WO2022237600A1

WO2022237600A1 - Information proxy method and apparatus

Info

Publication number: WO2022237600A1
Application number: PCT/CN2022/090578
Authority: WO
Inventors: 刘佳伟; 林立; 金戈; 沈陈侃; 邱俊凯
Original assignee: 支付宝(杭州)信息技术有限公司; 蚂蚁区块链科技(上海)有限公司
Priority date: 2021-05-11
Filing date: 2022-04-29
Publication date: 2022-11-17
Also published as: CN113315758B; CN113315758A

Abstract

The present description provides an information proxy method and apparatus, applied to an information proxy service platform, comprising: receiving first encrypted information and an authorization key sent by a computing device of an information sender, wherein the first encrypted information is target information ciphertext obtained by encrypting target information plaintext on the basis of a first public key of the information sender, and the authorization key is generated on the basis of a first private key corresponding to the first public key and a second public key of a communication operator; and performing a cryptographic operation on the authorization key and the first encrypted information to generate second encrypted information, which is target information ciphertext obtained by encrypting plaintext data of the target information on the basis of the second public key corresponding to the communication operator, so that a service system of the communication operator decrypts the second encrypted information on the basis of a second private key corresponding to the second public key to obtain the target information plaintext, and further sends the target information plaintext to an information receiver.

Description

Information agent method and device

technical field

One or more implementations in this specification relate to the field of network communications, and in particular, to an information agent method and device.

Background technique

In the information agency business, the information agency service platform forwards the information sent by the information sender to the service system of the information operator designated by the information sender, and then the information operator sends the above information to the information receiver. In the above-mentioned communication methods, the content of the information sent by the information sender may be known by the information agent, thus causing information security issues.

Contents of the invention

In view of this, one or more embodiments of this specification provide an information agent method, which is applied to an information agent service platform, wherein the information agent service platform is separated from the computing device of the information sender and the service system of the communication operator Communication connection; the method includes: receiving the first encrypted information and the authorization key sent by the computing device of the information sender, wherein the first encrypted information is the plaintext of the target information based on the first public key of the information sender Encrypted target information ciphertext; the authorization key is generated based on a cryptographic operation based on the first private key corresponding to the first public key and the second public key of the communication operator; for the authorization key key and the first encrypted information to perform cryptographic operations to generate second encrypted information corresponding to the first encrypted information; wherein the second encrypted information is based on the second public key pair corresponding to the communication operator The ciphertext of the target information obtained by encrypting the plaintext data of the target information; sending the second encrypted information to the service system of the communication operator, so that the service system of the communication operator is based on the second The second private key corresponding to the public key decrypts the second encrypted information, obtains the plaintext of the target information, and further sends the plaintext of the target information to an information receiver designated by the information sender.

In yet another illustrated embodiment, a smart contract for performing cryptographic operations is deployed in the block chain network corresponding to the information agency service platform; Mathematical operation, generating the second encrypted information corresponding to the first encrypted information, including: calling the cryptographic operation logic contained in the contract code of the smart contract, and encrypting the authorization key and the first encrypted information generate the second encrypted information corresponding to the first encrypted information, and store the generated second encrypted information in the blockchain; the sending the second encrypted information to the The service system of the communication operator includes: acquiring the second encrypted information stored in the block chain, and further sending the encrypted information to the service system of the communication operator.

In yet another illustrated embodiment, the receiving the first encrypted information and the authorization key sent by the computing device of the information sender includes: receiving the first encrypted information and the authorization key respectively sent by the computing device of the information sender key.

In yet another illustrated embodiment, the first encrypted information and the authorization key sent by the computing device of the information sender are digitally signed based on the private key of the information sender; Before performing cryptographic operations on the authorization key and the first encrypted information, the method further includes: verifying the authorization key and the digital signature of the first encrypted information based on the private key of the information sender ; If the verification is passed, further perform the step of performing a cryptographic operation on the authorization key and the first encrypted information.

In yet another illustrated embodiment, the service system of the communication operator includes the computing device of the communication channel party connected to the information agency service platform, and the core equipment of the above-mentioned communication operator; the communication operator's The second public key includes the public key corresponding to the communication channel party; the further sending the plaintext data of the target information to the information receiver designated by the information sender includes: the computing device of the communication channel party sending the plain text data of the target information to the core equipment of the communication operator, so that the core equipment of the communication operator further sends the target information in plain text to the information receiver designated by the information sender .

In yet another illustrated embodiment, performing cryptographic operations on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information includes: In the trusted execution environment carried by the information agent service platform, cryptographic operations are performed on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information; The cryptographic operation logic contained in the contract code of the smart contract in the trusted execution environment carried by the node device in the blockchain performs cryptographic operations on the authorization key and the first encrypted information to generate Second encrypted information corresponding to the first encrypted information.

In yet another illustrated embodiment, the performing cryptographic operations on the basis of the first private key corresponding to the first public key and the second public key of the communication operator to generate the authorization key includes: Based on a proxy re-encryption algorithm, cryptographic operations are performed on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information.

In yet another illustrated embodiment, the target information includes SMS short messages.

