WO2020237880A1 - 基于非对称加密技术的数据交换方法、发送终端和计算机可读存储介质 - Google Patents

基于非对称加密技术的数据交换方法、发送终端和计算机可读存储介质 Download PDF

Info

Publication number
WO2020237880A1
WO2020237880A1 PCT/CN2019/103432 CN2019103432W WO2020237880A1 WO 2020237880 A1 WO2020237880 A1 WO 2020237880A1 CN 2019103432 W CN2019103432 W CN 2019103432W WO 2020237880 A1 WO2020237880 A1 WO 2020237880A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
public key
address
receiving terminal
receiving
Prior art date
Application number
PCT/CN2019/103432
Other languages
English (en)
French (fr)
Inventor
杨小彦
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2020237880A1 publication Critical patent/WO2020237880A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption

Definitions

  • This application relates to the field of information encryption technology in cryptographic technology, and in particular to a data exchange method, sending terminal, and computer-readable storage medium based on asymmetric encryption technology.
  • the data transmission sharing method is mainly to establish a secure channel between the two parties and exchange data in the secure channel to ensure data security.
  • the inventor of the present application realizes that the shortcomings of this method are obvious, and a lot of resources are needed to establish and maintain such a secure channel, so the cost is relatively high.
  • an object of this application is to provide a method and device based on an asymmetric encryption technology.
  • a data exchange method based on asymmetric encryption technology is applied to a sending terminal, and the method includes: obtaining a message to be sent to the receiving terminal; according to the IP address of the receiving terminal, from the terminal IP address and public key Obtain the receiving terminal public key from the correspondence table; use the sending terminal private key to encrypt the message to be sent to obtain the first encrypted message; use the obtained receiving terminal public key to encrypt the first encrypted message to obtain the second encrypted message; The second encrypted message is sent to the receiving terminal so that the receiving terminal uses the receiving terminal private key and the sending terminal public key obtained from the terminal IP address and public key correspondence table to decrypt the second encrypted message into the message to be sent.
  • a sending terminal includes: a message to be sent acquiring unit for acquiring a message to be sent to the receiving terminal; a receiving terminal public key acquiring unit for acquiring a public key of the receiving terminal according to the IP address of the receiving terminal, Obtain the public key of the receiving terminal from the corresponding table of the terminal IP address and the public key; the first encrypted message obtaining unit is used to encrypt the message to be sent using the private key of the sending terminal to obtain the first encrypted message; obtain the second encrypted message Unit for encrypting the first encrypted message with the obtained public key of the receiving terminal to obtain a second encrypted message; a second encrypted message sending unit for sending the second encrypted message to the receiving terminal so that the receiving terminal can use the receiving terminal private The key and the public key of the sending terminal obtained from the correspondence table of the terminal IP address and the public key decrypt the second encrypted message into the message to be sent.
  • a sending terminal includes: a memory configured to store executable instructions.
  • the processor is configured to execute executable instructions stored in the memory to execute the method described above.
  • a computer-readable program medium stores computer program instructions that, when executed by a computer, cause the computer to execute the method described above.
  • Secure data transmission can also be carried out when a secure channel needs to be established.
  • the embodiments of the present disclosure use an asymmetric encryption algorithm to share data in a general channel, and can be deployed on hosts that only need to share data, which is easy to implement; deployed hosts only need to maintain a host address and public key correspondence table, which is easy to maintain ; Data encrypted by asymmetric algorithm is tamper-proof, safe and reliable.
  • Fig. 1 shows a flowchart of a data exchange method with asymmetric encryption technology according to an exemplary embodiment of the present disclosure.
  • Fig. 2 shows a flowchart of a data exchange method with asymmetric encryption technology according to an exemplary embodiment of the present disclosure.
  • Fig. 3 shows a flowchart of a data exchange method with asymmetric encryption technology according to an exemplary embodiment of the present disclosure.
  • Fig. 4 shows a block diagram of a transmitting terminal according to an exemplary embodiment of the present disclosure.
  • Fig. 5 shows a hardware diagram of a transmitting terminal according to an exemplary embodiment of the present disclosure.
  • Fig. 6 shows a schematic diagram of a computer-readable program medium according to an exemplary embodiment of the present disclosure.
  • a data exchange method based on asymmetric encryption technology is provided, which is applied to a sending terminal.
  • the method includes:
  • Step 110 Obtain a message to be sent to be sent to the receiving terminal
  • Step 120 According to the IP address of the receiving terminal, obtain the public key of the receiving terminal from the table of correspondence between the terminal IP address and the public key;
  • Step 130 Use the sending terminal private key to encrypt the message to be sent to obtain a first encrypted message
  • Step 140 Use the obtained receiving terminal public key to encrypt the first encrypted message to obtain a second encrypted message
  • Step 150 Send the second encrypted message to the receiving terminal, so that the receiving terminal uses the receiving terminal private key and the sending terminal public key obtained from the terminal IP address and public key correspondence table to decrypt the second encrypted message into the to-be-sent news.
  • step 110 a message to be sent to be sent to the receiving terminal is obtained.
  • the message mainly contains a query request or a response to the query request.
  • the message may also carry the specific content of the query or response.
  • the query request of the data table carries the name of the data to be queried, and the response to the request of the data table carries the queried data.
  • the message may be a request or response, or it may be multiple requests or responses to the same receiver or sender, or it may be multiple requests or responses to multiple receivers or senders.
  • Different application environments have different content and forms of message delivery. For example, there are no absolute restrictions on the sender or receiver, which can be a personal computer, a data server, or even a mobile terminal. Any data exchange method using the asymmetric encryption technology disclosed in this application can be regarded as the sender or the receiver.
  • the public key of the receiving terminal is obtained from the corresponding table of the terminal IP address and the public key.
  • the IP address of the receiving terminal can be placed in the message header of the message to be sent, and therefore, the IP address of the receiving terminal can be obtained from the message header.
  • the terminal IP address and public key correspondence table may be that each terminal reports the IP address and public key to the server in advance, and stores it in the server. Therefore, it is possible to send a request to the server to obtain a table of the correspondence between the terminal IP address and the public key, and obtain the public key corresponding to the IP address of the receiving terminal from the table. If the IP address of the receiving terminal is not in the correspondence table, the message to be sent is rejected.
  • the IP address and public key of the sending terminal are sent to the server to be stored in the terminal IP address and public key correspondence table, so that the terminal IP address and public key correspondence can be initially established Relational tables.
  • the terminal IP address and public key correspondence table corresponding to each terminal IP address does not store one terminal public key, but stores multiple terminal public keys, and the multiple terminal public keys respectively correspond to multiple terminals.
