ABSTRACT
Abstract
The disclosure provides a key generation method and apparatus. The key generation method comprises: encrypting a first key factor generated by a first device with an initial key, and sending the encrypted first key factor to a second device through a first secure channel, wherein the initial key is a key preset for the first device and the second device; receiving, through the first secure channel, a second key factor encrypted with the initial key, wherein the second key factor is generated by the second device; decrypting the second key factor encrypted with the initial key and received through the first secure channel, so as to obtain the second key factor; and generating a shared key between the first device and the second device according to the first key factor and the second key factor. According to the disclosed embodiments, a gateway device is unable to acquire a shared key negotiated between a first device and a second device, ensuring the security of data transmitted there between, and further reducing the risk of data being illegally captured during transmission.
Description
CROSS-REFERENCE TO RELATED APPLICATIONS
The present disclosure is a continuation of, and claims priority to, U.S. application Ser. No. 15/752,743 (now U.S. Pat. No. 10,693,634), filed Feb. 14, 2018, entitled âKEY GENERATION METHOD AND APPARATUS USING DOUBLE ENCRYPTION,â which claims priority to Chinese Patent Application No. 201510531892.2, filed on Aug. 26, 2015 entitled âMETHOD AND APPARATUS FOR KEY GENERATIONâ and PCT Appl. No. PCT/CN16/95522 filed on Aug. 16, 2016 and entitled âKEY GENERATION METHOD AND APPARATUS,â each of which is incorporated herein by reference in their entirety.
BACKGROUND
Technical Field
The disclosed embodiments relate to the field of network security technologies, and in particular, to key generation methods and apparatuses.
Description of the Related Art
In order to ensure secure transmission of data between a terminal device and a gateway device and between the gateway device and a public network server, respective secure transmission channels are usually established between the terminal device and the gateway device and between the gateway device and the public network server. The gateway device forwards data from one secure channel to another secure channel to implement data forwarding. However, during data forwarding, the gateway device needs to decrypt (with a key shared with the terminal device) data encrypted by the terminal device, and then encrypt the data with a key shared with the server before forwarding the data to the server. Therefore, the gateway device risks leaking data information.
SUMMARY
In view of this deficiency, the disclosure provides a novel technical solution, in which a gateway device will not be able to acquire a shared key between two devices, thereby reducing the risk of data being illegally captured during network transmission.
In order to achieve the aforementioned objective, the disclosure provides the following technical solutions.
According to a first aspect of the disclosure, a key generation method is provided, which is applied to a first device, the method comprising: encrypting a first key factor generated by the first device with an initial key, and sending the encrypted first key factor to a second device through a first secure channel, wherein the initial key is a key preset for the first device and the second device; receiving, through the first secure channel, a second key factor encrypted with the initial key, wherein the second key factor is generated by the second device; decrypting the second key factor encrypted with the initial key and received through the first secure channel, so as to obtain the second key factor; and generating a shared key between the first device and the second device according to the first key factor and the second key factor.
According to a second aspect of the disclosure, a key generation method is provided, which is applied to a second device, the method comprising: receiving, from a first device through a second secure channel, a first key factor encrypted with an initial key, wherein the initial key is a key preset between the first device and the second device; decrypting the first key factor encrypted with the initial key, so as to obtain the first key factor; and generating a shared key between the first device and the second device according to the first key factor and a second key factor generated by the second device.
According to a third aspect of the disclosure, a key generation apparatus is provided, which is applied to a first device, the method comprising: a first encryption module, configured to encrypt a first key factor generated by the first device with an initial key, and sending the encrypted first key factor to a second device through a first secure channel, wherein the initial key is a key preset for the first device and the second device; a first receiving module, configured to receive, through the first secure channel, a second key factor encrypted with the initial key, wherein the second key factor is generated by the second device; a first decryption module, configured to decrypt the second key factor encrypted with the initial key and received by the first receiving module through the first secure channel, so as to obtain the second key factor. A first key generation module, configured to generate a shared key between the first device and the second device according to the first key factor and the second key factor decrypted by the first decryption module.
According to a fourth aspect of the disclosure, a key generation apparatus is provided, which is applied to a second device, the method comprising: a third receiving module, configured to receive, from a first device through a second secure channel, a first key factor encrypted with an initial key, wherein the initial key is a key preset between the first device and the second device; a third decryption module, configured to decrypt the first key factor encrypted with the initial key, so as to obtain the first key factor. A second key generation module, configured to generate a shared key between the first device and the second device according to the first key factor and a second key factor generated by the second device.
As can be seen from the aforementioned technical solutions, a first key factor and a second key factor are both encrypted with an initial key when being forwarded by a gateway device. The initial key is a key preset for a first device and a second device. The gateway device, therefore, will not be able to know the first key factor and the second key factor; a shared key between the first device and the second device is generated through the first key factor and the second key factor. The finally negotiated shared key is therefore only known to the first device and the second device. The gateway device still is not able to acquire the negotiated shared key, thus ensuring a secure data transmission between the first device and the second device, and further reducing the risk of the data being illegally captured during transmission.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure.
FIG. 2 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure.
FIG. 3 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure.
FIG. 4 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure.
FIG. 5 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure.
FIG. 6 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure.
FIG. 7 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure.
FIG. 8 is a swim lane diagram illustrating key negotiation between a terminal device and a server according to some embodiments of the disclosure.
FIG. 9 is a swim lane diagram illustrating data transmission between a terminal device and a server according to some embodiments of the disclosure.
FIG. 10 is a block diagram illustrating a terminal device according to some embodiments of the disclosure.
FIG. 11 is a block diagram illustrating a server according to some embodiments of the disclosure.
FIG. 12 is a block diagram illustrating a key generation apparatus according to some embodiments of the disclosure.
FIG. 13 is a block diagram illustrating a key generation apparatus according to some embodiments of the disclosure.
FIG. 14 is a block diagram illustrating a key generation apparatus according to some embodiments of the disclosure.
FIG. 15 is a block diagram illustrating a key generation apparatus according to some embodiments of the disclosure.
DETAILED DESCRIPTION
Exemplary embodiments will be described in detail here, and examples thereof are shown in the drawings. The following description refers to the drawings in which the same numbers in different drawings represent the same or similar elements unless otherwise indicated. Implementations described in the following exemplary embodiments are not representative of all implementations consistent with the disclosure. Instead, they are merely examples of apparatuses and methods consistent with some aspects of the disclosure as recited in the appended claims.
The terms used in the disclosure are for the purpose of describing particular embodiments only and are not intended to limit the disclosure. The singular forms âaâ, âanâ, and âtheâ used in the disclosure are also intended to include plural forms, unless the context clearly indicates otherwise. It should also be understood that the term âand/orâ as used herein refers to and encompasses any or all possible combinations of one or more of the associated listed items.
It should be understood that although various types of information may be described using terms such as first, second, and third in the disclosure, such information should not be limited by these terms. These terms are only used to distinguish one type of information from another type of information. For example, first information may also be referred to as second information; and similarly, second information may also be referred to as first information without departing from the scope of the disclosure. Depending on the context, the word âifâ as used herein may be construed to mean âwhen . . . â or âupon . . . â or âin response to determiningâ.
The following embodiments are provided to further describe the disclosure.
According to an embodiment of the disclosure, a first key factor and a second key factor are both encrypted with an initial key when being forwarded by a gateway device. The initial key is a key preset for a first device and a second device. The gateway device, therefore, will not be able to know the first key factor and the second key factor. A shared key between the first device and the second device is generated through the first key factor and the second key factor. The finally negotiated shared key is therefore only known to the first device and the second device. The gateway device still is not able to acquire the negotiated shared key, thus ensuring a secure data transmission between the first device and the second device, and further reducing the risk of the data being illegally captured during transmission.
FIG. 1 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure. In the illustrated embodiment, a first device may be a terminal device, and a second device may be a server. Alternatively, the first device may be a server, and the second device may be a terminal device. The illustrated embodiment is exemplarily described by being applied to a terminal device as an example. As shown in FIG. 1 , the key generation method includes the following steps.
