WO2020042023A1

WO2020042023A1 - Instant messaging data encryption method and apparatus

Info

Publication number: WO2020042023A1
Application number: PCT/CN2018/103051
Authority: WO
Inventors: 袁振南; 林正显; 陈国豪
Original assignee: 区链通网络有限公司
Priority date: 2018-08-29
Filing date: 2018-08-29
Publication date: 2020-03-05
Also published as: CN109845184A

Abstract

Disclosed in the present application are an instant messaging data encryption method and apparatus. The method comprises: performing calculation on a password data source using a Hash algorithm to obtain an information password; and encrypting communication data using the information password. By using the approach above, the present application can improve the security of communication information.

Description

Data encryption method and device for instant communication

[Technical Field]

The present application relates to the field of network communication technologies, and in particular, to a data encryption method and device for instant communication.

【Background technique】

With the development of network communication technology, instant communication technology has gradually become a communication mode for both parties and an information platform for multi-party communication. When communicating through instant messaging, to ensure information security, the information needs to be encrypted. In the long-term research and development process, the inventor of the present application found that in the current group chat communication, the encryption technology uses password symmetric encryption to secure the communication information between the clients, and this password is stored on the server. When a new client joins the group, the server 'shares' the password with the user. This makes group communication completely dependent on group passwords, and group passwords are distributed on the back of each client and server. The communication security risk gap is obvious. Once the server is cracked, the security of the entire system is broken. Therefore, a secure and efficient encryption technology solution is needed to solve the problem of information communication.

[Summary of the Invention]

The technical problem mainly solved by this application is to provide a data encryption method and device for instant communication, which can improve the security of communication information.

In order to solve the above technical problem, a technical solution adopted in the present application is to provide a data encryption method for instant communication, wherein the method includes: the first client generates a random number, and combines the random number and a group password to obtain Password data source; use hash algorithm to calculate password data source to obtain information password; use information password to encrypt communication data.

In order to solve the above technical problem, a technical solution adopted in the present application is to provide a data encryption device for instant communication, wherein the device includes a processor, and the processor is configured to generate a random number and combine the random number with a group password. The password data source is obtained; the processor is also used to calculate the password data source by using a hash algorithm to obtain the information password; the processor is also used to encrypt the communication data by using the information password.

In order to solve the above technical problem, another technical solution adopted in the present application is to provide a data encryption device for instant communication, wherein the device includes: a generating module for generating a random number, and performing the random number and the group password. The combination obtains the password data source; the calculation module is used to calculate the password data source using a hash algorithm to obtain the information password; the encryption module is used to encrypt the communication data using the information password.

In order to solve the above technical problem, another technical solution adopted in the present application is to provide a device having a storage function, wherein the device stores a program, and when the program is executed, the data encryption method for real-time communication is implemented.

The beneficial effect of this application is: Different from the situation of the prior art, this application provides a data encryption method for instant communication. This method adds a random number to the password when the information is encrypted, so that each message sent will have a different The password is encrypted to improve the forward and backward password security of each message.

[Brief Description of the Drawings]

FIG. 1 is a schematic flowchart of a first embodiment of a data encryption method for instant communication according to the present application;

2 is a schematic flowchart of a second embodiment of a data encryption method for instant communication according to the present application;

3 is a schematic flowchart of a third embodiment of a data encryption method for instant communication according to the present application;

4 is a schematic flowchart of a fourth embodiment of a data encryption method for instant communication according to the present application;

5 is a schematic structural diagram of a first embodiment of a data encryption device for instant communication according to the present application;

6 is a schematic structural diagram of a second embodiment of a data encryption device for instant communication according to the present application;

FIG. 7 is a schematic structural diagram of a first embodiment of a device with a storage function according to the present application.

【detailed description】

In order to make the purpose, technical solution, and effect of this application more clear and definite, the application is further described in detail below with reference to the accompanying drawings and examples.

This application provides a data encryption method for instant communication, which is applied at least in group chat information encryption, and improves the security of group chat communication by changing the group password transmission method and the group information encryption method.

Wherein, in the group password transmission, the present application uses the Diffie-Hellman key exchange protocol (hereinafter referred to as the DH protocol), so that the communicating parties first determine a "negotiation key", and then This key is used as a symmetric key in subsequent communications to encrypt the information carrying the group password. In this way, it is possible to avoid the risk of leakage of the keys negotiated online by both parties and improve the security of password transmission.

Among them, in one embodiment, the present application provides a method for transmitting a group password. Please refer to FIG. 1. FIG. 1 is a schematic flowchart of a first embodiment of a data encryption method for instant messaging according to the present application. In this embodiment, the group password needs to be transferred, and the group password is encrypted when the group password is transferred.

Specifically, the first client creates a group, and a password is randomly generated as the group password when the group is created. For example, you can randomly generate a 64-bit random password as the group password.

