WO2020215572A1 - Authentication communication method and device, storage medium, and computer device - Google Patents

Abstract

The application provides an authentication communication method and device, a storage medium, and a computer device, the method comprising: determining multi-level dynamic encryption keys agreed with a server after successfully completing identity authentication of a target node; determining target data requiring transmission, sequentially performing multiple encryption on the target data using the dynamic encryption keys in a sequence from the lowest-level encryption key to the highest-level encryption key, and generating encrypted data; and sending the encrypted data to the server. In the method, an identity authentication mechanism is adopted to avoid attacks on sham links and prevent deception by untrusted agent nodes. Moreover, a multi-level dynamic key management mechanism renders password attacks extremely difficult, thus increasing security.

Description

Method, device, storage medium and computer equipment for authenticating communication

This application claims the priority of the Chinese patent application filed on April 25, 2019 with the Chinese Patent Office, the application number is 2019103411499, and the application name is "a method, device, storage medium and computer equipment for authenticating communication", and its entire contents Incorporated in the application by reference.

Technical field

This application relates to the technical field of secure communication, and in particular to a method, device, storage medium, and computer equipment for authenticating communication.

Background technique

At present, when adding or expanding the cluster, it is necessary to add a new host or proxy server. In the existing method to add a new host running for security authentication and encryption, it is necessary to manually deploy the agent and daemon software package suitable for the platform to issue the host New certificate; the communication uses a static key, which is easy to be cracked and attacked; the server and the host in the cluster communicate without verification, and the communication data is easy to be stolen and tampered with; and when the configuration file is modified, the cluster needs to be interrupted, and then the host is online. Will affect the business.

Summary of the invention

To solve the above technical problems, this application provides a method, device, storage medium and computer equipment for authenticating communication. According to the first aspect of the present application, a method for authenticating communication is provided, which includes: performing identity authentication on a target node, and after passing the identity authentication, determining a dynamic encryption key agreed with the target node, and the dynamic encryption key The key includes multiple levels of encryption keys; to determine the target data to be transmitted, according to the encryption keys of all levels of the dynamic encryption key, in the order from the encryption key of the lowest level to the encryption key of the highest level Perform multiple encryption processing on the target data in sequence, and generate final encrypted data after the encryption processing process ends; send the encrypted data to the server. According to a second aspect of the present application, there is provided a device for authenticating communication, including: an encryption key determining module, configured to perform identity authentication on a target node, and after passing the identity authentication, determine the dynamic encryption agreed with the target node The dynamic encryption key includes multiple levels of encryption keys; the encryption processing module is used to determine the target data that needs to be transmitted, according to the encryption keys of all levels of the dynamic encryption key, according to the lowest level The sequence from the encryption key to the top-level encryption key performs multiple encryption processing on the target data, and generates the final encrypted data after the encryption processing process ends; the sending module is used to send the encrypted data To the server. According to a third aspect of the present application, a method for authenticating communication is provided, including: performing identity authentication on a target node, agreeing on a dynamic encryption key with the target node after the authentication is passed, and generating a corresponding dynamic decryption key, The dynamic encryption key includes multiple levels of encryption keys, and the dynamic decryption key includes multiple levels of decryption keys; the encrypted data sent by the target node is obtained, and the encrypted data is based on the dynamic Encryption key, data determined after multiple encryption processing is performed on the target data in the order from the encryption key of the lowest level to the encryption key of the highest level; according to the dynamic decryption corresponding to the dynamic encryption key The decryption keys of all levels of the key are used to decrypt the encrypted data in sequence from the decryption key at the top level to the decryption key at the bottom level, until the target obtained after the decryption process is determined data. According to a fourth aspect of the present application, there is provided a device for authenticating communication, including: a decryption key determination module, configured to perform identity authentication on a target node, and agree on a dynamic encryption key with the target node after the authentication is passed, and Generate a corresponding dynamic decryption key, the dynamic encryption key includes multiple levels of encryption keys, and the dynamic decryption key includes multiple levels of decryption keys; the acquisition module is used to acquire the encrypted data sent by the target node , The encrypted data is data determined based on the multi-level dynamic encryption key, and the target data is encrypted for multiple times in the order from the encryption key at the bottom level to the encryption key at the top level; The decryption processing module is used to analyze the decryption keys of all levels of the dynamic decryption key corresponding to the dynamic encryption key in the order from the decryption key at the top level to the decryption key at the bottom level. The encrypted data is decrypted several times in sequence until the target data obtained after the end of the decryption process is determined. According to a fifth aspect of the present application, there is provided a computer-readable storage medium having computer-readable instructions stored thereon, and when the computer-readable instructions are executed by a processor, the steps of authenticating communication are realized. According to a sixth aspect of the present application, there is provided a computer device including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor. When the processor executes the computer-readable instructions Steps to achieve authentication communication.

In the method, device, storage medium and computer equipment for authenticating communication provided by the embodiments of the application, when the target node needs to access the server, the target node is first authenticated, and after the identity authentication is passed, it can be explained that the target node is legal The two parties agree on a multi-level dynamic key, so that the target node can encrypt the target data to be transmitted based on the multi-level dynamic key, and transmit the encrypted target data, thereby improving data security. The identity verification mechanism can prevent the attacks of false connections and the deception of untrusted proxy nodes; and the dynamic key management mechanism makes password attacks extremely difficult and more secure. Segmenting the target data and encrypting the target sub-data of each segment can improve the security of the data. At the same time, multi-layer encryption of the sub-data through a dynamic encryption key in the form of a binary tree can improve the security of each target sub-data and greatly improve the overall security of the data. When the transmitted target data is abnormal, the check information in the form of a binary tree can quickly determine which target sub-data has not been completely received by the server. At this time, there is no need to retransmit all the target data, but only the abnormal target sub-data can be retransmitted. That is, so that network resources can be saved and retransmission efficiency can be improved. Other features and advantages of the present application will be described in the following description, and partly become obvious from the description, or understood by implementing the present application. The purpose and other advantages of this application can be realized and obtained through the structure specified in the written description, claims, and drawings. The technical solutions of the present application will be further described in detail below through the drawings and embodiments.

Description of the drawings

The accompanying drawings are used to provide a further understanding of the application, and constitute a part of the specification. Together with the embodiments of the application, they are used to explain the application, and do not constitute a limitation to the application. In the attached picture:

FIG. 1 is a schematic flowchart of a method for authenticating communication according to an embodiment of the application;

2 is a schematic diagram of a dynamic encryption process in the form of a binary tree provided by an embodiment of the application;

FIG. 3 is a schematic flowchart of another method for authenticating communication according to an embodiment of the application;

4 is a schematic diagram of a dynamic decryption process in a binary tree form provided by an embodiment of the application;

FIG. 5 is a schematic structural diagram of a device for authenticating communication provided by an embodiment of this application;

6 is a schematic structural diagram of another device for authenticating communication provided by an embodiment of the application;

FIG. 7 is a schematic structural diagram of a computer device for executing an authentication communication method provided by an embodiment of the application.