Step 101 : Encrypt a first key factor generated by the first device with an initial key, and sending the encrypted first key factor to a second device through a first secure channel, wherein the initial key is a key preset for the first device and the second device.
Step 102 : Receive, through the first secure channel, a second key factor encrypted with the initial key, wherein the second key factor is generated by the second device.
Step 103 : Decrypt the second key factor encrypted with the initial key and received through the first secure channel, so as to obtain the second key factor.
Step 104 : Generate a shared key between the first device and the second device according to the first key factor and the second key factor.
Regarding step 101 , in one embodiment, an initial key K basic may be issued by the second device to the first device before the first device is put into use. The initial key K basic may be issued to the first device by writing the initial key in the hardware of the device. In one embodiment, relevant information is forwarded by a gateway device between the first device and the second device, wherein the first secure channel may be established through negotiation between the first device and the gateway device. The relevant information is transmitted through the first secure channel. A second secure channel may be established through negotiation between a server and the gateway device. The relevant information is transmitted through the second secure channel. Those skilled in the art should understand that the process of establishing the first secure channel and the second secure channel may be performed using an existing security protocol. For example, a key negotiation mechanism of Secure Socket Layer (SSL for short) or Transport Layer Security (TLS for short) may be used for this purpose.
In one embodiment, when the first device needs to initiate a key negotiation procedure with the second device, the first key factor is generated through a pseudo-random function. The first key factor is encrypted using the initial key to obtain the first key factor after being subjected to a first encryption. The first key factor after being subjected to the first encryption is encrypted using a first encryption key of the first secure channel to obtain the first key factor after being subjected to a second encryption. The first key factor is double-encrypted so that the first key factor is unknown to the gateway device, avoiding the risk of the first key factor being illegally captured at the gateway device.
In step 103 , the double-encrypted second key factor is decrypted with the first encryption key to obtain the second key factor after being subjected to the first decryption. The second key factor after being subjected to the first decryption is decrypted with the initial key to obtain the second key factor. Since the second key factor is already double-encrypted at the second device, the second key factor is unknown to the gateway device, avoiding the risk of the second key factor being illegally captured at the gateway device side.
Regarding how to generate a shared key between the first device and the second device according to the first key factor and the second key factor in step 104 , r
CROSS-REFERENCE TO RELATED APPLICATIONS
The present disclosure is a continuation of, and claims priority to, U.S. application Ser. No. 15/752,743 (now U.S. Pat. No. 10,693,634), filed Feb. 14, 2018, entitled âKEY GENERATION METHOD AND APPARATUS USING DOUBLE ENCRYPTION,â which claims priority to Chinese Patent Application No. 201510531892.2, filed on Aug. 26, 2015 entitled âMETHOD AND APPARATUS FOR KEY GENERATIONâ and PCT Appl. No. PCT/CN16/95522 filed on Aug. 16, 2016 and entitled âKEY GENERATION METHOD AND APPARATUS,â each of which is incorporated herein by reference in their entirety.
BACKGROUND
Technical Field
The disclosed embodiments relate to the field of network security technologies, and in particular, to key generation methods and apparatuses.
Description of the Related Art
In order to ensure secure transmission of data between a terminal device and a gateway device and between the gateway device and a public network server, respective secure transmission channels are usually established between the terminal device and the gateway device and between the gateway device and the public network server. The gateway device forwards data from one secure channel to another secure channel to implement data forwarding. However, during data forwarding, the gateway device needs to decrypt (with a key shared with the terminal device) data encrypted by the terminal device, and then encrypt the data with a key shared with the server before forwarding the data to the server. Therefore, the gateway device risks leaking data information.
SUMMARY
In view of this deficiency, the disclosure provides a novel technical solution, in which a gateway device will not be able to acquire a shared key between two devices, thereby reducing the risk of data being illegally captured during network transmission.
In order to achieve the aforementioned objective, the disclosure provides the following technical solutions.
According to a first aspect of the disclosure, a key generation method is provided, which is applied to a first device, the method comprising: encrypting a first key factor generated by the first device with an initial key, and sending the encrypted first key factor to a second device through a first secure channel, wherein the initial key is a key preset for the first device and the second device; receiving, through the first secure channel, a second key factor encrypted with the initial key, wherein the second key factor is generated by the second device; decrypting the second key factor encrypted with the initial key and received through the first secure channel, so as to obtain the second key factor; and generating a shared key between the first device and the second device according to the first key factor and the second key factor.
According to a second aspect of the disclosure, a key generation method is provided, which is applied to a second device, the method comprising: receiving, from a first device through a second secure channel, a first key factor encrypted with an initial key, wherein the initial key is a key preset between the first device and the second device; decrypting the first key factor encrypted with the initial key, so as to obtain the first key factor; and generating a shared key between the first device and the second device according to the first key factor and a second key factor generated by the second device.
According to a third aspect of the disclosure, a key generation apparatus is provided, which is applied to a first device, the method comprising: a first encryption module, configured to encrypt a first key factor generated by the first device with an initial key, and sending the encrypted first key factor to a second device through a first secure channel, wherein the initial key is a key preset for the first device and the second device; a first receiving module, configured to receive, through the first secure channel, a second key factor encrypted with the initial key, wherein the second key factor is generated by the second device; a first decryption module, configured to decrypt the second key factor encrypted with the initial key and received by the first receiving module through the first secure channel, so as to obtain the second key factor. A first key generation module, configured to generate a shared key between the first device and the second device according to the first key factor and the second key factor decrypted by the first decryption module.
According to a fourth aspect of the disclosure, a key generation apparatus is provided, which is applied to a second device, the method comprising: a third receiving module, configured to receive, from a first device through a second secure channel, a first key factor encrypted with an initial key, wherein the initial key is a key preset between the first device and the second device; a third decryption module, configured to decrypt the first key factor encrypted with the initial key, so as to obtain the first key factor. A second key generation module, configured to generate a shared key between the first device and the second device according to the first key factor and a second key factor generated by the second device.
As can be seen from the aforementioned technical solutions, a first key factor and a second key factor are both encrypted with an initial key when being forwarded by a gateway device. The initial key is a key preset for a first device and a second device. The gateway device, therefore, will not be able to know the first key factor and the second key factor; a shared key between the first device and the second device is generated through the first key factor and the second key factor. The finally negotiated shared key is therefore only known to the first device and the second device. The gateway device still is not able to acquire the negotiated shared key, thus ensuring a secure data transmission between the first device and the second device, and further reducing the risk of the data being illegally captured during transmission.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure.
FIG. 2 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure.
FIG. 3 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure.
FIG. 4 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure.
FIG. 5 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure.
FIG. 6 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure.
FIG. 7 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure.
FIG. 8 is a swim lane diagram illustrating key negotiation between a terminal device and a server according to some embodiments of the disclosure.
FIG. 9 is a swim lane diagram illustrating data transmission between a terminal device and a server according to some embodiments of the disclosure.
FIG. 10 is a block diagram illustrating a terminal device according to some embodiments of the disclosure.
FIG. 11 is a block diagram illustrating a server according to some embodiments of the disclosure.
FIG. 12 is a block diagram illustrating a key generation apparatus according to some embodiments of the disclosure.
FIG. 13 is a block diagram illustrating a key generation apparatus according to some embodiments of the disclosure.
FIG. 14 is a block diagram illustrating a key generation apparatus according to some embodiments of the disclosure.
FIG. 15 is a block diagram illustrating a key generation apparatus according to some embodiments of the disclosure.
DETAILED DESCRIPTION
Exemplary embodiments will be described in detail here, and examples thereof are shown in the drawings. The following description refers to the drawings in which the same numbers in different drawings represent the same or similar elements unless otherwise indicated. Implementations described in the following exemplary embodiments are not representative of all implementations consistent with the disclosure. Instead, they are merely examples of apparatuses and methods consistent with some aspects of the disclosure as recited in the appended claims.
The terms used in the disclosure are for the purpose of describing particular embodiments only and are not intended to limit the disclosure. The singular forms âaâ, âanâ, and âtheâ used in the disclosure are also intended to include plural forms, unless the context clearly indicates otherwise. It should also be understood that the term âand/orâ as used herein refers to and encompasses any or all possible combinations of one or more of the associated listed items.