  • a terminal private key In this way, before the formal transmission, the sending terminal and the receiving terminal negotiate in a secret manner which terminal public key is used for encryption. In this way, even if the attacker obtains the terminal public key list, it is still difficult to crack because it does not know which terminal public key encryption is used. Especially when the number of terminal public keys corresponding to a terminal IP address is large enough, the difficulty of cracking is greatly increased, and the security of transmission is improved.
  • the sending terminal and the receiving terminal pre-store the same set of functions, the set of functions has P functions, and P is a positive integer.
  • Each function has multiple input variables and one output variable.
  • the method further includes:
  • Step 111 Take the number of characters of the IP address of the receiving terminal as the remainder modulo P as the function number in the selected function set;
  • Step 112 Select a function in the function set according to the function number
  • Step 113 Send the input variables of the selected function to the receiving terminal;
  • Step 114 Receive the assignment of the input variable by the receiving terminal
  • Step 115 Substitute the value of the input variable into the selected function to obtain the output variable value of the function
  • Step 116 Take the remainder of the output variable value modulo M as the serial number of the terminal public key to be selected, where M is the number of multiple terminal public keys stored corresponding to each terminal IP address.
  • step 120 includes: step 1201, obtaining the receiving terminal public key of the serial number corresponding to the receiving terminal IP address from the terminal IP address and public key correspondence table.
  • Different receiving terminals have different IP addresses, so they have different numbers of characters.
  • P is the total number of functions in the function set
  • the remainder may be 0, 1, 2...P-1
  • Each function has multiple input variables and one output variable. Although the function is found in step 112, the value of multiple input variables is not known, and the output variable cannot be calculated. Therefore, in step 113, the input variables of the selected function are sent to the receiving terminal. In step 114, the receiving terminal assigns a value to the input variable and sends it back to the sending terminal. The sending terminal receives the assignment of the input variable by the receiving terminal. After receiving these assignments, in step 115, these assignments are substituted into the selected function to obtain the output variable value. In step 116, the value of the output variable will be modulo M to obtain the remainder. The value of the remainder is any one of 0, 1, 2...M-1, which is stored in correspondence with each terminal IP address The terminal public keys correspond exactly one to one.
  • the corresponding stored terminal public key of the serial number is taken out, making the selection of the terminal public key very secretive, and greatly improving the security of transmission.
  • the selection of the terminal public key is very secret, because the serial number of the terminal public key is determined by the value of the output variable of the function, and there are multiple functions. Even if the third party knows that the serial number of the terminal public key is determined by the output variable value of the function, it is difficult to know which function is used. Which function is used is the remainder modulo P from the number of characters in the IP address of the receiving terminal, which also increases the difficulty of cracking. Even if it knows which function is determined, it is difficult to know how to determine the value of the input variable of the function. Therefore, these obstacles increase the difficulty of third-party cracking and improve security.
  • the sending terminal sends a random character string request to the receiving terminal, receives the random character string sent by the receiving terminal, and then applies the digest algorithm to the random character string to obtain the random character string
  • the digest of the digest is the remainder of the number of characters modulo M as the serial number of the terminal public key to be selected, where M is the number of multiple terminal public keys stored corresponding to each terminal IP address.
  • the random string is also stored consistently after receiving.
  • the receiving terminal When the receiving terminal receives the second encrypted message encrypted by the sending terminal using the sending terminal’s private key and the receiving terminal’s public key, the receiving terminal applies a digest algorithm to the stored random string to obtain a digest of the random string, and modulate the number of characters of the digest
  • M is used as the serial number of the terminal public key to be selected, where M is the number of multiple terminal public keys stored corresponding to the IP address of each terminal, that is, the same process as the sending terminal is performed once to obtain the same
  • a serial number according to the serial number, the serial number of the sending terminal public key corresponding to the sending terminal IP address is obtained from the terminal IP address and public key correspondence table, and encrypted with it.
  • the same key can be used for encryption and decryption.
  • the third party obtains all the terminal private keys of the receiving terminal, it cannot be decrypted because it does not know which receiving terminal private key to use, thereby further improving security.
  • step 120 before step 120, it includes:
  • step 111' a random string request is sent to the receiving terminal.
  • Step 112' receiving a random character string sent by the receiving terminal.
  • Step 113' applying a digest algorithm to the random character string to obtain a digest of the random character string.
  • step 114' the remainder of the number of characters in the digest modulo M is used as the serial number of the terminal public key to be selected, where M is the number of multiple terminal public keys stored corresponding to each terminal IP address.
  • This step 120 includes: step 1201', obtaining the receiving terminal public key of the serial number corresponding to the receiving terminal IP address from the terminal IP address and public key correspondence table.
  • the digest algorithm here can be a hash algorithm and so on.
  • the random character string is also stored consistently in the receiving terminal.
  • the receiving terminal When the receiving terminal receives the second encrypted message encrypted by the sending terminal using the sending terminal’s private key and the receiving terminal’s public key, the receiving terminal applies a digest algorithm to the stored random string to obtain a digest of the random string, and modulate the number of characters of the digest
  • M is used as the serial number of the terminal public key to be selected, where M is the number of multiple terminal public keys stored corresponding to the IP address of each terminal, that is, the same process as the sending terminal is performed once to obtain the same
  • a serial number according to this serial number, the serial number corresponding to the sending terminal's IP address is obtained from the terminal IP address and public key correspondence table. Since the serial numbers finally obtained by the sending terminal and the receiving terminal are the same, the same key can be used for encryption and decryption. At the same time, even if the third party obtains all the terminal private keys of the receiving terminal, it cannot be decrypted because it does not know which receiving terminal private key to use, thereby further improving security.
  • step 130 the sending terminal private key is used to encrypt the message to be sent to obtain the first encrypted message.
  • step 140 the first encrypted message is encrypted using the obtained public key of the receiving terminal to obtain a second encrypted message.
  • the reason for using the public key of the receiving terminal for encryption is that only the private key of the receiving terminal can be used to decrypt the encrypted data. Therefore, even if a third party intercepts it, the message to be sent cannot be obtained.
  • the second encrypted message is sent to the receiving terminal. Since the embodiment of the present disclosure uses double encryption using the sending terminal private key and the receiving terminal public key, the receiving terminal can only be unlocked with the receiving terminal private key and the sending terminal public key, thus ensuring the security of the message to be sent.
  • the message to be sent includes: multiple sub-to-be-sent messages to be sent to multiple receiving terminals.