Detailed ways

The preferred embodiments of the present application will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described here are only used to illustrate and explain the present application, and are not used to limit the present application. An embodiment of the present application provides a method for authenticating communication. As shown in FIG. 1, the method includes: Step 101: Perform identity authentication on a target node, and after passing the identity authentication, determine a dynamic encryption key agreed upon with the target node, The dynamic encryption key includes multiple levels of encryption keys. In the embodiment of this application, when the target node needs to access the server and send data to the server, the identity authentication process between the target node and the server is first performed, that is, the server judges whether the target node is a legitimate node, or the target node can also judge Whether the server is a legitimate server. Among them, the target node may specifically be a proxy server, or other servers, or other node devices in the network. When the target node needs to access the cluster network, the server of the cluster needs to authenticate the target node first, and only allow transmission between the two after passing the verification. Specifically, the target node's self-signature or CA (Certification Authority) signature can be used to verify the target node. Taking CA signature as an example, the server uses the public key signed by the CA to verify the signature on the CA signature certificate. If the verification is passed, the signature is valid. After the identity authentication is passed, a dynamic key for data transmission can be set between the two, and the dynamic key management mechanism makes password attacks more difficult. Specifically, a dynamic encryption key is agreed between the target node and the server, so that the target node can perform encryption processing on the data to be transmitted through the dynamic encryption key. Among them, the dynamic encryption key includes multiple levels of encryption keys, and each level can also contain one or more encryption keys, and multiple multiple levels of encryption keys can implement multiple encryption processing of data to improve security . Step 102: Determine the target data to be transmitted. According to the encryption keys of all levels of the dynamic encryption key, the target data is encrypted for multiple times in sequence from the encryption key of the lowest level to the encryption key of the top level. , And generate the final encrypted data after the end of the encryption process. Step 103: Send the encrypted data to the server. In the embodiment of this application, when the target node needs to send the target data to be transmitted to the server, the target data can be encrypted according to the dynamic encryption key. The dynamic encryption key is configured for dynamic management and is configured by dynamic encryption. The key management mechanism makes password attacks more difficult, and data communication transmission is more secure. At the same time, the dynamic encryption key is a multi-level encryption key. When generating encrypted data, the target data is sequentially encrypted in the order from the encryption key at the bottom level to the encryption key at the top level. For example, if the dynamic encryption key is a three-level encryption key, first use the first-level encryption key (that is, the lowest-level encryption key) to encrypt the target data to generate the first-level encryption result; Then use the second-level encryption key to encrypt the first-level encryption result again to generate the second-level encryption result; finally use the third-level encryption key (that is, the top-level encryption key) Encryption processing is performed on the encryption result of the second level to generate the encryption result of the third level, and the encryption result of the third level is the last encrypted data generated by the target data. Optionally, the target data can be divided into multiple sub-data, and different encryption keys are used for encryption processing for different sub-data, so that the difficulty of cracking the encrypted data can be further increased, and the security of the data can be further improved. The embodiment of the application provides a method for authenticating communication. When the target node needs to access the server, the target node is first authenticated. After the identity authentication is passed, it can be explained that the target node is a legal node, and the two parties agree on multiple levels The dynamic key enables the target node to perform multi-level encryption processing on the target data to be transmitted based on the dynamic key, and transmit the encrypted target data, thereby improving data security. The identity verification mechanism can prevent the attacks of false connections and the deception of untrusted proxy nodes; and the dynamic key management mechanism makes password attacks extremely difficult and more secure.

Another embodiment of the present application provides a method for authenticating communication. The method includes steps 101-103 in the foregoing embodiment. For the implementation principle and technical effect, refer to the embodiment corresponding to FIG. 1. Meanwhile, in this embodiment of the application, the dynamic encryption key is a set of encryption keys in the form of a binary tree, and the dynamic encryption key includes: m leaf encryption keys

n node encryption keys

And 1 root encryption key

among them,

Represents the b-th encryption key of the a-th level, L is the total number of levels of the dynamic encryption key, i∈[1,m]; u represents the number of the node encryption key, and

n _u represents the number of node encryption keys at the u-th level, j _u ∈ [1, n _u ]. Specifically, as shown in Figure 2, the dynamic encryption key is a multi-layer binary tree structure, with a total of L layers. The bottom layer is the leaf encryption key (that is, the encryption key of the lowest level). The key is explained at 4 levels. The dynamic encryption key has 6 leaf encryption keys (ie m = 6), 3 node encryption keys at the second level (ie n ₂ = 3), and 2 at the first level. A 3-level node encryption key (ie, n ₃ = 2) and a root encryption key (ie, the top-level encryption key). The dynamic encryption key has a total of 3+2=5 node encryption keys (that is, n=5). Meanwhile, in the embodiments of this application,

The superscript a represents the number of levels, and the subscript b represents the order of the encryption key, namely

Represents the b-th encryption key of the a-th level, in the form of "encryption key ab" in Figure 2, that is, the leaf encryption key 11 in Figure 2 represents the leaf encryption key

Leaf encryption key 12 represents the leaf encryption key

Node encryption key 21 represents the node encryption key

Root encryption key 41 represents the root encryption key

(Ie L=4), and so on. Specifically, step 102 "encrypting the target data multiple times in sequence, and generating the final encrypted data after the end of the encryption process" includes: Step A1: segmenting the target data, and determining the segmented m targets Subdata

i∈[1,m]; where,

Represents the b-th encrypted sub-data after the a-time encryption process. In the embodiment of the present application, the target data is divided into m target sub-data

In this way, different target sub-data can be encrypted with different processes, that is, different target sub-data can be encrypted with different encryption keys. Among them, the number of target sub-data can be determined based on the number of leaf encryption keys of the dynamic encryption key, that is, both are m; or, the number of target sub-data is less than the number of leaf encryption keys in the dynamic encryption key That is, in addition to the m leaf encryption keys, the dynamic encryption key may also include other unused leaf encryption keys. Specifically, refer to Figure 2. In Figure 2, 6 target sub-data are taken as an example. The "target sub-data ab" in the figure represents the b-th encrypted sub-data after a-time encryption processing, namely the target sub-data 01 represents the target sub-data

The target sub-data 02 represents the target sub-data

And so on. At the same time, since the target sub-data has not undergone encryption processing, that is, a=0, the target sub-data is also encrypted sub-data that has undergone 0 encryption processing, that is, unencrypted data. Step A2: According to the leaf encryption key of the first level

Target sub-data

Perform encryption processing to determine the corresponding leaf encrypted sub-data

Determine the encryption key corresponding to the same next level node

Two leaf encryption keys

with

j ₂ ∈[1,n ₂ ]; encrypt the two leaf keys

with

Corresponding leaf encrypted sub-data

with

As a group, according to the node encryption key

Encrypt sub-data of a group of leaves

with

Perform encryption again to determine the encryption key with the node

Corresponding node encrypted child data

If there is no sub-data encrypted with the leaf in the current level

Have the same encryption key for the next level node

The other leaves of the encryption sub-data are directly based on the node encryption key

Encrypt the sub-data of the leaf

Perform encryption processing. In the embodiment of this application, the target sub-data is encrypted by the leaf encryption key. Specifically, as shown in Figure 2, the leaf encryption key

Target sub-data

Perform encryption processing to generate encrypted encrypted sub-data

Similarly, the "encrypted sub-data ab" in Figure 2 refers to the b-th encrypted sub-data after a-time encryption processing, that is, the encrypted sub-data 11 is the first encrypted sub-data after one encryption processing. Data, namely leaf encrypted sub-data

Encrypted sub-data 12 represents leaf encrypted sub-data

And so on. At the same time, since the dynamic encryption key in the embodiment of the application is in the form of a binary tree, the two encryption keys may correspond to the same encryption key at the upper level, that is, two leaf encryption keys

with

May correspond to the same upper-level node encryption key

As shown in Figure 2, the leaf encryption key 11 and the leaf encryption key 12 both correspond to the same node encryption key 21, the leaf encryption key 13 and the leaf encryption key 14 both correspond to the same node encryption key 22, etc.; Yes, the node encryption key 21 and the node encryption key 22 also correspond to the same upper-level node encryption key 31. In the embodiment of the present application, after the target sub-data is encrypted by the leaf encryption key of the first layer, the next encryption is continued by the node encryption key of the second layer. Specifically, it will have the same upper-level node encryption key

Two leaf encryption keys

with

Corresponding leaf encrypted sub-data

with

As a group, use the node encryption key

Encrypt the sub-data of the leaf

with

Encryption processing is performed to implement the second encryption processing for the target sub-data. Specifically, referring to FIG. 2, the encrypted sub-data 11 and the encrypted sub-data 12 generated by encrypting the leaf encryption key 11 and the leaf encryption key 12 are used as a set. Specifically, the encrypted sub-data 11 and the encrypted sub-data 12 can be string Connect as a whole to form an encrypted sub-data, and then use the node encryption key 21 to perform the encryption process again, thereby generating encrypted sub-data 21 after twice encryption, that is, the node encrypted sub-data

Similarly, encrypted sub-data 13 and encrypted sub-data 14 are encrypted by node encryption key 22 to generate encrypted sub-data 22, namely node encrypted sub-data

At the same time, if there is no sub-data encrypted with the leaf in the current level

Have the same encryption key for the next level node

Other leaf encrypted sub-data, it means that there is no other leaf encrypted sub-data that can be encrypted with this leaf

Form a group for the subsequent re-encryption process, at this time the leaf can be encrypted sub-data

As a group alone, that is, directly based on the node encryption key

Encrypt the sub-data of the leaf

Perform encryption processing. As shown in Figure 2, if the target sub-data 06 and the leaf encryption key 16 do not exist, that is, the encrypted sub-data 16 does not exist, the encrypted sub-data 15 is used as a set of data alone, and the next-level node encryption key 23 is directly used This encrypted sub-data 15 is encrypted again. Step A3: Determine the sub-data encrypted with the node

Corresponding to the same next-level node encryption key

Encrypted child data of neighboring nodes

And the node encryption key

Corresponding node encrypted child data

Among them, j` <sub>2</sub> =j <sub>2</sub> +1 or j` ₂ =j ₂ -1; according to the node encryption key of the next level

Encrypt child data for a group of nodes

with

Perform encryption again to determine the encryption key with the node

Corresponding node encrypted child data

If there is no sub-data encrypted with the node in the current level

Have the same encryption key for the next level node

Other nodes encrypt sub-data, directly according to the node encryption key

Encrypt child data of node

Perform encryption again.