Correspondingly, this specification also provides an information agent device, which is applied to an information agent service platform, wherein, the information agent service platform communicates with the computing device of the information sender and the service system of the communication operator respectively; the device It includes: a receiving unit, which receives the first encrypted information and the authorization key sent by the computing device of the information sender, wherein the first encrypted information is obtained by encrypting the plaintext of the target information based on the first public key of the information sender The target information ciphertext; the authorization key is generated based on the first private key corresponding to the first public key and the second public key of the communication operator through cryptographic operations; the calculation unit, for the authorization key key and the first encrypted information to perform cryptographic operations to generate second encrypted information corresponding to the first encrypted information; wherein the second encrypted information is based on the second public key pair corresponding to the communication operator The ciphertext of the target information obtained by encrypting the plaintext data of the target information; the sending unit, sending the second encrypted information to the service system of the communication operator, so that the service system of the communication operator is based on the The second private key corresponding to the second public key decrypts the second encrypted information, obtains the plaintext of the target information, and further sends the plaintext of the target information to the information receiver designated by the information sender.

In yet another illustrated embodiment, a smart contract for performing cryptographic operations is deployed in the block chain network corresponding to the information agency service platform; the computing unit is further used to: call the smart contract The cryptographic operation logic contained in the contract code performs cryptographic operations on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information, and the generated second encrypted information The encrypted information is stored in the block chain; the sending unit is further configured to: obtain the second encrypted information stored in the block chain, and further send the encrypted information to the communication operator's service system.

In yet another illustrated embodiment, the first encrypted information and the authorization key sent by the computing device of the information sender are digitally signed based on the private key of the information sender; The device also includes a verification unit, before performing cryptographic operations on the authorization key and the first encrypted information, digitally signing the authorization key and the first encrypted information based on the private key of the information sender Perform verification; if the verification is passed, further perform the step of performing cryptographic operations on the authorization key and the first encrypted information.

In yet another illustrated embodiment, the computing unit is further configured to: perform cryptographic operations on the authorization key and the first encrypted information based on a proxy re-encryption algorithm to generate The second encrypted information corresponding to the information.

Correspondingly, this specification also provides a computer device, including: a memory and a processor; a computer program that can be run by the processor is stored in the memory; when the processor runs the computer program, it executes the The information agent method executed by the information agent service platform.

Based on the information agent method, device, computer equipment, and computer-readable storage medium provided by each embodiment of this specification, the information agent service platform can, under the condition of not knowing the plaintext of the target information, perform a pair of public key based on the first public key of the information sender Encrypt the ciphertext of the target information obtained by encrypting the plaintext of the target information, and the authorization key generated by cryptographic operations based on the first private key corresponding to the first public key and the second public key of the communication operator, and encrypt Mathematical calculations to generate the target information ciphertext obtained by encrypting the plaintext data of the target information based on the second public key corresponding to the communication operator, so that the communication operator can decrypt the second encrypted information to obtain the plaintext of the target information, effectively preventing reduce the risk of user information leakage.

Description of drawings

Fig. 1a, Fig. 1b, and Fig. 1c are respectively schematic diagrams of the application environment of the information agent method provided by an exemplary embodiment.

Fig. 2 is a schematic diagram of creating and invoking smart contracts in the blockchain provided by an exemplary embodiment.

Fig. 3 is a flowchart of an information brokering method applied to a computing device of an information sender, a platform system of an information broker and a service system of a communication operator provided by an exemplary embodiment.

Fig. 4 is a schematic diagram of an information agent device applied to an information agent service platform provided by an exemplary embodiment.

FIG. 5 is a hardware structural diagram for running the implementation of the information agent device provided in this specification.

Detailed ways

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, the same numerals in different drawings refer to the same or similar elements unless otherwise indicated. The implementations described in the following exemplary implementations do not represent all implementations consistent with one or more implementations in this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more implementations of the present specification as recited in the appended claims.

It should be noted that in other implementation manners, the steps of the corresponding methods may not necessarily be performed in the order shown and described in this specification. In some other embodiments, the method may include more or fewer steps than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; multiple steps described in this specification may also be combined into a single step in other embodiments describe.

The communication operator service system may include a computer system that provides services for direct communication between users, for example, a computer system carried by communication service operators such as China Telecom, China Mobile, and China Unicom. A large number of commercial users often need to request the service system of the communication operator to send a large amount of notification information, such as commercial promotion information, business verification code information, etc., to its customer groups. In order to meet the different information requirements of a large number of commercial clients, an information agency service platform can be set up to integrate the information requirements of different commercial clients, and to reserve the amount of information from the communication operator at a lower communication rate; and compared In order to set up the communication coupling relationship with a large number of commercial users, the communication service operator can only set up the communication coupling relationship with the information agency service platform to process the information requests of different business users, and also reduce the communication service operation cost. communication connection cost of the provider.

In a communication environment including the computing device of the information sender, the information agency service platform, and the service system of the communication operator, the information agency service platform forwards the information sent by the information sender to the information operator service system, and then the information operator forwards the information sent by the information operator to the service system of the information operator. The above information is sent to the recipient of the information. In the above-mentioned communication methods, the content of the information sent by the information sender may be known by the information agent, thus causing information security issues.