The first client invites the second client to join the group chat. When the second client is invited to the group chat, the group password needs to be sent to the second client.

The first client is provided with a public key A and a private key A for encryption; the second client is provided with a public key B and a private key B for encryption. Specifically, the first client and the second client exchange the public key A and the public key B through the server; the first client uses the private key A and the public key B to calculate a DH password through the DH protocol, and uses the DH password as The symmetric password encrypts the information carrying the group password, and then sends the encrypted information carrying the group password to the second client.

The second client uses the private key B and the public key A to calculate the DH password through the DH protocol. The DH password calculated by the second client is the same as the password calculated by the first client. The group password encryption also uses a symmetric encryption method. Therefore, the second client can use the DH password to decrypt the information carrying the group password to obtain the group password.

In this way, the two parties can determine a "negotiation key" in an insecure network without communicating in advance, which can prevent the risk of leakage of the key negotiated by the two parties online. At the same time, the calculated DH password includes its own private key and the other's public key parameters; so even if hacked, the hacker only knows the public key A and the public key B, because it does not know the private key of either party, it cannot be calculated The DH password can improve the security of information.

Please refer to FIG. 2, which is a schematic flowchart of a second embodiment of a data encryption method for instant messaging according to the present application. In this embodiment, the first client uses the private key A and the public key B to calculate a DH password through an ECDH algorithm (Elliptic Curves Diffie-Hellman, ECDH). The ECDH algorithm is a combination of ECC (Elliptic Curves Cryptography, Elliptic Curve Cryptography) algorithm and DH. It is a key agreement algorithm used for key negotiation.

Then use the hash algorithm to calculate the DH password to obtain a string of predetermined digits; for example, you can use the SHA512 algorithm to calculate the DH password to obtain a string of 512 bits. The first 256 bits of the string are used as the information password to encrypt the information, and the last 128 bits of the string are used as the hash value (IV vector). The information carrying the group password is encrypted by using a symmetric encryption method, and the encrypted group password is obtained and sent. Specifically, the information carrying the group password and the hash value of the information are encrypted as the original data; so that the data receiver can use the hash value to check the integrity of the information. Symmetric encryption algorithms include DES (Data Encryption Standard), AES (Advanced Encryption Standard), IDEA (International Data Encryption Algorithm), and so on.

Wherein, in another embodiment, when the group password is transmitted, the present application may also be transmitted by using asymmetric encryption to improve the security of information transmission. In this embodiment, the first client uses the public key B of the second client to encrypt the group password, and sends the encrypted password to the second client. At this time, the second client uses its own private key B to decrypt and obtain Group password. By using asymmetric encryption to transfer the password, the security of one-way transmission is improved. This is because different clients have different public keys and corresponding private keys. Therefore, each client can only download a group password that can be decrypted by its private key.

After the group members obtain the group password, they can use this group password to encrypt the information during the group chat. However, if each message is encrypted with the same password, all information will become transparent once the password is leaked. Therefore, the password needs to be added with randomness to ensure that each message has a separate encrypted password. Based on this, the present application provides a method for encrypting information. By appending some random data to the password of each message, the original information password is derived from the new information password to improve the confidentiality of the original information password. Specifically, please refer to FIG. 3, which is a schematic flowchart of a third embodiment of a data encryption method for instant communication according to the present application. In this embodiment, the method includes the following steps:

S301: The first client generates a random number, and combines the random number and a group password to obtain a password data source.

The random number is data of a predetermined number of bits, and different information corresponds to that the random number is different. The group password is obtained by the first client being invited into the group, or randomly generated when the group is established. For the specific acquisition method, refer to the description of the foregoing embodiment, and details are not described herein again.

S302: Use a hash algorithm to calculate a password data source to obtain an information password.

Among them, the hash data is used to encrypt the password data source to protect the password more securely. Specifically, a digest with a fixed length is obtained after being encrypted by the hash, and the digest corresponding to each file is unique. Therefore, the digest is also called a file fingerprint and can be used to securely save the password. In addition, even if a file is modified by one character, its fingerprint will become completely different, so the file fingerprint can be used to judge the integrity of the file.

S303: Encrypt the communication data by using the information password.

Among them, symmetric encryption is used to encrypt communication data to increase the speed of encryption and decryption, facilitate password management, and adapt to group encrypted chat.

Please refer to FIG. 4, which is a schematic flowchart of a fourth embodiment of a data encryption method for instant messaging according to the present application. In this embodiment, when the first client sends information, a 512-bit password is randomly generated as a random number, and this random number and the public group password constitute a separate password data source for the information.