In the embodiment of the present application, the encryption process is performed according to the second-level node encryption key, and then the node encryption sub-data is determined

After that, similar to the above step A2, continue to encrypt the node data

Perform the next encryption process in pairs. Specifically, encrypt the sub-data of two adjacent nodes

with

As a group; among them, j` <sub>2</sub> =j <sub>2</sub> +1 or j` ₂ =j ₂ -1, depending on the actual situation. Encrypt the sub-data at the two nodes that determine the group

with

Then, it can be based on the corresponding next-level node encryption key

Encryption processing, which can determine the node encrypted sub-data

Specifically, referring to FIG. 2, for the encrypted sub-data 22, it has adjacent encrypted sub-data 21 and encrypted sub-data 23, but only the encrypted sub-data 21 and the encrypted sub-data 22 correspond to the same next-level node The encryption key is the node encryption key 31; therefore, at this time, the encrypted sub-data 21 and the encrypted sub-data 22 are used as a set, and the third encryption process is performed based on the node encryption key 31 to generate the encrypted sub-data 31. Similarly, similar to step A2, if there is no subdata encrypted with the node in the current level

Have the same encryption key for the next level node

Other nodes encrypt sub-data, directly according to the node encryption key

Encrypt child data of node

Perform encryption again. As shown in FIG. 2, there is no other encrypted sub-data that forms a group with the encrypted sub-data 23, so the encrypted sub-data 23 is directly encrypted according to the node encryption key 32 to generate the encrypted sub-data 32. Step A4: Repeat the above re-encryption process until the determined node encryption key at the upper level is the root encryption key

So far and will be based on the root encryption key

Data determined after encryption

As the final encrypted data. In the embodiment of this application, the process of combining two encrypted sub-data into a group for encryption is repeated until the encryption process reaches the top level of the dynamic encryption key, that is, the root encryption key should be passed

Perform the last encryption process. At this time, it will be based on the root encryption key

Data determined after encryption

As the final encrypted data. As shown in Figure 2, the root encryption key 41 performs the fourth encryption process on the encrypted sub-data 31 and the encrypted sub-data 32 to generate the final encrypted sub-data 41, which is the final encrypted target data. data. In the embodiment of the present application, the target data is segmented, and the target sub-data of each segment is respectively encrypted, which can improve data security. At the same time, using a dynamic encryption key in the form of a binary tree, two adjacent sub-data can be re-encrypted as a group until the final layer of encryption is completed with the root encryption key; the dynamic encryption key in the form of a binary tree Multi-layer encryption of the data can improve the security of each target sub-data and greatly improve the overall security of the data.

On the basis of the foregoing embodiment, the method further includes: Step B1: While performing the encryption process to generate the corresponding encrypted sub-data, determine the verification information of the encrypted sub-data, and encrypt all the verification information according to the dynamic encryption The binary tree form with the same key generates total verification information. Step B2: Send the total verification information to the server. In the embodiment of the present application, while generating encrypted sub-data (including leaf encrypted sub-data and node encrypted sub-data), the verification information of the encrypted sub-data is also determined. At the same time, as shown in Figure 2, since the encrypted sub-data can be represented in the form of a binary tree, all verification information can also be represented in the form of a binary tree, that is, the total verification information in the form of a binary tree that is the same as the dynamic encryption key can be generated. Afterwards, the total verification information can be sent to the server side, so that the server can verify the received target data through the total verification information to determine the integrity of the data. Specifically, the hash value of the encrypted sub-data can be used as the verification information, and the verification information can also be a verification code, a verification field, a digital signature, and the like. The embodiment of the application provides a method for authenticating communication. When the target node needs to access the server, the target node is first authenticated. After the identity authentication is passed, it can be explained that the target node is a legal node, and the two parties agree on multiple levels The dynamic key enables the target node to perform multi-level encryption processing on the target data to be transmitted based on the dynamic key, and transmit the encrypted target data, thereby improving data security. The identity verification mechanism can prevent the attacks of false connections and the deception of untrusted proxy nodes; and the dynamic key management mechanism makes password attacks extremely difficult and more secure. Segmenting the target data and encrypting the target sub-data of each segment can improve the security of the data. At the same time, multi-layer encryption of the sub-data through a dynamic encryption key in the form of a binary tree can improve the security of each target sub-data and greatly improve the overall security of the data. The total verification information is sent to the server side, so that the server can verify the received target data through the total verification information, so that the server can determine the integrity of the target data.

Based on the same inventive concept, another embodiment of the present application also provides a method for authenticating communication. The method is applied to the server side. As shown in FIG. 3, the method includes: Step 301: Perform identity authentication on the target node. After passing, the dynamic encryption key is agreed with the target node, and the corresponding dynamic decryption key is generated; the dynamic encryption key includes multiple levels of encryption keys, and the dynamic decryption key includes multiple levels of decryption keys. In the embodiment of this application, when the target node needs to access the server and send data to the server, the identity authentication process between the target node and the server is first performed, that is, the server judges whether the target node is a legitimate node, or the target node can also judge Whether the server is a legitimate server. The server of the cluster needs to authenticate the target node first, and only allow transmission between the two after passing the authentication. Specifically, the target node's self-signature or CA (Certification Authority) signature can be used to verify the target node. Taking CA signature as an example, the server uses the public key signed by the CA to verify the signature on the CA signature certificate. If the verification is passed, the signature is valid. After the identity authentication is passed, a dynamic key for data transmission can be set between the two, and the dynamic key management mechanism makes password attacks more difficult. Specifically, a multi-level dynamic encryption key is agreed between the target node and the server; and the server, as the data receiver, saves the multi-level dynamic decryption key corresponding to the dynamic encryption key. When the server receives the encrypted data encrypted by the target node through the dynamic encryption key, the server may perform decryption processing based on the dynamic decryption key to obtain corresponding plaintext data, that is, target data. Step 302: Obtain the encrypted data sent by the target node. The encrypted data is based on a multi-level dynamic encryption key. The target data is encrypted for multiple times in the order from the encryption key of the lowest level to the encryption key of the top level. The data determined afterwards. Step 303: According to the decryption keys of all levels of the dynamic decryption key corresponding to the dynamic encryption key, the encrypted data is decrypted multiple times in sequence from the decryption key of the top level to the decryption key of the bottom level. Process until the target data obtained after the end of the decryption process is determined.