In view of this, one or more embodiments of this specification provide an information proxy method, which provides information proxy services for the information sender under the condition that the information proxy service platform does not know the plain text of the target information provided by the information sender. Fig. 1a, Fig. 1b and Fig. 1c respectively illustrate the schematic diagrams of the application environment of the information agent method implemented in an exemplary embodiment provided in this specification. The information agent service platform communicates with the computing device of the information sender and the service system of the communication operator respectively. As an intermediary platform, the information agency service platform provides information agency services for the above-mentioned information senders and communication operators.

The above-mentioned information agent platform may include one or more service devices, and deploy cryptographic operation logic in the above-mentioned one or more service devices to provide information agent services for the computing device of the sender and the service system of the communication operator (as shown in Fig. 1a)); in yet another illustrated embodiment, the above-mentioned information agent service platform can be docked with the block chain network (as shown in Figure 1b), or, the above-mentioned information agent service platform is deployed as a decentralized Blockchain (as shown in Figure 1c), and deploy cryptographic operation logic in the form of smart contracts in the blockchain network to provide information agency services for the sender's computing device and the communication operator's service system.

The block chain or block chain network described in one or more embodiments of this specification can specifically refer to a P2P network system with a distributed data storage structure achieved by each node device through a consensus mechanism. The ledger data is distributed in "blocks" that are connected in time. The latter block can contain the data summary of the previous block, and according to the specific consensus mechanism (such as POW, POS, DPOS or PBFT, etc.) ) to achieve full data backup of all or part of the nodes.

Each blockchain node can be implemented in a server or server cluster. Server clusters can be load balanced. Each blockchain node may correspond to one or more physical hardware devices or virtual devices coupled together via various types of communication methods such as TCP/IP. According to classification, blockchain nodes can also be called full nodes, Geth nodes, consensus nodes, etc.

In some embodiments, the blockchain may also include light nodes. Light nodes may not be able to download the full blockchain, but can only download block headers to verify the authenticity of blockchain transactions. Light nodes can be served by full nodes (e.g., blockchain nodes in a blockchain network) and effectively rely on full nodes to access more functionality of the blockchain. Light nodes can be implemented in electronic devices such as laptops, mobile phones, etc. by installing appropriate software.

Blockchains are generally divided into three types: Public Blockchain, Private Blockchain and Consortium Blockchain. In addition, there can be a combination of the above types, such as private chain + alliance chain, alliance chain + public chain, etc. It can be expected that the implementations provided in this specification can be implemented in a suitable type of blockchain.

The computing device can construct the data into a standard transaction format supported by the blockchain, and then publish it to the blockchain, and the node devices in the blockchain will perform consensus processing on the received transaction, and after reaching a consensus , the node device as the bookkeeping node in the blockchain packs this transaction into a block, and performs persistent storage in the blockchain.

No matter which consensus algorithm the blockchain adopts, the accounting node can package the received transaction to generate the latest block, and send the generated latest block to other node devices for consensus verification. If other node devices receive the latest block and verify that there is no problem, the latest block can be appended to the end of the original blockchain to complete the accounting process of the blockchain. In the process of verifying the new block sent by the bookkeeping node, other nodes can also execute the transactions contained in the block.

It should be noted that every time the blockchain generates a newest block, after the transactions in the latest block are executed, the corresponding states of these executed transactions in the blockchain will change accordingly. For example, in a blockchain based on an account model, the account status of external accounts or smart contract accounts usually changes with the execution of transactions.

For example, when a "transfer transaction" in a block is executed, the balances of the transfer-out account and transfer-in account related to the "transfer transaction" (that is, the field value of the Balance field of these accounts) usually also Will change accordingly.

As another example, the "smart contract call transaction" in the block is used to call the smart contract deployed on the blockchain, and the above smart contract is called in the EVM corresponding to the node device to execute the above "smart contract call transaction", and the execution After the above-mentioned smart contract invokes the transaction, the account status of the smart contract account is updated in the account of the smart contract.

In practical applications, whether it is a public chain, a private chain or an alliance chain, it is possible to provide the function of a smart contract (Smart contract). Smart contracts on the blockchain are contracts that can be triggered by transactions on the blockchain. Smart contracts can be defined in the form of code.

For example, support users to create and call some complex logic in the blockchain network. As a programmable blockchain, its core is the Ethereum Virtual Machine (EVM), and each blockchain node can run the EVM. EVM is a Turing-complete virtual machine through which various complex logic can be realized. Users publish and call smart contracts in the blockchain that run on the EVM. In fact, EVM directly runs the virtual machine code (virtual machine bytecode, hereinafter referred to as "bytecode"), so the smart contract deployed on the blockchain can be bytecode.

The schematic diagram of creating a smart contract and calling a smart contract is shown in Figure 2. To create a smart contract in the blockchain, you need to go through the process of writing the smart contract, turning it into bytecode, and deploying it to the blockchain. Calling a smart contract in the blockchain is to initiate a transaction pointing to the address of the smart contract. The EVM of each node can execute the transaction separately, and the smart contract code is distributed and run in the virtual machine of each node in the Ethereum network.