A hash algorithm is used to calculate the password data source to obtain the information password. For example, the SHA512 algorithm is used to calculate the password information source to obtain a 512-bit string. The first 256 bits of the string are used as the AES password, and the last 128 bits are used as the IV vector. The information to be sent and the hash value of the information are used as The raw data is AES-encrypted. The encrypted data consists of two parts, the first half of the message (head) is a 512-bit random number, and the second half of the message (body) is the encrypted message.

Then use the private key to sign, and then send the encrypted information to the server, which will send it to other members.

When other group members receive information, they first use the sender's signature public key for verification. After successful verification, they use the corresponding chain key to generate the information password and decrypt it with the information password. Before decryption, you can also use the hash value to verify the integrity of the original information, and then use the information password to decrypt the information.

In this group encryption method, since the server does not store the client password, the security is in the hands of the client. At the same time, each message sent by the client will be encrypted with a different password, which improves the forward and backward password of each message. Safety.

The present application also provides a data encryption device for instant communication. Please refer to FIG. 5, which is a schematic structural diagram of a first embodiment of a data encryption device for instant communication of the present application. In this embodiment, the encryption device 50 includes a processor 501. The processor 501 is configured to generate a random number and combine the random number with a group password to obtain a cryptographic data source; and then use a hash algorithm to calculate the cryptographic data source to obtain information Password; Finally, the communication data is encrypted with the information password.

In one embodiment, each time a message is sent by the client, the processor 501 randomly generates a different random number.

In one embodiment, the processor 501 is specifically configured to use the SHA512 algorithm to calculate a password data source to obtain a 512-bit character string, and use the first 256 bits of the character string as the information password.

Wherein, in an embodiment, the processor 501 is further configured to receive a group password encrypted by a DH password, wherein the DH password is calculated by the second client using the Diffie-Herman key exchange protocol; the processor 501 It is also used to calculate the DH password by using the Diffie-Herman key exchange protocol, and use the DH password to decrypt the encrypted group password to obtain the group password.

Wherein, in an embodiment, the processor 501 is further configured to establish a group and randomly generate a group digit of a group password, and then use the Diffie-Herman key exchange protocol to calculate a DH password, and use the DH password. The DH password encrypts the group password.

The DH password calculated by using the Diffie-Herman key exchange protocol includes: the first client is used to calculate the DH password by using the public key of the second client and the private key of the first client; the second client uses The DH password is calculated by using the public key of the first client and the private key of the second client. The DH password calculated by the first client and the second client is the same.

In the foregoing, the data encryption device for instant communication is used to perform the data encryption method for instant communication described above, which encrypts information data and has corresponding beneficial effects. For specific processes, please refer to the description of the foregoing embodiments, and details are not described herein again. The device may be an independent device independent of the client, or may be a module or a processing unit in the client.

Please refer to FIG. 6, which is a schematic structural diagram of a second embodiment of a data encryption device for instant communication according to the present application. In this embodiment, the encryption device 60 is a certain processing module on the client side, and specifically includes a generation module 601, a calculation module 602, and an encryption module 603. The generation module 601 is used to generate a random number, which is obtained by combining the random number and the group password. A cryptographic data source; a computing module 602 is configured to calculate a cryptographic data source by using a hash algorithm to obtain an information password; an encryption module 603 is configured to use the information password to encrypt communication data.

In one embodiment, the generating module is specifically configured to randomly generate a different random number each time a piece of information is sent.

In one embodiment, the encryption device further includes a receiving module and a decryption module. The receiving module is configured to receive the group password encrypted by the DH password. The DH password is a second client using the Diffie-Herman key exchange. Calculated by the protocol; the decryption module is used to calculate the DH password using the Diffie-Herman key exchange protocol, and uses the DH password to decrypt the encrypted group password to obtain the group password. The data encryption device for instant communication is used to perform the above-mentioned data encryption method for instant communication, which encrypts information data and has corresponding beneficial effects. For specific processes, please refer to the description of the foregoing embodiments, and details are not described herein again.

The present application further provides a device with a storage function. Please refer to FIG. 7, which is a schematic structural diagram of a first embodiment of a device with a storage function according to the present application. In this embodiment, the storage device 70 stores a program 701. When the program 701 is executed, the data encryption method for real-time communication is implemented. The specific working process is the same as in the above method embodiment, so it is not repeated here. For details, please refer to the description of the corresponding method steps above. The device having a storage function may be a portable storage medium such as a U disk, an optical disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), or a magnetic disk. The medium storing the program code may also be a terminal, a server, or the like.

In the above solution, this application provides a data encryption method for instant communication. In this group encryption method, since the server does not store the client password, the security is in the hands of the client, and each message sent by the client will have Different passwords are encrypted to improve the forward and backward password security of each message.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods may be implemented in other ways. For example, the device implementations described above are only schematic. For example, the division of the modules or units is only a logical function division. In actual implementation, there may be another division manner. For example, multiple units or components may be divided. The combination can either be integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, which may be electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, may be located in one place, or may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objective of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each of the units may exist separately physically, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or in the form of software functional unit.

