻击或者管理员叛变的攻击概率会降低。
一种可能的实现方式中，该接收端服务器接收第一加密机设备发送的租户密钥可 以包括：接收端服务器可以接收第一加密机设备发送的加密的租户密钥，该加密的租户密钥为该第一加密机设备使用该目标用户所对应的租户公钥进行加密得到的密钥。在该可能的实现方式中，第一加密机设备可以向接收端服务器提供加密的租户密钥，且该加密的租户是该第一加密机设备使用该目标用户所对应的租户公钥进行加密得到的密钥，因此，通过加密的方式传输该租户密钥至接收端服务器，提高了传输租户密钥的安全性以及保密性。
另一种可能的实现方式中，在该接收端服务器接收该第一加密机设备发送的加密的租户密钥之后，该接收端服务器按照预设的协商方式将该租户密钥作为输出参数进行计算，得到解密值之前，该方法还可以包括：该接收端服务器可以将该加密的租户密钥发送至第二加密机设备，该第二加密机设备为存储有用户所对应的租户私钥的设备，该第二加密机设备用于使用该目标用户所对应的租户私钥对该加密的租户密钥进行解密；然后接收端服务器可以接收该第二加密机设备发送的解密后的租户密钥，该解密后的租户密钥为该第二加密机设备根据该目标用户所对应的租户私钥进行解密得到的密钥。在该可能的实现方式中，接收端服务器接收到加密的租户密钥时，可以向第二加密机设备发送该加密的租户密钥，然后让第二加密机设备通过租户私钥来进行解密，因此，通过可逆的解密方式以及第二加密机设备专门用于租户密钥的解密，提升了租户密钥在提供的过程的安全性，只能是可信的硬件设备才能对租户密钥进行解密，从而提高了服务器获取到的租户密钥的安全性。
另一种可能的实现方式中，在接收端服务器接收发送端服务器发送的目标报文之后，在接收端服务器接收第一加密机设备发送的租户密钥之前，该方法还可以包括：接收端服务器可以向第一加密机设备发送请求消息，该请求消息为该接收端服务器请求该租户密钥的消息。在该可能的实现方式中，提供了一种具体的接收端服务器获取租户密钥的方式，在实际应用当中，提升了方案的可实现性。
另一种可能的实现方式中，该接收端服务器按照预设的协商方式将该租户密钥作为输出参数进行计算，得到解密值之后，该方法还可以包括：接收端服务器可以将该租户密钥删除。在该可能的实现方式中，接收端服务器在计算得到解密值之后，立即释放该租户密钥，也就是租户密钥只有在协商计算过程才存在服务器中，降低了黑客攻击或者管理员叛变的攻击概率。
本申请实施例第二方面提供了一种接收端服务器，该接收端服务器具有实现上述第二方面接收端服务器行为的功能，该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能对应的模块。
本申请实施例中第三方面提供了一种接收端服务器，该接收端服务器包括：处理器、存储器、输入输出设备以及总线；该处理器、存储器、输入输出设备分别与该总线相连，该存储器中存储有计算机指令；该处理器在执行该存储器中的计算机指令时，该存储器中存储有计算机指令；该处理器在执行该存储器中的计算机指令时，用于实现如第一方面任意一种实现方式。
本申请实施例第四方面提供了一种芯片系统，该芯片系统包括处理器，用于支持网络设备实现上述第一方面中所涉及的功能，例如，例如发送或处理上述方法中所涉及的数据和/或信息。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器， 用于保存网络设备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
本申请实施例第五方面提供了一种包括指令的计算机程序产品，其特征在于，当其在计算机上运行时，使得该计算机执行如第一方面中任一种的实现方式。