It should be understood that although various types of information may be described using terms such as first, second, and third in the disclosure, such information should not be limited by these terms. These terms are only used to distinguish one type of information from another type of information. For example, first information may also be referred to as second information; and similarly, second information may also be referred to as first information without departing from the scope of the disclosure. Depending on the context, the word âifâ as used herein may be construed to mean âwhen . . . â or âupon . . . â or âin response to determiningâ.
The following embodiments are provided to further describe the disclosure.
According to an embodiment of the disclosure, a first key factor and a second key factor are both encrypted with an initial key when being forwarded by a gateway device. The initial key is a key preset for a first device and a second device. The gateway device, therefore, will not be able to know the first key factor and the second key factor. A shared key between the first device and the second device is generated through the first key factor and the second key factor. The finally negotiated shared key is therefore only known to the first device and the second device. The gateway device still is not able to acquire the negotiated shared key, thus ensuring a secure data transmission between the first device and the second device, and further reducing the risk of the data being illegally captured during transmission.
FIG. 1 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure. In the illustrated embodiment, a first device may be a terminal device, and a second device may be a server. Alternatively, the first device may be a server, and the second device may be a terminal device. The illustrated embodiment is exemplarily described by being applied to a terminal device as an example. As shown in FIG. 1 , the key generation method includes the following steps.
Step 101 : Encrypt a first key factor generated by the first device with an initial key, and sending the encrypted first key factor to a second device through a first secure channel, wherein the initial key is a key preset for the first device and the second device.
Step 102 : Receive, through the first secure channel, a second key factor encrypted with the initial key, wherein the second key factor is generated by the second device.
Step 103 : Decrypt the second key factor encrypted with the initial key and received through the first secure channel, so as to obtain the second key factor.
Step 104 : Generate a shared key between the first device and the second device according to the first key factor and the second key factor.
Regarding step 101 , in one embodiment, an initial key K basic may be issued by the second device to the first device before the first device is put into use. The initial key K basic may be issued to the first device by writing the initial key in the hardware of the device. In one embodiment, relevant information is forwarded by a gateway device between the first device and the second device, wherein the first secure channel may be established through negotiation between the first device and the gateway device. The relevant information is transmitted through the first secure channel. A second secure channel may be established through negotiation between a server and the gateway device. The relevant information is transmitted through the second secure channel. Those skilled in the art should understand that the process of establishing the first secure channel and the second secure channel may be performed using an existing security protocol. For example, a key negotiation mechanism of Secure Socket Layer (SSL for short) or Transport Layer Security (TLS for short) may be used for this purpose.
In one embodiment, when the first device needs to initiate a key negotiation procedure with the second device, the first key factor is generated through a pseudo-random function. The first key factor is encrypted using the initial key to obtain the first key factor after being subjected to a first encryption. The first key factor after being subjected to the first encryption is encrypted using a first encryption key of the first secure channel to obtain the first key factor after being subjected to a second encryption. The first key factor is double-encrypted so that the first key factor is unknown to the gateway device, avoiding the risk of the first key factor being illegally captured at the gateway device.
In step 103 , the double-encrypted second key factor is decrypted with the first encryption key to obtain the second key factor after being subjected to the first decryption. The second key factor after being subjected to the first decryption is decrypted with the initial key to obtain the second key factor. Since the second key factor is already double-encrypted at the second device, the second key factor is unknown to the gateway device, avoiding the risk of the second key factor being illegally captured at the gateway device side.
Regarding how to generate a shared key between the first device and the second device according to the first key factor and the second key factor in step 104 , reference may be made to the description of the embodiments described herein. Step 104 is not described in detail herein, but the description herein is incorporated by reference in its entirety.
As can be seen from the above description, a first key factor and a second key factor are both encrypted with an initial key when being forwarded by a gateway device. The initial key is a key preset for a first device and a second device. The gateway device, therefore, will not be able to know the first key factor and the second key factor. A shared key between the first device and the second device is generated through the first key factor and the second key factor. The finally negotiated shared key is therefore only known to the first device and the second device. The gateway device still is not able to acquire the negotiated shared key, thus ensuring a secure data transmission between the first device and the second device, and further reducing the risk of the data being illegally captured during transmission.
FIG. 2 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure. This embodiment is exemplarily described by using how to generate a shared key between the first device and the second device through the first key factor and the second key factor in step 104 in the embodiments shown in FIG. 1 as an example. As shown in FIG. 2 , the key generation method includes the following steps.
Step 201 : Determine the initial key shared between the first device and the second device and a device identity of the first device.
Step 202 : Concatenate the initial key, the device identity, the first key factor, and the second key factor in series to obtain a combined string.
Step 203 : Segment the combined string into two substrings of equal length.
Step 204 : Perform a hash operation on the two substrings, respectively, to obtain two hash results.
Step 205 : Perform an exclusive OR (XOR) operation on the two hash results by bit to obtain the shared key between the first device and the second device.
After the first device obtains the second key factor through step 103 in the embodiments shown in FIG. 1 , the first device has the first key factor p and the second key factor q. The first device may use the first key factor p and the second key factor q as inputs and use a shared key generation algorithm (KeyGenerate) to obtain a key K AC . The key generation algorithm is as follows:
K AC =KeyGenerate( K basic ,SharedKey, p,q ),
where K basic is the initial key and SharedKey is the device identity of the first device. The device identity may be a device serial number of the first device, or a MAC address, or a combination of the two, or the like. If the second device can distinguish the first device from other devices through the device identity, that will suffice.
Additionally, in the process of generating the shared key through the function KeyGenerate, a string corresponding to the initial key K basic , SharedKey, p, and q may be concatenated in series to obtain a combined string. The shared key K AC is generated from the combined string using the function KeyGenerate.
In one embodiment, the process implemented by the function KeyGenerate may comprise: segmenting an inputted combined string into two substrings of equal length (if the length of the combined string is an odd number, 1 is added to the last bit of the combined string); afterwards, separately perform a hash operation (for example, MD5) on the two substrings; perform an XOR operation on the two obtained computation results by bit. The obtained result is the shared key K AC .
Exemplary description is made by using MD5 as an example. Since MD5 can convert an input of any length into a result of a 128-bit length, the length of the shared key K AC is 128 bits, thereby reducing the complexity of shared key computation. Since the computation of the shared key K AC uses MD5, the computational burden is bearable for the first device with limited computing power.
In this embodiment, a shared key K AC is generated through the first key factor, the second key factor, the initial key, and a device identity of the first device, so that the shared key K AC is securely negotiated and shared between the first device and the second device. The shared key K AC is unknown to the gateway device serving as an intermediate node, thus ensuring that the first device can use the shared key K AC to encrypt data to be sent to the second device, and ensuring security of the data during network transmission.
FIG. 3 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure. On the basis of the aforementioned embodiment, as shown in FIG. 3 , the key generation method includes the following steps.
Step 301 : Determine a replacement cycle of the shared key between the first device and the second device.
Step 302 : Re-calculate the first key factor and the second key factor according to the replacement cycle.
Step 303 : Replace the shared key between the first device and the second device according to the re-calculated first key factor and the second key factor.
In one embodiment, the first device and the second device may specify the replacement cycle of the shared key K AC . After the shared key K AC is used for a time corresponding to the replacement cycle, a procedure of generating the shared key K AC is initiated between the first device and the second device again, so as to further ensure the security of the shared key K AC and the security of data during network transmission, and further reducing the possibility of the shared key K AC being cracked.
FIG. 4 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure. After the shared key is generated in the embodiments shown in FIG. 1 , data to be transmitted by the first device may be encrypted with the shared key and transmitted to the second device. As shown in FIG. 4 , the process of encrypting and transmitting the to-be-transmitted data includes the following steps.
Step 401 : Determine data needed to be transmitted from the first device to the second device.
Step 402 : Encrypt the data to be transmitted with the shared key, and sending the encrypted data to the second device through the first secure channel.
Step 403 : Receive, through the first secure channel, response data generated by the second device when receiving the to-be-transmitted data, wherein the response data has already been encrypted with the shared key.