  • a message A to be sent includes sub-messages A1, A2, and A3 to be sent to multiple receiving terminals. At this time, there may be multiple receiving terminal IP addresses in the message header of the message to be sent.
  • step 120 includes: according to the IP addresses of the multiple receiving terminals, respectively obtaining the public keys of the multiple receiving terminals from the corresponding table of the terminal IP addresses and public keys. According to the multiple IP addresses in the message header, the corresponding table of the terminal IP address and the public key can be searched to obtain multiple receiving terminal public keys corresponding to these IP addresses.
  • step 130 includes: encrypting the multiple sub-messages to be sent with the sending terminal private key to obtain multiple sub-first encrypted messages.
  • Step 140 includes: using the obtained public keys of the multiple receiving terminals to respectively encrypt multiple sub-first encrypted messages to obtain multiple sub-second encrypted messages; and synthesize the multiple sub-second encrypted messages into a second encrypted message .
  • the composition needs to be combined in the original order of the sub-messages to be sent. That is, after each message to be sent is taken out, it is encrypted with the private key of the sending terminal to obtain the corresponding first encrypted message, and then encrypted with the public key of the corresponding receiving terminal to obtain the corresponding second encrypted message, and then put back into the message to be sent. The original position in the message to be sent. Broadcast the second encrypted message to all receiving terminals.
  • Each receiving terminal uses the private key of the receiving terminal and the public key of the sending terminal obtained from the terminal IP address and public key correspondence table to decrypt each sub-second encrypted message in the second encrypted message. Only the receiving terminal having the receiving terminal private key corresponding to the receiving terminal public key used for encrypting each plurality of sub-first encrypted messages can successfully decrypt the corresponding sub-second encrypted message. In this way, a sub-message that can be sent to multiple receiving terminals in one message can be unlocked only by the receiving terminal that the sub-message really wants to reach, achieving both high efficiency and security.
  • a method for data exchange based on asymmetric encryption technology on the receiving terminal side includes: receiving a second encrypted message encrypted by the sending terminal using the sending terminal private key and the receiving terminal public key; Use the private key of the receiving terminal to decrypt the second encrypted message to obtain the first encrypted message; obtain the public key of the sending terminal from the corresponding table of the terminal IP address and public key according to the IP address of the sending terminal; use the obtained public key pair of the sending terminal.
  • the first encrypted message is decrypted, and the decrypted message is obtained.
  • the method on the receiving terminal side corresponds to the above-mentioned method on the transmitting terminal side one to one. Since this method has been described in detail on the receiving terminal side, it will not be repeated.
  • the second encrypted message includes a plurality of sub-second encrypted information, and each sub-second encrypted information is respectively encrypted with the public key of the receiving terminal to which the sub-second encrypted information is to be sent.
  • the decryption of the second encrypted message with the private key of the receiving terminal includes: decrypting the plurality of second encrypted messages with the private key of the receiving terminal, wherein, if the private key of the receiving terminal is used for encrypting the second encrypted information The private key corresponding to the public key of the receiving terminal is successfully decrypted, and the first encrypted message is obtained; the first encrypted message is decrypted with the obtained public key of the sending terminal, and the decrypted message includes: if the decryption is successful, the decrypted message is obtained The first encrypted message of the child is decrypted with the public key of the sending terminal to obtain the decrypted information.
  • the terminal IP address and public key correspondence table stores multiple terminal public keys corresponding to each terminal IP address, and the multiple terminal public keys respectively correspond to multiple terminal private keys.
  • the method further includes: receiving a random string request from the sending terminal; sending and saving the random string to the sending terminal,
  • obtaining the public key of the sending terminal from the corresponding table of the IP address of the terminal and the public key includes: applying a digest algorithm to the stored random character string to obtain a digest of the random character string; The remainder of the character digital modulus M is used as the serial number of the terminal public key to be selected, where M is the number of multiple terminal public keys stored corresponding to each terminal IP address; from the terminal IP address and public key correspondence table Obtain the serial number and public key of the sending terminal corresponding to the IP address of the sending terminal.
  • the terminal IP address and public key correspondence table stores multiple terminal public keys corresponding to each terminal IP address, and the multiple terminal public keys respectively correspond to multiple terminal private keys.
  • obtaining the public key of the sending terminal from the corresponding relationship table between the IP address of the terminal and the public key includes: taking the number of characters of the IP address of the receiving terminal as the remainder modulo P as the selection of the function set The function number; select the function in the function set according to the function number; obtain the saved assignment of the input variable by the receiving terminal; substitute the assignment of the input variable into the selected function to obtain the output of the function Variable value; take the remainder of the output variable value modulo M as the serial number of the terminal public key to be selected, where M is the number of multiple terminal public keys stored corresponding to each terminal IP address; from the terminal IP address The serial number of the sending terminal public key corresponding to the IP address of the sending terminal is obtained from the corresponding relationship table with the public key.
  • step 113 after the sending terminal sends the input variables of the selected function to the receiving terminal, the receiving terminal assigns values to these input variables and saves it locally corresponding to the identifier of the sending terminal, and then sends the assignment back to the sending terminal in step 114. Therefore, it is possible to directly obtain the locally saved assignment of the receiving terminal to the input variable. Specifically, according to the stored correspondence relationship between the sending terminal identifier and the input variable assignment, based on the sending terminal identifier, the assignment of the input variable can be obtained, and then the assignment of the input variable can be substituted into the selected function to obtain the output variable value of the function , The output variable value is taken as the remainder modulo M as the serial number of the terminal public key to be selected. This serial number should be the same as the serial number when the sending terminal selects the sending terminal public key. Therefore, through this method, the receiving The terminal correctly decrypts the message encrypted by the sending terminal.
  • the terminal IP address and public key correspondence table stores multiple terminal public keys corresponding to each terminal IP address, and the multiple terminal public keys respectively correspond to multiple terminal private keys.
  • the method further includes: receiving a random character string request from the sending terminal; sending the random character string to the sending terminal and saving it.
  • obtaining the public key of the sending terminal from the corresponding table of the IP address of the terminal and the public key includes: applying a digest algorithm to the stored random character string to obtain a digest of the random character string; The remainder of the character digital modulus M is used as the serial number of the terminal public key to be selected, where M is the number of multiple terminal public keys stored corresponding to each terminal IP address; from the terminal IP address and public key correspondence table Obtain the serial number and public key of the sending terminal corresponding to the IP address of the sending terminal.
  • This process is similar to the foregoing process of negotiating and selecting the pre-stored public key of the receiving terminal by sending a random character string at the sending terminal, except that the public key of the sending terminal is selected here, so it will not be repeated.