本申请实施例第六方面提供了一种计算机可读存储介质，其特征在于，包括指令，当该指令在计算机上运行时，使得计算机执行如第一方面中任一种实现方式。
从以上技术方案可以看出，本申请实施例具有以下优点：
经由上述的技术方案可知，接收端服务器接收发送端服务器发送的目标报文，该目标报文为该发送端服务器根据加密值进行加密得到的报文，该加密值为该发送端服务器按照预设的协商方式将目标用户所对应的租户密钥作为输出参数计算得到的加密值；然后该接收端服务器可以接收第一加密机设备发送的该租户密钥，该第一加密机设备为存储有该用户所对应的租户密钥的设备；接收端服务器按照预设的协商方式将该租户密钥作为输出参数进行计算，得到解密值，然后接收端服务器根据该解密值对该目标报文进行解密，得到原始报文。因此，本申请的技术方案中，当该接收端服务器接收到目标报文时，通过第一加密机设备来提供目标租户的租户密钥，租户密钥只有在接收端服务器需要计算使用时第一加密机设备才会向接收端服务器提供，提升了租户密钥的保密性，从而提高了网络传输数据的安全性。针对黑客攻击或者管理员叛变，由于该租户密钥为通过第一加密机设备提供，且租户密钥只在于接收端服务器要使用解密报文才会在服务器当中，因此，对于黑客攻击或者管理员叛变的攻击概率会降低。
附图说明
图1为本申请实施例中的一种应用场景框架示意图；
图2为本申请实施例中的报文处理方法的一种实施例示意图；
图3为本申请实施例中的报文处理方法的另一种实施例示意图；
图4为本申请实施例中的接收端服务器的一种结构示意图；
图5为本申请实施例中的接收端服务器的另一种结构示意图。
具体实施方式
本申请实施例提供了一种报文处理方法以及接收端服务器，用于提升租户密钥的保密性和安全性，从而提高网络传输数据的安全性。
请参阅图1，图1为本申请实施例的一种应用场景示意图，其中，该应用场景可以是公有云互联网协议安全性(Internet Protocol Security，IPsec)网络，也可以是其他类型的多租户网络，具体本申请不做限定。发送端服务器用于发送网络1的用户所要传输的数据报文至网络2，网络1和网络2属于不同租户的网络；接收端服务器用于接收发送端服务器发送的加密的报文；而第一加密机设备为用户侧可信的第三方硬件设备，用于提供多租户的租户密钥以及对租户密钥进行加密等功能；而第二加密机设备用于提供多租户的租户私钥，用于通过租户私钥对租户密钥进行解密的功能。需要说明的是，第二加密机设备在用户区域中部署，在数据中心中也可以部署有第二加 密机设备。在每个用户侧都会部署有对应的第二加密机设备，如图1所示，在发送端服务器和接收端服务器侧都部署有对应的第二加密机设备。第一加密机设备和第二加密机设备为用户侧可信的第三方硬件设备，通过第一加密机设备设备和第二加密机设备来向接收端服务器传输租户密钥，保障租户密钥的保密性，提高了用户在多租户网络中传输数据的安全性。
下面从接收端服务器的角度来对本申请实施例中报文处理方法进行介绍，请参阅图2，本申请实施例中报文处理方法的一个实施例包括：
201、接收端服务器接收发送端服务器发送的目标报文。
在多租户网络系统当中，例如公有云网络或者归属不同数据中心的多租户网络，两个归属不同租户的用户在多租户网络系统中进行传输数据，那么这两个用户传输加密报文，那么此时需要用户区域的发送端服务器将传输的原始报文进行加密，那么发送端服务器可以将获取发送用户所属于的租户密钥作为输出参数协商计算得到加密值，然后再根据该加密值对原始报文进行加密，得到目标报文，再向接收端服务器发送该目标报文，那么接收端服务器可以接收该发送端服务器发送的目标报文。
202、接收端服务器接收第一加密机设备发送的租户密钥。