In the embodiment of the present application, after obtaining the encrypted data sent by the target node, the server can perform decryption processing based on the dynamic decryption key to determine the decrypted target data. Among them, the dynamic decryption key and the dynamic encryption key have a one-to-one correspondence. The dynamic key management mechanism makes the password attack more difficult, and the security of data communication transmission is higher. At the same time, the dynamic encryption key is a multi-level encryption key. When generating encrypted data, the target data is sequentially encrypted in the order from the encryption key at the bottom level to the encryption key at the top level. Correspondingly, when the encrypted data needs to be decrypted, the encrypted data is decrypted multiple times in the order from the decryption key of the top level to the decryption key of the bottom level, thereby generating the decrypted target data. For example, the dynamic encryption key is a 3-level encryption key, and the corresponding dynamic decryption key is also a 3-level decryption key. When the encrypted data needs to be decrypted, first use the third-level decryption key (that is, the top-level decryption key) to decrypt the encrypted data to generate the first decryption result (corresponding to the above-mentioned second-level decryption key) Encryption result); then use the decryption key of the second level to decrypt the first decryption result again to generate the second decryption result (corresponding to the encryption result of the first level above); finally use the decryption of the first level The key (that is, the decryption key at the lowest level) decrypts the second decryption result to generate a third decryption result, and the third decryption result is the target data determined after the encrypted data is decrypted. The embodiment of the present application provides a method for authenticating communication. When the target node needs to access the server, the server first authenticates the target node. After the identity authentication is passed, it can be explained that the target node is a legal node, and the two parties agree on a dynamic The key enables the target node to encrypt the target data to be transmitted based on the dynamic key, and transmit the encrypted target data; the server can correctly decrypt based on the corresponding dynamic decryption key to determine the decrypted target data , Realize the safe transmission of data, thereby improving data security. The identity verification mechanism can prevent the attacks of false connections and the deception of untrusted proxy nodes; and the dynamic key management mechanism makes password attacks extremely difficult and more secure. It should be noted that the "target node" in the embodiment of the present application is the side that sends data, and the "server" is the side that receives the data. Those skilled in the art can understand that the target node can also perform the process of steps 301-303, or the process of steps 101-103, that is, the server can also send encrypted data to the target node, and the encrypted data is performed through a dynamic encryption mechanism Encrypted. On the basis of the foregoing embodiment, the dynamic encryption key is a set of encryption keys in the form of a binary tree, and the dynamic encryption key includes: m leaf encryption keys

n node encryption keys

And 1 root encryption key

among them,

Represents the b-th encryption key of the a-th level, L is the total number of levels of the dynamic encryption key, i∈[1,m]; u represents the number of the node encryption key, and

n _u represents the number of node encryption keys at the u-th level, j _u ∈ [1, n _u ]. See Figure 2 for a form of dynamic encryption key. The dynamic decryption key is a set of decryption keys in the same binary tree form as the dynamic encryption key, and the dynamic decryption key includes: m leaf decryption keys

n node decryption keys

And 1 root decryption key

among them,

Represents the b-th decryption key of the a-th level. There is a one-to-one correspondence between the leaf encryption key and the leaf decryption key, the node encryption key and the node decryption key, and the root encryption key and the root decryption key. . Among them, one form of the dynamic decryption key is shown in Figure 4. At the same time, the dynamic decryption key has a multi-layered binary tree structure, which is the same as the dynamic encryption key. The dynamic decryption key also has L layers. The top layer is the root decryption key (that is, the top-level decryption key). The bottom layer is the leaf decryption key (that is, the decryption key of the lowest level). In Figure 2, the dynamic decryption key is 4 layers for illustration. The dynamic decryption key has a total of 6 leaf decryption keys (ie m=6), Three node decryption keys at the second level (ie n ₂ =3), two node decryption keys at the third level (ie n ₃ = 2), and one root decryption key. The dynamic decryption key has a total of 3+2=5 node decryption keys (that is, n=5). At the same time, in the embodiments of this application

The superscript a represents the number of levels, and the subscript b represents the order of the decryption key, namely

Represents the b-th decryption key of the a-th level, in the form of "decryption key ab" in Figure 4, that is, the leaf decryption key 11 in Figure 4 represents the leaf decryption key

Leaf decryption key 12 represents the leaf decryption key

Node decryption key 21 represents the node decryption key

Root decryption key 41 represents the root decryption key

(Ie L=4), and so on. The above step 301 "decrypt the encrypted data multiple times in sequence until the target data obtained after the end of the decryption process is determined" specifically includes: Step C1: According to the root decryption key

Encrypted data

Perform decryption processing to determine the encrypted sub-data of the next two nodes

with

among them,

Indicates the b-th encrypted sub-data after La times of decryption processing; at the same time determine the encrypted sub-data of two nodes

with

Corresponding two node decryption keys

with

In the embodiment of this application, contrary to the process of encrypting the target data based on the dynamic encryption key, in this embodiment, the encrypted data is first decrypted according to the root decryption key. As shown in Figure 4, the encrypted sub-data 41 (ie, encrypted data) is decrypted by the root decryption key 41, thereby generating the next two-node encrypted sub-data

with

(Ie, encrypted sub-data 31 and encrypted sub-data 32 in Figure 4), and the two nodes encrypt the sub-data

with

Corresponding two node decryption keys

with

(Ie node decryption keys 31 and 32 in Figure 4). Step C2: Decrypt the key according to the node

Encrypt the sub-data of the corresponding node

Perform decryption processing to determine the next level of one or two nodes to encrypt sub-data; according to the node decryption key

Encrypt the sub-data of the corresponding node

Perform decryption processing to determine one or two node encryption sub-data of the next level; determine the next level node decryption key corresponding to the next level node encryption sub-data, and continue to encrypt the corresponding node according to the node decryption key The sub-data is decrypted. In the embodiment of this application, whenever a node is determined to encrypt sub-data (such as

or

), it can be determined to decrypt the node encrypted sub-data. After each node encrypted sub-data is decrypted, the number of the next-level node encrypted sub-data determined is one or two, depending on the specific structure of the encrypted data Depends. For example, as shown in Figure 4, after the encrypted sub-data 31 is decrypted, the encrypted sub-data 21 and the encrypted sub-data 22 of the next layer can be determined; while the encrypted sub-data 32 can be decrypted, only one encrypted sub-data can be determined. Data, that is, encrypted sub-data 23. Step C3: Repeat the above decryption process until the node decryption key at the next level determined is the leaf decryption key

And decrypt the key based on the leaf

Encrypt the sub-data of the corresponding leaf

Perform decryption processing to determine m decrypted target sub-data

According to all target sub-data

Generate the final target data. In the embodiment of this application, similar to the encryption process, when the dynamic decryption key is based on the binary tree form, the encrypted data is decrypted layer by layer using the layered dynamic decryption key until the decryption key is based on the leaf.

After the last step of decryption, unencrypted data is generated, namely the target sub-data

In turn, the target data sent by the target node can be finally determined. The dynamic decryption key in the same binary tree form as the dynamic encryption key is used to decrypt the multi-layer encrypted encrypted data, so that the encrypted data can be decrypted layer by layer until the final target data is determined. Through the dynamic encryption key and the dynamic decryption key in the form of a binary tree, the security of each target sub-data can be improved, and the overall security of the data can be greatly improved.