After the user sends a transaction including calling smart contract information to the Ethereum network, each node can execute the transaction in the EVM. Among them, the From field of the transaction is used to record the address of the account that initiated the call to the smart contract, the To field is used to record the address of the called smart contract, and the Data field of the transaction is used to record the method and parameters of the called smart contract. After calling the smart contract, the account status of the contract account may change. Subsequently, a client can view the account status of the contract account through the connected blockchain node. For example, the above account status can be stored in the Storage tree of the smart contract in the form of Key-Value pairs. The execution result of the transaction calling the smart contract can be stored in the MPT receipt tree in the form of a transaction receipt (receipt).

Smart contracts can be independently executed on each node in the blockchain in a prescribed manner, and all execution records and data are stored on the blockchain, so when such a transaction is executed, it is stored on the blockchain and cannot be tampered with. , Transaction certificates that will not be lost.

The event mechanism of smart contracts is a way for smart contracts to interact with entities outside the chain. For smart contracts deployed on the blockchain, it is usually impossible to directly interact with entities outside the chain; for example, after the smart contract is called, it usually cannot send the call result of the smart contract point-to-point to the call initiator of the smart contract .

The call results (including intermediate results and final call results) generated during the call of the smart contract are usually recorded in the transaction logs of the transaction that called the smart contract in the form of events. Store in the storage space of the node device. An off-chain entity that needs to interact with a smart contract can obtain the invocation result of the smart contract by listening to the above-mentioned transaction log stored in the storage space of the node device; for example, the transaction log will eventually serve as the Part of the receipt for that transaction is stored in the MPT receipt tree described above. The off-chain entity that interacts with the smart contract can monitor the transaction receipts on the MPT receipt tree stored in the storage space of the node device, and obtain the events generated by the smart contract from the monitored transaction receipts.

Fig. 3 shows a flow chart of an information proxy method provided by an exemplary embodiment, which may include: Step 302, the computing device of the information sender encrypts the plaintext of the target information based on its own first public key to generate a first encrypted information.

Step 304: The computing device of the information sender performs cryptographic operations based on the second public key of the communication operator used to send the plaintext of the target information and the second private key corresponding to the above-mentioned first public key, and generates a key for the target information. The authorization key of the communication operator mentioned above.

Since the information agency service platform may be connected to multiple communication operator service systems, the information sender can select one or more of the communication operator service systems to send the target information in plain text. This embodiment does not limit the specific manner in which the computing device of the information sender acquires the second public key of the communication operator. For example, the information agency service platform can provide multiple alternative communication operators for the information sender, and send the corresponding public keys of the above alternative communication operators to the computing device of the information sender; in response to the information sender Based on the user's selection operation, the information agency service platform can generate an authorization for the selected communication operator based on the second public key of the selected communication operator and its own second private key corresponding to the above-mentioned first public key. key.

Or, based on the offline commercial communication between the information sender and certain communication operators, these communication operators may transmit their own second public keys to the information sender.

Step 306, the computing device of the information sender sends the first encrypted information and the authorization key to the information agency service platform.

In yet another illustrated embodiment, in order to prevent the above-mentioned first encrypted information and authorization key from being illegally intercepted at the same time, causing data security risks, the computing device of the information sender may send the above-mentioned first encrypted information and authorization key respectively.

Step 308, the information agency service platform performs cryptographic operations on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information; wherein, the second encrypted information is based on The target information ciphertext obtained by encrypting the target information plaintext with the second public key of the communication operator.

In an illustrated embodiment, the information proxy service platform can use a proxy re-encryption algorithm to perform cryptographic operations on the authorization key and the first encrypted information, thereby generating a second public key based on the communication operator. The target information ciphertext that encrypts the target information plaintext with the key—the second encrypted information.

Step 310, the information agency service platform sends the second encrypted information to the service system of the communication operator.

Step 312, the service system of the communication operator decrypts the second encrypted information based on the second private key corresponding to the second public key, obtains the plaintext of the target information, and further sends the plaintext of the target information to The information receiver corresponding to the target information in clear text.

Based on the information agency method described in steps 302 to 312 above, under the premise that the information agency service platform does not know the target information plaintext of the information sender, the plaintext of the target information is converted into second encrypted information that can be decrypted by the communication operator, so as to be obtained by After decrypting the second encrypted information, the service system of the communication operator sends the above-mentioned target information to the corresponding user in plain text; thus, the communication operator does not need to meet the different information needs of a large number of information senders, but only needs to connect with the information agency service platform for data processing. Communication processing reduces communication connection costs for communication service operators.

Based on the different specific structures of the above-mentioned information agency service platforms, the specific ways in which the above-mentioned information agency service platforms perform cryptographic operations and the above-mentioned communication operators obtain the above-mentioned second encrypted information are also different.

In an illustrated embodiment, when the above-mentioned information agent service platform is set as a centralized service device (as shown in Figure 1a), the above-mentioned information agent service platform can call the cryptographic operation logic deployed locally, and for the above-mentioned authorization key The encryption key and the above-mentioned first encrypted information are subjected to a cryptographic operation to generate second encrypted information corresponding to the first encrypted information. At this time, the information agency service platform communicates end-to-end with the service system of the information operator to send the second encrypted information to the service system of the information operator.