接收端服务器接收到发送端服务器发送的目标报文之后，接收端服务器可以接收第一加密机设备发送的租户密钥，其中，该第一加密机设备为存储有用户所对应的租户密钥的设备。需要说明的是，接收端服务器接收第一加密机设备发送的租户密钥可以是接收端服务器向第一加密机设备主动请求获取该用户的租户密钥，也可以是第一加密机设备确定接收端服务器接收到目标报文时第一加密机设备可以主动发送用户的租户密钥至该接收端服务器，具体本申请不做限定。
203、接收端服务器按照预设的协商方式将该租户密钥作为输出参数进行计算，得到解密值。
接收端服务器获取到该目标用户的租户密钥之后，可以将该租户密钥作为输出参数并按照预设的协商方式进行计算，得到解密值。具体的，在公有云IPsec网络中，接收端服务器可以将该租户密钥作为混合型协议(Internet key exchange，IKE)协商的输出材料，通过IKE协商计算得到安全相关(Security Association，SA)，即解密值。
204、接收端服务器根据该解密值对该目标报文进行解密，得到原始报文。
接收端服务器可以通过该解密值对该目标报文进行解密，得到原始报文。具体的，在公有云IPsec网络中，接收端服务器通过IKE协商确定SA之后，可以通过SA解密目标报文，此时得到原始报文可以发送至接收端服务器中的接收虚机再传送给用户客户端。
本申请实施例中，接收端服务器接收发送端服务器发送的目标报文，该目标报文为该发送端服务器根据加密值进行加密得到的报文，该加密值为该发送端服务器按照预设的协商方式将目标用户所对应的租户密钥作为输出参数计算得到的加密值；然后该接收端服务器可以接收第一加密机设备发送的该租户密钥，该第一加密机设备为存储有该用户所对应的租户密钥的设备；接收端服务器按照预设的协商方式将该租户密钥作为输出参数进行计算，得到解密值，然后接收端服务器根据该解密值对该目标报文进行解密，得到原始报文。因此，本申请的技术方案中，当该接收端服务器接收到 目标报文时，通过第一加密机设备来提供目标租户的租户密钥，租户密钥只有在接收端服务器需要计算使用时第一加密机设备才会向接收端服务器提供，提升了租户密钥的保密性和安全性，从而提高了网络传输数据的安全性。针对黑客攻击或者管理员叛变，由于该租户密钥为通过第一加密机设备提供，且租户密钥只在于接收端服务器要使用解密报文才会在服务器当中，因此，对于黑客攻击或者管理员叛变的攻击概率会降低。
本申请实施例中，接收端服务器可以接收第一加密机设备发送的目标用户的租户密钥，也可以是接收端服务器接收第一加密机设备发送的目标用户的加密的租户密钥，具体本申请不做限定，在后续的实施例中，仅以该接收端服务器接收第一加密机设备发送的加密的租户密钥为例进行说明。
本申请实施例中，接收端服务器接收第一加密机设备发送的目标用户的租户密钥之前，可以是接收端服务器向该第一加密机设备发送请求消息，该请求消息用于接收端服务器请求该目标用户的租户密钥，也可以是第一加密机设备在确定该接收端服务器接收到目标用户所对应的发送端服务器发送的目标报文时，主动向接收端服务器发送该目标用户的租户密钥，具体本申请不做限定。在后续的实施例中，仅以该接收端服务器先向该第一加密机设备发送请求消息，然后再接收该第一加密机设备发送的租户密钥为例进行说明。
本申请实施例中，在接收端服务器根据该解密值对该目标报文进行解密，得到该原始报文之后，该接收端服务器可以立即将该租户密钥删除，即在接收端服务器中释放该租户密钥。因此，接收端服务器在使用该目标用户的租户密钥只有在获取解密值的那一瞬间需要使用该租户密钥为明文方式存储，在其他时刻该租户密钥都可以设置为密文状态，因此，提升了租户密钥的安全性，一定程度上降低了黑客攻击或者由于管理员叛变的攻击面。
本申请实施例中，第一加密机设备通过目标用户所对应的租户公钥对租户密钥进行加密之后，再发送给接收端服务器，那么接收端服务器需要对该租户密钥进行解密，本申请实施例提出，接收端服务器可以将该加密的租户密钥发送给第二加密机设备，由第二加密机设备来对该租户密钥进行解密。