On the basis of the foregoing embodiment, the method further includes a data verification process. Specifically, the process includes: Step D1: Receive total verification information sent by the target node, and the total verification information is a plurality of verification information according to Dynamically decrypt the information generated in the form of a binary tree with the same key. In the embodiment of the present application, the target node, when generating encrypted sub-data (including leaf encrypted sub-data and node encrypted sub-data), also determines the verification information of the encrypted sub-data. At the same time, as shown in Figure 2, since the encrypted sub-data can be represented in the form of a binary tree, all verification information can also be represented in the form of a binary tree; and the dynamic encryption key and the dynamic decryption key have the same binary tree structure, That is, the target node can generate total verification information in the form of a binary tree that is the same as the dynamic decryption key. Among them, when the target node sends the encrypted data (that is, the data encrypted by the root encryption key) to the local server, the target node also sends the total verification information of the tree structure to the local server; or the target node sends the tree The total verification information of the structure is sent to an intermediate server dedicated to storing the verification information, and the local server obtains the corresponding verification information from the intermediate server. Among them, the intermediate server is a trusted data source. Step D2: Determine the temporary verification information of the received encrypted data, and determine whether the verification information corresponding to the encrypted data in the total verification information is consistent with the temporary verification information of the encrypted data. Step D3: If the two are inconsistent, use the encrypted data as abnormal encrypted data, determine the temporary verification information of the encrypted sub-data, and encrypt the temporary verification of the sub-data according to the verification information corresponding to the encrypted sub-data in the total verification information. Whether the verification information is consistent; the encrypted sub-data with temporary verification information that is inconsistent with the total verification information is regarded as the abnormal encrypted sub-data. In the embodiment of the present application, the received target data can be verified through the total verification information to determine the integrity of the data. Specifically, first determine whether the top-level verification information in the total verification information (that is, the verification information corresponding to the total encrypted data) is consistent with the encrypted data verification information (that is, the temporary verification information) received by the server. If they are consistent, it means that the encrypted data received by the server matches the verification information transmitted by the target node. At this time, it can indicate that the server has completely received the encrypted data sent by the target node. Wherein, the temporary verification information is the verification information of the encrypted data received by the local server or the verification information of the encrypted sub-data determined after the decryption process. If the two are inconsistent, it means that the server has not completely received the data sent by the target node. At this time, the encrypted data is regarded as abnormal encrypted data. According to the verification information in the form of a binary tree, it is possible to quickly determine which target subdata the server has not received completely. . Specifically, the encrypted data received by the server can be decrypted into one or two next-level encrypted sub-data. Since the encrypted data is abnormal, there must be at least one abnormal data in the encrypted sub-data determined after decryption. , That is, abnormally encrypted sub-data. Referring to FIG. 4, if the encrypted sub-data 41 is abnormal data, the encrypted sub-data 31 and 32 generated after decrypting the abnormal encrypted sub-data 41 must have at least one abnormal data. Step D4: While performing the decryption process on the abnormally encrypted sub-data, while generating the corresponding next-level encrypted sub-data, continue to determine the temporary verification information of the next-level encrypted sub-data, and the next level has the same The encrypted sub-data of the temporary verification information with inconsistent total verification information is regarded as the abnormal encrypted sub-data. Step D5: Repeat the above process until the abnormal leaf encrypted sub-data is determined, and the target sub-data corresponding to the abnormal leaf encrypted sub-data is obtained again, until the correct target sub-data is obtained. In the embodiment of the present application, normal decryption processing can be performed on the encrypted sub-data that is not abnormal according to the above steps C1-C3. For the abnormal encrypted sub-data, while performing the decryption process according to the above-mentioned decryption process, the temporary verification information of the encrypted sub-data of the next level generated by decryption is also determined, and the temporary verification information of the next level is determined based on the total verification information. The verification information is correct, and the encrypted sub-data corresponding to the incorrect temporary verification information is also regarded as the abnormal encrypted sub-data. After that, the above process of judging the abnormal encrypted sub-data based on the verification information can be repeated until the abnormal leaf encrypted sub-data is determined, so that it can determine which data is abnormal from the root cause. For example, referring to FIG. 4, if the encrypted sub-data 31 is abnormal data and the encrypted sub-data 32 is normal data, that is, the verification information of the encrypted sub-data 32 is correct, then the encrypted sub-data 32 can be subsequently decrypted normally Processing, so as to finally determine the correct target sub-data 05 and 06; and for the abnormal encrypted sub-data 31, it is necessary to determine which of the decrypted encrypted sub-data 21 and 22 is abnormal data, or both are abnormal data. Then continue to judge until it is determined which of the leaf encrypted sub-data (ie, encrypted sub-data 11-14) is abnormal (such as data error, tampering, missed transmission, etc.). After determining the abnormal leaf encrypted sub-data, it can be determined which target sub-data is abnormal, so that the target node can be instructed to resend the target sub-data to the server, so that the server can receive the correct target sub-data. In the embodiment of the present application, when the transmitted target data is abnormal, it is not necessary to retransmit all the target data, and only the abnormal target sub-data may be retransmitted, thereby saving network resources and improving retransmission efficiency. For example, when the target sub-data 03 transmitted by the target node is abnormal, based on the total verification information, it can be determined that the path "encrypted sub-data 41→encrypted sub-data 31→encrypted sub-data 22→encrypted sub-data 13" is abnormal. It can be determined that the target sub-data 03 transmitted to the local server is abnormal, and the target sub-data 03 needs to be retransmitted. At the same time, according to the check information in the form of a binary tree, it can be quickly determined which target sub-data has not been completely received by the server. For example, as shown in Figure 4, the encryption and decryption of 6 target sub-data (up to 8 target sub-data) is realized through four-layer dynamic keys; if one of the target sub-data is abnormal, a binary tree form of correction is used. It can be judged which target sub-data is abnormal through 4 verifications; and if it is only judged by the verification information of the encrypted data of the 6 target sub-data (ie, the leaf encrypted sub-data), it needs to judge 6 times at most Only then can it be determined which target subdata is abnormal. When there are more target sub-data, the judgment efficiency based on the binary tree form verification information is higher.

The embodiment of the present application provides a method for authenticating communication. When the target node needs to access the server, the server first authenticates the target node. After the identity authentication is passed, it can be explained that the target node is a legal node, and the two parties agree on a dynamic The key enables the target node to encrypt the target data to be transmitted based on the dynamic key, and transmit the encrypted target data; the server can correctly decrypt based on the corresponding dynamic decryption key to determine the decrypted target data , Realize the safe transmission of data, thereby improving data security. The identity verification mechanism can prevent the attacks of false connections and the deception of untrusted proxy nodes; and the dynamic key management mechanism makes password attacks extremely difficult and more secure. Through the dynamic encryption key and the dynamic decryption key in the form of a binary tree, the security of each target sub-data can be improved, and the overall security of the data can be greatly improved. When the transmitted target data is abnormal, the check information in the form of a binary tree can quickly determine which target sub-data has not been completely received by the server. At this time, there is no need to retransmit all the target data, but only the abnormal target sub-data can be retransmitted. That is, so that network resources can be saved and retransmission efficiency can be improved. The process of the authentication communication method is described in detail above, and the method can also be implemented by a corresponding device. The structure and function of the device are described in detail below. An apparatus for authenticating communication provided by an embodiment of the present application, as shown in FIG. 5, includes: an encryption key determining module 51, configured to perform identity authentication on a target node, and after passing the identity authentication, determine an agreement with the target node The dynamic encryption key includes multiple levels of encryption keys; the encryption processing module 52 is used to determine the target data that needs to be transmitted, according to the encryption keys of all levels of the dynamic encryption key, From the encryption key at the lowest level to the encryption key at the top level, the target data is encrypted multiple times in sequence, and the final encrypted data is generated after the encryption process is over; the sending module 53 is used to transfer The encrypted data is sent to the server. On the basis of the foregoing embodiment, the dynamic encryption key is a set of encryption keys in the form of a binary tree, and the dynamic encryption key includes: m leaf encryption keys

n node encryption keys

And 1 root encryption key

among them,

Represents the b-th encryption key of the a-th level, L is the total number of levels of the dynamic encryption key, i ∈ [1, m]; u represents the number of the node encryption key, and

n _u represents the number of node encryption keys at the u-th level, j _u ∈[1, n _u ]; the encryption processing module 52 is specifically configured to: perform segmentation processing on the target data, and determine the segmented m Target subdata

i∈[1,m]; where,

Represents the b-th encrypted sub-data after a-time encryption processing; according to the leaf encryption key of the first level

Target sub-data

Perform encryption processing to determine the corresponding leaf encrypted sub-data

Determine the encryption key corresponding to the same next level node

Two leaf encryption keys

with

j ₂ ∈[1,n ₂ ]; encrypt the two leaf keys

with

Corresponding leaf encrypted sub-data

with

As a group, according to the node encryption key

Encrypt sub-data of a group of leaves

with

Perform encryption again to determine the encryption key with the node

Corresponding node encrypted child data

If there is no sub-data encrypted with the leaf in the current level

Have the same encryption key for the next level node

The other leaves encrypt sub-data directly according to the node encryption key

Encrypt the sub-data of the leaf

Encryption processing; confirm to encrypt child data with node

Corresponding to the same next-level node encryption key

Encrypted child data of neighboring nodes

And the node encryption key

Corresponding node encrypted child data

Among them, j` <sub>2</sub> =j <sub>2</sub> +1 or j` ₂ =j ₂ -1; according to the node encryption key of the next level

Encrypt child data for a group of nodes

with

Perform encryption again to determine the encryption key with the node

Corresponding node encrypted child data

If there is no sub-data encrypted with the node in the current level

Have the same encryption key for the next level node

Other nodes encrypt sub-data, directly according to the node encryption key

Encrypt child data of node

Perform encryption again; repeat the above-mentioned re-encryption process until the determined upper-level node encryption key is the root encryption key