When the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially a part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium. It includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) or a processor to perform all or part of the steps of the method described in each embodiment of the present application.

The above is only an implementation of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made by using the description and drawings of the present application, or directly or indirectly applied to other related technologies The fields are equally included in the patent protection scope of this application.

Claims

A data encryption method for instant communication, wherein the method includes:

The first client generates a random number, and combines the random number with a group password to obtain a password data source;

Calculating the information password using a hash algorithm to obtain the information password;

The communication data is encrypted by using the information password.
The method of claim 1, wherein the generating a random number by the first client comprises:

Each time the first client sends a message, a different random number is generated randomly.
The data encryption method for instant communication according to claim 1, wherein the information password obtained by calculating the password data source by using a hash algorithm comprises:

A SHA512 algorithm is used to calculate the password data source to obtain a 512-bit character string, and the first 256 bits of the character string are used as the information password.
The data encryption method for instant communication according to claim 3, wherein taking the last 128 bits of the character string as a hash value, and the encrypting the communication data by using the information password comprises:

The information data to be transmitted and the hash value are encrypted as communication data.
The data encryption method for instant communication according to claim 1, wherein the encrypting communication data by using an information password comprises:

The communication data is encrypted in a symmetric encryption manner, so that the information receiving end uses the information password to decrypt the communication data.
The data encryption method for instant communication according to claim 1, wherein before the first client generates a random number, and combining the random number and a group password to obtain a password data source comprises:

Receiving, by the first client, a group password encrypted by a DH password, wherein the DH password is calculated by the second client using a Diffie-Herman key exchange protocol;

The first client uses the Diffie-Herman key exchange protocol to calculate a DH password, and uses the DH password to decrypt the encrypted group password to obtain the group password.
The data encryption method for instant communication according to claim 1, wherein before the first client generates a random number, and combining the random number and a group password to obtain a password data source comprises:

The first client establishes a group and randomly generates a group password;

The first client uses a Diffie-Herman key exchange protocol to calculate a DH password, and uses the DH password to encrypt the group password.
The data encryption method for instant communication according to claim 6 or 7, wherein the encrypting the group password by using a DH password comprises:

The SHA512 algorithm is used to calculate the DH password to obtain a 512-bit character string, and the first 256 bits of the character string are used as the password to encrypt the group password.
The data encryption method for instant communication according to claim 6 or 7, wherein the DH password calculated by using the Diffie-Herman key exchange protocol comprises:

The first client calculates the DH password by using the public key of the second client and the private key of the first client;

The second client calculates the DH password by using the public key of the first client and the private key of the second client;

The DH password calculated by the first client and the second client is the same.
The method of claim 1, wherein the random number is a 512-bit random number, and the group password is a 64-bit group password.
A data encryption device for instant communication, wherein the device includes a processor for generating a random number, and combining the random number with a group password to obtain a password data source;

The processor is further configured to use a hash algorithm to calculate the password data source to obtain an information password;

The processor is further configured to encrypt the communication data by using the information password.
The data encryption device for instant communication according to claim 11, wherein each time the first client sends a message, the processor randomly generates a different random number.
The data encryption device for instant communication according to claim 11, wherein the processor is specifically configured to use the SHA512 algorithm to calculate the password data source to obtain a 512-bit character string, and take the first 256 of the character string Bits as the information password.
The data encryption device for instant communication according to claim 11, wherein the processor is further configured to receive a group password encrypted by a DH password, wherein the DH password is a second client utilizing Diffie-Herman Calculated by the key exchange protocol;

The processor is further configured to calculate a DH password by using the Diffie-Herman key exchange protocol, and use the DH password to decrypt the encrypted group password to obtain the group password.
The data encryption device for instant communication according to claim 11, wherein the processor is further configured to establish a group and randomly generate a group password with a predetermined number of digits;

The processor is further configured to use a Diffie-Herman key exchange protocol to calculate a DH password, and use the DH password to encrypt the group password.
The data encryption device for instant communication according to claim 14 or 15, wherein the DH password calculated by using the Diffie-Herman key exchange protocol comprises:

The first client is configured to calculate the DH password by using the public key of the second client and the private key of the first client;

The second client is configured to calculate the DH password by using the public key of the first client and the private key of the second client;

The DH password calculated by the first client and the second client is the same.
A data encryption device for instant communication, wherein the device includes:

A generating module, configured to generate a random number, and combine the random number with a group password to obtain a password data source;

A computing module, configured to use a hash algorithm to calculate the password data source to obtain an information password;

The encryption module is configured to encrypt the communication data by using the information password.
A device having a storage function, wherein the device stores a program, and when the program is executed, the data encryption method for instant messaging according to any one of claims 1 to 10 is implemented.