下面通过图3来进行详细接收本申请报文处理方法，本申请实施例的报文处理方法的另一个实施例包括：
301、发送端服务器向接收端服务器发送目标报文。
步骤301与前述图2中的步骤201类似，具体此处不再赘述。
302、接收端服务器向第一加密机设备发送请求消息。
接收端服务器接收到发送端服务器发送的目标报文之后，可以向第一加密机设备发送请求消息，该请求消息为接收端服务器请求目标用户所对应的租户密钥，第一加密机设备为存储有用户所对应的租户密钥的设备，能够提供提供多租户的租户公钥来加密租户密钥。例如，在公有云IPsec网络中，接收端服务器采用IKE协商的方式来获取SA来解密报文，那么此时，接收端服务器使用的是目标用户所对应的租户的预共享密钥pre-shared-key来作为IKE协商的输出参数，然后计算得到SA，即解密值，所以此时接收端服务器向第一加密机设备获取的为目标租户的pre-shared-key；而对于 其他类型的多租户网络,例如数据包传输层安全性协议(Datagram Transport Layer Security,DTLS)网络，则使用其他协商方式获取解密密钥。
需要说明的是，第一加密机设备可以是用户侧的安全基础设备，也可以是第三方可信的硬件终端。因此，用户侧或者可信的第三方来操控该租户密钥，可以提高用户接入数据中心的安全性。
303、第一加密机设备使用目标用户所对应的租户公钥对租户密钥进行加密，得到加密的租户密钥。
第一加密机设备接收到请求消息之后，可以使用目标租户所对应的租户公钥对租户密钥进行加密，得到加密的租户密钥；具体的，例如在公有云IPsec网络中，第一加密机设备可以使用目标租户的公钥public key来加密该目标租户的pre-shared-key。
304、第一加密机设备向接收端服务器发送加密的租户密钥。
第一加密机设备通过租户公钥对租户密钥进行加密之后，第一加密机设备可以将该加密的租户密钥发送至接收端服务器。具体的，在公有云IPsec网络中，第一加密机设备将目标租户所对应的加密的pre-shared-key发送给接收端服务器。
305、接收端服务器向第二加密机设备发送加密的租户密钥。
接收端服务器接收到加密的租户密钥之后，可以向第二加密机设备发送该加密的租户密钥，其中，该第二加密机设备提供多租户的私钥，用于通过私钥对加密的租户密钥进行解密。下面通过公有云IPsec网络进行说明，第二加密机设备可以部署在用户区域，在IPsec网络的数据中心侧也可以部署有第二加密机设备。
306、第二加密机设备使用目标用户所对应的租户私钥对该加密的租户密钥进行解密，得到解密后的租户密钥。
第二加密机设备可以使用目标用户所对应的租户私钥对该加密的租户密钥进行解密，得到解密后的租户密钥。例如，在公有云IPsec网络中，第二加密机设备通过目标租户的private key解密该目标租户的pre-shared-key，得到解密后的pre-shared-key。
307、第二加密机设备向接收端服务器发送解密后的租户密钥。
第二加密机设备得到该解密后的租户密钥后就会将该租户密钥发送给接收端服务器。具体的，例如，在公有云IPsec网络中，第二加密机设备得到解密后的pre-shared-key就会将该pre-shared-key发送给接收端服务器。
308、接收端服务器按照预设的协商方式将该解密后的租户密钥作为输出参数进行计算得到解密值。