  • a sending terminal As shown in FIG. 4, according to an embodiment of the present disclosure, a sending terminal is provided, and the sending terminal includes:
  • the message to be sent acquiring unit 210 is configured to acquire the message to be sent to the receiving terminal;
  • the receiving terminal public key obtaining unit 220 is configured to obtain the receiving terminal public key from the corresponding table of the terminal IP address and the public key according to the receiving terminal's IP address;
  • the first encrypted message obtaining unit 230 is configured to use the sending terminal private key to encrypt the message to be sent to obtain the first encrypted message;
  • the second encrypted message obtaining unit 240 is configured to use the obtained receiving terminal public key to encrypt the first encrypted message to obtain the second encrypted message;
  • the second encrypted message sending unit 250 is configured to send the second encrypted message to the receiving terminal, so that the receiving terminal uses the receiving terminal private key and the sending terminal public key obtained from the terminal IP address and public key correspondence table to encrypt the second The message is decrypted into the message to be sent.
  • the sending terminal and the receiving terminal store the same set of functions in advance.
  • the set of functions has P functions, where P is a positive integer, and each function has multiple input variables and one output variable.
  • the sending terminal further includes:
  • the function sequence number determining unit is configured to take the number of characters of the IP address of the receiving terminal as the remainder modulo P as the function sequence number in the selected function set;
  • the function selection unit is configured to select functions in the function set according to the function sequence number
  • the input number sending unit is used to send the input variables of the selected function to the receiving terminal;
  • An assignment receiving unit configured to receive the assignment of the input variable by the receiving terminal
  • the output variable value obtaining unit is used to substitute the value of the input variable into the selected function to obtain the output variable value of the function;
  • the terminal public key sequence number determination unit is used to take the remainder of the output variable value modulo M as the sequence number of the terminal public key to be selected, where M is the number of multiple terminal public keys stored corresponding to each terminal IP address number.
  • the receiving terminal public key obtaining unit 220 is further configured to obtain the receiving terminal public key of the serial number corresponding to the receiving terminal IP address from the terminal IP address and public key correspondence table.
  • the message to be sent includes: multiple sub-to-be-sent messages to be sent to multiple receiving terminals.
  • the receiving terminal public key obtaining unit 220 is further configured to: according to the IP addresses of the multiple receiving terminals, obtain the public keys of the receiving terminals from the corresponding table of the terminal IP addresses and public keys.
  • the first encrypted message obtaining unit 230 is further configured to: use the sending terminal private key to encrypt the multiple sub-to-be-sent messages to obtain multiple sub-first encrypted messages; the second encrypted message obtaining unit 240 is further configured to: use the obtained The public keys of multiple receiving terminals respectively encrypt multiple sub-first encrypted messages to obtain multiple sub-second encrypted messages; synthesize the multiple sub-second encrypted messages into a second encrypted message; the second encrypted message sending unit 250 further Used to: broadcast the second encrypted message to all receiving terminals, where each receiving terminal uses the private key of the receiving terminal and the public key of the sending terminal obtained from the terminal IP address and public key correspondence table to convert the second encrypted message Each sub-second encrypted message in is decrypted, and only the receiving terminal having the receiving terminal private key corresponding to the receiving terminal public key used for encrypting each of the multiple sub-first encrypted messages can successfully decrypt the respective sub-second encrypted message.
  • the terminal IP address and public key correspondence table stores multiple terminal public keys corresponding to each terminal IP address, and the multiple terminal public keys respectively correspond to multiple terminal private keys;
  • the sending terminal Also includes:
  • Random string request sending unit for sending random string request to receiving terminal
  • the random character string receiving unit is used to receive the random character string sent by the receiving terminal;
  • a summary obtaining unit configured to apply a digest algorithm to the random string to obtain a summary of the random string
  • the remainder unit is used to modulate the remainder of the character number of the digest as the serial number of the terminal public key to be selected, where M is the number of multiple terminal public keys stored corresponding to each terminal IP address;
  • the receiving terminal public key obtaining unit 220 is further configured to:
  • modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory.
  • the features and functions of two or more modules or units described above may be embodied in one module or unit.
  • the features and functions of a module or unit described above can be further divided into multiple modules or units to be embodied.
  • the exemplary embodiments described herein can be implemented by software, or can be implemented by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , Including several instructions to make a computing device (which may be a personal computer, server, mobile terminal, or network device, etc.) execute the method according to the embodiments of the present disclosure.
  • a non-volatile storage medium which can be a CD-ROM, U disk, mobile hard disk, etc.
  • Including several instructions to make a computing device which may be a personal computer, server, mobile terminal, or network device, etc.
  • a transmitting terminal capable of implementing the above method.
  • the transmitting terminal 400 according to this embodiment of the present application will be described below with reference to FIG. 5.
  • the sending terminal 400 shown in FIG. 5 is only an example, and should not bring any limitation to the function and scope of use of the embodiments of the present application.
  • the sending terminal 400 is represented in the form of a general-purpose computing device.
  • the components of the sending terminal 400 may include, but are not limited to: the aforementioned at least one processing unit 410, the aforementioned at least one storage unit 420, and a bus 430 connecting different system components (including the storage unit 420 and the processing unit 410).
  • the storage unit stores computer-readable instructions, and the computer-readable instructions can be executed by the processing unit 410, so that the processing unit 410 executes the method described in the “exemplary method” section of this specification according to the application. Steps of various exemplary embodiments.
  • the processing unit 410 may perform the process shown in FIG. 1.
  • the storage unit 420 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 4201 and/or a cache storage unit 4202, and may further include a read-only storage unit (ROM) 4203.
  • the storage unit 420 may also include a program/utility tool 4204 having a set (at least one) program module 4205.
  • Such program module 4205 includes but is not limited to: an operating system, one or more application programs, other program modules, and program data, Each of these examples or some combination may include the implementation of a network environment.
  • the bus 430 may represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local area using any bus structure among multiple bus structures. bus.
  • the sending terminal 400 may also communicate with one or more external devices 500, and may also communicate with one or more devices that enable a user to interact with the sending terminal 400, and/or communicate with one or more devices that enable the sending terminal 400 to communicate with one or more Any device (such as a router, modem, etc.) that communicates with other computing devices.
  • This communication can be performed through an input/output (I/O) interface 450.
  • I/O input/output
  • other hardware and/or software modules can be used in conjunction with the sending terminal 400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives And data backup storage system, etc.
