WO2023141864A1 - 会议数据的传输方法、装置、系统、电子设备及可读介质 - Google Patents

会议数据的传输方法、装置、系统、电子设备及可读介质 Download PDF

Info

Publication number
WO2023141864A1
WO2023141864A1 PCT/CN2022/074249 CN2022074249W WO2023141864A1 WO 2023141864 A1 WO2023141864 A1 WO 2023141864A1 CN 2022074249 W CN2022074249 W CN 2022074249W WO 2023141864 A1 WO2023141864 A1 WO 2023141864A1
Authority
WO
WIPO (PCT)
Prior art keywords
conference
data
key
security
transmission device
Prior art date
Application number
PCT/CN2022/074249
Other languages
English (en)
French (fr)
Inventor
马希通
李涛
Original Assignee
京东方科技集团股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 京东方科技集团股份有限公司 filed Critical 京东方科技集团股份有限公司
Priority to CN202280000082.2A priority Critical patent/CN116830564A/zh
Priority to PCT/CN2022/074249 priority patent/WO2023141864A1/zh
Publication of WO2023141864A1 publication Critical patent/WO2023141864A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N7/00—Television systems
    • H04N7/14—Systems for two-way working
    • H04N7/15—Conference systems

Definitions

  • the disclosure belongs to the field of computer technology, and in particular relates to a conference data transmission method, device, system, electronic equipment and readable medium.
  • Participants in the online meeting can use mobile phones, computers and other terminal devices to access the network and communicate through network data transmission.
  • many software with chat function or online meeting function can be used to initiate online meeting.
  • the present disclosure aims to provide a conference data transmission method, device, system, electronic equipment and readable medium.
  • the first aspect of the present disclosure provides a conference data transmission method applied to a security enhancement module, which includes:
  • the acquisition of the meeting key corresponding to the first meeting data, and encrypting the first meeting data by using the meeting key to obtain the encrypted second Meeting data includes:
  • the second conference data is obtained according to the encrypted first conference data and the ciphertext key.
  • the conference key is calculated by the security enhancement module according to module information; or, the conference key is obtained by the security enhancement module according to the data type of the first conference data Sure.
  • the receiving the security key returned by the cloud platform in response to the key negotiation request sent by the conference transmission device includes:
  • the identity verification of the participating members includes:
  • the identification result is sent to the conference transmission device, so that the conference transmission device can verify the identity of the participating members according to the identification result.
  • the conference transmission device before receiving the identification data sent by the conference transmission device, it also includes: receiving and storing the security verification data from the host computer; wherein, the The above security verification data is in ciphertext form;
  • the matching of the identification data with the security verification data pre-stored in the security enhancement module includes:
  • the security verification data in cipher text form is decrypted by the verification key to obtain security verification data in plain text form; and the identification data is matched with the security verification data in plain text form.
  • the identification data sent by the conference transmission device includes at least one of the following: device collection data used to identify the identity of the participants;
  • the security verification data includes: characteristic data of registered members and identification information of registered members;
  • the identification result corresponding to the identification data includes: identification information of the participants; wherein, the data collected by the device includes at least one of the following: face image data, iris image data, fingerprint data, And password data; the identification information includes: name, unique identifier, profile information.
  • auxiliary verification data to the platform certificate to obtain a module certificate, and send the module certificate to the conference transmission device, so that the conference transmission device can transfer the
  • the module certificate is provided to the cloud platform for device authentication; wherein, if the device authentication is passed, the identity verification of the participating members is performed.
  • the security enhancement module communicates with the conference transmission device through a preset application program interface; A software development kit for the module is provided.
  • the second aspect of the present disclosure provides a conference data transmission method, which is applied to a conference transmission device, including:
  • the meeting key is generated by the security enhancement module, and the second meeting data further includes: pairing the meeting key with the security key provided by the cloud platform The ciphertext key obtained after encryption.
  • the method before receiving the encrypted second conference data obtained after the security enhancement module encrypts the first conference data with the acquired conference key, the method further includes:
  • the security enhancement module with the security key from the cloud platform; wherein the security key is generated according to the device service type and/or device authentication type of the conference transmission device.
  • the providing the security enhancement module with the security key from the cloud platform includes:
  • the first key is decrypted to obtain the security key.
  • the security enhancement module before sending the unencrypted first meeting data to the security enhancement module, it further includes:
  • the identification result is matched with the personnel identity information contained in the participant configuration request received from the cloud platform, and the identity of the participant is verified according to the matching result.
  • the conference transmission device communicates with the cloud platform through a first communication protocol, and the conference transmission device communicates with the security enhancement module through a second communication protocol.
  • Communication wherein, the first communication protocol includes: MQTT protocol, and the second communication protocol includes: USB protocol.
  • a third aspect of the present disclosure provides a method for transmitting conference data, which is applied to a conference client, including:
  • the second conference data is obtained by encrypting the first conference data provided by the conference transmission device by the security enhancement module using a conference key;
  • the conference key is obtained, and the second conference data is decrypted by using the conference key to obtain unencrypted first conference data.
  • the obtaining the conference key includes:
  • the ciphertext key is obtained by encrypting the meeting key with a security key provided by the cloud platform;
  • the ciphertext key is decrypted by using the security key provided by the cloud platform to obtain the meeting key.
  • a fourth aspect of the present disclosure provides a conference data transmission device, which includes:
  • the receiving module is configured to receive the unencrypted first conference data sent by the conference transmission device when the identity verification of the participating members is passed;
  • An encryption module configured to obtain a conference key corresponding to the first conference data, and encrypt the first conference data with the conference key to obtain encrypted second conference data;
  • the sending module is configured to send the encrypted second conference data to the conference transmission device, so that the conference transmission device can provide the encrypted second conference data to the conference client through a cloud platform.
  • a fifth aspect of the present disclosure provides a conference data transmission device, which includes:
  • the first sending module is configured to send the unencrypted first meeting data to the security enhancement module when the identity verification of the participating members is passed;
  • the receiving module is configured to receive the encrypted second conference data obtained after the security enhancement module encrypts the first conference data with the acquired conference key;
  • the second sending module is configured to send the encrypted second conference data to a cloud platform, so that the cloud platform can provide the second conference data to a conference client.
  • a sixth aspect of the present disclosure provides a conference client, which includes:
  • the obtaining module is configured to obtain the encrypted second conference data from the conference transmission device from the cloud platform; wherein, the second conference data is provided by the security enhancement module to the conference transmission device for the first conference using a conference key Data encryption is obtained;
  • the decryption module is configured to obtain the conference key, and decrypt the second conference data by using the conference key to obtain unencrypted first conference data.
  • a seventh aspect of the present disclosure provides a conference transmission system, which includes:
  • the data transmission device of the fifth aspect the data transmission device of the sixth aspect, the conference client and the cloud platform of the seventh aspect.
  • the eighth aspect of the present disclosure provides an electronic device, including:
  • processors one or more processors
  • a memory on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any one of the above;
  • One or more I/O interfaces are connected between the processor and the memory, configured to realize information exchange between the processor and the memory.
  • a ninth aspect of the present disclosure provides a computer-readable medium on which a computer program is stored, and when the program is executed by a processor, the method described in any one of the above-mentioned methods is implemented.
  • FIG. 1 is a flowchart of a method for transmitting conference data applied to a security enhancement module provided by an embodiment of the present disclosure
  • FIG. 2 is a flowchart of a conference data transmission method applied to a conference transmission device provided by an embodiment of the present disclosure
  • FIG. 3 is a flowchart of a method for transmitting conference data applied to a conference client provided by an embodiment of the present disclosure
  • FIG. 4 is a flowchart of a device authentication process applied to a security enhancement module, a conference transmission device, and a cloud platform provided by an embodiment of the present disclosure
  • FIG. 5 shows a schematic diagram of a specific flow of identity verification and conference data transmission
  • FIG. 6 is a structural diagram of a conference transmission device provided by an embodiment of the present disclosure.
  • FIG. 7 is a structural diagram of a conference transmission device provided by another embodiment of the present disclosure.
  • FIG. 8 is a structural diagram of a conference client provided by an embodiment of the present disclosure.
  • FIG. 9 is a structural diagram of a conference transmission system provided by an embodiment of the present disclosure.
  • Fig. 10 is a functional block diagram of an electronic device provided by an embodiment of the present disclosure.
  • the embodiments of the present disclosure provide a conference data transmission method, which improves the reliability of conference data transmission through a security enhancement module, and avoids data leakage problems caused by attacks on conference transmission equipment.
  • the conference data transmission method provided by the embodiment of the present disclosure may be applied to a security enhancement module.
  • the security enhancement module can be connected with the conference transmission equipment through plugging, and the conference transmission equipment and the cloud platform communicate with each other.
  • the method includes:
  • Step S110 Receive unencrypted first conference data sent by the conference transmission device when the identity verification of the conference participants passes.
  • the execution subject of this embodiment may be a security enhancement module.
  • the security enhancement module is capable of communicating with conference transmission equipment.
  • the meeting In order to improve security and prevent unrelated people from intervening in the meeting, it is necessary to verify the identities of the participating members in advance, and when the identity verification is passed, the meeting will be started and the meeting data will be transmitted through the network.
  • the present disclosure does not limit the specific implementation manner of the identity verification, as long as the identities of the participating members are legal.
  • the conference transmission device obtains the unencrypted first conference data after the conference starts.
  • the unencrypted first meeting data is generated according to meeting content.
  • the conference transmission device sends the first conference data to the security enhancement module.
  • the security enhancement module receives the unencrypted first conference data sent by the conference transmission device.
  • Step S120 Obtain a meeting key corresponding to the first meeting data, encrypt the first meeting data with the meeting key, and obtain encrypted second meeting data.
  • the conference key can be obtained in various ways.
  • the meeting key can be obtained from the cloud platform in advance.
  • the conference key can also be generated by the security enhancement module and provided to the cloud platform.
  • the core of the present disclosure is that the meeting key is stored inside the security enhancement module, and cannot be obtained by an external meeting transmission device, thus improving security.
  • Step S130 Send the encrypted second conference data to the conference transmission device, so that the conference transmission device can provide the encrypted second conference data to the conference client through the cloud platform.
  • the security enhancement module sends the encrypted second conference data to the conference transmission device, so that the conference transmission device provides the second conference data to the cloud platform, and the cloud platform provides the conference client.
  • the conference data can be encrypted by the security enhancement module. Since the encryption and decryption processes are completed inside the security enhancement module, the security is improved and the risk of data leakage is avoided.
  • the conference data transmission method provided by the embodiment of the present disclosure can be applied to a conference transmission device.
  • the method includes:
  • Step S210 Send the unencrypted first meeting data to the security enhancement module if the identity verification of the meeting member is passed.
  • the executor of this embodiment may be a conference transmission device.
  • the conference transmission device obtains the unencrypted first conference data after the conference starts.
  • the unencrypted first meeting data is generated according to meeting content.
  • the conference transmission device sends the first conference data to the security enhancement module.
  • Step S220 Receive encrypted second conference data obtained by encrypting the first conference data with the obtained conference key by the security enhancement module.
  • Step S230 Send the encrypted second conference data to the cloud platform, so that the cloud platform can provide the second conference data to the conference client.
  • the cloud platform is used to provide the received second conference data to the conference client for downloading by the conference client.
  • This method improves the security of data transmission by means of the multi-terminal interaction process of the security enhancement module, conference transmission equipment, cloud platform and conference client.
  • the conference data transmission method provided by the embodiment of the present disclosure may be applied to a conference client.
  • the method includes:
  • Step S310 Obtain encrypted second conference data from the conference transmission device from the cloud platform; wherein, the second conference data is obtained by encrypting the first conference data provided by the conference transmission device by the security enhancement module with a conference key.
  • the execution subject of this embodiment may be a conference client.
  • the conference client can be various types of communication terminals such as mobile terminals and tablet computers.
  • the conference client can obtain the second conference data through various methods such as downloading an entry, sharing a two-dimensional code, etc., and the present disclosure does not limit the specific method of obtaining the second conference data.
  • Step S320 Obtain a conference key, and decrypt the second conference data by using the conference key to obtain unencrypted first conference data.
  • the conference key can be obtained in various ways, for example, it can be provided by the cloud platform.
  • the second conference data can be decrypted by using the conference key to obtain the original first conference data.
  • This method enables the conference client to directly download the second conference data in ciphertext form through the encryption and decryption processing of the security enhancement module, avoiding the risk of malicious interception or tampering during data transmission, and the conference client can Convert meeting data in ciphertext form to meeting data in plaintext form to realize sharing of meeting content.
  • the conference data transmission method provided by the embodiment of the present disclosure is used to realize data interaction between a cloud platform, a conference transmission device, a security enhancement module, and a conference client.
  • Figure 4 is intended to illustrate the authentication interaction process between multiple devices.
  • the conference transmission device is used to realize the acquisition of conference data and the cloud upload operation.
  • the conference transmission equipment is located in the conference venue, so that conference data such as conference images can be captured in real time.
  • the conference transmission equipment is an external equipment with many types and various sources. Therefore, it will undoubtedly take a lot of time and cost to check the security of each conference transmission equipment one by one, and it is easy to miss inspections and other problems. lead to safety hazards.
  • the conference transmission equipment has characteristics such as wide sources and difficult security investigation.
  • a security enhancement module is provided in order to realize the security verification of the conference transmission device conveniently, quickly, safely and efficiently.
  • the encryption and decryption process of sensitive data is realized through the security enhancement module, so as to ensure that the sensitive data is not leaked, and the communication security is improved in the scenario where the conference transmission equipment is untrustworthy.
  • the security enhancement module can communicate with the conference transmission equipment in various ways.
  • the security enhancement module can be connected with the conference transmission equipment in a wired or wireless manner.
  • the security enhancement module in order to increase the flexibility of setting the security enhancement module, is plugged with the conference transmission device in a pluggable manner to realize mutual communication.
  • the security enhancement module may be connected to the conference transmission device through a USB interface, or may also be connected through an internal data bus, such as PICE/LVDS/I2C/UART.
  • the security enhancement module can be inserted into the conference transmission device as a security chip (FPGA), so as to connect to the SOC (System on Chip, System on Chip) through the internal data bus, thereby communicating with the conference transmission device.
  • FPGA security chip
  • the present disclosure does not limit the specific access form of the security enhancement module, as long as the purpose of communicating with the conference transmission device flexibly and conveniently can be achieved.
  • the security enhancement module can replace the conference transmission equipment to implement data encryption and decryption, data verification, etc., thereby improving security.
  • device registration and device authentication operations are performed before the conference data is transmitted, and when the device authentication is passed, the participant's identities, and transmit meeting data when the identity verification of the participating members is passed.
  • the method includes the following processes:
  • Step S1 The conference transmission device sends a device registration request to the cloud platform.
  • the device registration request is used to register the relevant information of the conference transmission device on the cloud platform, and during the device registration process, the cloud platform not only needs to record the device information of the conference transmission device, but also needs to record the association with the conference transmission device Module information for the security-enhanced module of the relationship.
  • the legitimacy of the conference transmission device and the security enhancement module is verified to ensure the trusted access of the device.
  • the security enhancement module is assigned to the conference transmission device in advance, and correspondingly, the device registration request sent by the conference transmission device includes: module information of the security enhancement module and device information of the conference transmission device.
  • the module information of the security enhancement module is used to uniquely identify a security enhancement module, for example, may be an ID of the security enhancement module.
  • the device information of the conference transmission device is used to describe the device characteristics of the conference transmission device.
  • the device information includes: device service type and/or device authentication type.
  • the device service type is used to describe the service type of the conference transmission device (that is, the conference type, such as internal conference, external conference, etc.).
  • the device authentication type is used to describe the authentication method of the device, which can be set by the security level of the device. In this method, the conference transmission device sends a device registration request. Therefore, the corresponding relationship between the conference transmission device and the security enhancement module can be adjusted flexibly, which facilitates the flexible pairing between the security enhancement module and the conference transmission device, and has high flexibility.
  • the security enhancement module is not pre-assigned to the conference transmission device.
  • the cloud platform receives the device registration request, it allocates the corresponding security enhancement module to the conference transmission device.
  • the device registration request sent by the conference transmission device includes: the device information of the conference transmission device, but does not include the module information of the security enhancement module.
  • the security enhancement module is directly assigned by the cloud platform. Therefore, the corresponding relationship between the security enhancement module and the conference transmission equipment is set by the cloud platform, and cannot be changed at will later, so the security is high.