接收端服务器可以将该解密后的租户密钥作为输出参数，然后进行对应的协商方式进行计算，得到解密值。例如，在公有云IPsec网络中，接收端服务器使用IKE协商的方式，将解密后的pre-shared-key作为输出参数，然后进行计算，可以得到解密目标报文的SA。对于IPsec网络当中，还有端到端或者个人计算机(personal computer，PC)到PC进行IPsec会话保护的过程，那么在该过程接收端服务器使用end to end端到端的协商方式来进行计算，具体本申请对此不做限定。
309、接收端服务器删除该解密后的租户密钥。
接收端服务器可以将接收到的解密后的租户密钥删除；具体的，在公有云IPsec网络中，接收端通过IKE协商计算得到SA之后，可以立即将该解密后的pre-shared-key 删除，这样可以使得解密后的pre-shared-key在服务器停留的时间只在于IKE协商的时候，使用完之后立即释放该pre-shared-key，降低了黑客攻击或者管理员叛变的攻击概率。
310、接收端服务器根据解密值对该目标报文进行解密，得到原始报文。
步骤310与前述图2中的步骤204类似，具体此处不再赘述。
本申请实施例中，接收端服务器接收发送端服务器发送的目标报文，该目标报文为该发送端服务器根据加密值进行加密得到的报文，该加密值为该发送端服务器将目标用户所对应的租户密钥作为输出参数计算得到的加密值；然后该接收端服务器可以接收第一加密机设备发送的该租户密钥，该第一加密机设备为存储有该用户所对应的租户密钥的设备；接收端服务器按照预设的协商方式将该租户密钥作为输出参数进行计算，得到解密值，然后接收端服务器根据该解密值对该目标报文进行解密，得到原始报文。因此，本申请的技术方案中，当该接收端服务器接收到目标报文时，通过第一加密机设备来提供目标租户的租户密钥，租户密钥只有在接收端服务器需要计算使用时第一加密机设备才会向接收端服务器提供，提升了提供租户密钥的安全性，针对黑客攻击或者管理员叛变，由于该租户密钥为通过第一加密机设备提供，且租户密钥只在于接收端服务器要使用解密报文才会在服务器当中，因此，对于黑客攻击或者管理员叛变的攻击概率会降低。
上面对本申请实施例中的报文处理方法进行了描述，下面对本申请实施例中的接收端服务器进行描述，请参阅图4，其中，第一发送单元405、第二发送单元406以及删除单元407为可选单元，本申请实施例中接收端服务器的一个实施例包括：
第一接收单元401，用于接收发送端服务器发送的目标报文，该目标报文为该发送端服务器根据加密值进行加密得到的报文，该加密值为该发送端服务器按照预设的协商方式将目标用户所对应的租户密钥作为输出参数进行计算得到的加密值；
第二接收单元402，用于接收第一加密机设备发送的该租户密钥；
计算单元403，用于按照所述预设的协商方式将该租户密钥作为输出参数进行计算，得到解密值；
解密单元404，用于根据该解密值对该目标报文进行解密，得到原始报文。
本实施例中，该第二接收单元402具体用于：
接收该第一加密机设备发送的加密的租户密钥，该加密的租户密钥为所述第一加密机设备使用该目标用户所对应的租户公钥进行加密得到的密钥。
本实施例中，该接收端服务器还包括：
第一发送单元405，用于将该加密的租户密钥发送至该第二加密机设备，该第二加密机设备为存储有用户所对应的租户私钥的设备，该第二加密机设备用于使用该目标用户所对应的租户私钥对该加密的租户密钥进行解密；
该第二接收单元402还用于：
接收该第二加密机设备发送解密后的租户密钥，该解密后的租户密钥为该第二加密机设备根据该目标用户所对应的租户私钥进行解密得到的密钥。
本实施例中，该接收端服务器还包括：
第二发送单元406，用于向该第一加密机设备发送请求消息，该请求消息为该接 收端服务器请求该租户密钥的消息。
本实施例中，该接收端服务器还包括：
删除单元407，用于将该租户密钥删除。