Step 404 : Decrypt, with the shared key, the response data encrypted with the shared key, so as to obtain the response data.
In step 401 , the to-be-transmitted data may be Internet of Things data acquired by a sensor on the first device.
Regarding the relevant description of the first secure channel in step 402 and step 403 , reference may be made to the relevant description of the embodiments shown in FIG. 1 , which will not be described in detail herein again but is incorporated by reference.
In step 404 , when the response data encrypted with the shared key is received through the first secure channel, the response data encrypted with the shared key may be decrypted first with the first encryption key of the first secure channel. Then the response data is decrypted for the second time with the shared key, so as to obtain the original response data.
In this embodiment, since data to be transmitted is encrypted with the shared key when being forwarded by the gateway device, and the shared key is a key jointly negotiated between the first device and the second device, the gateway device will not know the shared key, thus ensuring that the to-be-transmitted data is transmitted more securely between the first device and the second device, and further reducing the risk of the data being illegally captured during transmission.
FIG. 5 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure. In this embodiment, a first device may be a terminal device, and a second device may be a server. This embodiment may be applied to the second device. As shown in FIG. 5 , the key generation method includes the following steps.
Step 501 : Receive, from a first device through a second secure channel, a first key factor encrypted with an initial key, wherein the initial key is a key preset between the first device and the second device.
Step 502 : Decrypt the first key factor encrypted with the initial key, obtaining the first key factor.
Step 503 : Generate a shared key between the first device and the second device according to the first key factor and the second key factor generated by the second device.
Regarding the relevant description of the second secure channel in step 501 , reference may be made to the relevant description of the embodiments shown in FIG. 1 , which will not be described in detail herein again but is incorporated by reference.
In step 502 , after the first key factor encrypted with the initial key is received through the second secure channel, the first key factor encrypted with the initial key may be decrypted first with a second encryption key of the second secure channel. Then the first key factor is decrypted for the second time with the initial key, so as to obtain the original first key factor.
Regarding how to generate a shared key between the first device and the second device according to the first key factor and the second key factor in step 503 , reference may be made to the description of the embodiments shown in FIG. 2 , which will not be described in detail herein again but is incorporated by reference.
As can be seen from the above description, a first key factor and a second key factor are both encrypted with an initial key when being forwarded by a gateway device. The initial key is a key preset for a first device and a second device. The gateway device, therefore, will not be able to know the first key factor and the second key factor; a shared key between the first device and the second device is generated through the first key factor and the second key factor. The finally negotiated shared key is therefore only known to the first device and the second device. The gateway device still is not able to acquire the negotiated shared key, thus ensuring a secure data transmission between the first device and the second device, and further reducing the risk of the data being illegally captured during transmission.
FIG. 6 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure. As shown in FIG. 6 , the key generation method includes the following steps.
Step 601 : Encrypt the second key factor generated by the second device with the initial key.
Step 602 : Send to the first device through the second secure channel the second key factor encrypted with the initial key.
In this embodiment, the second key factor encrypted with the initial key is encrypted for a second time with a second encryption key of the second secure channel. The second key factor is therefore unknown to the gateway device when being forwarded by the gateway device during the process of sending the second key factor to the first device, avoiding the risk of the second key factor being illegally captured at the gateway device.
FIG. 7 is a flow diagram illustrating a key generation method according to according to some embodiments of the disclosure. As shown in FIG. 7 , the key generation method includes the following steps.
Step 701 : Receive, from the first device through the second secure channel, data to be transmitted that has been encrypted with the shared key.
Step 702 : Decrypt the to-be-transmitted data with the shared key.
Step 703 : Generate response data after receiving the to-be-transmitted data.
Step 704 : Encrypt the response data with the shared key.
Step 705 : Send the response data encrypted with the shared key to the first device through the second secure channel.
Regarding the relevant description of the second secure channel in step 701 , reference may be made to the relevant description of the embodiments shown in FIG. 1 , which will not be described in detail herein again but is incorporated by reference.
In step 704 , after the to-be-transmitted data is received from the first device through the second secure channel, the to-be-transmitted data is decrypted with the shared key to obtain original data. When a response needs to be made to the first device, the response data encrypted with the shared key may be encrypted first with a second encryption key of the second secure channel, so that the gateway device will not be able to acquire the original response data in the process of forwarding the response data.
In this embodiment, since data to be transmitted is encrypted with the shared key when being forwarded by the gateway device, and the shared key is a key jointly negotiated between the first device and the second device, the gateway device will not know the shared key, thus ensuring that the to-be-transmitted data is transmitted more securely between the first device and the second device, and further reducing the risk of the data being illegally captured during transmission.
Through the aforementioned embodiment, a shared key may be generated through a key generation algorithm locally at a first device and a second device based on an initial key preset for the first device and the second device; and finally, data to be transmitted is encrypted using the shared key, so that a gateway device is unable to view the original data when forwarding the data in the network, thereby achieving the purpose of secure data transmission.
FIG. 8 is a swim lane diagram illustrating key negotiation between a terminal device and a server according to some embodiments of the disclosure. Exemplary description is made by using a first device being a terminal device and a second device being a server as an example. Before the terminal device accesses a network, the server needs to issue an initial key (K basic ) to the terminal device in advance, wherein the initial key (K basic ) may be issued to the terminal device through hardware writing or the like. As shown in FIG. 8 , the key negotiation between the terminal device and the server includes the following steps.
Step 801 : The terminal device negotiates a first encryption key (K AB ) of a first secure channel with a gateway device, and establishes the first secure channel between the terminal device and the gateway device. Regarding methods of establishing the first secure channel, reference may be made to the relevant description of existing techniques (e.g., SSL) described above.
Step 802 : The gateway device negotiates a second encryption key (K BC ) of a second secure channel with the server, and establishes the second secure channel. Similar to the aforementioned step 801 , reference may be made to the relevant description of existing techniques described above for the process of establishing the second secure channel, which may also use a key negotiation mechanism of SSL or TLS. Those skilled in the art should understand that step 801 and step 802 are interchangeable in sequence. The execution sequence may be set according to actual execution needs.
Step 803 : The terminal device prepares to initiate a key negotiation procedure with the server. The terminal device generates a first key factor (p), wherein the first key factor is used for generating a shared key between the terminal device and the server. Meanwhile, the first key factor is encrypted with the initial key (K basic ) to obtain K basic (p), and then K basic (p) is encrypted with the first encryption key K AB to obtain K AB [K basic (p)].
Step 804 : The terminal device sends the double-encrypted first key factor K AB [K basic (p)] to the gateway device through the first secure channel.
Step 805 : After receiving the double-encrypted first key factor K AB [K basic (p)], the gateway device decrypts the double-encrypted first key factor K AB [K basic (p)] with the first encryption key K AB of the first secure channel to obtain K basic (p); and afterwards encrypts K basic (p) with the second encryption key K BC of the second secure channel to obtain double-encrypted K BC [K basic (p)].
Step 806 : Send the first key factor K BC [K basic (p)] double-encrypted with the initial key and the second encryption key to the server through the second secure channel.
Step 807 : After receiving the double-encrypted first key factor, the server decrypts the double-encrypted first key factor with the second encryption key K BC of the second secure channel to obtain K basic (p); and afterwards decrypts K basic (p) with the initial key K basic to obtain the first key factor p.
Step 808 : The server generates a second key factor (q) through a pseudo-random function, wherein the second key factor q will be used together with the first key factor p, as parameters for generating a shared key K AC .
Step 809 : The server encrypts the second key factor q with the initial key K basic to obtain K basic (q), and then encrypts K basic (q) with the second encryption key K BC to obtain K BC [K basic (q)].
Step 810 : The server sends the double-encrypted second key factor K BC [K basic (q)] to the gateway device through the second secure channel.
Step 811 : After receiving the double-encrypted second key factor K BC [K basic (q)], the gateway device decrypts the double-encrypted second key factor with the second encryption key K BC of the second secure channel to obtain K basic (q); afterwards encrypts K basic (q) with the first encryption key K AB of the first secure channel to obtain K AB [K basic (q)]; and afterwards sends the double-encrypted second key factor to the terminal device through the first secure channel.