  • At least one of the above two methods can be flexibly selected according to the characteristics of a specific meeting.
  • Step S2 The cloud platform generates a platform certificate according to the received device registration request.
  • the cloud platform obtains the module information of the security enhancement module and the device information of the conference transmission device included in the device registration request, and generates a platform certificate according to the module information of the security enhancement module and the device information of the conference transmission device.
  • the platform certificate is generated according to the module information of the security enhancement module and the device information of the conference transmission device, the module information of the security enhancement module and the device information of the conference transmission device are further encrypted to obtain the platform certificate in ciphertext.
  • the cloud platform parses the device registration request, obtains the module information of the security enhancement module contained in it and the device information of the conference transmission device, and uses the platform certificate key (such as key A) to verify the security
  • the module information of the enhancement module and the equipment information of the conference transmission equipment are encrypted, and the platform certificate is obtained according to the encryption result.
  • the encryption operation may be a symmetric encryption operation.
  • an AES encryption algorithm may be used. It can be seen that the plaintext of the platform certificate includes the module information of the security enhancement module and the equipment information of the conference transmission equipment, and the security during transmission can be improved through encryption operations.
  • the cloud platform parses the device registration request, obtains the device information of the conference transmission device contained therein, and allocates a corresponding security enhancement module according to the type of the conference transmission device.
  • the platform certificate key (such as key A)
  • the security enhancement module is allocated by the cloud platform according to the device information in the device authentication request.
  • the cloud platform selects the corresponding The security enhancement module that matches the device type of the current device is assigned.
  • Step S3 The cloud platform provides the platform certificate to the security enhancement module.
  • the cloud platform may provide the platform certificate to the security enhancement module through the conference transmission device, or directly provide the platform certificate to the security enhancement module.
  • the security enhancement module receives and stores the platform certificate generated by the cloud platform in response to the device registration request.
  • the cloud platform sends the platform certificate to the conference transmission device, and the conference transmission device provides the platform certificate and the platform certificate key to the security enhancement module.
  • the cloud platform directly provides the platform certificate and the platform certificate key to the security enhancement module.
  • the platform certificate stored in the security enhancement module is added dynamically, so that different conference transmission devices can be dynamically adapted, and the flexibility is improved.
  • the platform certificate and platform certificate key can be directly burned in the security enhancement module, thereby further improving security.
  • the cloud platform needs to record the corresponding relationship between the module information of the security enhancement module and the device information of the conference transmission device, so as to further improve the security in the subsequent authentication process with the help of the corresponding relationship, and prevent the Security risks caused by malicious replacement of conference transmission equipment or security enhancement modules.
  • Step S4 The conference transmission device sends an authentication instruction to the security enhancement module.
  • the conference transmission device actively initiates a device authentication operation, so as to send an authentication instruction to the security enhancement module.
  • Step S5 In response to the authentication instruction, the security enhancement module adds auxiliary verification data to the platform certificate to obtain the module certificate.
  • the security enhancing module responds to the authentication instruction sent by the conference transmission device, adds auxiliary verification data to the stored platform certificate, and obtains the module certificate.
  • the auxiliary verification data includes various additional data that can realize the auxiliary verification function, such as time stamp data, device fingerprint data, and the like.
  • the platform certificate generated by the cloud platform is a platform certificate in ciphertext form.
  • the security enhancement module decrypts the platform certificate in ciphertext form according to the platform certificate key (such as key A) provided by the cloud platform to obtain the platform certificate in plaintext form.
  • the platform certificate key such as key A
  • the key of the platform certificate used for decryption is the same as the key of the platform certificate when encrypted by the cloud platform, so that decryption can be realized at a relatively fast speed.
  • it can also be implemented through asymmetric encryption and decryption.
  • auxiliary verification data to the platform certificate in plain text to obtain a module certificate in plain text.
  • the security enhancement module obtains the internal system time, generates time stamp data according to the internal system time, adds the time stamp data to the platform certificate, and obtains the module certificate.
  • This process is essentially equivalent to the certificate reorganization process.
  • certificate reorganization the security can be further improved with the help of auxiliary verification data. For example, if the timestamp data is tampered with, it means that the certificate has been attacked during transmission.
  • the module certificate in plain text is encrypted by the module certificate key to obtain the module certificate in cipher text.
  • the platform certificate in ciphertext is obtained through symmetric encryption; the module certificate in ciphertext is obtained through asymmetric encryption; and the key of the module certificate is obtained from the cloud platform.
  • the module certificate in ciphertext form is obtained through an asymmetric encryption method, the transmission security of the module certificate can be improved.
  • the module certificate key can be obtained in various ways.
  • the security enhancement module sends a communication request (also called a module certificate key acquisition request) to the cloud platform through the conference transmission device.
  • the cloud platform produces the private key of the module certificate and the public key of the module certificate according to the received communication request.
  • the private key of the module certificate is stored on the cloud platform, and the public key of the module certificate is forwarded to the security enhancement module through the conference transmission device.
  • the module certificate public key is the module certificate key. It can be seen that asymmetric encryption and decryption are realized with the help of the module certificate private key and the module certificate public key.
  • the security enhancement module is pluggably connected to the conference transmission device through a preset interface, and the security enhancement module uses a preset transmission protocol corresponding to the preset interface (that is, the first A transmission protocol) communicates with the conference transmission equipment; wherein, the preset interface includes a USB interface, and the preset transmission protocol includes a USB protocol.
  • the conference transmission device communicates with the cloud platform through a platform transmission protocol (also called the first communication protocol), such as the MQTT protocol.
  • MQTT Message Queuing Telemetry Transport
  • MQTT Message Queuing Telemetry Transport
  • MQTT is a client-server based message publish/subscribe transport protocol.
  • the MQTT protocol is lightweight, simple, open, and easy to implement. These characteristics make it applicable to a wide range of applications.
  • M2M machine-to-machine
  • IoT Internet of Things
  • the conference transmission device needs to perform a protocol conversion operation. After performing protocol conversion on the data received from the security enhancement module through the second transmission protocol, it is sent to the cloud platform through the first transmission protocol; After protocol conversion, the data from the cloud platform is sent to the security enhancement module through the second transmission protocol. Therefore, in this step, the conference transmission device needs to perform protocol conversion on the communication request from the security enhancement module, so that it is converted from the USB protocol to the MQTT protocol, and then transmitted to the cloud platform. Moreover, after receiving the module certificate public key sent by the cloud platform through the MQTT protocol, the protocol conversion is performed and sent to the security enhancement module through the USB protocol.
  • Step S6 The security enhancement module sends the module certificate to the cloud platform for the cloud platform to perform device authentication.
  • the security enhancement module first sends the module certificate to the conference transmission device, and the conference transmission device sends the module certificate to the cloud platform for device authentication.
  • the conference transmission device sends the received module certificate from the security enhancement module to the cloud platform for the cloud platform to perform device authentication.
  • the security enhancement module sends the module certificate in ciphertext to the conference transmission device through the USB protocol, and the conference transmission device sends the module certificate in ciphertext to the cloud platform through the MQTT protocol.
  • Step S7 The cloud platform receives the module certificate sent by the security enhancement module through the conference transmission device, analyzes the module certificate, and performs device authentication according to the analysis result.
  • the cloud platform decrypts the received module certificate in ciphertext form to obtain the module certificate in plaintext form; and matches the module certificate in plaintext form with the pre-generated platform certificate; If the matching is successful, the device authentication is passed.
  • the module certificate in ciphertext form can be asymmetrically decrypted through the module certificate private key mentioned above.
  • the module certificate in plain text includes: the auxiliary verification data and the platform certificate in plain text obtained by parsing the security enhancement module.
  • the module information of the security enhancement module and the device information of the conference transmission device contained in the plaintext platform certificate obtained by the security enhancement module are consistent with the relevant information in the platform certificate pre-generated by the cloud platform. Therefore, if the module certificate in plain text matches the pre-generated platform certificate successfully, the device authentication passes; if the match fails, the device authentication fails.
  • the cloud extracts effective information from the decrypted module certificate plaintext, for example, extracts the ID identification of the security enhancement module, that is, the unique ID inside the security enhancement module is used as the only trusted root of the conference transmission device on the cloud platform.
  • the cloud platform compares the internal unique ID of the security enhancement module extracted by the platform with the root of trust stored in the cloud. If the comparison is successful, the authentication is successful, otherwise the authentication fails.
  • the cloud platform transmits the authentication result in plain text to the conference transmission device through the MQTT protocol, and the conference transmission device transmits the authentication result to the security enhancement module through the USB protocol.
  • the cloud platform only compares the module information of the security enhancement module, and as long as the module information of the security enhancement module matches successfully, the authentication is successful.
  • the cloud platform not only compares the module information of the security enhancement module, but also compares the device information of the conference transmission device. Only when the combination of the module information of the security enhancement module and the device information of the conference transmission device Only when the relationship is consistent with the pre-stored content on the cloud platform will the authentication be successful.
  • This method uses the combination of the module information of the security enhancement module and the device information of the conference transmission device for authentication. As long as any device in the conference transmission device or the security enhancement module Changes can result in authentication failures, which improves security.
  • Step S8 The cloud platform feeds back the authentication result to the conference transmission device.
  • the process of device registration and device authentication is mainly used to verify the legitimacy of the conference transmission device and the security enhancement module. Wherein, in other embodiments, the device registration and device authentication processes may also be omitted. For example, when the conference transmission device is frequently used, the device registration and device authentication processes can be omitted, and the identity verification process can be implemented directly.
  • Fig. 5 shows a schematic flow chart of identity verification and conference data transmission. As shown in Figure 5, identity verification and conference data transmission specifically include the following steps:
  • Step S11 The conference transmission device receives and obtains the personnel identity information contained in the participant configuration request sent by the cloud platform.
  • the cloud platform sends a participant configuration request to the data transmission device in response to the input operation of the conference configuration personnel, and the participant configuration request includes personnel identity information to indicate the identity of the participants.
  • the conference transmission device saves the identity information of the person for subsequent verification.
  • the cloud platform creates a conference, sets the identity authority of the participants, and transmits the IDs of the participants to the conference transmission device through the MQTT protocol, so that the conference transmission device can store the IDs of the participants locally.
  • Step S12 The conference transmission device sends the acquired identification data to the security enhancement module.
  • the identification data is used to identify the identity of the participating members.
  • the identification data sent by the conference transmission device includes at least one of the following: device collection data for identifying the identity of the participants.
  • the data collected by the device includes at least one of the following: face image data, iris image data, fingerprint data, and password data.
  • the conference transmission device may include various acquisition modules, such as a camera module, an iris acquisition module, a fingerprint input module, and a password input module.
  • various forms of identification data can be flexibly collected.
  • the identification data may also be face image data uploaded by each conference client, so as to verify the identity of the participants corresponding to each conference client.
  • the information of the participants is collected, and the information is transmitted to the conference transmission equipment.
  • the conference transmission equipment extracts the facial feature information, and transmits the facial feature information as identification data to the security Enhancement modules.
  • Step S13 The security enhancement module matches the received identification data with the security verification data stored in the security enhancement module, and determines the identification result corresponding to the identification data according to the matching result.
  • the security verification data pre-stored in the security enhancement module refers to user personal data related to personnel identity verification, such as facial features and iris features of employees within the company.
  • the security verification data includes: characteristic data of registered members and identification information of registered members.
  • the user's personal data is stored in the security enhancement module, and external devices cannot access the security verification data stored in the security enhancement module, so as to improve information security.
  • the identification result corresponding to the identification data includes: the identification information of the participants; wherein, the data collected by the device includes at least one of the following: face image data, iris image data, Fingerprint data, and password data; identification information includes: name, unique identifier, profile information.
  • the security enhancement module before receiving the identification data sent by the conference transmission device, the security enhancement module further receives and stores the aforementioned security verification data from the upper computer.
  • the security verification data from the host computer is in the form of cipher text.
  • the security verification data in cipher text form is decrypted by the verification key to obtain the security verification data in plain text form;
  • the security verification data in plain text form is matched.
  • the verification key and decryption algorithm can be obtained through negotiation with the upper computer.
  • the security verification data stored inside the security enhancement module is in the form of cipher text, even if the security enhancement module is maliciously cracked, the security verification data will not be leaked.
  • the security enhancement module decrypts the ciphertext of the security verification data through the symmetric decryption algorithm and the verification key, and obtains the face feature library (that is, the feature data of registered members) and the form (that is, stored in the data table) contained in the security verification data.
  • the security enhancement module compares the identification data sent by the conference transmission device with the face feature library one by one, records the sequence number with the largest comparison result (that is, the number of the face feature with the highest similarity), and uses the sequence number to read from the form
  • the corresponding ID number is queried in plain text, and the ID number is sent to the device as the identification result.
  • the face feature library is a 20,000 base library, that is, 20,000 sets of face feature information are stored, and each set of face feature information contains 512 floating point numbers.
  • the form is the ID number corresponding to the signature database information.
  • Step S14 the security enhancement module sends the identification result to the conference transmission device.
  • Step S15 The conference transmission device verifies the identity of the participating members according to the identification result.
  • the conference transmission device receives the identification result returned by the security enhancement module after matching the identification data with the pre-stored security verification data, and compares the identification result with the personnel identity contained in the participant configuration request received from the cloud platform. The information is matched, and the identity of the participating members is verified according to the matching result. For example, the conference transmission device compares the ID (i.e., personnel identity information) issued by the cloud platform with the ID transmitted by the security enhancement module (i.e., the ID number queried from the plain text of the form), and if they match completely, the conference is opened normally; If they do not match, it will prompt whether there is a person with permission to participate in the meeting.
  • ID i.e., personnel identity information
  • Step S16 If the identity verification of the participants passes, the conference transmission device sends the unencrypted first conference data to the security enhancement module.
  • the conference transmission device generates the first conference data according to the conference content (including note information, etc.), and sends the unencrypted first conference data to the security enhancement module.
  • Step S17 The security enhancement module obtains the conference key corresponding to the first conference data, and encrypts the first conference data with the conference key to obtain encrypted second conference data.
  • the security enhancement module is used to perform an encryption operation on the first conference data, wherein the conference key can be generated in a variety of ways:
  • the conference key is generated by a security enhancement module, and, in order to improve security, the conference key is encrypted twice: first, a conference key corresponding to the first conference data is generated, and through the The meeting key encrypts the first meeting data.
  • the conference key can be calculated by the security enhancement module according to the module information (for example, the security enhancement module derives the conference key B according to the internal unique identification number, also called the device DNA); or, the conference key is calculated by the security enhancement module according to The data type of the first conference data is determined, for example, different conference keys are set for conference data of different types and different security levels.
  • the meeting key is encrypted with the security key provided by the cloud platform to obtain a ciphertext key, so as to obtain the second meeting data according to the encrypted first meeting data and the ciphertext key.
  • the second conference data includes: the first conference data encrypted by the conference key and the ciphertext key (that is, the result of encrypting the conference key by the security key).
  • the security enhancement module encrypts the conference content by means of symmetric encryption and the conference key B, obtains the ciphertext of the conference content, and sends it to the cloud platform through the conference transmission device.
  • the conference key B is encrypted by means of symmetric encryption and the key C (security key) to obtain the ciphertext of the key B, which is sent to the cloud platform through the conference transmission device.
  • the cloud platform stores the above-mentioned second meeting data.
  • the security key provided by the cloud platform can be generated by either a symmetric encryption algorithm or an asymmetric encryption algorithm, and the security key can be either a fixed key or a variable key. Since the variable key can be changed dynamically, it is suitable for scenarios with higher security. Moreover, the security key can further perform secondary encryption to avoid the problem that plaintext transmission is vulnerable.