本申请实施例中，第一接收单元401接收发送端服务器发送的目标报文，该目标报文为该发送端服务器根据加密值进行加密得到的报文，该加密值为发送端服务器按照预设的协商方式将目标用户所对应的租户密钥作为输出参数进行计算得到加密值；然后该第二接收单元402可以接收第一加密机设备发送的该租户密钥，该第一加密机设备为存储有该用户所对应的租户密钥的设备；计算单元403按照预设的协商方式将该租户密钥作为输出参数进行计算，得到解密值，然后解密单元404根据该解密值对该目标报文进行解密，得到原始报文。因此，本申请的技术方案中，当该第一接收单元401接收到目标报文时，通过第一加密机设备来提供目标租户的租户密钥，租户密钥只有在计算单元403需要计算使用时第一加密机设备才会向第二接收单元402提供，提升了租户密钥的保密性和安全性，从而提高了网络传输数据的安全性。针对黑客攻击或者管理员叛变，由于该租户密钥为通过第一加密机设备提供，且租户密钥只在于接收端服务器要使用解密报文才会在服务器当中，因此，对于黑客攻击或者管理员叛变的攻击概率会降低。
本申请还提供一种接收端服务器500，请参阅图5，本申请实施例中接收端服务器一个实施例包括：
处理器501、存储器502、输入输出设备503以及总线504；
处理器501、存储器502、输入输出设备503分别与总线504相连，该存储器中存储有计算机指令；
该处理器501用于接收发送端服务器发送的目标报文，该目标报文为该发送端服务器根据加密值进行加密得到的报文，该加密值为该发送端服务器按照预设的协商方式将目标用户所对应的租户密钥作为输出参数进行计算得到的加密值；接收第一加密机设备发送的该租户密钥；按照所述预设的协商方式将该租户密钥作为输出参数进行计算，得到解密值；该解密值对该目标报文进行解密，得到原始报文。
一种可能的实现方式中，该处理器501具体用于：
接收该第一加密机设备发送的加密的租户密钥，该加密的租户密钥为所述第一加密机设备使用该目标用户所对应的租户公钥进行加密得到的密钥。
另一种可能的实现方式中，该处理器501还用于：
将该加密的租户密钥发送至该第二加密机设备，该第二加密机设备为存储有用户所对应的租户私钥的设备，该第二加密机设备用于使用该目标用户所对应的租户私钥对该加密的租户密钥进行解密；
接收该第二加密机设备发送解密后的租户密钥，该解密后的租户密钥为该第二加密机设备根据该目标用户所对应的租户私钥进行解密得到的密钥。
另一种可能的实现方式中，该处理器501还用于：
向该第一加密机设备发送请求消息，该请求消息为该接收端服务器请求该租户密钥的消息。
另一种可能的实现方式中，该处理器501还用于：
将该租户密钥删除。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在另一种可能的设计中，当该接收端服务器为终端内的芯片时，芯片包括：处理单元和通信单元，所述处理单元例如可以是处理器，所述通信单元例如可以是输入/输出接口、管脚或电路等。该处理单元可执行存储单元存储的计算机执行指令，以使该终端内的芯片执行上述第一方面任意一项的报文处理方法。可选地，所述存储单元为所述芯片内的存储单元，如寄存器、缓存等，所述存储单元还可以是所述终端内的位于所述芯片外部的存储单元，如只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)等。
其中，上述任一处提到的处理器，可以是一个通用中央处理器(CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制上述第一方面的报文处理方法的程序执行的集成电路。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成 的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (13)