So far and will be based on the root encryption key

Data determined after encryption

As the final encrypted data. On the basis of the above-mentioned embodiment, the device further includes: a verification information generation module; the verification information generation module is used to determine the verification of the encrypted sub-data while executing the encryption processing to generate the corresponding encrypted sub-data. And generate total verification information according to the binary tree form same as the dynamic encryption key; the sending module 53 is also configured to send the total verification information to the server. In the device for authenticating communication provided by the embodiment of the application, when the target node needs to access the server, the target node is first authenticated. After the identity authentication is passed, the target node can be explained as a legal node, and the two parties agree on a dynamic secret The key enables the target node to encrypt the target data to be transmitted based on the dynamic key, and transmit the encrypted target data, thereby improving data security. The identity verification mechanism can prevent the attacks of false connections and the deception of untrusted agent nodes; and the dynamic key management mechanism makes password attacks extremely difficult and more secure. Segmenting the target data and encrypting the target sub-data of each segment can improve the security of the data. At the same time, multi-layer encryption of the sub-data through a dynamic encryption key in the form of a binary tree can improve the security of each target sub-data and greatly improve the overall security of the data. The total verification information is sent to the server side, so that the server can verify the received target data through the total verification information, so that the server can determine the integrity of the target data. Based on the same inventive concept, an embodiment of the present application also provides a device for authenticating communication. As shown in FIG. 6, the device includes: a decryption key determining module 61, which is used to authenticate the target node's identity, and communicate with all users after the authentication is passed. The target node agrees on a dynamic encryption key and generates a corresponding dynamic decryption key, the dynamic encryption key includes multiple levels of encryption keys, and the dynamic decryption key includes multiple levels of decryption keys; acquisition module 62. Used to obtain encrypted data sent by the target node, where the encrypted data is based on the multi-level dynamic encryption key, and the target data is compared in the order from the encryption key at the bottom level to the encryption key at the top level. The data is determined after multiple encryption processing; the decryption processing module 63 is used for decryption keys of all levels according to the dynamic decryption key corresponding to the dynamic encryption key, according to the decryption key from the top level to The decryption key of the lowest level sequentially decrypts the encrypted data multiple times in sequence until the target data obtained after the decryption process is determined.

On the basis of the foregoing embodiment, the dynamic encryption key is a set of encryption keys in the form of a binary tree, and the dynamic encryption key includes: m leaf encryption keys

n node encryption keys

And 1 root encryption key

among them,

Represents the b-th encryption key of the a-th level, L is the total number of levels of the dynamic encryption key, i ∈ [1, m]; u represents the number of the node encryption key, and

n _u represents the number of node encryption keys at the u-th level, j _u ∈[1, n _u ]; the dynamic decryption key is a set of decryption keys in the same binary tree form as the dynamic encryption key, and The dynamic decryption key includes: m leaf decryption keys

n node decryption keys

And 1 root decryption key

among them,

Represents the b-th decryption key of the a-th level, the leaf encryption key and the leaf decryption key, the node encryption key and the node decryption key, the root encryption key and the root There is a one-to-one correspondence between the decryption keys; the decryption processing module 63 is specifically configured to: according to the root decryption key

To the encrypted data

Perform decryption processing to determine the encrypted sub-data of the next two nodes

with

among them,

Indicates the b-th encrypted sub-data after La times of decryption processing; at the same time determine the encrypted sub-data of two nodes

with

Corresponding two node decryption keys

with

Decrypt the key according to the node

Encrypt the sub-data of the corresponding node

Perform decryption processing to determine the next level of one or two nodes to encrypt sub-data; according to the node decryption key

Encrypt the sub-data of the corresponding node

Perform decryption processing to determine one or two node encryption sub-data of the next level; determine the next level node decryption key corresponding to the next level node encryption sub-data, and continue to encrypt the corresponding node according to the node decryption key The sub-data is decrypted; the above decryption process is repeated until the node decryption key at the next level determined is the leaf decryption key

And decrypt the key based on the leaf

Encrypt the sub-data of the corresponding leaf

Perform decryption processing to determine m decrypted target sub-data

According to all target sub-data

Generate the final target data. On the basis of the foregoing embodiment, the device further includes: a verification module; the verification module is configured to receive total verification information sent by the target node, where the total verification information is a plurality of verification information according to Information generated in the form of a binary tree that is the same as the dynamic decryption key; determine the temporary verification information of the received encrypted data, and determine the verification information corresponding to the encrypted data in the total verification information and the Whether the temporary verification information of the encrypted data is consistent; if the two are inconsistent, the encrypted data is regarded as abnormal encrypted data, the temporary verification information of the encrypted sub-data is determined, and the total verification information is compared with all The verification information corresponding to the encrypted sub-data is the same as the temporary verification information of the encrypted sub-data; the encrypted sub-data with the temporary verification information inconsistent with the total verification information is regarded as the abnormal encrypted sub-data; When the abnormal encrypted sub-data executes the decryption process to generate the corresponding next-level encrypted sub-data, continue to determine the temporary verification information of the next-level encrypted sub-data, and the next level has inconsistency with the total verification information The encrypted sub-data of the temporary verification information is used as the abnormal encrypted sub-data; the above process is repeated until the abnormal leaf encrypted sub-data is determined, and the target sub-data corresponding to the abnormal leaf encrypted sub-data is obtained again until the correct target is obtained Sub data. The embodiment of the present application provides a device for authenticating communication. When the target node needs to access the server, the server first authenticates the target node. After the identity authentication is passed, it can be explained that the target node is a legitimate node, and the two parties agree on a dynamic The key enables the target node to encrypt the target data to be transmitted based on the dynamic key, and transmit the encrypted target data; the server can correctly decrypt based on the corresponding dynamic decryption key to determine the decrypted target data , Realize the safe transmission of data, thereby improving data security. The identity verification mechanism can prevent the attacks of false connections and the deception of untrusted proxy nodes; and the dynamic key management mechanism makes password attacks extremely difficult and more secure. Through the dynamic encryption key and the dynamic decryption key in the form of a binary tree, the security of each target sub-data can be improved, and the overall security of the data can be greatly improved. When the transmitted target data is abnormal, the check information in the form of a binary tree can quickly determine which target sub-data has not been completely received by the server. At this time, there is no need to retransmit all the target data, but only the abnormal target sub-data can be retransmitted. That is, network resources can be saved and the retransmission efficiency can be improved.

An embodiment of the present application also provides a computer storage medium that stores computer-executable instructions, which contains a program for executing the above-mentioned authentication communication method, and the computer-executable instructions can execute any of the above-mentioned method embodiments Method in. Wherein, the computer storage medium may be any available medium or data storage device that the computer can access, including but not limited to magnetic storage (such as floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor memory (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state drive (SSD)), etc. Fig. 7 shows a structural block diagram of a computer device according to another embodiment of the present application. The computer device 1100 may be a host server with computing capabilities, a personal computer PC, or a portable computer or terminal that can be carried. The specific embodiment of the present application does not limit the specific implementation of the computer device. The computer device 1100 includes at least one processor (processor) 1110, a communication interface (Communications Interface) 1120, a memory (memory array) 1130, and a bus 1140. Among them, the processor 1110, the communication interface 1120, and the memory 1130 communicate with each other through the bus 1140. The communication interface 1120 is used to communicate with network elements, where the network elements include, for example, a virtual machine management center and shared storage. The processor 1110 is used to execute programs. The processor 1110 may be a central processing unit CPU, or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The memory 1130 is used for executable instructions. The memory 1130 may include a high-speed RAM memory, or may also include a non-volatile memory (non-volatile memory), for example, at least one disk memory. The memory 1130 may also be a memory array. The memory 1130 may also be divided into blocks, and the blocks may be combined into a virtual volume according to certain rules. The instructions stored in the memory 1130 may be executed by the processor 1110, so that the processor 1110 can execute the method in any of the foregoing method embodiments. Obviously, those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. In this way, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalent technologies, this application also intends to include these modifications and variations.