  • the conference transmission device sends a key negotiation request to the cloud platform; according to the result returned by the cloud platform, provide the security enhancement module with the security key from the cloud platform;
  • the key is generated according to the device service type and/or device authentication type of the conference transmission device.
  • the security enhancement module receives the security key returned by the cloud platform in response to the key agreement request sent by the conference transmission device.
  • the security enhancement module receives the first key obtained after the cloud platform encrypts the security key with the platform private key; and decrypts the first key with the pre-acquired platform public key to obtain the security key.
  • the present disclosure does not limit the frequency of obtaining the security key and the specific encryption method.
  • the above-mentioned conference key may also be obtained directly through a key agreement request, and the above-mentioned conference key may be used for both symmetric encryption and asymmetric encryption.
  • Step S18 the security enhancement module sends the encrypted second conference data to the conference transmission device.
  • Step S19 The conference transmission device sends the encrypted second conference data to the cloud platform, so that the cloud platform can provide the second conference data to the conference client.
  • Step S20 The conference client acquires the encrypted second conference data from the conference transmission device from the cloud platform.
  • the second conference data is obtained by encrypting the first conference data provided by the conference transmission device by the security enhancement module using the conference key.
  • the conference client can obtain the second conference data through the conference download portal provided by the cloud platform (such as a hyperlink, a download button, and a shared QR code).
  • the cloud platform such as a hyperlink, a download button, and a shared QR code.
  • Step S21 The meeting client obtains the meeting key, and decrypts the second meeting data through the meeting key to obtain the unencrypted first meeting data.
  • the meeting client obtains the ciphertext key contained in the second meeting data; wherein, the ciphertext key is obtained by encrypting the meeting key with a security key provided by the cloud platform.
  • the meeting client decrypts the ciphertext key through the security key provided by the cloud platform to obtain the meeting key.
  • the way of obtaining the security key can refer to the way of obtaining the conference transmission device, and will not be repeated here.
  • the conference client downloads the conference information ciphertext and the key B ciphertext from the cloud platform, and decrypts the key B ciphertext through symmetric decryption and the built-in key C (that is, the security key) to obtain the key B clear text.
  • the ciphertext of the meeting content is decrypted by means of symmetric decryption and the key B to obtain the plaintext of the meeting content.
  • this disclosure proposes a security conference management system based on a security enhancement module.
  • the security enhancement module sensitive data storage and security calculations are performed inside the security enhancement module, and the calculation results of the devices are fed back, effectively reducing sensitive data. Risk of spillage.
  • key management is carried out inside the security enhancement module to enhance the key security level.
  • the conference content is transmitted on the cloud to the cloud for full-link ciphertext, and private key sharing is performed on the device side and the client side, which protects the security of the conference content in the public cloud.
  • the secure conference management system consists of a conference client, a cloud, a device (that is, a conference transmission device), and a security enhancement module.
  • the conference client can be designed based on operating systems such as Android and Linux, and the present disclosure does not limit the operating system environment. Clouds include public clouds, private clouds, and privatized deployments of public clouds, and this disclosure does not limit cloud deployment environments.
  • the conference transmission device in this embodiment refers to the conference all-in-one machine, and the security enhancement module can be connected to the conference transmission device through various forms such as USB or security chip.
  • the cloud platform is used for: secure conference creation, security rights management, conference content ciphertext storage, key B ciphertext storage, and the like.
  • Conference transmission equipment is used for: camera acquisition, feature extraction, etc.
  • the security enhancement module is used for: sensitive data storage, secure computing, and data encryption.
  • the meeting client is used for: acquiring meeting content ciphertext, key ciphertext decryption, and meeting content ciphertext decryption.
  • the sensitive data is encrypted and stored inside the security enhancement module, and the sensitive data includes: face feature database, fingerprint database, digital certificate, key, form, etc. In this embodiment, it refers to a face feature library and a form.
  • the face feature library refers to the face information of employees in a certain organization or company, and the form refers to the physical information corresponding to the feature information, such as ID number, name, age, etc.
  • the camera mainly collects the images of the participants, and transmits the information to the device, which extracts facial features and sends them to the security enhancement module for comparison of facial features. According to the comparison results, Pass the ID information corresponding to the form to the device.
  • the security enhancement module has at least the following characteristics: the sensitive data is stored in the form of ciphertext inside the security enhancement module. Sensitive data is encrypted by customized host computer software and stored inside the security enhancement module, and the encryption method is symmetric encryption. Sensitive data inside the security enhancement module can only be written, but not read.
  • full-link ciphertext transmission of meeting content is jointly completed by the client, cloud, device and security enhancement module.
  • the cloud completes the ciphertext storage
  • the device completes the shared QR code generation
  • the security enhancement module completes the content encryption and decryption
  • the client completes the meeting content download and decryption.
  • the security key in this embodiment can be flexibly set according to the authentication type of the conference transmission device: when the device authentication type is the first authentication type (eg, one-machine-one-secret type), the security key corresponds to the device ID. This type needs to generate a key for each device, and because the device is unique, it has higher security.
  • the device authentication type is the second authentication type (eg, one-type-one-secret type)
  • the security key corresponds to the device model. This type needs to generate a key for each device model, and since the same model may contain multiple devices, the security is slightly lower than the security key of the first authentication type.
  • the device authentication type is the third authentication type (such as the unified key type)
  • the security key corresponds to the device service type. This type can generate a unified security key for all devices, so the security is the lowest. For example, the same security key can be generated for conference transmission devices of the same business type.
  • the conference transmission device communicates with the cloud platform through a first communication protocol
  • the conference transmission device communicates with the security enhancement module through a second communication protocol
  • the first communication protocol includes: MQTT protocol
  • the second communication protocol includes: USB protocol.
  • the conference transmission device needs to perform corresponding protocol conversion processing according to the data type.
  • the conference transmission device since the transmission protocol adopted between the conference transmission device and the cloud platform is different from the transmission protocol adopted between the conference transmission device and the security enhancement module, the conference transmission device needs to execute the protocol on the received or to-be-sent data Conversion processing.
  • the security enhancement module communicates with the conference transmission device through a preset application program interface; wherein, the preset application program interface is provided by a software development kit corresponding to the security enhancement module.
  • the present disclosure protects the security of the device to the greatest extent by adding a security enhancement module to the device, through the establishment of device authentication among the security enhancement module, the device, and the platform, and the establishment of a security data interaction mode.
  • the security enhancement module performs data interaction with the device side through the USB interface, so as to be compatible with current existing devices.
  • a secure data interaction mechanism between the security enhancement module, the device terminal, and the cloud platform is constructed through the security enhancement module and the device-side security SDK.
  • the security enhancement module has at least the following characteristics: trusted storage for sensitive data such as keys and certificates, and cannot be sent externally through the USB interface.
  • sensitive data is stored inside the security enhancement module in an encrypted manner, and even if the security enhancement module is cracked, the plaintext information of the encrypted data stored inside cannot be directly obtained.
  • the security key stored inside the security enhancement module is stored in ciphertext through a secondary encryption process.
  • the sensitive data stored inside the security enhancement module will not be sent out.
  • Sensitive data such as certificates can be written through customized host computer software, and can only be written but not read.
  • the encryption and decryption processes are all completed inside the security enhancement module, which avoids vulnerable defects caused by encryption and decryption in external devices.
  • the security enhancement module can dynamically perform the key negotiation operation through the conference transmission device and the cloud platform, and the frequency of the key negotiation can be flexibly adjusted according to the device type and authentication method.
  • the security key obtained through key negotiation can be generated in different ways in combination with device types and authentication methods, so that the generation method of the security key can be determined according to the data security level, and security can be further improved.
  • the key in the authentication process and the key in the data transmission process can be flexibly set according to the data type.
  • the cloud platform dynamically determines the key matching the data type according to the type of data to be transmitted. That is: the type of key and the way of encryption and decryption can be flexibly set according to the data type and the interaction process.
  • the security enhancement module is provided by the cloud platform of the Internet of Things, so it is a trusted device, and the conference transmission device is an external device independent of the cloud platform, so it is an untrusted device. In order to avoid security problems caused by attacks on untrusted devices, all sensitive data and encryption and decryption processes are implemented by the security enhancement module. Moreover, in order to further improve security, a software development kit SDK is provided for the security enhancement module.
  • the conference transmission device only needs to integrate the SDK to communicate with the security enhancement module and the cloud platform. That is, data transmission is performed between the security enhancement module and the conference transmission device through a preset application program interface; and the application program interface is provided by a software development kit corresponding to the security enhancement module.
  • the application program interface API function provided by the SDK must be called. For example, when the conference transmission device sends data to the security enhancement module, it needs to call the sending API implementation that matches the type of data sent; when the conference transmission device receives the data returned by the security enhancement module, it needs to call the The matching receiver class API implementation.
  • An embodiment of the present disclosure also provides a conference transmission device, which may be the security enhancement module mentioned above.
  • a conference transmission device provided by an embodiment of the present disclosure includes:
  • the receiving module 61 is configured to receive the unencrypted first conference data sent by the conference transmission device when the identity verification of the participating members is passed;
  • the encryption module 62 is configured to obtain a conference key corresponding to the first conference data, and encrypt the first conference data by using the conference key to obtain encrypted second conference data;
  • the sending module 63 is configured to send the encrypted second conference data to the conference transmission device, so that the conference transmission device can provide the encrypted second conference data to the conference client through the cloud platform .
  • the encryption module is specifically configured as:
  • the second conference data is obtained according to the encrypted first conference data and the ciphertext key.
  • the conference key is calculated by the security enhancement module according to module information; or, the conference key is obtained by the security enhancement module according to the data type of the first conference data Sure.
  • the encryption module is specifically configured as:
  • the encryption module is specifically configured as:
  • the device further includes:
  • the identity verification module is configured to receive the identification data sent by the conference transmission device; match the identification data with the security verification data pre-stored in the security enhancement module, and determine the identification data corresponding to the identification data according to the matching result. A corresponding identification result; sending the identification result to the conference transmission device, so that the conference transmission device can verify the identity of the participating members according to the identification result.
  • the device further includes:
  • the storage module is configured to receive and store the security verification data from the host computer; wherein, the security verification data from the host computer is in ciphertext form.
  • the identification data sent by the conference transmission device includes at least one of the following: device collection data used to identify the identity of the participants;
  • the security verification data includes: characteristic data of registered members and identification information of registered members;
  • the identification result corresponding to the identification data includes: identification information of the participants; wherein, the data collected by the device includes at least one of the following: face image data, iris image data, fingerprint data, And password data; the identification information includes: name, unique identifier, profile information.
  • the device further includes:
  • the device authentication module is configured to receive and store the platform certificate generated by the cloud platform in response to the device registration request; in response to the authentication instruction sent by the conference transmission device, add auxiliary verification data to the platform certificate to obtain the module certificate, and
  • the module certificate is sent to the conference transmission device for the conference transmission device to provide the module certificate to the cloud platform for device authentication; wherein, in the case of passing the device authentication, execute the authentication.
  • An embodiment of the present disclosure also provides a conference transmission device, which may be the conference transmission device mentioned above.
  • a conference transmission device provided by an embodiment of the present disclosure includes:
  • the first sending module 71 is configured to send the unencrypted first meeting data to the security enhancement module when the identity verification of the participating members is passed;
  • the receiving module 72 is configured to receive encrypted second conference data obtained by encrypting the first conference data with the obtained conference key by the security enhancement module;
  • the second sending module 73 is configured to send the encrypted second meeting data to a cloud platform, so that the cloud platform can provide the second meeting data to a meeting client.
  • the meeting key is generated by the security enhancement module, and the second meeting data further includes: pairing the meeting key with the security key provided by the cloud platform The ciphertext key obtained after encryption.
  • the device further includes:
  • the key agreement module is configured to send a key agreement request to the cloud platform; according to the result returned by the cloud platform, provide the security enhancement module with the security key from the cloud platform; wherein the security key is based on the meeting
  • the device service type and/or device authentication type of the transmitting device is generated.
  • the key agreement module is specifically configured as:
  • the first key is decrypted to obtain the security key.
  • the device further includes:
  • the identity verification module is configured to send the obtained identity recognition data to the security enhancement module; receive the identity recognition result returned by the security enhancement module after matching the identity recognition data with the pre-stored security verification data; The identification result is matched with the personnel identity information contained in the participant configuration request received from the cloud platform, and the identities of the participants are verified according to the matching result.
  • the device further includes:
  • the registration authentication module is configured to send a device registration request to the cloud platform, so that the security enhancement module receives and stores the platform certificate generated by the cloud platform in response to the device registration request; sends an authentication instruction to the security enhancement module , for the security enhancement module to add auxiliary verification data to the platform certificate to obtain the module certificate; send the received module certificate from the security enhancement module to the cloud platform for the cloud platform to perform device authentication .
  • the embodiment of the present disclosure also provides a conference client.
  • the conference client provided by an embodiment of the present disclosure includes:
  • the obtaining module 81 is configured to obtain encrypted second conference data from the conference transmission device from the cloud platform; wherein, the second conference data is provided by the security enhancement module to the conference transmission device using the conference key.
  • the meeting data is encrypted;
  • the decryption module 82 is configured to obtain the conference key, and decrypt the second conference data by using the conference key to obtain unencrypted first conference data.
  • the acquisition module is specifically configured as:
  • the ciphertext key is obtained by encrypting the meeting key with a security key provided by the cloud platform;
  • the ciphertext key is decrypted by using the security key provided by the cloud platform to obtain the meeting key.
  • a conference transmission system provided by an embodiment of the present disclosure includes:
  • the first conference transmission device 91 may be the security enhancement module shown in FIG. 6
  • the second data transmission device 92 may be the conference transmission device shown in FIG. 7
  • the structure of the conference client 93 may be shown in FIG. 8 .
  • an embodiment of the present disclosure provides an electronic device, which includes:
  • processors 901 one or more processors 901;
  • Memory 902 on which one or more programs are stored, and when the one or more programs are executed by one or more processors, one or more processors implement any one of the conference data transmission methods described above;
  • One or more I/O interfaces 903 are connected between the processor and the memory, and are configured to realize information exchange between the processor and the memory.
  • the processor 901 is a device with data processing capability, which includes but not limited to a central processing unit (CPU), etc.
  • the memory 902 is a device with data storage capability, which includes but not limited to a random access memory (RAM, more specifically Such as SDRAM, DDR, etc.), read-only memory (ROM), electrified erasable programmable read-only memory (EEPROM), flash memory (FLASH); I/O interface (read-write interface) 903 is connected between processor 901 and memory 902 , can realize information interaction between the processor 901 and the memory 902, which includes but not limited to a data bus (Bus) and the like.
  • RAM random access memory
  • ROM read-only memory
  • EEPROM electrified erasable programmable read-only memory
  • FLASH flash memory
  • I/O interface (read-write interface) 903 is connected between processor 901 and memory 902 , can realize information interaction between the processor 901 and the memory 902, which includes but not limited to a data bus (Bus) and the
  • the processor 901, the memory 902 and the I/O interface 903 are connected to each other through a bus, and further connected to other components of the computing device.
  • This embodiment also provides a computer-readable medium, on which a computer program is stored.
  • the program is executed by a processor, the conference data transmission method provided by this embodiment is implemented.
  • details of the conference data will not be repeated here. The specific steps of the transfer method.
  • the functional modules/units in the system, and the device can be implemented as software, firmware, hardware, and an appropriate combination thereof.
  • the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical components. Components cooperate to execute.
  • Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit .
  • Such software may be distributed on computer readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media).
  • computer storage media includes both volatile and nonvolatile media implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules, or other data. permanent, removable and non-removable media.
  • Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, tape, magnetic disk storage or other magnetic storage, or may be used Any other medium that stores desired information and can be accessed by a computer.
  • communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .

Abstract

公开了一种会议数据的传输方法、装置、系统、电子设备及可读介质，属于计算机技术领域，其可解决现有的非法设备入侵的问题。本公开的会议数据的传输方法包括：在参会成员的身份验证通过的情况下，接收会议传输设备发送的未加密的第一会议数据；获取与所述第一会议数据相对应的会议密钥，通过所述会议密钥对所述第一会议数据进行加密处理，得到已加密的第二会议数据；将所述已加密的第二会议数据发送给所述会议传输设备，以供所述会议传输设备将所述已加密的第二会议数据通过云平台提供给会议客户端。本公开可提升会议数据传输的安全性，避免数据传输过程中被破解的问题。

Description

会议数据的传输方法、装置、系统、电子设备及可读介质 技术领域
本公开属于计算机技术领域，具体涉及一种会议数据的传输方法、装置、系统、电子设备及可读介质。
背景技术
随着互联网技术的发展，越来越多的会议开始采用线上方式举办。线上会议的各个参会成员能够利用手机、电脑等终端设备接入网络，并通过网络数据传输的方式进行交流沟通。例如，很多具备聊天功能或线上会议功能的软件都能够用于发起线上会议。
但是，传统的线上会议的会议内容通常以明文形式进行传输，存在着易遭受攻击，且内容易泄露的风险。由此可见，传统的会议传输设备只能满足常规会议需求，对于一些较为重要、且安全等级较高的会议则无法适用。
发明内容
本公开旨在提供一种会议数据的传输方法、装置、系统、电子设备及可读介质。
本公开第一方面提供一种会议数据的传输方法，应用于安全增强模块，其包括：
在参会成员的身份验证通过的情况下，接收会议传输设备发送的未加密的第一会议数据；
获取与所述第一会议数据相对应的会议密钥，通过所述会议密钥对所述第一会议数据进行加密处理，得到已加密的第二会议数据；
将所述已加密的第二会议数据发送给所述会议传输设备，以供所述会议传输设备将所述已加密的第二会议数据通过云平台提供给会议客户端。
在一种可选的实现方式中，所述获取与所述第一会议数据相对应的会议密钥，通过所述会议密钥对所述第一会议数据进行加密处理，得到已加密的第二会议数据包括：
生成与所述第一会议数据相对应的会议密钥，通过所述会议密钥对所述第一会议数据进行加密处理；
通过由所述云平台提供的安全密钥对所述会议密钥进行加密，得到密文密钥；
根据加密处理后的第一会议数据以及所述密文密钥，得到所述第二会议数据。
在一种可选的实现方式中，所述会议密钥由所述安全增强模块根据模块信息计算得到；或者，所述会议密钥由所述安全增强模块根据所述第一会议数据的数据类型确定。
在一种可选的实现方式中，所述通过由所述云平台提供的安全密钥对所述会议密钥进行加密之前，还包括：
接收所述云平台响应于所述会议传输设备发送的密钥协商请求返回的所述安全密钥；其中，所述安全密钥根据所述会议传输设备的设备业务类型和/或设备认证类型生成。
在一种可选的实现方式中，所述接收所述云平台响应于所述会议传输设备发送的密钥协商请求返回的所述安全密钥包括：
接收所述云平台通过平台私钥对所述安全密钥进行加密后得到的第一密钥；通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
在一种可选的实现方式中，所述参会成员的身份验证包括：
接收所述会议传输设备发送的身份识别数据；
将所述身份识别数据与所述安全增强模块预存的安全验证数据进行匹配，根据匹配结果确定与所述身份识别数据相对应的身份识别结果；
将所述身份识别结果发送给所述会议传输设备，以供所述会议传输设备根据所述身份识别结果进行参会成员的身份验证。
在一种可选的实现方式中，所述接收所述会议传输设备发送的身份识别数据之前，还包括：接收并存储来自上位机的所述安全验证数据；其中，所述来自上位机的所述安全验证数据为密文形式；
则所述将所述身份识别数据与所述安全增强模块预存的安全验证数据进行匹配包括：
通过验证密钥对密文形式的安全验证数据进行解密处理，得到明文形式的安全验证数据；将所述身份识别数据与明文形式的安全验证数据进行匹配。
在一种可选的实现方式中，所述会议传输设备发送的身份识别数据包括以下中的至少一个：用于标识参会人员身份的设备采集数据；
所述安全验证数据包括：注册成员的特征数据以及注册成员的标识信息；
则所述与所述身份识别数据相对应的身份识别结果包括：参会人员的标识信息；其中，所述设备采集数据包括以下中的至少一个：人脸图像数据、虹膜图像数据、指纹数据、以及密码数据；所述标识信息包括：姓名、唯一标识符、简介信息。
在一种可选的实现方式中，所述参会成员的身份验证之前，还包括：
接收并存储云平台响应于设备注册请求生成的平台证书；
响应于所述会议传输设备发送的认证指令，针对所述平台证书添加辅助校验数据，得到模块证书，将所述模块证书发送给所述会议传输设备，以供所述会议传输设备将所述模块证书提供给所述云平台进行设备认证；其中，在设备认证通过的情况下，执行所述参会成员的身份验证。
在一种可选的实现方式中，所述安全增强模块与所述会议传输设备之间通过预设的应用程序接口进行通信；其中，所述预设的应用程序接口由 对应于所述安全增强模块的软件开发工具包提供。
本公开第二方面提供一种会议数据的传输方法，应用于会议传输设备，其包括：
在参会成员的身份验证通过的情况下，将未加密的第一会议数据发送给安全增强模块；
接收所述安全增强模块通过获取的会议密钥对所述第一会议数据进行加密处理后得到的已加密的第二会议数据；
将所述已加密的第二会议数据发送给云平台，以供所述云平台将所述第二会议数据提供给会议客户端。
在一种可选的实现方式中，所述会议密钥由所述安全增强模块生成，且所述第二会议数据进一步包括：通过由所述云平台提供的安全密钥对所述会议密钥进行加密后得到的密文密钥。
在一种可选的实现方式中，所述接收所述安全增强模块通过获取的会议密钥对所述第一会议数据进行加密处理后得到的已加密的第二会议数据之前，还包括：
向云平台发送密钥协商请求；
根据云平台返回的结果，向安全增强模块提供来自云平台的所述安全密钥；其中，所述安全密钥根据所述会议传输设备的设备业务类型和/或设备认证类型生成。
在一种可选的实现方式中，所述向安全增强模块提供来自云平台的所述安全密钥包括：
将所述云平台通过平台私钥对所述安全密钥进行加密后得到的第一密钥发送给所述安全增强模块，以供所述安全增强模块通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
在一种可选的实现方式中，所述将未加密的第一会议数据发送给安全增强模块之前，还包括：
将获取到的身份识别数据发送给所述安全增强模块；
接收所述安全增强模块将所述身份识别数据与预存的安全验证数据进行匹配后返回的身份识别结果；
将所述身份识别结果与接收到的来自云平台的参会人员配置请求中包含的人员身份信息进行匹配，根据匹配结果验证参会成员的身份。
在一种可选的实现方式中，所述参会成员的身份验证之前，还包括：
向所述云平台发送设备注册请求，以使所述安全增强模块接收并存储云平台响应于所述设备注册请求生成的平台证书；
向所述安全增强模块发送认证指令，以供所述安全增强模块针对所述平台证书添加辅助校验数据，得到模块证书；
将接收到的来自所述安全增强模块的模块证书发送给云平台，以供所述云平台进行设备认证。
在一种可选的实现方式中，所述会议传输设备与所述云平台之间通过第一通信协议进行通信，且所述会议传输设备与所述安全增强模块之间通过第二通信协议进行通信；其中，所述第一通信协议包括：MQTT协议，且所述第二通信协议包括：USB协议。
本公开第三方面提供一种会议数据的传输方法，应用于会议客户端，其包括：
从云平台获取来自会议传输设备的已加密的第二会议数据；其中，所述第二会议数据由安全增强模块利用会议密钥对所述会议传输设备提供的第一会议数据加密得到；
获取所述会议密钥，通过所述会议密钥对所述第二会议数据进行解密，得到未加密的第一会议数据。
在一种可选的实现方式中，所述获取所述会议密钥包括：
获取所述第二会议数据中包含的密文密钥；其中，所述密文密钥由所述云平台提供的安全密钥对所述会议密钥进行加密得到；
通过由所述云平台提供的安全密钥对所述密文密钥进行解密，得到所述会议密钥。
本公开第四方面提供一种会议数据传输装置，其包括：
接收模块，被配置为在参会成员的身份验证通过的情况下，接收会议传输设备发送的未加密的第一会议数据；
加密模块，被配置为获取与所述第一会议数据相对应的会议密钥，通过所述会议密钥对所述第一会议数据进行加密处理，得到已加密的第二会议数据；
发送模块，被配置为将所述已加密的第二会议数据发送给所述会议传输设备，以供所述会议传输设备将所述已加密的第二会议数据通过云平台提供给会议客户端。
本公开第五方面提供一种会议数据传输装置，其包括：
第一发送模块，被配置为在参会成员的身份验证通过的情况下，将未加密的第一会议数据发送给安全增强模块；
接收模块，被配置为接收所述安全增强模块通过获取的会议密钥对所述第一会议数据进行加密处理后得到的已加密的第二会议数据；
第二发送模块，被配置为将所述已加密的第二会议数据发送给云平台，以供所述云平台将所述第二会议数据提供给会议客户端。
本公开第六方面提供一种会议客户端，其包括：
获取模块，被配置为从云平台获取来自会议传输设备的已加密的第二会议数据；其中，所述第二会议数据由安全增强模块利用会议密钥对所述会议传输设备提供的第一会议数据加密得到；
解密模块，被配置为获取所述会议密钥，通过所述会议密钥对所述第二会议数据进行解密，得到未加密的第一会议数据。
本公开第七方面提供一种会议传输系统，其包括：
第五方面的数据传输装置、第六方面的数据传输装置、第七方面的会 议客户端以及云平台。
本公开第八方面提供一种电子设备，包括：
一个或多个处理器；
存储器，其上存储有一个或多个程序，当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现上述任意一项所述的方法；
一个或多个I/O接口，连接在所述处理器与存储器之间，配置为实现所述处理器与存储器的信息交互。
本公开第九方面提供一种计算机可读介质，其上存储有计算机程序，所述程序被处理器执行时实现上述任意一项所述的方法。
附图说明
附图是用来提供对本公开的进一步理解，并且构成说明书的一部分，与下面的具体实施方式一起用于解释本公开，但并不构成对本公开的限制。在附图中：
图1为本公开实施例提供的应用于安全增强模块的会议数据的传输方法的流程图；
图2为本公开实施例提供的应用于会议传输设备的会议数据的传输方法的流程图；
图3为本公开实施例提供的应用于会议客户端的会议数据的传输方法的流程图；
图4为本公开实施例提供的应用于安全增强模块、会议传输设备以及云平台的设备认证过程的流程图；
图5示出了身份验证以及会议数据传输的具体流程示意图；
图6为本公开一个实施例提供的会议传输装置的结构图；
图7为本公开另一个实施例提供的会议传输装置的结构图；
图8为本公开实施例提供的会议客户端的结构图；
图9为本公开实施例提供的会议传输系统的结构图；
图10为本公开实施例提供一种电子设备的原理框图。
具体实施方式
为使本领域技术人员更好地理解本公开/实用新型的技术方案，下面结合附图和具体实施方式对本公开/实用新型作进一步详细描述。
除非另外定义，本公开使用的技术术语或者科学术语应当为本公开所属领域内具有一般技能的人士所理解的通常意义。本公开中使用的“第一”、“第二”以及类似的词语并不表示任何顺序、数量或者重要性，而只是用来区分不同的组成部分。同样，“一个”、“一”或者“该”等类似词语也不表示数量限制，而是表示存在至少一个。“包括”或者“包含”等类似的词语意指出现该词前面的元件或者物件涵盖出现在该词后面列举的元件或者物件及其等同，而不排除其他元件或者物件。“连接”或者“相连”等类似的词语并非限定于物理的或者机械的连接，而是可以包括电性的连接，不管是直接的还是间接的。“上”、“下”、“左”、“右”等仅用于表示相对位置关系，当被描述对象的绝对位置改变后，则该相对位置关系也可能相应地改变。
第一方面，本公开实施例提供一种会议数据的传输方法，通过安全增强模块提升会议数据传输的可靠性，避免因会议传输设备遭遇攻击所导致的数据泄露问题。
如图1所示，本公开实施例提供的会议数据的传输方法，可以应用于安全增强模块。其中，安全增强模块可通过插接方式与会议传输设备相连，会议传输设备与云平台相互通信。该方法包括：
步骤S110：在参会成员的身份验证通过的情况下，接收会议传输设备发送的未加密的第一会议数据。
其中，本实施例的执行主体可以为安全增强模块。该安全增强模块能 够与会议传输设备进行通信。
为了提升安全性，防止会议无关人员介入，需要预先对参会成员的身份进行验证，并在身份验证通过的情况下，开启会议，并将会议数据通过网络传播。本公开不限定身份验证的具体实现方式，只要能够确保参会成员的身份合法即可。
其中，会议传输设备在会议启动后，获取未加密的第一会议数据。其中，该未加密的第一会议数据根据会议内容生成。并且，会议传输设备将第一会议数据发送给安全增强模块。相应的，安全增强模块接收会议传输设备发送的未加密的第一会议数据。
步骤S120：获取与第一会议数据相对应的会议密钥，通过会议密钥对第一会议数据进行加密处理，得到已加密的第二会议数据。