  • the exemplary embodiments described herein can be implemented by software, or can be implemented by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , Including several instructions to make a computing device (which may be a personal computer, server, terminal device, or network device, etc.) execute the method according to the embodiments of the present disclosure.
  • a non-volatile storage medium which can be a CD-ROM, U disk, mobile hard disk, etc.
  • Including several instructions to make a computing device which may be a personal computer, server, terminal device, or network device, etc.
  • a computer-readable storage medium on which is stored a program product capable of implementing the above method in this specification.
  • various aspects of the present application can also be implemented in the form of a program product, which includes computer-readable instructions.
  • the program product runs on a terminal device, the computer-readable instructions are To make the terminal device execute the steps according to various exemplary implementations of the present application described in the above-mentioned "Exemplary Method" section of this specification.
  • FIG. 6 a program product 600 for implementing the above method according to an embodiment of the present application is described.
  • the computer-readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or combined with an instruction execution system, device, or device.
  • the program product may adopt any combination of one or more computer-readable storage media.
  • the computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), Erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • the computer-readable instructions for performing the operations of the present application can be written in any combination of one or more programming languages.
  • the programming languages include object-oriented programming languages—such as Java, C++, etc., as well as conventional Procedural programming language-such as "C" language or similar programming language.
  • the computer-readable instructions can be executed entirely on the user's computing device, partly on the user's device, executed as a stand-alone software package, partly on the user's computing device and partly executed on the remote computing device, or entirely on the remote computing device Or execute on the server.
  • the remote computing device can be connected to a user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (for example, using Internet service providers). Business to connect via the Internet).
  • LAN local area network
  • WAN wide area network
  • Internet service providers for example, using Internet service providers.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请提供了一种基于非对称加密技术的数据交换方法、发送终端和介质。本申请用于密码技术中的信息加密。该方法包括：获取待发送至接收终端的待发送消息；根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥；使用发送终端私钥对所述待发送消息加密，得到第一加密消息；使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息；将第二加密消息发送至接收终端，以便接收终端使用接收终端私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息解密成所述待发送消息。本公开实施例不需要建立安全信道，用较低的成本实现了终端之间的安全数据传输。

Description

基于非对称加密技术的数据交换方法、发送终端和计算机可读存储介质 技术领域
本申请要求2019年05月28日递交、发明名称为“基于非对称加密技术的数据交换方法、发送终端和介质”的中国专利申请201910450400.5的优先权，在此通过引用将其全部内容合并于此。
本申请涉及密码技术中的信息加密技术领域，尤其涉及一种基于非对称加密技术的数据交换方法、发送终端和计算机可读存储介质。
 背景技术
数据传输共享方法主要是双方建立安全信道，在安全信道中进行数据交换，以此来保证数据的安全性。
 技术问题
本申请的发明人意识到，这种方式的缺点很明显，需要耗费大量资源来建立和维持这样的一个安全通道，因此成本比较高。
 技术解决方案
为了解决在不需要建立和维持专用的安全通道的前提下在通信双方建立安全通信技术问题，本申请的一个目的在于提供一种基于非对称加密技术的方法及装置。
其中，本申请所采用的技术方案为：