The above-mentioned information agency service platform can carry a trusted execution environment (TEE), and perform cryptographic operations on the authorization key and the first encrypted information in the carried trusted execution environment, and generate a key corresponding to the first encrypted information. The second encrypted information, thereby further increasing the security of the above cryptographic operation process and results.

In yet another illustrated embodiment, when the above-mentioned information agency service platform is connected to the blockchain network (as shown in Figure 1b or Figure 1c), smart contracts for cryptographic operations can be deployed in the above-mentioned blockchain network . After receiving the first encrypted information and the authorization key sent by the computing device of the information sender, the above-mentioned information agency service platform performs cryptographic operations on the authorization key and the first encrypted information to generate an encryption key corresponding to the first encrypted information. The specific process of the second encrypted information corresponding to the encrypted information may include: calling the cryptographic operation logic contained in the contract code of the smart contract, performing cryptographic operations on the authorization key and the first encrypted information, and generating the same The first encrypted information corresponds to the second encrypted information, and the generated second encrypted information is stored in the block chain.

The sending the second encrypted information to the service system of the communication operator includes: obtaining the second encrypted information stored in the block chain, and further sending the second encrypted information to the The service system of the communication operator.

Similarly, the blockchain node device can also be equipped with a trusted execution environment (TEE), calling the cryptographic operations contained in the contract code of the smart contract in the trusted execution environment carried by the node device in the blockchain The logic is to perform a cryptographic operation on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information.

The above-mentioned information agency service platform can construct a smart contract invocation transaction based on the above-mentioned first encrypted information and the authorization key, or, the above-mentioned information sender directly constructs a smart contract invocation transaction based on the above-mentioned first encrypted information and the above-mentioned authorization key, and will The above-mentioned smart contract calling transaction is sent to its corresponding blockchain network, so that the node device of the blockchain network responds to the above-mentioned calling transaction, calling the cryptographic operation logic declared by the above-mentioned smart contract, based on the authorization key and the Cryptographic operations are performed on the first encrypted information to generate and store second encrypted information corresponding to the first encrypted information in the block chain. The above-mentioned second encrypted information can be saved in the form of an event (Event) in the transaction log corresponding to the smart contract call transaction, so that the above-mentioned information agent service platform can obtain the above-mentioned smart contract from the block chain connected to it The execution result of the call transaction - the above-mentioned second encrypted information.

It is worth noting that some blockchain networks can be set as BaaS (Block chain as a service) terminals that provide services to blockchain users. Therefore, in an illustrated embodiment, the above-mentioned information agency service platform and Blockchain network docking may include communication coupling between the information agency service platform and the above-mentioned BaaS terminal; the above-mentioned information agency service platform can subscribe to the execution result of the above-mentioned smart contract call transaction on the above-mentioned BaaS terminal, so as to obtain the above-mentioned second encryption from the above-mentioned BaaS terminal. information. Some blockchain networks may not have a BaaS terminal, and the node devices of the blockchain deploy corresponding service (such as blockchain event subscription service, blockchain data transmission, query service, etc.) logic to provide users with block Chain service, therefore, in yet another illustrated embodiment, the information agent service platform docking with the block chain network may include the above information agent service platform docking with any node device in the block chain network, the above The information agent service platform can subscribe to the execution result of the smart contract call transaction at the node device connected to it, so as to obtain the second encrypted information from the node device connected to it.

After obtaining the second encrypted information, the above-mentioned information agency service platform may send the above-mentioned second encrypted information to the service system of the above-mentioned information operator in the manner of end-to-end communication. Since the above-mentioned second encrypted information is the call execution result of the smart contract deployed on the blockchain, the node devices of the blockchain decentralizedly perform cryptographic operations based on the above-mentioned first encrypted information and the authorization key to generate the second encrypted information , based on the anti-tampering mechanism of the blockchain and the decentralized operation mechanism of the smart contract, the data security of the first encrypted information and the authorization key is ensured, thereby further improving the security and credibility of the above-mentioned second encrypted information sex.

When the above-mentioned information agency service platform is deployed as a blockchain network in a decentralized manner, that is, the above-mentioned information agency service platform includes multiple node devices in the blockchain network, or the above-mentioned information agency service platform is used as a blockchain network A node device in the chain network. Smart contracts for encryption operations can be deployed in the above-mentioned blockchain network. At this time, the computing equipment of the above-mentioned information sender and the service system of the communication operator are all connected to the above-mentioned blockchain network. The computing device of the above-mentioned information sender can construct a smart contract call transaction based on the above-mentioned first encrypted information and the authorization key, and send the above-mentioned smart contract call transaction to the block chain network connected to it, so that the block chain network In response to the above call transaction, the node device invokes the cryptographic operation logic declared by the above smart contract, and performs cryptographic operations based on the authorization key and the first encrypted information to obtain the second encrypted information corresponding to the first encrypted information. encrypted information. The above-mentioned second encrypted information can be saved in the transaction log corresponding to the smart contract call transaction in the form of an event, and the node of the block chain that is connected with the service equipment of the above-mentioned communication operator to be specified by the above-mentioned communication operator The device can be equipped with an SDK program to push the blockchain events subscribed by the above-mentioned communication operator to the service equipment of the above-mentioned communication operator, so that the service system of the above-mentioned communication operator can receive information from the above-mentioned blockchain connected to it. Obtain the execution result of the above-mentioned smart contract call transaction - the above-mentioned second encrypted information.