为了提升安全性，在传输过程中，不直接传输明文数据，而是传输经加密处理后的密文数据。其中，会议密钥可通过多种方式获取。例如，会议密钥可以预先从云平台获取。又如，会议密钥还可以由安全增强模块生成，并提供给云平台。总之，无论会议密钥采用何种生成方式，本公开的核心在于：会议密钥存储在安全增强模块内部，外部的会议传输设备无法获取，因而提升了安全性。
步骤S130：将已加密的第二会议数据发送给会议传输设备，以供会议传输设备将已加密的第二会议数据通过云平台提供给会议客户端。
其中，安全增强模块将加密处理后的第二会议数据发送给会议传输设备，以供会议传输设备将第二会议数据提供给云平台，并由云平台提供给会议客户端。
由此可见，该方式能够借由安全增强模块对会议数据进行加密处理，由于加解密过程都在安全增强模块内部完成，因此，提升了安全性，避免了数据泄露的风险。
如图2所示，本公开实施例提供的会议数据的传输方法，可以应用于 会议传输设备。该方法包括：
步骤S210：在参会成员的身份验证通过的情况下，将未加密的第一会议数据发送给安全增强模块。
其中，本实施例的执行主体可以为会议传输设备。其中，会议传输设备在会议启动后，获取未加密的第一会议数据。该未加密的第一会议数据根据会议内容生成。并且，会议传输设备将第一会议数据发送给安全增强模块。
步骤S220：接收安全增强模块通过获取的会议密钥对第一会议数据进行加密处理后得到的已加密的第二会议数据。
步骤S230：将已加密的第二会议数据发送给云平台，以供云平台将第二会议数据提供给会议客户端。
其中，云平台用于将接收到的第二会议数据提供给会议客户端，以供会议客户端下载。
该方式借助安全增强模块、会议传输设备、云平台以及会议客户端的多端交互过程，提升了数据传输的安全性。
如图3所示，本公开实施例提供的会议数据的传输方法，可以应用于会议客户端。该方法包括：
步骤S310：从云平台获取来自会议传输设备的已加密的第二会议数据；其中，第二会议数据由安全增强模块利用会议密钥对会议传输设备提供的第一会议数据加密得到。
其中，本实施例的执行主体可以为会议客户端。会议客户端可以为移动终端、平板电脑等各种类型的通信终端。其中，会议客户端可通过下载入口、共享二维码等多种方式获取第二会议数据，本公开不限定第二会议数据的具体获取方式。
步骤S320：获取会议密钥，通过会议密钥对第二会议数据进行解密，得到未加密的第一会议数据。
其中，会议密钥可通过多种方式获取，例如，可由云平台提供。相应的，通过会议密钥即可对第二会议数据进行解密，以得到原始的第一会议数据。
该方式通过安全增强模块的加解密处理，使会议客户端能够直接下载密文形式的第二会议数据，避免了数据传输过程中被恶意截获或篡改的风险，且会议客户端能够根据会议密钥将密文形式的会议数据转换为明文形式的会议数据，实现会议内容的共享。
如图4所示，本公开实施例提供的会议数据的传输方法，用于实现云平台、会议传输设备、安全增强模块以及会议客户端之间的数据交互。图4旨在说明多个设备之间的认证交互过程。
其中，会议传输设备用于实现会议数据的获取以及云端上传操作。通常会议传输设备位于会议场地内，从而便于实时捕获会议图像等会议数据。由于会传输设备相对于云平台而言属于外部设备，其设备型号众多、来源多样，因此，若逐一针对各个会议传输设备进行安全检查，无疑将耗费大量的时间成本，且容易因漏检等问题导致安全隐患。由此可见，在本实施例的应用场景中，会议传输设备存在来源广泛、安全排查困难等特点。为了能够方便快捷且安全高效的实现对会议传输设备的安全验证，在本实施例中，设置了安全增强模块。通过安全增强模块实现敏感数据的加解密过程，从而确保敏感数据不外泄，在会议传输设备不可信的场景中提升通信安全性。
该安全增强模块可通过各类方式与会议传输设备通信。例如，该安全增强模块可通过有线或无线方式与会议传输设备连接。在一种可选的实现方式中，为了提升安全增强模块设置的灵活性，安全增强模块通过可插拔方式与会议传输设备插接，以实现相互通信。例如，在一种实现方式中，安全增强模块可通过USB接口与会议传输设备连接，或者，也可以通过内部数据总线的方式连接，例如PICE/LVDS/I2C/UART等。又如，在另一种 实现方式中，安全增强模块可作为安全芯片(FPGA)插入会议传输设备，从而通过内部数据总线连接SOC(System on Chip,片上系统)，从而与会议传输设备相互通信。总之，本公开不限定安全增强模块的具体接入形式，只要能够实现灵活方便的与会议传输设备通信的目的即可。
由此可见，安全增强模块能够替代会议传输设备实现数据加解密、数据验证等，从而提升安全性。可选地，为了防止不可信的设备接入云平台，在本实施例中，在会议数据传输之前，先执行设备注册以及设备认证操作，在设备认证通过的情况下，再验证参会成员的身份，并在参会成员身份验证通过的情况下传输会议数据。如图4所示，该方法包括以下流程：
一、设备注册过程：
步骤S1：会议传输设备向云平台发送设备注册请求。
其中，设备注册请求用于将会议传输设备的相关信息在云平台进行注册，并且，在设备注册过程中，云平台不仅要记录会议传输设备的设备信息，还需要记录与该会议传输设备建立关联关系的安全增强模块的模块信息。相应的，在后续的设备认证过程中，针对会议传输设备以及安全增强模块的合法性进行验证，以确保设备的可信接入。
在第一种应用场景中，预先将安全增强模块分配给会议传输设备，相应的，在会议传输设备发送的设备注册请求中包括：安全增强模块的模块信息以及会议传输设备的设备信息。其中，安全增强模块的模块信息用于唯一标识一个安全增强模块，例如，可以是安全增强模块的ID标识。会议传输设备的设备信息用于描述会议传输设备的设备特征，例如，设备信息包括：设备业务类型和/或设备认证类型。其中，设备业务类型用于描述会议传输设备的业务种类(即会议类型，如内部会议、外部会议等)。设备认证类型用于描述设备的认证方式，具体可由设备的安全等级设定。该方式由会议传输设备发送设备注册请求，因此，会议传输设备与安全增强模块之间的对应关系可灵活调整，便于实现安全增强模块与会议传输设备之间 的灵活配对，灵活性较高。
在第二种应用场景中，安全增强模块未预先分配给会议传输设备，相应的，在云平台接收到设备注册请求后，为该会议传输设备分配对应的安全增强模块。此时，在会议传输设备发送的设备注册请求中包括：会议传输设备的设备信息，而不包含安全增强模块的模块信息。该方式直接由云平台分配安全增强模块，因此，安全增强模块与会议传输设备之间的对应关系由云平台设定，且后期不可随意更改，安全性较高。
实际情况中，可根据具体会议的特点灵活选用上述两种方式中的至少一种。
步骤S2：云平台根据接收到的设备注册请求，生成平台证书。
其中，云平台获取设备注册请求中包含的安全增强模块的模块信息以及会议传输设备的设备信息，根据安全增强模块的模块信息以及会议传输设备的设备信息生成平台证书。可选地，在根据安全增强模块的模块信息以及会议传输设备的设备信息生成平台证书时，进一步对安全增强模块的模块信息以及会议传输设备的设备信息进行加密，得到密文形式的平台证书。
其中，在上述第一种应用场景中，云平台解析设备注册请求，获取其中包含的安全增强模块的模块信息以及会议传输设备的设备信息，通过平台证书密钥(如密钥A)，对安全增强模块的模块信息以及会议传输设备的设备信息执行加密操作，根据加密结果得到平台证书。为了提升加密执行效率，该加密操作可以为对称加密操作。比如，可采用AES加密算法。由此可见，平台证书的明文包括安全增强模块的模块信息以及会议传输设备的设备信息，通过加密操作能够提升传输过程中的安全性。
在上述第二种应用场景中，云平台解析设备注册请求，获取其中包含的会议传输设备的设备信息，并根据该会议传输设备的类型分配对应的安全增强模块。通过平台证书密钥(如密钥A)，对已分配的安全增强模块的 模块信息以及会议传输设备的设备信息执行加密操作，根据加密结果得到平台证书。在该方式中，安全增强模块由云平台根据设备认证请求中的设备信息进行分配。
可选的，当会议传输设备的设备类型为多种时，可以分别针对各种类型的会议传输设备设置不同种类的安全增强模块，相应的，云平台根据设备认证请求中的设备信息，选择与当前设备的设备类型相匹配的安全增强模块进行分配。
步骤S3：云平台将平台证书提供给安全增强模块。
在该步骤中，云平台可以通过会议传输设备将平台证书提供给安全增强模块，也可以直接将平台证书提供给安全增强模块。相应的，安全增强模块接收并存储云平台响应于设备注册请求生成的平台证书。例如，在上述第一种应用场景中，云平台将平台证书发送给会议传输设备，由会议传输设备将平台证书以及平台证书密钥提供给安全增强模块。在上述第二种应用场景中，云平台直接将平台证书以及平台证书密钥提供给安全增强模块。其中，在前一种方式中，安全增强模块内存储的平台证书动态添加，从而能够动态适配不同的会议传输设备，提升了灵活性。在后一种方式中，可在安全增强模块中直接烧录平台证书以及平台证书密钥，从而进一步提升安全性。
另外，无论采用何种方式，云平台均需要记录安全增强模块的模块信息以及会议传输设备的设备信息之间的对应关系，从而借助该对应关系在后续的认证过程中进一步提升安全性，防止因会议传输设备或安全增强模块被恶意替换而导致的安全隐患。
二、设备认证过程：
步骤S4：会议传输设备向安全增强模块发送认证指令。
其中，会议传输设备主动发起设备认证操作，从而向安全增强模块发送认证指令。
步骤S5：安全增强模块响应于认证指令，针对平台证书添加辅助校验数据，得到模块证书。
安全增强模块响应于会议传输设备发送的认证指令，针对已存储的平台证书添加辅助校验数据，得到模块证书。其中，辅助校验数据包括各类能够实现辅助校验功能的附加数据，如时间戳数据、设备指纹数据等。
可选的，为了提升安全性，云平台生成的平台证书为密文形式的平台证书。首先，安全增强模块根据云平台提供的平台证书密钥(如密钥A)对密文形式的平台证书进行解密，得到明文形式的平台证书。其中，当平台证书采用对称加密方式得到时，用于解密的平台证书密钥与云平台加密时的平台证书密钥相同，从而能够以较快的速度实现解密。当然，在其他安全性更高的应用场景中，也可以通过非对称加解密方式实现。
然后，针对明文形式的平台证书添加辅助校验数据，得到明文形式的模块证书。例如，安全增强模块获取内部系统时间，根据内部系统时间生成时间戳数据，将时间戳数据添加至平台证书中，得到模块证书。该过程实质上相当于证书重组过程，通过证书重组，能够借助辅助校验数据进一步提升安全性。例如，若时间戳数据被篡改，则说明证书在传输过程中遭遇了攻击。
最后，通过模块证书密钥对明文形式的模块证书进行加密，得到密文形式的模块证书。在一种可选的实现方式中，密文形式的平台证书通过对称加密方式得到；密文形式的模块证书通过非对称加密方式得到；并且，模块证书密钥从云平台获取。其中，由于密文形式的模块证书通过非对称加密方式得到，因此，能够提升模块证书的传输安全性。
其中，模块证书密钥可通过多种方式获取。例如，在一种实现方式中，由安全增强模块通过会议传输设备向云平台发送通讯请求(也叫模块证书密钥获取请求)。云平台根据接收到的通讯请求，生产模块证书私钥以及模块证书公钥，其中，模块证书私钥存储在云平台，模块证书公钥通过会议 传输设备转发给安全增强模块。其中，模块证书公钥即为模块证书密钥。由此可见，借助模块证书私钥以及模块证书公钥实现了非对称加解密。
另外，需要说明的是，在本实施例中，安全增强模块通过预设接口以可插拔方式与会议传输设备连接，且安全增强模块通过与预设接口相对应的预设传输协议(即第一传输协议)与会议传输设备通信；其中，预设接口包括USB接口，且预设传输协议包括USB协议。另外，会议传输设备与云平台之间通过平台传输协议(也叫第一通信协议)，例如MQTT协议，进行通信。其中，MQTT(Message Queuing Telemetry Transport，消息队列遥测传输)是基于TCP的非加密协议，是ISO标准(ISO/IEC PRF 20922)下基于发布/订阅范式的消息协议，其工作在TCP/IP协议族上，是为硬件性能低下的远程设备以及网络状况糟糕的情况下而设计的发布/订阅型消息协议，为此，需要一个消息中间件。MQTT是一个基于客户端-服务器的消息发布/订阅传输协议。MQTT协议是轻量、简单、开放和易于实现的，这些特点使其适用范围非常广泛。在很多情况下，包括受限的环境中，如：机器与机器(M2M)通信和物联网(IoT)。其中，通过卫星链路通信传感器、偶尔拨号的医疗设备、智能家居、及一些小型化设备中已广泛使用。
相应的，会议传输设备需要执行协议转换操作，将通过第二传输协议接收到的来自安全增强模块的数据进行协议转换后，通过第一传输协议发送给云平台；将通过第一传输协议接收到的来自云平台的数据进行协议转换后，通过第二传输协议发送给安全增强模块。因此，在本步骤中，会议传输设备需要对来自安全增强模块的通讯请求进行协议转换，使其由USB协议转换为MQTT协议，从而传输给云平台。并且，当接收到云平台通过MQTT协议发送的模块证书公钥后，进行协议转换，并通过USB协议发送给安全增强模块。
步骤S6：安全增强模块将模块证书发送给云平台，以供云平台进行设备认证。