一方面，一种基于非对称加密技术的数据交换方法，应用于发送终端，所述方法包括：获取待发送至接收终端的待发送消息；根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥；使用发送终端私钥对所述待发送消息加密，得到第一加密消息；使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息；将第二加密消息发送至接收终端，以便接收终端使用接收终端私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息解密成所述待发送消息。
另一方面，一种发送终端，所述发送终端包括：待发送消息获取单元，用于获取待发送至接收终端的待发送消息；接收终端公钥获取单元，用于根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥；第一加密消息获得单元，用于使用发送终端私钥对所述待发送消息加密，得到第一加密消息；第二加密消息获得单元，用于使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息；第二加密消息发送单元，用于将第二加密消息发送至接收终端，以便接收终端使用接收终端私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息解密成所述待发送消息。
另一方面，一种发送终端，包括：存储器，配置为存储可执行指令。处理器，配置为执行所述存储器中存储的可执行指令，以执行根据以上所述的方法。
另一方面，一种计算机可读程序介质，其存储有计算机程序指令，当所述计算机指令被计算机执行时，使计算机执行以上所述的方法。
 有益效果
在上述技术方案中，由于待发送消息用发送终端的私钥、接收终端的公钥双重加密，如果传输途中被人拦截，拦截者也不会知道接收终端的私钥，无法解密，从而在不需要建立安全信道的情况下也能进行安全数据传输。本公开实施例利用非对称加密算法在一般信道中进行数据共享，可在仅需要共享数据的主机上部署，易于实施；已部署的主机只需维护主机地址和公钥对应表即可，易于维护；非对称算法加密后的数据防篡改，安全可靠。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本申请。
 附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本申请的实施例，并于说明书一起用于解释本申请的原理。
图1示出根据本公开一示例实施方式的非对称加密技术数据交换方法的流程图。
图2示出根据本公开一示例实施方式的非对称加密技术数据交换方法的流程图。
图3示出根据本公开一示例实施方式的非对称加密技术数据交换方法的流程图。
图4示出根据本公开一示例实施方式的发送终端的模块图。
图5示出根据本公开一示例实施方式的发送终端的硬件图。
图6示出根据本公开一示例实施方式的计算机可读程序介质的示意图。
通过上述附图，已示出本申请明确的实施例，后文中将有更详细的描述，这些附图和文字描述并不是为了通过任何方式限制本申请构思的范围，而是通过参考特定实施例为本领域技术人员说明本申请的概念。
 本发明的实施方式
这里将详细地对示例性实施例执行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请的一些方面相一致的装置和方法的例子。
如图1所示，在一实施例中，提供了一种基于非对称加密技术的数据交换方法，其应用于发送终端。所述方法包括：
步骤110、获取待发送至接收终端的待发送消息；
步骤120、根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥；
步骤130、使用发送终端私钥对所述待发送消息加密，得到第一加密消息；
步骤140、使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息；
步骤150、将第二加密消息发送至接收终端，以便接收终端使用接收终端私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息解密成所述待发送消息。
下面对这些步骤进行详细描述。
在步骤110中，获取待发送至接收终端的待发送消息。
例如，对于待发送消息，该消息主要包含查询请求或者对查询请求的应答。消息可能还要携带查询或应答的具体内容，如数据表的查询请求中携带要查询的数据名称，数据表的请求的应答中携带查询到的数据。此外，消息可能是一条请求或应答，也可能是对同一接收端或发送端的多条请求或应答，也可能是对多个接收端或发送端的多条请求或应答。不同的应用环境有不同的消息传递内容和形式。例如，对于发送端或接收端没有绝对限制，可以是个人电脑，也可以是数据服务器，甚至是移动终端。只要是使用了本申请公开的非对称加密技术数据交换方法都可以视为发送端或接收端。
在步骤120中，根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥。在一个实施例中，接收终端的IP地址可以放在待发送消息的消息头中，因此，可以从消息头获取接收终端的IP地址。终端IP地址与公钥对应关系表可以是事先由每个终端将IP地址和公钥上报给服务器，存储在服务器。因此，可以向服务器发请求，获取终端IP地址与公钥对应关系表，从该表中获取与接收终端的IP地址对应的公钥。如果接收终端IP地址不在对应关系表中，则拒绝发送待发送消息。在一个实施例中，在步骤120之前，将发送终端的IP地址和公钥发送到服务器，以存储在终端IP地址与公钥对应关系表中，这样可以初始化建立起终端IP地址与公钥对应关系表。 为了进一步提高安全性，终端IP地址与公钥对应关系表与每个终端IP地址对应地不是存储一个终端公钥，而是存储多个终端公钥，所述多个终端公钥分别对应着多个终端私钥。这样，在正式传输之前，发送终端和接收终端采用隐密的方式协商用第几个终端公钥加密。这样，即使攻击方得到了终端公钥列表，由于其不知道采用了第几个终端公钥加密，因此仍然难以破解。尤其当一个终端IP地址对应的终端公钥数目足够大时，大大增加了破解的难度，提高了传输的安全性。
在一个实施例中，所述发送终端和接收终端预先存储同样的函数集合，所述函数集合中具有P个函数，P为正整数。每个函数具有多个输入变量、一个输出变量。如图2所示，在步骤120之前，所述方法还包括：
步骤111、将接收终端的IP地址的字符数取模P的余数，作为选取所述函数集合中的函数序号；
步骤112、按照所述函数序号选取所述函数集合中的函数；
步骤113、将选取的函数的输入变量发送给接收终端；
步骤114、接收所述接收终端对所述输入变量的赋值；
步骤115、将所述输入变量的赋值代入选取的函数，得到该函数的输出变量值；
步骤116、将该输出变量值取模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数。
在该实施例中，步骤120包括：步骤1201、从终端IP地址与公钥对应关系表中获取与接收终端IP地址对应的所述序号的接收终端公钥。不同接收终端的IP地址不同，也就具有不同的字符数，这样，将其取P的余数（P是函数集合中函数总数），得到的余数可能是0、1、2……P-1，一共P种可能，分别对应着P个函数序号。因此，在步骤111中，根据这个余数，可以确定相同的函数序号，然后在步骤112中找到这个序号的函数。
每个函数具有多个输入变量、一个输出变量。步骤112中虽然找到了函数，但不知道多个输入变量的取值，无法计算出输出变量。因此，在步骤113中，将选取的函数的输入变量发送给接收终端。在步骤114中，接收终端对所述输入变量赋值，发回发送终端。发送终端就接收到所述接收终端对所述输入变量的赋值。接收到这些赋值后，在步骤115中，将这些赋值代入选取的函数，得到输出变量值。在步骤116中，将将该输出变量值模M，得到余数，该余数的取值为0、1、2……M-1中的任一个，与每个终端IP地址对应地存储的多个终端公钥正好一一对应。这样，用这个余数，作为序号，取出该序号的对应存储的终端公钥，使得终端公钥的选取非常隐秘，大大提高了传输的安全性。该终端公钥的选取非常隐秘，是因为选取终端公钥的序号是由函数的输出变量值决定，而函数有多个。即使第三方知道是选取终端公钥的序号是由函数的输出变量值决定的，也难以知道用到了哪个函数。而用到哪个函数是由接收终端的IP地址的字符数取模P的余数，这也增加了破解的难度。即使知道了由哪个函数决定，其也很难知道函数的输入变量的取值如何确定。因此，这重重障碍增加了第三方破解的难度，提高了安全性。