Claims (20)

1. A method of authenticating communication includes:

   Perform identity authentication on the target node. After passing the identity authentication, determine the dynamic encryption key agreed upon with the target node. The dynamic encryption key includes multiple levels of encryption keys; determine the target data to be transmitted according to all The encryption keys of all levels of the dynamic encryption key are sequentially encrypted for multiple times on the target data in the order from the encryption key of the lowest level to the encryption key of the top level, and after the end of the encryption process Generate final encrypted data; send the encrypted data to the server.
2. The method according to claim 1, wherein the dynamic encryption key is a set of encryption keys in the form of a binary tree, and the dynamic encryption key comprises: m leaf encryption keys

   

   n node encryption keys

   

   And 1 root encryption key

   

   among them,

   

   Represents the b-th encryption key of the a-th level, L is the total number of levels of the dynamic encryption key, i ∈ [1, m]; u represents the number of the node encryption key, and

   

   n _u represents the number of node encryption keys at the u-th level, j _u ∈ [1, n _u ]; the target data is sequentially encrypted for multiple times, and the final encrypted data is generated after the encryption process is over , Including: performing segmentation processing on the target data, and determining m target subdata after segmentation

   

   i∈[1,m]; where,

   

   Represents the b-th encrypted sub-data after a-time encryption processing; according to the leaf encryption key of the first level

   

   Target sub-data

   

   Perform encryption processing to determine the corresponding leaf encrypted sub-data

   

   Determine the encryption key corresponding to the same next level node

   

   Two leaf encryption keys

   

   with

   

   j ₂ ∈[1,n ₂ ]; encrypt the two leaf keys

   

   with

   

   Corresponding leaf encrypted sub-data

   

   with

   

   As a group, according to the node encryption key

   

   Encrypt sub-data of a group of leaves

   

   with

   

   Perform encryption again to determine the encryption key with the node

   

   Corresponding node encrypted child data

   

   If there is no sub-data encrypted with the leaf in the current level

   

   Have the same encryption key for the next level node

   

   The other leaves of the encryption sub-data are directly based on the node encryption key

   

   Encrypt the sub-data of the leaf

   

   Encryption processing; confirm to encrypt child data with node

   

   Corresponding to the same next-level node encryption key

   

   Encrypted child data of neighboring nodes

   

   And the node encryption key

   

   Corresponding node encrypted child data

   

   Among them, j` <sub>2</sub> =j <sub>2</sub> +1 or j` ₂ =j ₂ -1; according to the node encryption key of the next level

   

   Encrypt child data for a group of nodes

   

   with

   

   Perform encryption again to determine the encryption key with the node

   

   Corresponding node encrypted child data

   

   If there is no sub-data encrypted with the node in the current level

   

   Have the same encryption key for the next level node

   

   Other nodes encrypt sub-data, directly according to the node encryption key

   

   Encrypt child data of node

   

   Perform encryption again;

   Repeat the above re-encryption process until the determined node encryption key of the upper level is the root encryption key

   

   So far and will be based on the root encryption key

   

   Data determined after encryption

   

   As the final encrypted data.
3. The method according to claim 2, further comprising: determining the verification information of the encrypted sub-data while performing the encryption process to generate the corresponding encrypted sub-data, and combining all the verification information with the dynamic encryption The binary tree form with the same key generates total verification information; and the total verification information is sent to the server.
4. A method for authenticating communication includes: performing identity authentication on a target node, agreeing on a dynamic encryption key with the target node after the authentication is passed, and generating a corresponding dynamic decryption key, the dynamic encryption key including multiple levels The dynamic decryption key includes multiple levels of decryption keys; the encrypted data sent by the target node is obtained, and the encrypted data is based on the dynamic encryption key of multiple levels, according to the lowest level The sequence from the encryption key to the encryption key of the top level is the data determined after multiple encryption processing of the target data; according to the decryption keys of all levels of the dynamic decryption key corresponding to the dynamic encryption key, From the decryption key at the top level to the decryption key at the bottom level, the encrypted data is decrypted multiple times in sequence until the target data obtained after the decryption process is determined.
5. The method according to claim 4, wherein the dynamic encryption key is a set of encryption keys in the form of a binary tree, and the dynamic encryption key comprises: m leaf encryption keys

   

   n node encryption keys

   

   And 1 root encryption key

   

   among them,

   

   Represents the b-th encryption key of the a-th level, L is the total number of levels of the dynamic encryption key, i ∈ [1, m]; u represents the number of the node encryption key, and

   

   n _u represents the number of node encryption keys at the u-th level, j _u ∈[1, n _u ]; the dynamic decryption key is a set of decryption keys in the same binary tree form as the dynamic encryption key, and The dynamic decryption key includes: m leaf decryption keys

   

   n node decryption keys

   

   And 1 root decryption key

   

   among them,

   

   Represents the b-th decryption key of the a-th level, the leaf encryption key and the leaf decryption key, the node encryption key and the node decryption key, the root encryption key and the root There is a one-to-one correspondence between the decryption keys; the step of decrypting the encrypted data multiple times in sequence until the target data obtained after the end of the decrypting process is determined includes: according to the root decryption key

   

   To the encrypted data

   

   Perform decryption processing to determine the encrypted sub-data of the next two nodes

   

   with

   

   among them,

   

   Indicates the b-th encrypted sub-data after La times of decryption processing; at the same time determine the encrypted sub-data of two nodes

   

   with

   

   Corresponding two node decryption keys

   

   with

   

   Decrypt the key according to the node

   

   Encrypt the sub-data of the corresponding node

   

   Perform decryption processing to determine the next level of one or two nodes to encrypt sub-data; according to the node decryption key

   

   Encrypt the sub-data of the corresponding node

   

   Perform decryption processing to determine one or two node encryption sub-data of the next level; determine the next level node decryption key corresponding to the next level node encryption sub-data, and continue to encrypt the corresponding node according to the node decryption key The sub-data is decrypted;

   Repeat the above decryption process until the node decryption key at the next level determined is the leaf decryption key

   

   And decrypt the key based on the leaf

   

   Encrypt the sub-data of the corresponding leaf

   

   Perform decryption processing to determine m decrypted target sub-data

   

   According to all target sub-data

   

   Generate the final target data.
6. The method according to claim 5, further comprising: receiving total verification information sent by the target node, the total verification information being a plurality of verification information generated in the same binary tree form as the dynamic decryption key的信息; Determine the temporary verification information of the received encrypted data, and determine whether the verification information corresponding to the encrypted data in the total verification information is consistent with the temporary verification information of the encrypted data; if two If they are inconsistent, the encrypted data is regarded as abnormal encrypted data, the temporary verification information of the encrypted sub-data is determined, and the encryption is performed according to the verification information corresponding to the encrypted sub-data in the total verification information. Whether the temporary verification information of the sub-data is consistent; the encrypted sub-data with the temporary verification information that is inconsistent with the total verification information is regarded as the abnormal encrypted sub-data; the corresponding download is generated during the decryption process of the abnormal encrypted sub-data While encrypting the sub-data of one level, continue to determine the temporary verification information of the encrypted sub-data of the next level, and use the encrypted sub-data of the next level with temporary verification information that is inconsistent with the total verification information as the abnormal encryption sub-data data;

   The above process is repeated until the abnormal leaf encrypted sub-data is determined, and the target sub-data corresponding to the abnormal leaf encrypted sub-data is obtained again until the correct target sub-data is obtained.
7. A device for authenticating communication, comprising: an encryption key determining module, used to perform identity authentication on a target node, and after passing the identity authentication, determine a dynamic encryption key agreed upon with the target node, the dynamic encryption key including Multiple levels of encryption keys; encryption processing module, used to determine the target data to be transmitted, according to the encryption keys of all levels of the dynamic encryption key, according to the encryption key from the lowest level to the top level encryption The sequence of the keys performs multiple encryption processing on the target data in turn, and generates final encrypted data after the encryption processing process ends; the sending module is used to send the encrypted data to the server.
8. The apparatus according to claim 7, wherein the dynamic encryption key is a set of encryption keys in the form of a binary tree, and the dynamic encryption key comprises: m leaf encryption keys

   

   n node encryption keys

   

   And 1 root encryption key

   

   among them,

   

   Represents the b-th encryption key of the a-th level, L is the total number of levels of the dynamic encryption key, i∈[1,m]; u represents the number of the node encryption key, and

   

   n _u represents the number of node encryption keys at the u-th level, j _u ∈ [1, n _u ].
9. The apparatus according to claim 8, further comprising: a verification information generating module; the verification information generating module is configured to determine the verification of the encrypted sub-data while performing the encryption processing to generate the corresponding encrypted sub-data And generate total verification information according to the binary tree form same as the dynamic encryption key; the sending module is also used to send the total verification information to the server.
10. A device for authenticating communication includes: a decryption key determination module, which is used to authenticate a target node, agree on a dynamic encryption key with the target node after the authentication is passed, and generate a corresponding dynamic decryption key. The dynamic encryption key includes multiple levels of encryption keys, and the dynamic decryption key includes multiple levels of decryption keys; the acquisition module is used to acquire the encrypted data sent by the target node, and the encrypted data is based on multiple levels. The dynamic encryption key is the data determined after the target data is encrypted for multiple times in the order from the encryption key at the bottom level to the encryption key at the top level; the decryption processing module is used for The decryption keys of all levels of the dynamic decryption key corresponding to the dynamic encryption key are decrypted multiple times in sequence from the decryption key of the top level to the decryption key of the bottom level, until Determine the target data obtained after the decryption process is over.
11. The device according to claim 10, wherein the dynamic encryption key is a set of encryption keys in the form of a binary tree, and the dynamic encryption key comprises: m leaf encryption keys