其中，安全增强模块先将模块证书发送给会议传输设备，由会议传输设备将模块证书发送给云平台进行设备认证。相应的，会议传输设备将接收到的来自安全增强模块的模块证书发送给云平台，以供云平台进行设备认证。
在一种实现方式中，安全增强模块通过USB协议将密文形式的模块证书发送给会议传输设备，会议传输设备将密文形式的模块证书通过MQTT协议发送给云平台。
步骤S7：云平台接收安全增强模块通过会议传输设备发送的模块证书，针对模块证书进行解析，根据解析结果进行设备认证。
可选的，当模块证书为密文形式时，云平台对接收到的密文形式的模块证书进行解密，得到明文形式的模块证书；将明文形式的模块证书与预先生成的平台证书进行匹配；若匹配成功，则设备认证通过。其中，可通过上文提到的模块证书私钥对密文形式的模块证书进行非对称解密。
其中，明文形式的模块证书包括：辅助校验数据以及安全增强模块解析得到的明文形式的平台证书。正常情况下，安全增强模块解析得到的明文形式的平台证书中包含的安全增强模块的模块信息以及会议传输设备的设备信息与云平台预先生成的平台证书中的相关信息一致。因此，若明文形式的模块证书与预先生成的平台证书匹配成功，则设备认证通过；若匹配不成功，则设备认证失败。
在一种示例中，云端通过对解密后的模块证书明文进行有效信息提取，例如，提取安全增强模块的ID标识，即将安全增强模块内部唯一ID作为会议传输设备在云平台的唯一可信任根。相应的，云平台在比对过程中，将平台提取的安全增强模块内部唯一ID与云端存储的可信任根进行比对。如果比对成功，则认证成功，否则认证失败。云平台将认证结果以明文形式，通过MQTT协议传递给会议传输设备，会议传输设备将认证结果通过USB协议传递给安全增强模块。在该示例中，云平台仅比对安全增强模块 的模块信息，只要安全增强模块的模块信息匹配成功，则认证成功。
为了提升安全性，在其他示例中，云平台不仅比对安全增强模块的模块信息，还要比对会议传输设备的设备信息，只有当安全增强模块的模块信息以及会议传输设备的设备信息的组合关系与云平台预先存储的内容一致时，才认证成功，该方式通过安全增强模块的模块信息以及会议传输设备的设备信息的组合关系进行认证，只要会议传输设备或安全增强模块中的任一设备发生改变则会导致认证失败，从而提升了安全性。
步骤S8：云平台向会议传输设备反馈认证结果。
三、身份验证过程
设备注册和设备认证过程主要用于验证会议传输设备以及安全增强模块的合法性。其中，在其他实施例中，也可以省略设备注册和设备认证过程。例如，当会议传输设备频繁使用时，可以省略设备注册和设备认证过程，直接从身份验证过程开始实施。
身份验证过程旨在验证参会人员的身份是否合法，以避免无关人员参与会议。图5示出了身份验证以及会议数据传输的具体流程示意图。如图5所示，身份验证以及会议数据传输具体包括如下步骤：
步骤S11：会议传输设备接收并获取云平台发送的参会人员配置请求中包含的人员身份信息。
其中，云平台响应于会议配置人员的输入操作，向数据传输设备发送参会人员配置请求，该参会人员配置请求中包含人员身份信息，用以指示参会人员的身份标识。会议传输设备保存该人员身份信息，以便进行后续验证。
例如，云平台进行会议创建，设定参会成员的身份权限，将参会成员的ID通过MQTT协议传递给会议传输设备，以供会议传输设备将参会成员ID在本地进行存储。
步骤S12：会议传输设备将获取到的身份识别数据发送给安全增强模块。
其中，身份识别数据用于标识参会成员的身份。会议传输设备发送的身份识别数据包括以下中的至少一个：用于标识参会人员身份的设备采集数据。其中，设备采集数据包括以下中的至少一个：人脸图像数据、虹膜图像数据、指纹数据、以及密码数据。
其中，会议传输设备可以包括各种采集模块，如摄像头模块、虹膜采集模块、指纹输入模块、以及密码输入模块等。相应的，借助各类采集模块，能够灵活采集多种形式的身份识别数据。另外，在远程会议场景中，身份识别数据还可以为通过各个会议客户端上传的人脸图像数据，以便验证各个会议客户端所对应的参会成员的身份。
例如，通过摄像头采集以及特征提取方式，采集参会成员的信息，并将该信息传递给会议传输设备，会议传输设备提取人脸特征信息，并将该人脸特征信息作为身份识别数据传递给安全增强模块。
步骤S13：安全增强模块将接收到的身份识别数据与安全增强模块预存的安全验证数据进行匹配，根据匹配结果确定与身份识别数据相对应的身份识别结果。
其中，安全增强模块预存的安全验证数据是指：与人员身份验证相关的用户个人数据，如公司内部员工的人脸特征、虹膜特征等。例如，安全验证数据包括：注册成员的特征数据以及注册成员的标识信息。在本实施例中，为了提升用户个人数据的安全性，将上述用户个人数据存储在安全增强模块中，并且，外部设备无法访问安全增强模块中存储的安全验证数据，以提升信息安全性。由此可见，在本实施例中，与身份识别数据相对应的身份识别结果包括：参会人员的标识信息；其中，设备采集数据包括以下中的至少一个：人脸图像数据、虹膜图像数据、指纹数据、以及密码数据；标识信息包括：姓名、唯一标识符、简介信息。
可选的，在接收会议传输设备发送的身份识别数据之前，安全增强模块进一步接收并存储来自上位机的上述安全验证数据。其中，来自上位机 的安全验证数据为密文形式。相应的，在将身份识别数据与安全增强模块预存的安全验证数据进行匹配时，通过验证密钥对密文形式的安全验证数据进行解密处理，得到明文形式的安全验证数据；将身份识别数据与明文形式的安全验证数据进行匹配。其中，验证密钥和解密算法可通过与上位机协商的方式获得。总之，由于安全增强模块内部存储的安全验证数据为密文形式，因此，即使安全增强模块被恶意破解，也不会导致安全验证数据的泄露。
其中，在将身份识别数据与安全增强模块预存的安全验证数据进行匹配时，可通过以下方式实现：
首先，安全增强模块通过对称解密算法和验证密钥对安全验证数据的密文进行解密，得到安全验证数据中包含的人脸特征库(即注册成员的特征数据)和表单(即通过数据表存储的注册成员的标识信息)的明文。安全增强模块将会议传输设备发送的身份识别数据和人脸特征库进行一一比对，记录比对结果最大的顺序号(即相似度最高的人脸特征的号码)，通过该顺序号从表单明文中查询对应的ID号码，并将该ID号码作为身份识别结果发送给设备端。在一种实现方式中，人脸特征库为2万底库，即存储有2万组人脸特征信息，每一组人脸特征信息包含512个浮点数。表单为特征库信息对应的ID号。
步骤S14：安全增强模块将身份识别结果发送给会议传输设备。
步骤S15：会议传输设备根据身份识别结果进行参会成员的身份验证。
其中，会议传输设备接收安全增强模块将身份识别数据与预存的安全验证数据进行匹配后返回的身份识别结果，将身份识别结果与接收到的来自云平台的参会人员配置请求中包含的人员身份信息进行匹配，根据匹配结果验证参会成员的身份。例如，会议传输设备将云平台下发的ID(即人员身份信息)和安全增强模块传输的ID(即从表单明文中查询到的ID号码)进行比对，如果完全匹配，则会议正常开启；如果不匹配，则提示，有无 权限人员参会。
步骤S16：在参会成员的身份验证通过的情况下，会议传输设备将未加密的第一会议数据发送给安全增强模块。
其中，会议传输设备根据会议内容(包含笔记信息等)生成第一会议数据，将该未加密的第一会议数据发送给安全增强模块。
步骤S17：安全增强模块获取与第一会议数据相对应的会议密钥，通过会议密钥对第一会议数据进行加密处理，得到已加密的第二会议数据。
其中，安全增强模块用于对第一会议数据执行加密操作，其中，会议密钥可通过多种方式生成：
在一种实现方式中，会议密钥由安全增强模块生成，并且，为了提升安全性，对会议密钥进行二次加密处理：首先，生成与第一会议数据相对应的会议密钥，通过该会议密钥对第一会议数据进行加密处理。其中，会议密钥可以由安全增强模块根据模块信息计算得到(例如，安全增强模块根据内部的唯一标识号，也叫器件DNA派生出会议密钥B)；或者，会议密钥由安全增强模块根据第一会议数据的数据类型确定，例如，分别针对不同类型和不同安全等级的会议数据设定不同的会议密钥。然后，通过由云平台提供的安全密钥对会议密钥进行加密，得到密文密钥，从而根据加密处理后的第一会议数据以及密文密钥，得到第二会议数据。由此可见，第二会议数据包括：通过会议密钥加密处理后的第一会议数据以及密文密钥(即通过安全密钥对会议密钥加密后的结果)。例如，安全增强模块通过对称加密的方式和会议密钥B对会议内容进行加密，得到会议内容密文，通过会议传输设备发送给云平台。同时通过对称加密的方式和密钥C(安全密钥)对会议密钥B进行加密，得到密钥B密文，通过会议传输设备发送给云平台。相应的，云平台存储上述的第二会议数据。
其中，云平台提供的安全密钥既可以通过对称加密算法产生，也可以通过非对称加密算法产生，并且，安全密钥既可以为固定密钥，也可以为 可变密钥。由于可变密钥能够动态改变，因而适用于安全性更高的场景。并且，安全密钥还可以进一步执行二次加密，以避免明文传输易受攻击的问题。
可选的，通过密钥协商方式动态获取安全密钥：会议传输设备向云平台发送密钥协商请求；根据云平台返回的结果，向安全增强模块提供来自云平台的安全密钥；其中，安全密钥根据会议传输设备的设备业务类型和/或设备认证类型生成。其中，在向安全增强模块提供来自云平台的安全密钥时，将云平台通过平台私钥对安全密钥进行加密后得到的第一密钥发送给安全增强模块，以供安全增强模块通过预先获取到的平台公钥对第一密钥进行解密，得到安全密钥。相应的，安全增强模块接收云平台响应于会议传输设备发送的密钥协商请求返回的安全密钥。例如，安全增强模块接收云平台通过平台私钥对安全密钥进行加密后得到的第一密钥；通过预先获取到的平台公钥对第一密钥进行解密，得到安全密钥。总之，本公开不限定安全密钥的获取频次以及具体加密方式。
在其他实现方式中，还可以直接通过密钥协商请求获取上述的会议密钥，并且，上述的会议密钥既可以用于对称加密，也可以用于非对称加密。
步骤S18：安全增强模块将已加密的第二会议数据发送给会议传输设备。
步骤S19：会议传输设备将已加密的第二会议数据发送给云平台，以供云平台将第二会议数据提供给会议客户端。
步骤S20：会议客户端从云平台获取来自会议传输设备的已加密的第二会议数据。
其中，第二会议数据由安全增强模块利用会议密钥对会议传输设备提供的第一会议数据加密得到。其中，会议客户端可通过云平台提供的会议下载入口(如超链接、下载按钮、共享二维码)获取第二会议数据，本发明不限定具体获取方式。
步骤S21：会议客户端获取会议密钥，通过会议密钥对第二会议数据进 行解密，得到未加密的第一会议数据。
其中，会议客户端获取第二会议数据中包含的密文密钥；其中，密文密钥由云平台提供的安全密钥对会议密钥进行加密得到。相应的，会议客户端通过由云平台提供的安全密钥对密文密钥进行解密，得到会议密钥。其中，安全密钥的获取方式可参照会议传输设备侧的获取方式，此处不再赘述。
例如，会议客户端从云平台下载会议信息密文和密钥B密文，并通过对称解密的方式和内置密钥C(即安全密钥)对密钥B密文进行解密，得到密钥B明文。通过对称解密的方式和密钥B对会议内容密文进行解密，得到会议内容明文。
综上可知，本公开提出了一种基于安全增强模块的安全会议管理系统，通过安全增强模块的加入，在安全增强模块内部进行敏感数据的存储和安全计算，反馈设备计算结果，有效降低敏感数据泄漏风险。同时，在安全增强模块内部进行密钥的管理，增强密钥安全等级。并且，会议内容上云下云进行全链路的密文传递，在设备端和客户端进行私有化密钥共享，保护了会议内容在公有云端的安全性。该安全会议管理系统由会议客户端、云端、设备端(即会议传输设备)、安全增强模块端组成。会议客户端可基于安卓、linux等操作系统设计，本公开不对操作系统环境进行限制。云端包括了公有云、私有云、以及公有云的私有化部署，本公开不对云部署环境进行限制。本实施例中的会议传输设备指会议一体机，安全增强模块可通过USB形式或安全芯片等各类形式接入会议传输设备。
在本实施例中，云平台用于：安全会议创建、安全权限管理、会议内容密文存储，密钥B密文存储等。会议传输设备用于：摄像头采集、特征提取等。安全增强模块用于：敏感数据存储、安全计算、数据加密。会议客户端用于：会议内容密文获取、密钥密文解密、会议内容密文解密。其中，敏感数据加密存储在安全增强模块内部，且敏感数据包括：人脸特征 库、指纹库、数字证书、密钥、表单等。本实施例中指的是人脸特征库和表单，人脸特征库指某一个组织或者公司内部员工的人脸信息，表单指特征信息对应的实物信息，例如ID号码、姓名、年龄等。本实施例中摄像头主要针对参会人员的图像进行采集，并将信息传递给设备端，由设备端进行人脸特征提取，发送给安全增强模块进行人脸特征的比对，根据比对结果，将表单对应的ID信息传递给设备端。其中，安全增强模块至少具有以下特点：敏感数据在安全增强模块内部以密文形式存储。敏感数据通过定制上位机软件加密后存入安全增强模块内部，加密方式为对称加密。安全增强模块内部敏感数据只能写入，不可读出。并且，会议内容全链路密文传输：全链路密文传输由客户端、云端、设备端和安全增强模块端共同完成。云端完成密文存储，设备端完成共享二维码生成，安全增强模块端完成内容加解密，客户端完成会议内容下载以及解密。