Step 812 : After receiving the double-encrypted second key factor, the terminal device decrypts the double-encrypted second key factor with the first encryption key K AB of the first secure channel to obtain K basic (q); and afterwards decrypts K basic (q) after being subjected to the first decryption for the second time with the initial key K basic to obtain the second key factor q.
Step 813 : The terminal device and the server both share the first key factor p and the second key factor q. The terminal device and the server both use the first key factor and the second key factor as inputs and use a key generation algorithm to obtain the shared key K AC between the terminal device and the server. Regarding the detailed description of the key generation algorithm, reference may be made to the relevant description of the embodiments shown in FIG. 2 , which will not be described in detail herein again but is incorporated by reference.
In this embodiment, a shared key K AC is thus securely negotiated and shared between a terminal device and a public network server. The shared key is therefore unknown to a gateway device serving as an intermediate node; and afterwards, the terminal device can use the shared key to encrypt Internet of Things data to be sent to the public network server, thereby ensuring the security of data transmission.
In order to further ensure the security of the shared key and data transmission, the terminal device may periodically perform a key negotiation procedure with the server to replace the shared key K AC , so as to further reduce the possibility of shared key being cracked.
FIG. 9 is a swim lane diagram illustrating data transmission between a terminal device and a server according to some embodiments of the disclosure. After a shared key is generated through the embodiments shown in FIG. 8 , if a terminal device needs to send Internet of Things data (data) to a server, the data transmission method includes the following steps as shown in FIG. 9 .
Step 901 : Perform first encryption on Internet of Things data with a shared key K AC to obtain a cipher text K AC (data); and afterwards, perform a second encryption with a first encryption key K AB of a first secure channel to obtain a cipher text K AB [K AC (data)].
Step 902 : The terminal device sends the cipher text K AB [K AC (data)] to a gateway device through the first secure channel.
Step 903 : After receiving the cipher text K AB [K AC (data)], the gateway device decrypts the cipher text K AB [K AC (data)] with the first encryption key K AB to obtain K AC (data); and then encrypts K AC (data) with a second encryption key K BC to obtain a cipher text K BC [K AC (data)].
Step 904 : The gateway device sends the cipher text K BC [K AC (data)] to the server through a second secure channel.
Step 905 : After receiving the double-encrypted cipher text K BC [K AC (data)], the server decrypts the cipher text K BC [K AC (data)] with the second encryption key K BC to obtain K AC (data); and then decrypts K AC (data) with the shared key K AC to obtain the original Internet of Things data.
Step 906 : After obtaining the original Internet of Things data, the server generates response data (res); encrypts the response data with the shared key K AC to obtain a cipher text K AC (res); and then performs the second encryption with the second encryption key K BC to obtain K BC [K AC (res)].
Step 907 : The server sends the double-encrypted cipher text K BC [K AC (res)] to the gateway device through the second secure channel.
Step 908 : After receiving the double-encrypted cipher text K BC [K AC (res)], the gateway device decrypts the cipher text K BC [K AC (res)] with the second encryption key K BC to obtain K AC (res); and then encrypts K AC (res) with the first encryption key K AB to obtain a cipher text K AB [K AC (res)].
Step 909 : The gateway device sends the double-encrypted cipher text K AB [K AC (res)] to the terminal device through the first secure channel.
Step 910 : After receiving the double-encrypted cipher text K AB [K AC (res)], the terminal device decrypts the cipher text K AB [K AC (res)] with the first encryption key K AB to obtain K AC (res); and then decrypts K AC (res) with the shared key K AC to obtain the original response data (res).
This embodiment enables cross-domain key negotiation and sharing between a terminal device and a server through a gateway device as an intermediate node. A shared key is unknown to the gateway device, thereby ensuring end-to-end secure transmission of Internet of Things data between the terminal device and the server. Additionally, secure data transmission between the terminal device and the gateway device, and secure data transmission between the gateway device and the public network server are ensured. Forwarding of the data in the gateway device on the transmission path is also protected for security. Even if the gateway device is illegally accessed, the Internet of Things data forwarded through the gateway device is still protected with the encryption of the shared key, thereby avoiding the Internet of Things data being illegally captured.
In accordance with the aforementioned key generation method, the disclosure further provides a block diagram illustrating a terminal device according to an exemplary embodiment of the disclosure shown in FIG. 10 .
FIG. 10 is a block diagram illustrating a terminal device 1000 according to some embodiments of the disclosure. On a hardware level, the device 1000 includes a processor 1002 , an internal bus 1004 , a network interface 1006 , a memory 1008 , and a non-volatile storage 1010 ; and certainly this may also include hardware required by other services. The processor 1002 reads a corresponding computer program 1010 A into the memory 1008 from the non-volatile storage 1010 and then runs the computer program, so as to form a key generation apparatus 1008 A on a logical level. Certainly, in addition to the software implementation, the disclosure does not exclude other implementations, like using a logical device or a combination of software and hardware. That is to say, execution bodies of the following processing flows are not limited to logical units, and may also be hardware or logical devices.
In accordance with the aforementioned key generation method, the disclosure further provides a block diagram illustrating a server according to an exemplary embodiment of the disclosure shown in FIG. 11 .
FIG. 11 is a block diagram illustrating a server according to some embodiments of the disclosure. On a hardware level, the network server 1100 includes a processor 1102 , an internal bus 1104 , a network interface 1106 , a memory 1108 , and a non-volatile storage 1110 ; and certainly this may also include hardware required by other services. The processor 1102 reads a corresponding computer program 1110 A into the memory 1108 from the non-volatile storage 1110 and then runs the computer program, so as to form a key generation apparatus 1108 A on a logical level. Certainly, in addition to the software implementation, the disclosure does not exclude other implementations, for example, using a logical device or a combination of software and hardware. That is to say, execution bodies of the following processing flows are not limited to logical units, and may also be hardware or logical devices.
FIG. 12 is a block diagram illustrating a key generation apparatus according to some embodiments of the disclosure. As shown in FIG. 12 , the key generation apparatus may include: a first encryption module 1201 , a first receiving module 1202 , a first decryption module 1203 , and a first key generation module 1204 .
The first encryption module 1201 is configured to encrypt a first key factor generated by the first device with an initial key, and send the encrypted first key factor to a second device through a first secure channel, wherein the initial key is a key preset for the first device and the second device.
The first receiving module 1202 is configured to receive, through the first secure channel, a second key factor encrypted with the initial key, wherein the second key factor is generated by the second device.
The first decryption module 1203 is configured to decrypt the second key factor encrypted with the initial key and received by the first receiving module through the first secure channel, so as to obtain the second key factor.
The first key generation module 1204 is configured to generate a shared key between the first device and the second device according to the first key factor and the second key factor decrypted by the first decryption module 1203 .
FIG. 13 is a block diagram illustrating a key generation apparatus according to some embodiments of the disclosure. As shown in FIG. 13 , on the basis of the embodiments shown in FIG. 12 , the first encryption module 1201 may include: a first factor generation unit 12011 , configured to generate the first key factor through a pseudo-random function when the first device needs to initiate a key negotiation procedure with the second device; a first encryption unit 12012 , configured to encrypt, with the initial key, the first
CLAIMS
Claims ( 22 )
What is claimed is:
1. A method comprising:
receiving, at a server device through a second secure channel, a first key factor encrypted using an initial key from a terminal device, the initial key comprising a key preset between the terminal device and the server device;
decrypting, by the server device, the first key factor;
generating, by the server device, a shared key based on the first key factor and a second key factor generated by the server device;
encrypting, by the server device, the second key factor using the initial key; and
sending, by the server device, the second key factor to the terminal device through the second secure channel.
2. The method of claim 1 , further comprising:
determining, by the server device, a replacement cycle of the shared key between the terminal device and the server device;
re-calculating, by the server device, the first key factor and the second key factor according to the replacement cycle; and
replacing, by the server device, the shared key based on the re-calculated first key factor and the second key factor.
3. The method of claim 1 , further comprising:
receiving, by the server device from the terminal device through the second secure channel, data that has been encrypted with the shared key; and
decrypting, by the server device, the data with the shared key.