In this embodiment, the computing device of the information sender directly sends the above-mentioned first encrypted information and authorization key to the block chain in the form of parameters contained in the smart contract call transaction. After obtaining the above-mentioned first encrypted information and authorization key, the proxy service platform sends the smart contract call transaction to the blockchain network, which further improves the credibility of the above-mentioned first encrypted information and authorization key. Moreover, the service system of the communication operator directly obtains the above-mentioned second encrypted information from the blockchain network connected to it. The second encrypted information is sent to the service system of the above-mentioned communication operator by means of end-to-end communication, which further improves the security and credibility of the second encrypted information.

It is worth noting that, in one or more of the above-mentioned implementation manners, in order to further determine whether the identity of the information sender is legitimate, the first encrypted information and the authorization Key, based on the private key of the information sender, the digital signature processing is carried out; before the above-mentioned information agency service platform performs cryptographic operations on the authorization key and the first encrypted information, the method also includes: based on the Verify the authorization key and the digital signature of the first encrypted information with the private key of the information sender; if the verification is passed, further perform cryptographic operations on the authorization key and the first encrypted information step.

In addition, in actual business applications, in the face of a large number of mobile short message (SMS short message) services, in order to reduce the decryption calculation pressure of the service system of the information operator, the service system of the communication operator, in addition to the communication The core equipment of the operator also includes at least one computing device of the communication channel party connected to the information agency service platform; the second public key of the communication operator includes the public key corresponding to the communication channel party.

At this time, the process of decrypting the second encrypted information by the service system of the communication operator based on the second private key corresponding to the second public key is actually performed by the computing device of the communication channel party based on the second private key corresponding to the second public key. The second private key corresponding to the public key decrypts the second encrypted information, and obtains the plaintext of the above target information.

The further sending of the plaintext data of the target information to the information receiver designated by the information sender in step 312 above includes: the computing device of the communication channel party sends the plaintext data of the target information to the communication The core device of the operator, so that the core device of the communication operator further sends the target information in plain text to the information receiver designated by the information sender.

In this embodiment, in order to facilitate the communication operator's service system to distinguish which channel party's computing device included in the communication operator's service system should decrypt the second encrypted information, the above-mentioned information sender can use the selected The second public key corresponding to the target channel party is sent to the information agency service platform, so that the information agency service platform forwards it to the computing device of the target channel party corresponding to the second public key based on the second public key, so as to facilitate the above-mentioned communication The computing device of the target channel party corresponding to the second public key in the service system of the operator decrypts the second encrypted information based on the second private key held by itself.

Through the information proxy method described in one or more of the above implementations, the information proxy service platform can, under the condition that the plaintext of the target information is unknown, perform the first message containing the plaintext of the target information encrypted by the first public key The encrypted information is encrypted to generate the second encrypted information including the plaintext of the target information encrypted by the second public key of the communication operator, so that the communication operator can decrypt the second encrypted information to obtain the plaintext of the target information, effectively preventing the user from Risk of Information Leakage.

Corresponding to the realization of the above process, the embodiment of this specification also provides an information agent device 40 . The device 40 may be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in the logical sense, it is formed by reading the corresponding computer program instructions into the memory through the CPU (Central Process Unit, central processing unit) of the device where it is located. From the perspective of hardware, in addition to the CPU, internal memory, and storage shown in Figure 5, the equipment where the above-mentioned device is located usually includes other hardware such as chips for wireless signal transmission and reception, and/or a network for implementing network communication functions. boards and other hardware.

As shown in FIG. 4 , this specification provides an information agent device 40, which is applied to an information agent service platform, wherein the information agent service platform communicates with the computing device of the information sender and the service system of the communication operator, respectively; The apparatus 40 includes: a receiving unit 402, which receives the first encrypted information and the authorization key sent by the computing device of the information sender, wherein the first encrypted information is based on the first public key pair of the information sender. The target information ciphertext obtained by encrypting the information plaintext; the authorization key is generated based on the first private key corresponding to the first public key and the second public key of the communication operator by performing cryptographic operations; the calculation unit 404 , performing cryptographic operations on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information; wherein, the second encrypted information is based on the communication operator corresponding The target information ciphertext obtained by encrypting the plaintext data of the target information with the second public key of the target information; the sending unit 406 sends the second encrypted information to the service system of the communication operator, so that the communication operator The party's service system decrypts the second encrypted information based on the second private key corresponding to the second public key, obtains the plaintext of the target information, and further sends the plaintext of the target information to the recipient of the information.

In yet another illustrated embodiment, a smart contract for performing cryptographic operations is deployed in the block chain network corresponding to the information agency service platform; the computing unit 404 is further configured to: call the smart contract The cryptographic operation logic included in the contract code performs cryptographic operations on the authorization key and the first encrypted information to generate the second encrypted information corresponding to the first encrypted information, and the generated first encrypted information The second encrypted information is stored in the block chain; the sending unit 406 is further configured to: obtain the second encrypted information stored in the block chain, and further send the encrypted information to the communication operator square service system.