另外，本实施例中的安全密钥可根据会议传输设备的认证类型灵活设定：当设备认证类型为第一认证类型(如一机一密类型)时，安全密钥与设备标识相对应。该类型需要分别针对每个设备生成一个密钥，由于设备具有唯一性，因而安全性较高。当设备认证类型为第二认证类型(如一型一密类型)时，安全密钥与设备型号相对应。该类型需要分别针对每个设备型号生成一个密钥，由于同一型号可能包含多个设备，因而安全性略低于第一认证类型的安全密钥。当设备认证类型为第三认证类型(如统一密钥类型)时，安全密钥与设备业务类型相对应。该类型可以针对所有设备都生成统一的安全密钥，因而安全性最低，例如，可以针对同一业务类型的会议传输设备都生成相同的安全密钥。
另外，在本实施例中，会议传输设备与云平台之间通过第一通信协议进行通信，且会议传输设备与安全增强模块之间通过第二通信协议进行通信；其中，第一通信协议包括：MQTT协议，且第二通信协议包括：USB协议。相应的，会议传输设备需要根据数据类型执行对应的协议转换处理。 在本实施例中，由于会议传输设备与云平台之间采用的传输协议不同于会议传输设备与安全增强模块之间采用的传输协议，因此，会议传输设备需要对接收或待发送的数据执行协议转换处理。另外，通过在不同设备间采用不同传输协议，能够避免设备间的网络攻击，提升安全性。
另外，安全增强模块与会议传输设备之间通过预设的应用程序接口进行通信；其中，预设的应用程序接口由对应于安全增强模块的软件开发工具包提供。
由此可见，本公开通过对设备端进行安全增强模块的加入，通过安全增强模块、设备端、平台端的设备认证以及安全数据交互方式的建立，最大限度保护设备端的安全。安全增强模块通过USB接口与设备端进行数据交互，以兼容目前的现有设备。另外，通过安全增强模块与设备端安全SDK构建安全增强模块、设备端、云平台之间的安全数据交互机制。其中，安全增强模块至少具备以下特性：针对密钥、证书等敏感数据进行可信存储，不可以通过USB接口对外发送。并且，敏感数据通过加密方式存储在安全增强模块内部，即使安全增强模块被破解，也无法直接获取到内部存储的已加密的数据的明文信息。例如，安全增强模块内部存储的安全密钥通过二次加密过程，以密文形式存储。另外，安全增强模块内部存储的敏感数据不外发。证书等敏感数据可通过定制的上位机软件写入，且只可写入不可读出。而且，加解密过程均在安全增强模块内部完成，避免了在外部设备中加解密所导致的易受攻击的缺陷。安全增强模块可通过会议传输设备与云平台动态执行密钥协商操作，且密钥协商的频次可根据设备类型以及认证方式灵活调整。并且，通过密钥协商得到的安全密钥可以结合设备类型以及认证方式采取不同的生成方式，从而便于根据数据安全等级确定安全密钥的生成方式，进一步提升安全性。认证过程中的密钥以及数据传输过程中的密钥都可以根据数据类型灵活设定。例如，云平台根据待传输的数据类型动态确定与数据类型相匹配的密钥。即：密钥的种类以及加解密 方式都能根据数据类型和交互过程而灵活设定。例如，可针对不同交互过程选用不同加解密方式，比如对平台证书使用对称密钥，对模块证书使用非对称密钥，从而根据交互过程和数据安全等级设定密钥以及加解密方式。另外，在本公开的应用场景中，安全增强模块由物联网云平台提供，因此，属于可信任设备，而会议传输设备为独立于云平台的外部设备，因而属于不可信设备。为了避免不可信设备遭遇攻击所导致的安全问题，将敏感数据以及加解密过程全部由安全增强模块实施。并且，为了进一步提升安全性，针对安全增强模块设置有软件开发工具包SDK，相应的，会议传输设备只需集成该SDK即可与安全增强模块以及云平台通信。即：安全增强模块与会议传输设备之间通过预设的应用程序接口进行数据传输；并且，应用程序接口由对应于安全增强模块的软件开发工具包提供。由此可见，在本实施例中，会议传输设备与安全增强模块之间传输数据时，必须调用由SDK提供的应用程序接口API函数方可实现。例如，会议传输设备向安全增强模块发送数据时，需要调用与发送的数据类型相匹配的发送类应用程序接口实现；会议传输设备接收安全增强模块返回的数据时，需要调用与接收的数据类型相匹配的接收类应用程序接口实现。由于SDK中包含的各个应用程序接口函数的参数、执行逻辑都是预先定义的，因此，能够在设定SDK的过程中，避免将与访问敏感数据相关的执行逻辑写入接口函数，从而避免敏感数据被恶意访问的问题。
本公开实施例还提供了一种会议传输装置，该装置可以为上文提到的安全增强模块。如图6所示，本公开一个实施例提供的会议传输装置包括：
接收模块61，被配置为在参会成员的身份验证通过的情况下，接收会议传输设备发送的未加密的第一会议数据；
加密模块62，被配置为获取与所述第一会议数据相对应的会议密钥，通过所述会议密钥对所述第一会议数据进行加密处理，得到已加密的第二会议数据；
发送模块63，被配置为将所述已加密的第二会议数据发送给所述会议传输设备，以供所述会议传输设备将所述已加密的第二会议数据通过云平台提供给会议客户端。
在一种可选的实现方式中，所述加密模块具体被配置为：
生成与所述第一会议数据相对应的会议密钥，通过所述会议密钥对所述第一会议数据进行加密处理；
通过由所述云平台提供的安全密钥对所述会议密钥进行加密，得到密文密钥；
根据加密处理后的第一会议数据以及所述密文密钥，得到所述第二会议数据。
在一种可选的实现方式中，所述会议密钥由所述安全增强模块根据模块信息计算得到；或者，所述会议密钥由所述安全增强模块根据所述第一会议数据的数据类型确定。
在一种可选的实现方式中，所述加密模块具体被配置为：
接收所述云平台响应于所述会议传输设备发送的密钥协商请求返回的所述安全密钥；其中，所述安全密钥根据所述会议传输设备的设备业务类型和/或设备认证类型生成。
在一种可选的实现方式中，所述加密模块具体被配置为：
接收所述云平台通过平台私钥对所述安全密钥进行加密后得到的第一密钥；通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
在一种可选的实现方式中，所述装置还包括：
身份验证模块，被配置为接收所述会议传输设备发送的身份识别数据；将所述身份识别数据与所述安全增强模块预存的安全验证数据进行匹配，根据匹配结果确定与所述身份识别数据相对应的身份识别结果；将所述身份识别结果发送给所述会议传输设备，以供所述会议传输设备根据所述身 份识别结果进行参会成员的身份验证。
在一种可选的实现方式中，所述装置还包括：
存储模块，被配置为接收并存储来自上位机的所述安全验证数据；其中，所述来自上位机的所述安全验证数据为密文形式。
在一种可选的实现方式中，所述会议传输设备发送的身份识别数据包括以下中的至少一个：用于标识参会人员身份的设备采集数据；
所述安全验证数据包括：注册成员的特征数据以及注册成员的标识信息；
则所述与所述身份识别数据相对应的身份识别结果包括：参会人员的标识信息；其中，所述设备采集数据包括以下中的至少一个：人脸图像数据、虹膜图像数据、指纹数据、以及密码数据；所述标识信息包括：姓名、唯一标识符、简介信息。
在一种可选的实现方式中，所述装置还包括：
设备认证模块，被配置为接收并存储云平台响应于设备注册请求生成的平台证书；响应于所述会议传输设备发送的认证指令，针对所述平台证书添加辅助校验数据，得到模块证书，将所述模块证书发送给所述会议传输设备，以供所述会议传输设备将所述模块证书提供给所述云平台进行设备认证；其中，在设备认证通过的情况下，执行所述参会成员的身份验证。
本公开实施例还提供了一种会议传输装置，该装置可以为上文提到的会议传输设备。如图7所示，本公开一个实施例提供的会议传输装置包括：
第一发送模块71，被配置为在参会成员的身份验证通过的情况下，将未加密的第一会议数据发送给安全增强模块；
接收模块72，被配置为接收所述安全增强模块通过获取的会议密钥对所述第一会议数据进行加密处理后得到的已加密的第二会议数据；
第二发送模块73，被配置为将所述已加密的第二会议数据发送给云平台，以供所述云平台将所述第二会议数据提供给会议客户端。
在一种可选的实现方式中，所述会议密钥由所述安全增强模块生成，且所述第二会议数据进一步包括：通过由所述云平台提供的安全密钥对所述会议密钥进行加密后得到的密文密钥。
在一种可选的实现方式中，所述装置还包括：
密钥协商模块，被配置为向云平台发送密钥协商请求；根据云平台返回的结果，向安全增强模块提供来自云平台的所述安全密钥；其中，所述安全密钥根据所述会议传输设备的设备业务类型和/或设备认证类型生成。
在一种可选的实现方式中，所述密钥协商模块具体被配置为：
将所述云平台通过平台私钥对所述安全密钥进行加密后得到的第一密钥发送给所述安全增强模块，以供所述安全增强模块通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
在一种可选的实现方式中，所述装置还包括：
身份验证模块，被配置为将获取到的身份识别数据发送给所述安全增强模块；接收所述安全增强模块将所述身份识别数据与预存的安全验证数据进行匹配后返回的身份识别结果；将所述身份识别结果与接收到的来自云平台的参会人员配置请求中包含的人员身份信息进行匹配，根据匹配结果验证参会成员的身份。
在一种可选的实现方式中，所述装置还包括：
注册认证模块，被配置为向所述云平台发送设备注册请求，以使所述安全增强模块接收并存储云平台响应于所述设备注册请求生成的平台证书；向所述安全增强模块发送认证指令，以供所述安全增强模块针对所述平台证书添加辅助校验数据，得到模块证书；将接收到的来自所述安全增强模块的模块证书发送给云平台，以供所述云平台进行设备认证。
本公开实施例还提供了一种会议客户端。如图8所示，本公开一个实施例提供的会议客户端包括：
获取模块81，被配置为从云平台获取来自会议传输设备的已加密的第 二会议数据；其中，所述第二会议数据由安全增强模块利用会议密钥对所述会议传输设备提供的第一会议数据加密得到；
解密模块82，被配置为获取所述会议密钥，通过所述会议密钥对所述第二会议数据进行解密，得到未加密的第一会议数据。
在一种可选的实现方式中，所述获取模块具体被配置为：
获取所述第二会议数据中包含的密文密钥；其中，所述密文密钥由所述云平台提供的安全密钥对所述会议密钥进行加密得到；
通过由所述云平台提供的安全密钥对所述密文密钥进行解密，得到所述会议密钥。
本公开实施例还提供了一种会议传输系统。如图9所示，本公开一个实施例提供的会议传输系统包括：
第一会议传输装置91、第二会议传输装置92、会议客户端93以及云平台94。其中，第一会议传输装置91可以为图6所示的安全增强模块，第二数据传输装置92可以为图7所示的会议传输设备，会议客户端93的结构可参见图8所示。
参照图10，本公开实施例提供一种电子设备，其包括：
一个或多个处理器901；
存储器902，其上存储有一个或多个程序，当一个或多个程序被一个或多个处理器执行，使得一个或多个处理器实现上述任意一项的会议数据的传输方法；
一个或多个I/O接口903，连接在处理器与存储器之间，配置为实现处理器与存储器的信息交互。
其中，处理器901为具有数据处理能力的器件，其包括但不限于中央处理器(CPU)等；存储器902为具有数据存储能力的器件，其包括但不限于随机存取存储器(RAM，更具体如SDRAM、DDR等)、只读存储器(ROM)、带电可擦可编程只读存储器(EEPROM)、闪存(FLASH)；I/O 接口(读写接口)903连接在处理器901与存储器902间，能实现处理器901与存储器902的信息交互，其包括但不限于数据总线(Bus)等。
在一些实施例中，处理器901、存储器902和I/O接口903通过总线相互连接，进而与计算设备的其它组件连接。
本实施例还提供一种计算机可读介质，其上存储有计算机程序，程序被处理器执行时实现本实施例提供的会议数据的传输方法，为避免重复描述，在此不再赘述会议数据的传输方法的具体步骤。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、系统、装置中的功能模块/单元可以被实施为软件、固件、硬件及其适当的组合。在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其它数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其它存储器技术、CD-ROM、数字多功能盘(DVD)或其它光盘存储、磁盒、磁带、磁盘存储或其它磁存储器、或者可以用于存储期望的信息并且可以被计算机访问的任何其它的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其它传输机制之类的调制数据信号中的其它数据，并且可包括任何信息递送介质。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变 体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。
可以理解的是，以上实施方式仅仅是为了说明本公开/实用新型的原理而采用的示例性实施方式，然而本公开/实用新型并不局限于此。对于本领域内的普通技术人员而言，在不脱离本公开/实用新型的精神和实质的情况下，可以做出各种变型和改进，这些变型和改进也视为本公开/实用新型的保护范围。