4. The method of claim 3 , further comprising:
generating, by the server device, response data after receiving the data;
encrypting, by the server device, the response data with the shared key; and
sending, by the server device, the response data to the first device through the second secure channel.
5. The method of claim 1 , the generating the shared key comprising:
concatenating the initial key, a device identity of the first device, the first key factor, and the second key factor in series to obtain a combined string;
segmenting the combined string into two substrings of equal length;
performing a hash operation on the two substrings respectively to obtain two hash results; and
performing an XOR operation on the two hash results by bit to obtain the shared key between the first device and the second device.
6. An apparatus comprising:
a processor configured to;
receive, through a second secure channel, a first key factor encrypted using an initial key from a terminal device, the initial key comprising a key preset between the terminal device and the apparatus;
decrypt the first key factor;
generate a shared key based on the first key factor and a second key factor generated by the apparatus;
encrypt the second key factor using the initial key; and
send the second key factor to the terminal device through the second secure channel.
7. The apparatus of claim 6 , the processor further configured to:
determine a replacement cycle of the shared key between the terminal device and the apparatus;
re-calculate the first key factor and the second key factor according to the replacement cycle; and
replace the shared key based on the re-calculated first key factor and the second key factor.
8. The apparatus of claim 6 , the processor further configured to:
receive, from the terminal device through the second secure channel, data that has been encrypted with the shared key; and
decrypt the data with the shared key.
9. The apparatus of claim 8 , the processor further configured to:
generate response data after receiving the data;
encrypt the response data with the shared key; and
send the response data to the first device through the second secure channel.
10. The apparatus of claim 6 , the generating the shared key comprising:
concatenating the initial key, a device identity of the first device, the first key factor, and the second key factor in series to obtain a combined string;
segmenting the combined string into two substrings of equal length;
performing a hash operation on the two substrings respectively to obtain two hash results; and
performing an XOR operation on the two hash results by bit to obtain the shared key between the first device and the second device.
11. A non-transitory computer-readable storage medium for tangibly storing computer program instructions capable of being executed by a computer processor, the computer program instructions defining steps of:
receiving, at a server device through a second secure channel, a first key factor encrypted using an initial key from a terminal device, the initial key comprising a key preset between the terminal device and the server device;
decrypting, by the server device, the first key factor;
generating, by the server device, a shared key based on the first key factor and a second key factor generated by the server device;
encrypting, by the server device, the second key factor using the initial key; and
sending, by the server device, the second key factor to the terminal device through the second secure channel.
12. The non-transitory computer-readable storage medium of claim 11 , the steps further comprising:
determining, by the server device, a replacement cycle of the shared key between the terminal device and the server device;
re-calculating, by the server device, the first key factor and the second key factor according to the replacement cycle; and
replacing, by the server device, the shared key based on the re-calculated first key factor and the second key factor.
13. The non-transitory computer-readable storage medium of claim 11 , the steps further comprising:
receiving, by the server device from the terminal device through the second secure channel, data that has been encrypted with the shared key; and
decrypting, by the server device, the data with the shared key.
14. The non-transitory computer-readable storage medium of claim 13 , the steps further comprising:
generating, by the server device, response data after receiving the data;
encrypting, by the server device, the response data with the shared key; and
sending, by the server device, the response data to the first device through the second secure channel.
15. The non-transitory computer-readable storage medium of claim 11 , the generating the shared key comprising:
concatenating the initial key, a device identity of the first device, the first key factor, and the second key factor in series to obtain a combined string;
segmenting the combined string into two substrings of equal length;
performing a hash operation on the two substrings respectively to obtain two hash results; and
performing an XOR operation on the two hash results by bit to obtain the shared key between the first device and the second device.
16. A non-transitory computer-readable storage medium for tangibly storing computer program instructions capable of being executed by a computer processor, the computer program instructions defining the steps of:
encrypting a first key factor generated using an initial key, the initial key comprising a present key and a server device;
sending the encrypted first key factor to the server device through a first secure channel;
receiving, through the first secure channel, a second key factor encrypted with the initial key, the second key factor encrypted by the server device using the initial key;
decrypting the second key factor using the initial key; and
generating a shared key based on the initial key, a device identity, the first key factor, and the decrypted second key factor.
17. The non-transitory computer-readable storage medium of claim 16 , the encrypting a first key factor comprising:
initiating a key negotiation procedure with the server device;
generating the first key factor through a pseudo-random function in response to the initiating;
encrypting the first key factor using the initial key to obtain an encrypted first key factor; and
encrypting the encrypted first key factor with a first encryption key of the first secure channel to obtain a twice-encrypted first key factor.
18. The non-transitory computer-readable storage medium of claim 16 , the decrypting the second key factor using the initial key comprising:
decrypting a double-encrypted second key factor with a first encryption key of the first secure channel to obtain a once-decrypted second key factor; and
decrypting the once-decrypted second key factor with the initial key to obtain an unencrypted second key factor.
19. The non-transitory computer-readable storage medium of claim 16 , the generating the shared key based on the initial key, the device identity, the first key factor, and the second key factor comprising:
concatenating the initial key, the device identity, the first key factor, and the second key factor in series to obtain a combined string;
segmenting the combined string into two substrings of equal length;
performing a hash operation on the two substrings respectively to obtain two hash results; and
performing an XOR operation on the two hash results by bit to obtain the shared key.
20. The non-transitory computer-readable storage medium of claim 16 , the steps further comprising:
determining a replacement cycle of the shared key;
re-calculating the first key factor and the second key factor based on the replacement cycle; and
replacing the shared key using the re-determined first key factor and the second key factor.
21. The non-transitory computer-readable storage medium of claim 16 , the steps further comprising:
determining data to be transmitted to the server device;
encrypting the data to be transmitted with the shared key; and
sending the encrypted data to the server device through the first secure channel.
22. The non-transitory computer-readable storage medium of claim 16 , the steps further comprising:
receiving, through the first secure channel, response data generated by the server device in response to the data to be transmitted, the response data encrypted with the shared key; and
decrypting the response data using the shared key.
US16/901,261
2015-08-26
2020-06-15
Key generation method and apparatus using double encryption
Active
2037-02-05
US11463243B2
( en )
Priority Applications (1)
Application Number
Priority Date
Filing Date
Title
US16/901,261
US11463243B2
( en )
2015-08-26
2020-06-15
Key generation method and apparatus using double encryption
Applications Claiming Priority (5)
Application Number
Priority Date
Filing Date
Title
CN201510531892.2
2015-08-26
CN201510531892.2A
CN106487749B
( en )
2015-08-26
2015-08-26
Key generation method and device
PCT/CN2016/095522
WO2017032242A1
( en )
2015-08-26
2016-08-16
Key generation method and apparatus
US201815752743A
2018-02-14
2018-02-14
US16/901,261
US11463243B2
( en )
2015-08-26
2020-06-15
Key generation method and apparatus using double encryption
Related Parent Applications (2)
Application Number
Title
Priority Date
Filing Date
US15/752,743
Continuation
US10693634B2
( en )
2015-08-26
2016-08-16
Key generation method and apparatus using double encryption
PCT/CN2016/095522
Continuation
WO2017032242A1
( en )
2015-08-26
2016-08-16
Key generation method and apparatus
Publications (2)
Publication Number
Publication Date
US20200313865A1
US20200313865A1 ( en )
2020-10-01
US11463243B2
true
US11463243B2 ( en )
2022-10-04
Family
ID=58099579
Family Applications (2)
Application Number
Title
Priority Date
Filing Date
US15/752,743
Active
2036-12-24
US10693634B2
( en )
2015-08-26
2016-08-16
Key generation method and apparatus using double encryption
US16/901,261
Active
2037-02-05
US11463243B2
( en )
2015-08-26
2020-06-15
Key generation method and apparatus using double encryption
Family Applications Before (1)
Application Number
Title
Priority Date
Filing Date
US15/752,743
Active
2036-12-24
US10693634B2
( en )
2015-08-26
2016-08-16
Key generation method and apparatus using double encryption
Country Status (4)
Country
Link
US
( 2 )
US10693634B2
( en )
JP
( 1 )
JP2018529271A
( en )
CN
( 1 )
CN106487749B
( en )
WO
( 1 )
WO2017032242A1
( en )
Families Citing this family (30)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US9015281B2
( en )
*
2010-10-08
2015-04-21
Brian Lee Moffat
Private data sharing system
CN107666383B
( en )
*
2016-07-29
2021-06-18
é¿éå·´å·´éå¢æ§è¡æéå ¬å¸
Message processing method and device based on HTTPS protocol
US10691837B1
( en )
*
2017-06-02
2020-06-23
Apple Inc.