In yet another illustrated implementation manner, the receiving unit 402 is further configured to: receive the first encrypted information and the authorization key respectively sent by the computing device of the information sender.

In yet another illustrated embodiment, the first encrypted information and the authorization key sent by the computing device of the information sender are digitally signed based on the private key of the information sender; The device 40 further includes a verification unit 408, which performs a verification of the authorization key and the first encrypted information based on the private key of the information sender before performing cryptographic operations on the authorized key and the first encrypted information. The digital signature is verified; if the verification is passed, the calculation unit 404 further executes the step of performing a cryptographic operation on the authorization key and the first encrypted information.

In yet another illustrated embodiment, the calculation unit 404 is further configured to: perform encryption on the authorization key and the first encrypted information in the trusted execution environment carried by the information agent service platform. generate the second encrypted information corresponding to the first encrypted information; or call the cryptographic operation contained in the contract code of the smart contract in the trusted execution environment carried by the node device running in the blockchain The logic is to perform a cryptographic operation on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information.

In yet another illustrated embodiment, the calculation unit 404 is further configured to: based on a proxy re-encryption algorithm, perform cryptographic operations on the authorization key and the first encrypted information to generate an Second encrypted information corresponding to the encrypted information.

For the implementation process of the functions and effects of each unit in the above-mentioned device 40, please refer to the implementation process of the corresponding steps in the information agency method executed by the above-mentioned information agency service platform for details. No longer.

The device implementations described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical modules, that is, they may be located in One place, or it can be distributed to multiple network modules. Part or all of the units or modules can be selected according to actual needs to achieve the purpose of the solution in this specification. It can be understood and implemented by those skilled in the art without creative effort.

The devices, units, and modules described in the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementing device is a computer, which may take the form of a personal computer, laptop computer, cellular phone, camera phone, smart phone, personal digital assistant, media player, navigation device, e-mail device, game control device, etc. desktops, tablets, wearables, or any combination of these.

Corresponding to the above method implementation, the implementation of this specification further provides a computer device, as shown in FIG. 5 , the computer device includes a memory and a processor. Wherein, a computer program that can be run by the processor is stored in the memory; when the processor runs the stored computer program, it executes each step of the information agency method described in the information agency service platform in the implementation mode of this specification. For the detailed description of each step of the information proxy method executed by the above information proxy service platform, please refer to the previous content, and will not be repeated here.

The above is only the preferred implementation mode of this specification, and is not intended to limit this specification. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this specification shall be included in this specification. within the scope of protection.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in computer-readable media, in the form of random access memory (RAM) and/or nonvolatile memory such as read-only memory (ROM) or flash RAM. Memory is an example of computer readable media.

Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can be implemented by any method or technology for storage of information. Information may be computer readable instructions, data structures, modules of a program, or other data.

Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic tape cartridge, tape magnetic disk storage or other magnetic storage device or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media excludes transitory computer-readable media, such as modulated data signals and carrier waves.

It should also be noted that the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes Other elements not expressly listed, or elements inherent in the process, method, commodity, or apparatus are also included. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

Those skilled in the art should understand that the embodiments of this specification may be provided as methods, systems or computer program products. Accordingly, the embodiments of the present description may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present specification may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein. .

Claims

An information agency method, applied to an information agency service platform, wherein the information agency service platform communicates with a computing device of an information sender and a service system of a communication operator, respectively; the method includes:

receiving the first encrypted information and the authorization key sent by the computing device of the information sender, wherein the first encrypted information is the ciphertext of the target information obtained by encrypting the plaintext of the target information based on the first public key of the information sender ; The authorization key is generated by cryptographic operations based on the first private key corresponding to the first public key and the second public key of the communication operator;

Perform cryptographic operations on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information; wherein the second encrypted information is based on the information corresponding to the communication operator The target information ciphertext obtained by encrypting the plaintext data of the target information with the second public key; sending the second encrypted information to the service system of the communication operator, so that the service system of the communication operator is based on The second private key corresponding to the second public key decrypts the second encrypted information, obtains the plaintext of the target information, and further sends the plaintext of the target information to an information receiver designated by the information sender.
According to the method according to claim 1, a smart contract for performing cryptographic operations is deployed in the block chain network corresponding to the information agency service platform; cryptographic operations are performed for the authorization key and the first encrypted information Operation, generating second encrypted information corresponding to the first encrypted information, including:

calling the cryptographic operation logic contained in the contract code of the smart contract, performing cryptographic operations on the authorization key and the first encrypted information, generating second encrypted information corresponding to the first encrypted information, and The generated second encrypted information is stored in the block chain;

The sending the second encrypted information to the service system of the communication operator includes:

The second encrypted information stored in the block chain is obtained, and the encrypted information is further sent to the service system of the communication operator.
According to the method according to claim 1 or 2, said receiving the first encrypted information and authorization key sent by the computing device of the information sender includes:

The first encrypted information and the authorization key respectively sent by the computing device of the information sender are received.
According to the method according to claim 1, the first encrypted information and the authorization key sent by the computing device of the information sender are digitally signed based on the private key of the information sender;

Before performing cryptographic operations on the authorization key and the first encrypted information, the method further includes:

Verify the authorization key and the digital signature of the first encrypted information based on the private key of the information sender; if the verification is passed, further perform cryptography on the authorization key and the first encrypted information operation steps.
According to the method according to claim 1, the service system of the communication operator includes the computing device of the communication channel party connected to the information agency service platform, and the core equipment of the above-mentioned communication operator; the second communication operator of the communication operator The second public key includes the public key corresponding to the communication channel party;

The further sending the plaintext data of the target information to the information receiver designated by the information sender includes:

The computing device of the communication channel party sends the plain text data of the target information to the core device of the communication operator, so that the core device of the communication operator further sends the target information in plain text to the core device of the communication operator. The receiver of the message specified by the sender of the message.
According to the method according to claim 2, performing cryptographic operations on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information includes:

In the trusted execution environment carried by the information agency service platform, cryptographic operations are performed on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information;

Or, call the cryptographic operation logic included in the contract code of the smart contract in the trusted execution environment carried by the node device in the blockchain, and perform cryptographic operations on the authorization key and the first encrypted information. operation to generate second encrypted information corresponding to the first encrypted information.
The method according to claim 1, said performing cryptographic operations on the basis of the first private key corresponding to the first public key and the second public key of the communication operator to generate the authorization key, comprising:

Based on a proxy re-encryption algorithm, cryptographic operations are performed on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information.
The method according to claim 1, said target information comprises SMS short messages.
An information agent device, applied to an information agent service platform, wherein the information agent service platform communicates with a computing device of an information sender and a service system of a communication operator respectively; the device includes:

The receiving unit is configured to receive the first encrypted information and the authorization key sent by the computing device of the information sender, wherein the first encrypted information is the target information obtained by encrypting the plaintext of the target information based on the first public key of the information sender. Information ciphertext; the authorization key is generated based on a cryptographic operation based on the first private key corresponding to the first public key and the second public key of the communication operator;

A computing unit, performing cryptographic operations on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information; wherein the second encrypted information is based on the communication operation The target information ciphertext obtained by encrypting the plaintext data of the target information with the second public key corresponding to the party;

a sending unit, configured to send the second encrypted information to the service system of the communication operator, so that the service system of the communication operator can decrypt the second encrypted information based on the second private key corresponding to the second public key; Encrypting information to obtain the plaintext of the target information, and further sending the plaintext of the target information to an information receiver designated by the information sender.
According to the device according to claim 9, smart contracts for performing cryptographic operations are deployed in the block chain network corresponding to the information agency service platform;

The calculation unit is further used for:

calling the cryptographic operation logic contained in the contract code of the smart contract, performing cryptographic operations on the authorization key and the first encrypted information, generating second encrypted information corresponding to the first encrypted information, and The generated second encrypted information is stored in the block chain;

The sending unit is further used for:

The second encrypted information stored in the block chain is obtained, and the encrypted information is further sent to the service system of the communication operator.
The apparatus according to claim 9, said receiving the first encrypted information and the authorization key sent by the computing device of the information sender, comprising:

The first encrypted information and the authorization key respectively sent by the computing device of the information sender are received.
The apparatus according to claim 9, the first encrypted information and the authorization key sent by the computing device of the information sender are digitally signed based on the private key of the information sender;

The device further includes a verification unit, before performing cryptographic operations on the authorization key and the first encrypted information, based on the private key of the information sender, verifying the identity of the authorization key and the first encrypted information The digital signature is verified; if the verification is passed, the step of performing a cryptographic operation on the authorization key and the first encrypted information is further performed.
According to the device according to claim 9, the service system of the communication operator includes the computing equipment of the communication channel party connected to the information agency service platform, and the core equipment of the above-mentioned communication operator; the first communication operator of the communication operator The second public key includes the public key corresponding to the communication channel party;

The further sending the plaintext data of the target information to the information receiver designated by the information sender includes:

The computing device of the communication channel party sends the plain text data of the target information to the core device of the communication operator, so that the core device of the communication operator further sends the target information in plain text to the core device of the communication operator. The receiver of the message specified by the sender of the message.
According to the device according to claim 10, performing cryptographic operations on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information includes:

In the trusted execution environment carried by the information agency service platform, cryptographic operations are performed on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information;

Or, call the cryptographic operation logic included in the contract code of the smart contract in the trusted execution environment carried by the node device in the blockchain, and perform cryptographic operations on the authorization key and the first encrypted information. operation to generate second encrypted information corresponding to the first encrypted information.
The device according to claim 9, the computing unit is further configured to:

Based on a proxy re-encryption algorithm, cryptographic operations are performed on the authorization key and the first encrypted information to generate second encrypted information corresponding to the first encrypted information.
The apparatus according to claim 9, said target information comprising SMS short messages.
A computer device, comprising: a memory and a processor; a computer program that can be run by the processor is stored on the memory; when the processor runs the computer program, it executes the computer program described in any one of claims 1 to 8. described method.