在另一个实施例中，如图3所示，发送终端向接收终端发送随机字符串请求，接收接收终端发送的随机字符串，然后对所述随机字符串应用摘要算法，得到所述随机字符串的摘要，将摘要的字符数模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数。在接收到也一致保存该随机字符串。当接收终端接收到发送终端利用发送终端私钥和接收终端公钥加密的第二加密消息后，对保存的随机字符串应用摘要算法，得到所述随机字符串的摘要，将摘要的字符数模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数，也就是执行一遍与发送终端同样的过程，得到相同的一个序号，按照这个序号，从终端IP地址与公钥对应关系表中获取与发送终端IP地址对应的第所述序号个发送终端公钥，用其进行加密。由于发送终端和接收终端最后得到的序号是一样的，因此，能够用同一密钥进行加解密。同时，即使第三方获取接收终端的全部终端私钥，由于其不知道使用哪个接收终端私钥，也无法解密，从而进一步提高了安全性。
在该实施例中，步骤120之前包括：
步骤111‘’，向接收终端发送随机字符串请求。
步骤112’，接收接收终端发送的随机字符串。
步骤113’，对所述随机字符串应用摘要算法，得到所述随机字符串的摘要。
步骤114’，将摘要的字符数模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数。
该步骤120包括：步骤1201’，从终端IP地址与公钥对应关系表中获取与接收终端IP地址对应的所述序号的接收终端公钥。这里的摘要算法可以是哈希算法等。在接收终端也一致保存该随机字符串。当接收终端接收到发送终端利用发送终端私钥和接收终端公钥加密的第二加密消息后，对保存的随机字符串应用摘要算法，得到所述随机字符串的摘要，将摘要的字符数模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数，也就是执行一遍与发送终端同样的过程，得到相同的一个序号，按照这个序号，从终端IP地址与公钥对应关系表中获取与发送终端IP地址对应的第所述序号个发送终端公钥。由于发送终端和接收终端最后得到的序号是一样的，因此，能够用同一密钥进行加解密。同时，即使第三方获取接收终端的全部终端私钥，由于其不知道使用哪个接收终端私钥，也无法解密，从而进一步提高了安全性。
在步骤130中，使用发送终端私钥对所述待发送消息加密，得到第一加密消息。
在步骤140中，使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息。
使用接收终端公钥加密的原因是，由于只有使用接收终端私钥才能将加密后的数据解密，因此，即使第三者拦截，也无法得到待发送消息。
在步骤150中，将第二加密消息发送至接收终端。由于本公开实施例使用用发送终端私钥和接收终端公钥的双重加密，在接收终端只有用接收终端私钥和发送终端公钥才能解开，因此，保证了待发送消息的安全性。在一个实施例中，所述待发送消息包括：多个待发送至多个接收终端的子待发送消息。例如，在一个待发送消息A中包括到多个接收终端的子待发送消息A1、A2、A3。这时，在待发送消息的消息头中可能有多个接收终端的IP地址。对于多个子待发送消息的情况，步骤120包括：根据所述多个接收终端的IP地址，分别从终端IP地址与公钥对应关系表中获取接收所述多个终端的公钥。可以根据消息头中的多个IP地址，查找终端IP地址与公钥对应关系表，获得与这些IP地址对应的多个接收终端公钥。对于多个子待发送消息的情况，步骤130包括：用发送终端私钥对所述多个子待发送消息加密，得到多个子第一加密消息。步骤140包括：使用获取的所述多个接收终端的公钥分别对各自的多个子第一加密消息加密，得到多个子第二加密消息；将所述多个子第二加密消息合成第二加密消息。合成需要按照子待发送消息原有的顺序进行合成。即，每个子待发送消息取出后，用发送终端私钥加密，得到相应子第一加密消息，再用相应接收终端的公钥加密，得到相应子第二加密消息，再放回子待发送消息在待发送消息中的原有位置。将第二加密消息广播至所有接收终端。每个接收终端使用该接收终端的私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息中的各子第二加密消息进行解密。只有具有与加密各多个子第一加密消息所用的接收终端公钥对应的接收终端私钥的接收终端才能成功解密相应子第二加密消息。这样，就使得在一个消息中可以发送给多个接收终端的子消息但只有子消息真正要到的接收终端才能解开，实现了高效率和安全性兼顾。由于待发送消息用发送终端的私钥、接收终端的公钥双重加密，如果传输途中被人拦截，拦截者也不会知道接收终端的私钥，无法解密，从而在不需要建立安全信道的情况下也能进行安全数据传输。
按照本申请的另一方面，还提供了一种在接收终端侧的基于非对称加密技术数据交换的方法，包括：接收发送终端使用发送终端私钥、接收终端公钥加密的第二加密消息；用接收终端私钥对第二加密消息解密，得到第一加密消息；根据发送终端的IP地址，从终端IP地址与公钥对应关系表中获取发送终端公钥；用获取的发送终端公钥对第一加密消息解密，得到解密后消息。接收终端侧的方法与上述发送终端侧的方法一一对应。由于该方法已经在接收终端侧进行了详细的描述，故不赘述。
在一个实施例中，所述第二加密消息包括多个子第二加密信息，每个子第二加密信息分别用该子第二加密信息要发往的接收终端公钥加密。所述用接收终端私钥对第二加密消息解密，包括：用接收终端私钥对所述多个子第二加密消息解密，其中，如果所述接收终端私钥是与加密子第二加密信息所用的接收终端公钥对应的私钥，则解密成功，得到子第一加密消息；所述用获取的发送终端公钥对第一加密消息解密，得到解密后消息包括：如果解密成功，将解密得到子的第一加密消息用发送终端公钥解密，得到解密后信息。 由于该过程只是前面所述的在发送终端侧待发送消息包括多个子待发送消息的情况下处理过程的相反过程，在发送终端侧待发送消息包括多个子待发送消息的情况下处理过程已经如上详细描述，故不赘述。 
在一个实施例中，终端IP地址与公钥对应关系表与每个终端IP地址对应地存储多个终端公钥，所述多个终端公钥分别对应着多个终端私钥。
在接收发送终端使用发送终端私钥、接收终端公钥加密的第二加密消息之前，所述方法还包括：从发送终端接收随机字符串请求；向发送终端发送随机字符串并保存，
所述根据发送终端的IP地址，从终端IP地址与公钥对应关系表中获取发送终端公钥，包括：对保存的随机字符串应用摘要算法，得到所述随机字符串的摘要；将摘要的字符数模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数；从终端IP地址与公钥对应关系表中获取与发送终端IP地址对应的第所述序号个发送终端公钥。
在一个实施例中，终端IP地址与公钥对应关系表与每个终端IP地址对应地存储多个终端公钥，所述多个终端公钥分别对应着多个终端私钥。所述根据发送终端的IP地址，从终端IP地址与公钥对应关系表中获取发送终端公钥，包括：将接收终端的IP地址的字符数取模P的余数，作为选取所述函数集合中的函数序号；按照所述函数序号选取所述函数集合中的函数；获取保存的所述接收终端对所述输入变量的赋值；将所述输入变量的赋值代入选取的函数，得到该函数的输出变量值；将该输出变量值取模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数；从终端IP地址与公钥对应关系表中获取与发送终端IP地址对应的第所述序号个发送终端公钥。
在前述步骤113中，发送终端将选取的函数的输入变量发送给接收终端后，接收终端为这些输入变量赋值后本地与发送终端的标识对应保存，然后将赋值在步骤114中发送回发送终端，因此，可以直接获取本地保存的所述接收终端对所述输入变量的赋值。具体地说，可以按照存储的发送终端标识与输入变量赋值的对应关系，基于发送终端标识，得到输入变量的赋值，然后将所述输入变量的赋值代入选取的函数，得到该函数的输出变量值，将该输出变量值取模M的余数，作为待选取的终端公钥的序号，这个序号与发送终端选取发送终端公钥时的序号应该是一样的，因此，通过这种方法，可以保证接收终端正确解密发送终端加密后的消息。