    

    n node encryption keys

    

    And 1 root encryption key

    

    among them,

    

    Represents the b-th encryption key of the a-th level, L is the total number of levels of the dynamic encryption key, i ∈ [1, m]; u represents the number of the node encryption key, and

    

    n _u represents the number of node encryption keys at the u-th level, j _u ∈[1, n _u ]; the dynamic decryption key is a set of decryption keys in the same binary tree form as the dynamic encryption key, and The dynamic decryption key includes: m leaf decryption keys

    

    n node decryption keys

    

    And 1 root decryption key

    

    among them,

    

    Represents the b-th decryption key of the a-th level, the leaf encryption key and the leaf decryption key, the node encryption key and the node decryption key, the root encryption key and the root There is a one-to-one correspondence between the decryption keys.
12. The apparatus according to claim 11, further comprising: a check module, configured to receive total check information sent by the target node, the total check information being a plurality of check information according to the dynamic decryption key Information generated in the same binary tree form; determine the temporary verification information of the received encrypted data, and determine the verification information corresponding to the encrypted data in the total verification information and the temporary verification of the encrypted data Whether the information is consistent; if the two are inconsistent, the encrypted data is regarded as abnormal encrypted data, and the temporary verification information of the encrypted sub-data is determined, and based on the total verification information corresponding to the encrypted sub-data Check whether the temporary check information of the encrypted sub-data is consistent with the check information; use the encrypted sub-data with temporary check information that is inconsistent with the total check information as the abnormal encrypted sub-data; perform decryption processing on the abnormal encrypted sub-data While generating the corresponding next-level encrypted sub-data in the process, continue to determine the temporary verification information of the next-level encrypted sub-data, and encrypt the temporary verification information in the next level that is inconsistent with the total verification information Sub-data is regarded as abnormal encrypted sub-data;

    The above process is repeated until the abnormal leaf encrypted sub-data is determined, and the target sub-data corresponding to the abnormal leaf encrypted sub-data is obtained again until the correct target sub-data is obtained.
13. A non-volatile readable storage medium storing computer readable instructions. The method for implementing authentication communication when the computer readable instructions are executed by one or more processors includes: performing identity authentication on a target node, and After identity authentication, determine the dynamic encryption key agreed with the target node, the dynamic encryption key includes multiple levels of encryption keys; determine the target data that needs to be transmitted, and encrypt all levels according to the dynamic encryption key Key, the target data is encrypted multiple times in sequence from the encryption key at the bottom level to the encryption key at the top level, and the final encrypted data is generated after the encryption process is over; The encrypted data is sent to the server.
14. The non-volatile readable storage medium of claim 1, when the computer-readable instructions are executed by the processor, the dynamic encryption key is a set of encryption keys in the form of a binary tree, and the dynamic encryption key The key includes: m leaf encryption keys

    

    n node encryption keys

    

    And 1 root encryption key

    

    among them,

    

    Represents the b-th encryption key of the a-th level, L is the total number of levels of the dynamic encryption key, i∈[1,m]; u represents the number of the node encryption key, and

    

    n _u represents the number of node encryption keys at the u-th level, j _u ∈[1, n _u ].
15. A non-volatile readable storage medium storing computer readable instructions. The method for realizing authentication communication when the computer readable instructions are executed by one or more processors includes: performing identity authentication on a target node, and After passing, the dynamic encryption key is agreed with the target node, and a corresponding dynamic decryption key is generated. The dynamic encryption key includes multiple levels of encryption keys, and the dynamic decryption key includes multiple levels of decryption keys. Key; Obtain the encrypted data sent by the target node, the encrypted data is based on the multi-level dynamic encryption key, the target data is multiplied in order from the encryption key at the bottom level to the encryption key at the top level Data determined after the second encryption processing; according to the decryption keys of all levels of the dynamic decryption key corresponding to the dynamic encryption key, in the order from the decryption key of the top level to the decryption key of the bottom level The encrypted data is decrypted multiple times in sequence until the target data obtained after the end of the decryption process is determined.
16. The non-volatile readable storage medium according to claim 15, wherein when the computer-readable instructions are executed by the processor, the dynamic encryption key is a set of encryption keys in the form of a binary tree, and the dynamic encryption key The key includes: m leaf encryption keys

    

    n node encryption keys

    

    And 1 root encryption key

    

    among them,

    

    Represents the b-th encryption key of the a-th level, L is the total number of levels of the dynamic encryption key, i ∈ [1, m]; u represents the number of the node encryption key, and

    

    n _u represents the number of node encryption keys at the u-th level, j _u ∈[1, n _u ]; the dynamic decryption key is a set of decryption keys in the same binary tree form as the dynamic encryption key, and The dynamic decryption key includes: m leaf decryption keys

    

    n node decryption keys

    

    And 1 root decryption key

    

    among them,

    

    Represents the b-th decryption key of the a-th level, the leaf encryption key and the leaf decryption key, the node encryption key and the node decryption key, the root encryption key and the root There is a one-to-one correspondence between the decryption keys.
17. A computer device includes a memory and a processor. The memory stores computer-readable instructions. The method for implementing authentication communication when the processor executes the computer-readable instructions includes: performing identity authentication on a target node, and After identity authentication, determine the dynamic encryption key agreed with the target node, the dynamic encryption key includes multiple levels of encryption keys; determine the target data that needs to be transmitted, and encrypt all levels according to the dynamic encryption key Key, the target data is encrypted multiple times in sequence from the encryption key at the bottom level to the encryption key at the top level, and the final encrypted data is generated after the encryption process is over; The encrypted data is sent to the server.
18. The computer device according to claim 17, wherein when the computer-readable instructions are executed by the processor, the dynamic encryption key is a set of encryption keys in the form of a binary tree, the dynamic encryption key comprising: m leaves Encryption key

    

    n node encryption keys

    

    And 1 root encryption key

    

    among them,

    

    Represents the b-th encryption key of the a-th level, L is the total number of levels of the dynamic encryption key, i ∈ [1, m]; u represents the number of the node encryption key, and

    

    n _u represents the number of node encryption keys at the u-th level, j _u ∈ [1, n _u ].
19. A computer device includes a memory and a processor. The memory stores computer-readable instructions. The method for implementing authentication communication when the processor executes the computer-readable instructions includes: performing identity authentication on a target node, and After passing, the dynamic encryption key is agreed with the target node, and a corresponding dynamic decryption key is generated. The dynamic encryption key includes multiple levels of encryption keys, and the dynamic decryption key includes multiple levels of decryption keys. Key; Obtain the encrypted data sent by the target node, the encrypted data is based on the multi-level dynamic encryption key, the target data is multiplied in order from the encryption key at the bottom level to the encryption key at the top level Data determined after the second encryption processing; according to the decryption keys of all levels of the dynamic decryption key corresponding to the dynamic encryption key, in the order from the decryption key of the top level to the decryption key of the bottom level The encrypted data is decrypted multiple times in sequence until the target data obtained after the end of the decryption process is determined.
20. The computer device according to claim 19, when the computer-readable instructions are executed by the processor, the dynamic encryption key is a set of encryption keys in the form of a binary tree, the dynamic encryption key comprising: m leaves Encryption key

    

    n node encryption keys

    

    And 1 root encryption key

    

    among them,

    

    Represents the b-th encryption key of the a-th level, L is the total number of levels of the dynamic encryption key, i ∈ [1, m]; u represents the number of the node encryption key, and

    

    n _u represents the number of node encryption keys at the u-th level, j _u ∈[1, n _u ]; the dynamic decryption key is a set of decryption keys in the same binary tree form as the dynamic encryption key, and The dynamic decryption key includes: m leaf decryption keys

    

    n node decryption keys

    

    And 1 root decryption key

    

    among them,

    

    Represents the b-th decryption key of the a-th level, the leaf encryption key and the leaf decryption key, the node encryption key and the node decryption key, the root encryption key and the root There is a one-to-one correspondence between the decryption keys.

Images