Multi-user storage volume encryption via secure enclave
CN108243181A
( en )
*
2017-10-09
2018-07-03
å京车å家信æ¯ææ¯æéå ¬å¸
A kind of car networking terminal, data ciphering method and car networking server
US10999265B2
( en )
*
2017-11-15
2021-05-04
Team One International Holding Pte Ltd.
Method and system for deploying wireless IoT sensor nodes
CN107808284B
( en )
*
2017-11-17
2021-12-28
ä¸æµ·çé¶ä¿¡æ¯ææ¯æéå ¬å¸
Payment method based on POS machine system
CN108667598B
( en )
*
2018-04-28
2021-10-15
å æ´æ¯æ¯å°æéå ¬å¸
Device and method for realizing secure key exchange and secure key exchange method
US11627132B2
( en )
*
2018-06-13
2023-04-11
International Business Machines Corporation
Key-based cross domain registration and authorization
CN109151015B
( en )
*
2018-08-13
2021-10-08
å京æè§ä¿¡æ¯ç§ææéå ¬å¸
Transaction information secure pushing method
CN108924161A
( en )
*
2018-08-13
2018-11-30
å京æè§ä¿¡æ¯ç§ææéå ¬å¸
A kind of encrypted transaction data communication means and system
CN109379333B
( en )
*
2018-09-10
2021-04-13
å®å¾½å¸è大å¦
Safe transmission method based on network layer
CN109302285A
( en )
*
2018-10-25
2019-02-01
å®å¾½é®å¤©éåç§æè¡ä»½æéå ¬å¸
A kind of IPv6 network node data safe transmission method
CN109617696B
( en )
*
2019-01-03
2022-08-19
å京åå¸ç½é»ä¿¡æ¯ææ¯æéå ¬å¸
Data encryption and data decryption method and device
KR102885076B1
( en )
*
2019-01-10
2025-11-13
ì¼ì±ì ì주ìíì¬
Electronic apparatus, control method of the electronic apparatus and network system
US20210173950A1
( en )
*
2019-12-06
2021-06-10
TEEware Co., Ltd.
Data sharing between trusted execution environments
CN111193797B
( en )
*
2019-12-30
2022-10-11
æµ·å°ä¼å®¶æºè½ç§æï¼å京ï¼æéå ¬å¸
Information processing method of internet of things operating system with trusted computing architecture
US11343094B2
( en )
2020-01-13
2022-05-24
i2Chain, Inc.
Methods and systems for encrypting shared information through its lifecycle
CN112260823B
( en )
*
2020-09-16
2022-08-09
æµæ±å¤§åææ¯è¡ä»½æéå ¬å¸
Data transmission method, intelligent terminal and computer readable storage medium
CN112564901B
( en )
*
2020-12-08
2023-08-25
ä¸ç»´éä¿¡è¡ä»½æéå ¬å¸
Method and system for generating secret key, storage medium and electronic device
CN112769759B
( en )
*
2020-12-22
2021-10-26
å京深ææ°ç¾ç§æè¡ä»½æéå ¬å¸
Information processing method, information gateway, server and medium
CN113536355B
( en )
*
2021-07-29
2024-06-28
ä¸å½å·¥åé¶è¡è¡ä»½æéå ¬å¸
Session key generation method and device
US12095749B2
( en )
2021-12-09
2024-09-17
Netflow, UAB
Distributed trust-based communication
US12238078B2
( en )
2021-12-09
2025-02-25
Netflow, UAB
Distributed trust-based communication
US12177196B2
( en )
2021-12-09
2024-12-24
Netflow, UAB
Distributed trust-based communication
CN114244630B
( en )
*
2022-02-15
2022-06-03
å京æææç§ææéå ¬å¸
Communication method, device, equipment and storage medium
CN114553552B
( en )
*
2022-02-24
2024-08-13
å京å°ç±³ç§»å¨è½¯ä»¶æéå ¬å¸
Data encryption method and device, data decryption method and device and storage medium
KR102663891B1
( en )
*
2022-04-28
2024-05-03
주ìíì¬ ì¨ë¸ì´ë¤í¸
Smart home system having dual security characteristics and communication method thereof
CN115426111B
( en )
*
2022-06-13
2024-08-13
ä¸å½ç¬¬ä¸æ±½è½¦è¡ä»½æéå ¬å¸
Data encryption method and device, electronic equipment and storage medium
DE102023131881A1
( en )
*
2023-11-15
2025-05-15
Jonathan Rogers
ENCRYPTOR, DECRYPTOR, COMMUNICATION SYSTEM, METHOD, COMMUNICATION METHOD
US20260105138A1
( en )
*
2024-10-11
2026-04-16
Hewlett-Packard Development Company, L.P.
Shared secret key based on system components
Citations (20)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US5206905A
( en )
1989-05-15
1993-04-27
Dallas Semiconductor Corp.
Password protected device using incorrect passwords as seed values for pseudo-random number generator for outputting random data to thwart unauthorized accesses
US5226137A
( en )
1989-05-15
1993-07-06
Dallas Semiconductor Corp.
Electronic key with multiple password protected sub-keys using address and translation to implement a block data move between public and protected sub-keys
US6199162B1
( en )
1997-09-17
2001-03-06
Frank C. Luyster
Block cipher method
US20020078345A1
( en )
2000-12-19
2002-06-20
Ravi Sandhu
System and method for authentication in a crypto-system utilizing symmetric and asymmetric crypto-keys
US20020078344A1
( en )
2000-12-19
2002-06-20
Ravi Sandhu
System and method for generation and use of asymmetric crypto-keys each having a public portion and multiple private portions
US20020157016A1
( en )
2001-04-19
2002-10-24
Russell Lance W.
Data security for distributed file systems
US20050125684A1
( en )
*
2002-03-18
2005-06-09
Schmidt Colin M.
Session key distribution methods using a hierarchy of key servers
US6970562B2
( en )
2000-12-19
2005-11-29
Tricipher, Inc.
System and method for crypto-key generation and use in cryptosystem
US7013389B1
( en )
1999-09-29
2006-03-14
Cisco Technology, Inc.
Method and apparatus for creating a secure communication channel among multiple event service nodes
US7103185B1
( en )
1999-12-22
2006-09-05
Cisco Technology, Inc.
Method and apparatus for distributing and updating private keys of multicast group managers using directory replication
US20080092239A1
( en )
2006-10-11
2008-04-17
David H. Sitrick
Method and system for secure distribution of selected content to be protected
US20080092240A1
( en )
2006-10-11
2008-04-17
David H. Sitrick
Method and system for secure distribution of selected content to be protected on an appliance specific basis
US20080148067A1
( en )
2006-10-11
2008-06-19
David H. Sitrick
Method and system for secure distribution of selected content to be protected on an appliance-specific basis with definable permitted associated usage rights for the selected content
US7676813B2
( en )
2004-09-30
2010-03-09
Citrix Systems, Inc.