  1. 一种报文处理方法，其特征在于，应用于多租户网络，所述方法包括：
    接收端服务器接收发送端服务器发送的目标报文，所述目标报文为所述发送端服务器根据加密值进行加密得到的报文，所述加密值为所述发送端服务器按照预设的协商方式将目标用户所对应的租户密钥作为输出参数进行计算得到的加密值；
    所述接收端服务器接收所述第一加密机设备发送的所述租户密钥，所述第一加密机设备为存储有用户所对应的租户密钥的设备；
    所述接收端服务器按照所述预设的协商方式将所述租户密钥作为输出参数进行计算，得到解密值；
    所述接收端服务器根据所述解密值对所述目标报文进行解密，得到原始报文。
  2. 根据权利要求1所述的方法，其特征在于，所述接收端服务器接收所述第一加密机设备发送的所述租户密钥包括：
    所述接收端服务器接收所述第一加密机设备发送的加密的租户密钥，所述加密的租户密钥为所述第一加密机设备使用所述目标用户所对应的租户公钥进行加密得到的密钥。
  3. 根据权利要求2所述的方法，其特征在于，所述接收端服务器接收所述第一加密机设备发送的加密的租户密钥之后，所述接收端服务器按照预设的协商方式将所述租户密钥作为输出参数进行计算，得到解密值之前，所述方法还包括：
    所述接收端服务器将所述加密的租户密钥发送至第二加密机设备，所述第二加密机设备为存储有用户所对应的租户私钥的设备，所述第二加密机设备用于所述使用所述目标用户所对应的租户私钥对所述加密的租户密钥进行解密；
    所述接收端服务器接收所述第二加密机设备发送解密后的租户密钥，所述解密后的租户密钥为所述第二加密机设备根据所述目标用户所对应的租户私钥进行解密得到的密钥。
  4. 根据权利要求1至3中的任一项所述的方法，其特征在于，所述接收端服务器接收发送端服务器发送的目标报文之后，所述接收端服务器接收所述第一加密机设备发送的所述租户密钥之前，所述方法还包括：
    所述接收端服务器向所述第一加密机设备发送请求消息，所述请求消息为所述接收端服务器请求所述租户密钥的消息。
  5. 根据权利要求1至3中的任一项所述的方法，其特征在于，所述接收端服务器按照预设的协商方式将所述租户密钥作为输出参数进行计算，得到解密值之后，所述方法还包括：
    所述接收端服务器将所述租户密钥删除。
  6. 一种接收端服务器，其特征在于，所述接收端服务器包括：
    第一接收单元，用于接收发送端服务器发送的目标报文，所述目标报文为所述发送端服务器根据加密值进行加密得到的报文，所述加密值为所述发送端服务器按照预设的协商方式将目标用户所对应的租户密钥作为输出参数进行计算得到的加密值；
    第二接收单元，用于接收第一加密机设备发送的所述租户密钥；
    计算单元，用于按照所述预设的协商方式将所述租户密钥作为输出参数进行计算， 得到解密值；
    解密单元，用于根据所述解密值对所述目标报文进行解密，得到原始报文。
  7. 根据权利要求6所述的接收端服务器，其特征在于，所述第二接收单元具体用于：
    接收所述第一加密机设备发送的加密的租户密钥，所述加密的租户密钥为所述第一加密机设备使用所述目标用户所对应的租户公钥进行加密得到的密钥。
  8. 根据权利要求7所述的接收端服务器，其特征在于，所述接收端服务器还包括：
    第一发送单元，用于将所述加密的租户密钥发送至所述第二加密机设备，所述第二加密机设备为存储有用户所对应的租户私钥的设备，所述第二加密机设备用于所述使用所述目标用户所对应的租户私钥对所述加密的租户密钥进行解密；
    所述第二接收单元还用于：
    接收所述第二加密机设备发送解密后的租户密钥，所述解密后的租户密钥为所述第二加密机设备根据所述目标用户所对应的租户私钥进行解密得到的密钥。
  9. 根据权利要求6至8中的任一项所述的接收端服务器，其特征在于，所述接收端服务器还包括：
    第二发送单元，用于向所述第一加密机设备发送请求消息，所述请求消息为所述接收端服务器请求所述租户密钥的消息。
  10. 根据权利要求6至8中的任一项所述的接收端服务器，其特征在于，所述接收端服务器还包括：
    删除单元，用于将所述租户密钥删除。
  11. 一种接收端服务器，其特征在于，所述接收端服务器包括：处理器、存储器、收发器，所述处理器、存储器以及收发器通过总线连接，所述存储器存储有计算机指令，所述处理器通过执行所述计算机指令用于实现如权1至权5任意一项所述的报文处理方法。
  12. 一种包含指令的计算机程序产品，其特征在于，当其在计算机上运行时，使得所述计算机执行如权利要求1至5中任一项所述的方法。
  13. 一种计算机可读存储介质，其特征在于，包括指令，当所述指令在计算机上运行时，使得计算机执行如权利要求1至5中任一项所述的方法。
PCT/CN2019/094453 2018-07-04 2019-07-03 报文处理方法以及接收端服务器 WO2020007308A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810725098.5A CN109104273B (zh) 2018-07-04 2018-07-04 报文处理方法以及接收端服务器
CN201810725098.5 2018-07-04