Claims (25)

  1. 一种会议数据的传输方法，应用于安全增强模块，其包括：
    在参会成员的身份验证通过的情况下，接收会议传输设备发送的未加密的第一会议数据；
    获取与所述第一会议数据相对应的会议密钥，通过所述会议密钥对所述第一会议数据进行加密处理，得到已加密的第二会议数据；
    将所述已加密的第二会议数据发送给所述会议传输设备，以供所述会议传输设备将所述已加密的第二会议数据通过云平台提供给会议客户端。
  2. 根据权利要求1所述的方法，其中，所述获取与所述第一会议数据相对应的会议密钥，通过所述会议密钥对所述第一会议数据进行加密处理，得到已加密的第二会议数据包括：
    生成与所述第一会议数据相对应的会议密钥，通过所述会议密钥对所述第一会议数据进行加密处理；
    通过由所述云平台提供的安全密钥对所述会议密钥进行加密，得到密文密钥；
    根据加密处理后的第一会议数据以及所述密文密钥，得到所述第二会议数据。
  3. 根据权利要求2所述的方法，其中，所述会议密钥由所述安全增强模块根据模块信息计算得到；或者，所述会议密钥由所述安全增强模块根据所述第一会议数据的数据类型确定。
  4. 根据权利要求2所述的方法，其中，所述通过由所述云平台提供的安全密钥对所述会议密钥进行加密之前，还包括：
    接收所述云平台响应于所述会议传输设备发送的密钥协商请求返回的所述安全密钥；其中，所述安全密钥根据所述会议传输设备的设备业务类型和/或设备认证类型生成。
  5. 根据权利要求4所述的方法，其中，所述接收所述云平台响应于所 述会议传输设备发送的密钥协商请求返回的所述安全密钥包括：
    接收所述云平台通过平台私钥对所述安全密钥进行加密后得到的第一密钥；通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
  6. 根据权利要求1-5任一所述的方法，其中，所述参会成员的身份验证包括：
    接收所述会议传输设备发送的身份识别数据；
    将所述身份识别数据与所述安全增强模块预存的安全验证数据进行匹配，根据匹配结果确定与所述身份识别数据相对应的身份识别结果；
    将所述身份识别结果发送给所述会议传输设备，以供所述会议传输设备根据所述身份识别结果进行参会成员的身份验证。
  7. 根据权利要求6所述的方法，其中，所述接收所述会议传输设备发送的身份识别数据之前，还包括：接收并存储来自上位机的所述安全验证数据；其中，所述来自上位机的所述安全验证数据为密文形式；
    则所述将所述身份识别数据与所述安全增强模块预存的安全验证数据进行匹配包括：
    通过验证密钥对密文形式的安全验证数据进行解密处理，得到明文形式的安全验证数据；将所述身份识别数据与明文形式的安全验证数据进行匹配。
  8. 根据权利要求7所述的方法，其中，所述会议传输设备发送的身份识别数据包括以下中的至少一个：用于标识参会人员身份的设备采集数据；
    所述安全验证数据包括：注册成员的特征数据以及注册成员的标识信息；
    则所述与所述身份识别数据相对应的身份识别结果包括：参会人员的标识信息；其中，所述设备采集数据包括以下中的至少一个：人脸图像数据、虹膜图像数据、指纹数据、以及密码数据；所述标识信息包括：姓名、 唯一标识符、简介信息。
  9. 根据权利要求6所述的方法，其中，所述参会成员的身份验证之前，还包括：
    接收并存储云平台响应于设备注册请求生成的平台证书；
    响应于所述会议传输设备发送的认证指令，针对所述平台证书添加辅助校验数据，得到模块证书，将所述模块证书发送给所述会议传输设备，以供所述会议传输设备将所述模块证书提供给所述云平台进行设备认证；其中，在设备认证通过的情况下，执行所述参会成员的身份验证。
  10. 根据权利要求1-5任一所述的方法，其中，所述安全增强模块与所述会议传输设备之间通过预设的应用程序接口进行通信；其中，所述预设的应用程序接口由对应于所述安全增强模块的软件开发工具包提供。
  11. 一种会议数据的传输方法，应用于会议传输设备，其包括：
    在参会成员的身份验证通过的情况下，将未加密的第一会议数据发送给安全增强模块；
    接收所述安全增强模块通过获取的会议密钥对所述第一会议数据进行加密处理后得到的已加密的第二会议数据；
    将所述已加密的第二会议数据发送给云平台，以供所述云平台将所述第二会议数据提供给会议客户端。
  12. 根据权利要求11所述的方法，其中，所述会议密钥由所述安全增强模块生成，且所述第二会议数据进一步包括：通过由所述云平台提供的安全密钥对所述会议密钥进行加密后得到的密文密钥。
  13. 根据权利要求12所述的方法，其中，所述接收所述安全增强模块通过获取的会议密钥对所述第一会议数据进行加密处理后得到的已加密的第二会议数据之前，还包括：
    向云平台发送密钥协商请求；
    根据云平台返回的结果，向安全增强模块提供来自云平台的所述安全 密钥；其中，所述安全密钥根据所述会议传输设备的设备业务类型和/或设备认证类型生成。
  14. 根据权利要求13所述的方法，其中，所述向安全增强模块提供来自云平台的所述安全密钥包括：
    将所述云平台通过平台私钥对所述安全密钥进行加密后得到的第一密钥发送给所述安全增强模块，以供所述安全增强模块通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
  15. 根据权利要求11-14任一所述的方法，其中，所述将未加密的第一会议数据发送给安全增强模块之前，还包括：
    将获取到的身份识别数据发送给所述安全增强模块；
    接收所述安全增强模块将所述身份识别数据与预存的安全验证数据进行匹配后返回的身份识别结果；
    将所述身份识别结果与接收到的来自云平台的参会人员配置请求中包含的人员身份信息进行匹配，根据匹配结果验证参会成员的身份。
  16. 根据权利要求11-14任一所述的方法，其中，所述参会成员的身份验证之前，还包括：
    向所述云平台发送设备注册请求，以使所述安全增强模块接收并存储云平台响应于所述设备注册请求生成的平台证书；
    向所述安全增强模块发送认证指令，以供所述安全增强模块针对所述平台证书添加辅助校验数据，得到模块证书；
    将接收到的来自所述安全增强模块的模块证书发送给云平台，以供所述云平台进行设备认证。
  17. 根据权利要求11-14任一所述的方法，其中，所述会议传输设备与所述云平台之间通过第一通信协议进行通信，且所述会议传输设备与所述安全增强模块之间通过第二通信协议进行通信；其中，所述第一通信协议包括：MQTT协议，且所述第二通信协议包括：USB协议。
  18. 一种会议数据的传输方法，应用于会议客户端，其包括：
    从云平台获取来自会议传输设备的已加密的第二会议数据；其中，所述第二会议数据由安全增强模块利用会议密钥对所述会议传输设备提供的第一会议数据加密得到；
    获取所述会议密钥，通过所述会议密钥对所述第二会议数据进行解密，得到未加密的第一会议数据。
  19. 根据权利要求18所述的方法，其中，所述获取所述会议密钥包括：
    获取所述第二会议数据中包含的密文密钥；其中，所述密文密钥由所述云平台提供的安全密钥对所述会议密钥进行加密得到；
    通过由所述云平台提供的安全密钥对所述密文密钥进行解密，得到所述会议密钥。
  20. 一种会议数据传输装置，其包括：
    接收模块，被配置为在参会成员的身份验证通过的情况下，接收会议传输设备发送的未加密的第一会议数据；
    加密模块，被配置为获取与所述第一会议数据相对应的会议密钥，通过所述会议密钥对所述第一会议数据进行加密处理，得到已加密的第二会议数据；
    发送模块，被配置为将所述已加密的第二会议数据发送给所述会议传输设备，以供所述会议传输设备将所述已加密的第二会议数据通过云平台提供给会议客户端。
  21. 一种会议数据传输装置，其包括：
    第一发送模块，被配置为在参会成员的身份验证通过的情况下，将未加密的第一会议数据发送给安全增强模块；
    接收模块，被配置为接收所述安全增强模块通过获取的会议密钥对所述第一会议数据进行加密处理后得到的已加密的第二会议数据；
    第二发送模块，被配置为将所述已加密的第二会议数据发送给云平台， 以供所述云平台将所述第二会议数据提供给会议客户端。
  22. 一种会议客户端，其包括：
    获取模块，被配置为从云平台获取来自会议传输设备的已加密的第二会议数据；其中，所述第二会议数据由安全增强模块利用会议密钥对所述会议传输设备提供的第一会议数据加密得到；
    解密模块，被配置为获取所述会议密钥，通过所述会议密钥对所述第二会议数据进行解密，得到未加密的第一会议数据。
  23. 一种会议传输系统，其包括：
    权利要求20所述的数据传输装置、权利要求21所述的数据传输装置、权利要求22所述的会议客户端以及云平台。
  24. 一种电子设备，其包括：
    一个或多个处理器；
    存储器，其上存储有一个或多个程序，当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现根据权利要求1-10、权利要求11-17或18-19中任意一项所述的方法；
    一个或多个I/O接口，连接在所述处理器与存储器之间，配置为实现所述处理器与存储器的信息交互。
  25. 一种计算机可读介质，其上存储有计算机程序，所述程序被处理器执行时实现根据权利要求1-10、权利要求11-17或18-19中任意一项所述的方法。
PCT/CN2022/074249 2022-01-27 2022-01-27 会议数据的传输方法、装置、系统、电子设备及可读介质 WO2023141864A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202280000082.2A CN116830564A (zh) 2022-01-27 2022-01-27 会议数据的传输方法、装置、系统、电子设备及可读介质
PCT/CN2022/074249 WO2023141864A1 (zh) 2022-01-27 2022-01-27 会议数据的传输方法、装置、系统、电子设备及可读介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/074249 WO2023141864A1 (zh) 2022-01-27 2022-01-27 会议数据的传输方法、装置、系统、电子设备及可读介质

Publications (1)

Publication Number Publication Date
WO2023141864A1 true WO2023141864A1 (zh) 2023-08-03

Family

ID=87469892

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/074249 WO2023141864A1 (zh) 2022-01-27 2022-01-27 会议数据的传输方法、装置、系统、电子设备及可读介质

Country Status (2)

Country Link
CN (1) CN116830564A (zh)
WO (1) WO2023141864A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080263648A1 (en) * 2007-04-17 2008-10-23 Infosys Technologies Ltd. Secure conferencing over ip-based networks
CN110475095A (zh) * 2019-08-21 2019-11-19 苏州科达科技股份有限公司 一种会议控制方法、装置、设备及可读存储介质
CN110489979A (zh) * 2019-07-10 2019-11-22 平安科技（深圳）有限公司 会议信息展示方法、装置、计算机设备和存储介质
CN110505201A (zh) * 2019-07-10 2019-11-26 平安科技（深圳）有限公司 会议信息处理方法、装置、计算机设备和存储介质
CN111355921A (zh) * 2020-04-13 2020-06-30 随锐科技集团股份有限公司 一种视频会议加密方法及系统
CN112672098A (zh) * 2020-12-30 2021-04-16 北京弈天诚达科技有限公司 一种云视频会议加密方法、装置及系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080263648A1 (en) * 2007-04-17 2008-10-23 Infosys Technologies Ltd. Secure conferencing over ip-based networks
CN110489979A (zh) * 2019-07-10 2019-11-22 平安科技（深圳）有限公司 会议信息展示方法、装置、计算机设备和存储介质
CN110505201A (zh) * 2019-07-10 2019-11-26 平安科技（深圳）有限公司 会议信息处理方法、装置、计算机设备和存储介质
CN110475095A (zh) * 2019-08-21 2019-11-19 苏州科达科技股份有限公司 一种会议控制方法、装置、设备及可读存储介质
CN111355921A (zh) * 2020-04-13 2020-06-30 随锐科技集团股份有限公司 一种视频会议加密方法及系统
CN112672098A (zh) * 2020-12-30 2021-04-16 北京弈天诚达科技有限公司 一种云视频会议加密方法、装置及系统

Also Published As

Publication number Publication date
CN116830564A (zh) 2023-09-29

Similar Documents

Publication Publication Date Title
US11647023B2 (en) Out-of-band authentication to access web-service with indication of physical access to client device
JP6571250B2 (ja) ある装置を使用して別の装置をアンロックする方法
US10412061B2 (en) Method and system for encrypted communications
US11824644B2 (en) Controlling electronically communicated resources
EP3602991B1 (en) Mechanism for achieving mutual identity verification via one-way application-device channels
US20220191016A1 (en) Methods, apparatuses, and computer program products for frictionless electronic signature management
US9762567B2 (en) Wireless communication of a user identifier and encrypted time-sensitive data
US20090158033A1 (en) Method and apparatus for performing secure communication using one time password
CN114500536B (zh) 云边协同方法及系统、装置、云平台、设备、介质
KR20150092140A (ko) 지문 인증 기반 이미지 관리 시스템 및 이미지 관리 방법
JP2011176435A (ja) 秘密鍵共有システム、方法、データ処理装置、管理サーバ、及びプログラム
CN112995144A (zh) 文件处理方法、系统、可读存储介质及电子设备
US20240039707A1 (en) Mobile authenticator for performing a role in user authentication
KR101745482B1 (ko) 스마트홈 시스템에서의 통신 방법 및 그 장치
KR101900060B1 (ko) 공유기와 연계되어 동작하는 보안요소, 공유기 및 이를 이용한 네트워크 형성 방법
WO2023141864A1 (zh) 会议数据的传输方法、装置、系统、电子设备及可读介质
KR20180034199A (ko) 싱글 사인 온 서비스 기반의 상호 인증 방법 및 시스템
WO2023141876A1 (zh) 数据传输方法、装置、系统、电子设备及可读介质
JP5660454B2 (ja) プライバシを保障した機器間接続方法
US11943349B2 (en) Authentication through secure sharing of digital secrets previously established between devices
KR102476270B1 (ko) 웨어러블 기기, 이의 인증 방법, 그리고 인증 서버의 인증 방법
JP2022190213A (ja) 多要素認証のための方法および装置
CN117376006A (zh) 一种临时会话密钥安全通信方法、装置、电子设备及介质

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 202280000082.2

Country of ref document: CN

WWE Wipo information: entry into national phase

Ref document number: 18016425

Country of ref document: US

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22922713

Country of ref document: EP

Kind code of ref document: A1