Method and system for accessing resources
US8050405B2
( en )
*
2005-09-30
2011-11-01
Sony Ericsson Mobile Communications Ab
Shared key encryption using long keypads
US20120257756A1
( en )
*
2011-04-08
2012-10-11
Arizona Board Of Regents For And On Behalf Of Arizona State University
Methods, Systems, and Apparatuses for Optimal Group Key Management for Secure Multicast Communication
WO2013089725A1
( en )
2011-12-15
2013-06-20
Intel Corporation
Method and device for secure communications over a network using a hardware security engine
CN103209075A
( en )
2013-03-15
2013-07-17
å京æå¸æçµåç§æè¡ä»½æéå ¬å¸
Password exchange method
US20130227286A1
( en )
*
2006-04-25
2013-08-29
Andre Jacques Brisson
Dynamic Identity Verification and Authentication, Dynamic Distributed Key Infrastructures, Dynamic Distributed Key Systems and Method for Identity Management, Authentication Servers, Data Security and Preventing Man-in-the-Middle Attacks, Side Channel Attacks, Botnet Attacks, and Credit Card and Financial Transaction Fraud, Mitigating Biometric False Positives and False Negatives, and Controlling Life of Accessible Data in the Cloud
CN104753682A
( en )
2015-04-03
2015-07-01
å京äºå®ä¸çºªç§ææéå ¬å¸
Generating system and method of session keys
Family Cites Families (6)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US5602917A
( en )
*
1994-12-30
1997-02-11
Lucent Technologies Inc.
Method for secure session key generation
SG105005A1
( en )
*
2002-06-12
2004-07-30
Contraves Ag
Device for firearms and firearm
JP2005100412A
( en )
*
2003-09-25
2005-04-14
Ricoh Co Ltd
Multimedia output device with built-in encryption
KR101282972B1
( en )
*
2004-03-22
2013-07-08
ì¼ì±ì ì주ìíì¬
Authentication between a device and a portable storage
EP2351287B1
( en )
*
2008-10-20
2014-02-12
Philips Intellectual Property & Standards GmbH
Method of generating a cryptographic key, network and computer program therefor
US10305900B2
( en )
*
2013-10-15
2019-05-28
Telefonaktiebolaget Lm Ericsson (Publ)
Establishing a secure connection between a master device and a slave device
2015
2015-08-26
CN
CN201510531892.2A
patent/CN106487749B/en
active
Active
2016
2016-08-16
US
US15/752,743
patent/US10693634B2/en
active
Active
2016-08-16
JP
JP2018508212A
patent/JP2018529271A/en
active
Pending
2016-08-16
WO
PCT/CN2016/095522
patent/WO2017032242A1/en
not_active
Ceased
2020
2020-06-15
US
US16/901,261
patent/US11463243B2/en
active
Active
Patent Citations (22)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US5226137A
( en )
1989-05-15
1993-07-06
Dallas Semiconductor Corp.
Electronic key with multiple password protected sub-keys using address and translation to implement a block data move between public and protected sub-keys
US5206905A
( en )
1989-05-15
1993-04-27
Dallas Semiconductor Corp.
Password protected device using incorrect passwords as seed values for pseudo-random number generator for outputting random data to thwart unauthorized accesses
US6199162B1
( en )
1997-09-17
2001-03-06
Frank C. Luyster
Block cipher method
US7013389B1
( en )
1999-09-29
2006-03-14
Cisco Technology, Inc.
Method and apparatus for creating a secure communication channel among multiple event service nodes
US7103185B1
( en )
1999-12-22
2006-09-05
Cisco Technology, Inc.
Method and apparatus for distributing and updating private keys of multicast group managers using directory replication
US20020078345A1
( en )
2000-12-19
2002-06-20
Ravi Sandhu
System and method for authentication in a crypto-system utilizing symmetric and asymmetric crypto-keys
US6970562B2
( en )
2000-12-19
2005-11-29
Tricipher, Inc.
System and method for crypto-key generation and use in cryptosystem
US20020078344A1
( en )
2000-12-19
2002-06-20
Ravi Sandhu
System and method for generation and use of asymmetric crypto-keys each having a public portion and multiple private portions
US20020157016A1
( en )
2001-04-19
2002-10-24
Russell Lance W.
Data security for distributed file systems
US20050125684A1
( en )
*
2002-03-18
2005-06-09
Schmidt Colin M.
Session key distribution methods using a hierarchy of key servers
US7676813B2
( en )
2004-09-30
2010-03-09
Citrix Systems, Inc.
Method and system for accessing resources
US8050405B2
( en )
*
2005-09-30
2011-11-01
Sony Ericsson Mobile Communications Ab
Shared key encryption using long keypads
US20130227286A1
( en )
*
2006-04-25
2013-08-29
Andre Jacques Brisson
Dynamic Identity Verification and Authentication, Dynamic Distributed Key Infrastructures, Dynamic Distributed Key Systems and Method for Identity Management, Authentication Servers, Data Security and Preventing Man-in-the-Middle Attacks, Side Channel Attacks, Botnet Attacks, and Credit Card and Financial Transaction Fraud, Mitigating Biometric False Positives and False Negatives, and Controlling Life of Accessible Data in the Cloud
US20080092239A1
( en )
2006-10-11
2008-04-17
David H. Sitrick
Method and system for secure distribution of selected content to be protected
US20080148067A1
( en )
2006-10-11
2008-06-19
David H. Sitrick
Method and system for secure distribution of selected content to be protected on an appliance-specific basis with definable permitted associated usage rights for the selected content
US20080092240A1
( en )
2006-10-11
2008-04-17
David H. Sitrick
Method and system for secure distribution of selected content to be protected on an appliance specific basis
US20120257756A1
( en )
*
2011-04-08
2012-10-11
Arizona Board Of Regents For And On Behalf Of Arizona State University
Methods, Systems, and Apparatuses for Optimal Group Key Management for Secure Multicast Communication
WO2013089725A1
( en )
2011-12-15
2013-06-20
Intel Corporation
Method and device for secure communications over a network using a hardware security engine
US20150039890A1
( en )
2011-12-15
2015-02-05
Hormuzd M. Khosravi
Method and device for secure communications over a network using a hardware security engine
US9887838B2
( en )
2011-12-15
2018-02-06
Intel Corporation
Method and device for secure communications over a network using a hardware security engine
CN103209075A
( en )
2013-03-15
2013-07-17
å京æå¸æçµåç§æè¡ä»½æéå ¬å¸
Password exchange method
CN104753682A
( en )
2015-04-03
2015-07-01
å京äºå®ä¸çºªç§ææéå ¬å¸
Generating system and method of session keys
Non-Patent Citations (1)
* Cited by examiner, â Cited by third party
Title
International Search Report and Written Opinion to corresponding International Application No. PCT/CN2016/095522 dated Nov. 6, 2016 (2 pages).
Also Published As
Publication number
Publication date
US20200313865A1
( en )
2020-10-01
CN106487749B
( en )
2021-02-19
WO2017032242A1
( en )
2017-03-02
US20180241549A1
( en )
2018-08-23
CN106487749A
( en )
2017-03-08
JP2018529271A
( en )
2018-10-04
US10693634B2
( en )
2020-06-23
Similar Documents
Publication
Publication Date
Title
US20200313865A1
( en )
2020-10-01
Key generation method and apparatus using double encryption
TWI683566B
( en )
2020-01-21
Quantum key output method, storage consistency verification method, device and system
US10050955B2
( en )
2018-08-14
Efficient start-up for secured connections and related services
US10425234B2
( en )
2019-09-24
Systems and methods for perfect forward secrecy (PFS) traffic monitoring via a hardware security module
EP3476078B1
( en )
2020-05-27
Systems and methods for authenticating communications using a single message exchange and symmetric key
US20150229621A1
( en )
2015-08-13
One-time-pad data encryption in communication channels
CN105262772B
( en )
2020-03-17
Data transmission method, system and related device
US11316671B2
( en )
2022-04-26
Accelerated encryption and decryption of files with shared secret and method therefor
US20150244520A1
( en )
2015-08-27
One-time-pad data encryption with media server
US9203614B2
( en )
2015-12-01
Method, apparatus, and system for protecting cloud data security
US10104050B2
( en )
2018-10-16
Authenticated group context in transitive IP network domains
TWI559168B
( en )
2016-11-21
Data encryption system and method
CN104468095A
( en )
2015-03-25
Data transmission method and device
US10291600B2
( en )
2019-05-14
Synchronizing secure session keys
US10015208B2
( en )
2018-07-03
Single proxies in secure communication using service function chaining
WO2017075134A1
( en )
2017-05-04
Key management for privacy-ensured conferencing
CN105721505A
( en )
2016-06-29
Data secure transmission method, device and system
Olumide et al.
2015