Publications (1)

Publication Number Publication Date
WO2020007308A1 true WO2020007308A1 (zh) 2020-01-09

Family

ID=64845690

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/094453 WO2020007308A1 (zh) 2018-07-04 2019-07-03 报文处理方法以及接收端服务器

Country Status (2)

Country Link
CN (1) CN109104273B (zh)
WO (1) WO2020007308A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022110716A1 (zh) * 2020-11-27 2022-06-02 平安科技（深圳）有限公司 冷启动推荐方法、装置、计算机设备及存储介质

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109104273B (zh) * 2018-07-04 2021-03-30 华为技术有限公司 报文处理方法以及接收端服务器
CN111737709A (zh) * 2020-06-02 2020-10-02 北京人大金仓信息技术股份有限公司 一种数据保护方法、装置、设备及介质
CN113778499B (zh) * 2020-08-21 2023-09-26 北京京东振世信息技术有限公司 发布服务的方法、装置、设备和计算机可读介质
CN112671705A (zh) * 2020-11-23 2021-04-16 中信银行股份有限公司 报文的处理方法、装置、电子设备及计算机可读存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104917787A (zh) * 2014-03-11 2015-09-16 中国电信股份有限公司 基于群组密钥的文件安全共享方法和系统
CN107948156A (zh) * 2017-11-24 2018-04-20 郑州云海信息技术有限公司 一种基于身份的封闭式密钥管理方法及系统
CN109104273A (zh) * 2018-07-04 2018-12-28 华为技术有限公司 报文处理方法以及接收端服务器

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101192918B (zh) * 2006-11-24 2011-05-11 中兴通讯股份有限公司 一种广播网络中处理加密流的方法及系统
US20090025066A1 (en) * 2007-07-17 2009-01-22 Protectia Corporation Systems and methods for first and second party authentication
CN108055130A (zh) * 2017-12-27 2018-05-18 深圳技术大学（筹） 差异化安全的密文保护系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104917787A (zh) * 2014-03-11 2015-09-16 中国电信股份有限公司 基于群组密钥的文件安全共享方法和系统
CN107948156A (zh) * 2017-11-24 2018-04-20 郑州云海信息技术有限公司 一种基于身份的封闭式密钥管理方法及系统
CN109104273A (zh) * 2018-07-04 2018-12-28 华为技术有限公司 报文处理方法以及接收端服务器

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022110716A1 (zh) * 2020-11-27 2022-06-02 平安科技（深圳）有限公司 冷启动推荐方法、装置、计算机设备及存储介质

Also Published As

Publication number Publication date
CN109104273A (zh) 2018-12-28
CN109104273B (zh) 2021-03-30

Similar Documents

Publication Publication Date Title
US11792169B2 (en) Cloud storage using encryption gateway with certificate authority identification
WO2020007308A1 (zh) 报文处理方法以及接收端服务器
JP2023116573A (ja) クライアント－クラウドまたはリモートサーバーの安全なデータまたはファイル・オブジェクト暗号化ゲートウェイ
US10341118B2 (en) SSL gateway with integrated hardware security module
US20220353247A1 (en) Secure publish-subscribe communication methods and apparatus
WO2017215582A1 (zh) 加密内容检测的方法和设备
CN110769420B (zh) 网络接入方法、装置、终端、基站和可读存储介质
CA2938166C (en) Method and system for protecting data using data passports
CA3066728A1 (en) Cloud storage using encryption gateway with certificate authority identification
WO2021244569A1 (zh) 数据传输方法、系统、电子设备、存储介质
WO2021089035A1 (zh) 一种签约数据的管理方法、装置
JP2011176395A (ja) ＩＰｓｅｃ通信方法およびＩＰｓｅｃ通信システム
WO2020087286A1 (zh) 一种密钥生成方法、设备及系统
WO2024021958A1 (zh) 通信处理方法及系统、客户端、通信服务端和监管服务端
Li et al. Itls/idtls: Lightweight end-to-end security protocol for iot through minimal latency
CN109474667B (zh) 一种基于tcp和udp的无人机通信方法
CA3219175A1 (en) Protocol translation for encrypted data traffic
CN113242216A (zh) 一种基于国产商用密码算法的可信网络摄像机
JP2004135134A (ja) 無線通信用アダプタ
US20230239138A1 (en) Enhanced secure cryptographic communication system
US20220069982A1 (en) Caching encrypted content in an oblivious content distribution network, and system, compter-readable medium, and terminal for the same
KR101594897B1 (ko) 사물 인터넷에서 경량 사물간 보안 통신 세션 개설 방법 및 보안 통신 시스템
CN115766172A (zh) 基于dpu和国密的报文转发方法、装置、设备及介质
JP2023138927A (ja) データファイル送信及びデータファイルへのアクセス権を管理するためのシステム及び方法
CN115767535A (zh) 一种5G场景下终端vpn网络接入鉴权方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19830444

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19830444

Country of ref document: EP

Kind code of ref document: A1