在一个实施例中，终端IP地址与公钥对应关系表与每个终端IP地址对应地存储多个终端公钥，所述多个终端公钥分别对应着多个终端私钥。在接收发送终端使用发送终端私钥、接收终端公钥加密的第二加密消息之前，所述方法还包括： 从发送终端接收随机字符串请求；向发送终端发送随机字符串并保存。
所述根据发送终端的IP地址，从终端IP地址与公钥对应关系表中获取发送终端公钥，包括：对保存的随机字符串应用摘要算法，得到所述随机字符串的摘要；将摘要的字符数模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数；从终端IP地址与公钥对应关系表中获取与发送终端IP地址对应的第所述序号个发送终端公钥。该过程与前述在发送终端通过发送随机字符串来协商选取预先存储的第几个接收终端公钥的过程类似，只不过这里选取的是发送终端公钥，故不赘述。
如图4所示，根据本公开一个实施例，提供了一种发送终端，所述发送终端包括：
待发送消息获取单元210，用于获取待发送至接收终端的待发送消息；
接收终端公钥获取单元220，用于根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥；
第一加密消息获得单元230，用于使用发送终端私钥对所述待发送消息加密，得到第一加密消息；
第二加密消息获得单元240，用于使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息；
第二加密消息发送单元250，用于将第二加密消息发送至接收终端，以便接收终端使用接收终端私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息解密成所述待发送消息。
在一个实施例中，所述终端IP地址与公钥对应关系表中，与每个终端IP地址对应地存储多个终端公钥，所述多个终端公钥分别对应着多个终端私钥；所述发送终端和接收终端预先存储同样的函数集合，所述函数集合中具有P个函数，P为正整数，每个函数具有多个输入变量、一个输出变量。所述发送终端还包括：
函数序号确定单元，用于将接收终端的IP地址的字符数取模P的余数，作为选取所述函数集合中的函数序号；
函数选取单元，用于按照所述函数序号选取所述函数集合中的函数；
输入编号发送单元，用于将选取的函数的输入变量发送给接收终端；
赋值接收单元，用于接收所述接收终端对所述输入变量的赋值；
输出变量值获得单元，用于将所述输入变量的赋值代入选取的函数，得到该函数的输出变量值；
终端公钥序号确定单元，用于将该输出变量值取模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数。
该实施例中，所述接收终端公钥获取单元220进一步用于：从终端IP地址与公钥对应关系表中获取与接收终端IP地址对应的所述序号的接收终端公钥。
在一个实施例中，所述待发送消息包括：多个待发送至多个接收终端的子待发送消息。接收终端公钥获取单元220进一步用于：根据所述多个接收终端的IP地址，分别从终端IP地址与公钥对应关系表中获取接收所述多个终端的公钥。第一加密消息获得单元230进一步用于：使用发送终端私钥对所述多个子待发送消息加密，得到多个子第一加密消息；第二加密消息获得单元240进一步用于：使用获取的所述多个接收终端的公钥分别对各自的多个子第一加密消息加密，得到多个子第二加密消息；将所述多个子第二加密消息合成第二加密消息；第二加密消息发送单元250进一步用于：将第二加密消息广播至所有接收终端，其中，每个接收终端使用该接收终端的私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息中的各子第二加密消息进行解密，只有具有与加密各多个子第一加密消息所用的接收终端公钥对应的接收终端私钥的接收终端能成功解密各自的子第二加密消息。 
在一个实施例中，终端IP地址与公钥对应关系表与每个终端IP地址对应地存储多个终端公钥，所述多个终端公钥分别对应着多个终端私钥；所述发送终端还包括：
随机字符串请求发送单元，用于向接收终端发送随机字符串请求；
随机字符串接收单元，用于接收接收终端发送的随机字符串；
摘要获得单元，用于对所述随机字符串应用摘要算法，得到所述随机字符串的摘要；
取余数单元，用于将摘要的字符数模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数；
接收终端公钥获取单元220进一步用于：
从终端IP地址与公钥对应关系表中获取与接收终端IP地址对应的所述序号的接收终端公钥。
上述装置中各个单元的功能和作用的实现过程具体详见上述方法中对应步骤的实现过程，在此不再赘述。
应当注意，尽管在上文详细描述中提及了用于动作执行的设备的若干模块或者单元，但是这种划分并非强制性的。实际上，根据本公开的实施方式，上文描述的两个或更多模块或者单元的特征和功能可以在一个模块或者单元中具体化。反之，上文描述的一个模块或者单元的特征和功能可以进一步划分为由多个模块或者单元来具体化。
此外，尽管在附图中以特定顺序描述了本公开中方法的各个步骤，但是，这并非要求或者暗示必须按照该特定顺序来执行这些步骤，或是必须执行全部所示的步骤才能实现期望的结果。附加的或备选的，可以省略某些步骤，将多个步骤合并为一个步骤执行，以及/或者将一个步骤分解为多个步骤执行等。
通过以上的实施方式的描述，本领域的技术人员易于理解，这里描述的示例实施方式可以通过软件实现，也可以通过软件结合必要的硬件的方式来实现。因此，根据本公开实施方式的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在一个非易失性存储介质（可以是CD-ROM，U盘，移动硬盘等）中或网络上，包括若干指令以使得一台计算设备（可以是个人计算机、服务器、移动终端、或者网络设备等）执行根据本公开实施方式的方法。
在本公开的示例性实施例中，还提供了一种能够实现上述方法的发送终端。
所属技术领域的技术人员能够理解，本申请的各个方面可以实现为***、方法或程序产品。因此，本申请的各个方面可以具体实现为以下形式，即：完全的硬件实施方式、完全的软件实施方式（包括固件、微代码等），或硬件和软件方面结合的实施方式，这里可以统称为“电路”、“模块”或“***”。
下面参照图5来描述根据本申请的这种实施方式的发送终端400。图5显示的发送终端400仅仅是一个示例，不应对本申请实施例的功能和使用范围带来任何限制。
如图5所示，发送终端400以通用计算设备的形式表现。发送终端400的组件可以包括但不限于：上述至少一个处理单元410、上述至少一个存储单元420、连接不同***组件（包括存储单元420和处理单元410）的总线430。
其中，所述存储单元存储有计算机可读指令，所述计算机可读指令可以被所述处理单元410执行，使得所述处理单元410执行本说明书上述“示例性方法”部分中描述的根据本申请各种示例性实施方式的步骤。例如，所述处理单元410可以执行如图1中所示的过程。存储单元420可以包括易失性存储单元形式的可读介质，例如随机存取存储单元（RAM）4201和/或高速缓存存储单元4202，还可以进一步包括只读存储单元（ROM）4203。存储单元420还可以包括具有一组（至少一个）程序模块4205的程序/实用工具4204，这样的程序模块4205包括但不限于：操作***、一个或者多个应用程序、其它程序模块以及程序数据，这些示例中的每一个或某种组合中可能包括网络环境的实现。总线430可以为表示几类总线结构中的一种或多种，包括存储单元总线或者存储单元控制器、***总线、图形加速端口、处理单元或者使用多种总线结构中的任意总线结构的局域总线。发送终端400也可以与一个或多个外部设备500通信，还可与一个或者多个使得用户能与该发送终端400交互的设备通信，和/或与使得该发送终端400能与一个或多个其它计算设备进行通信的任何设备（例如路由器、调制解调器等等）通信。这种通信可以通过输入/输出（I/O）接口450进行。应当明白，尽管图中未示出，可以结合发送终端400使用其它硬件和/或软件模块，包括但不限于：微代码、设备驱动器、冗余处理单元、外部磁盘驱动阵列、RAID***、磁带驱动器以及数据备份存储***等。
通过以上的实施方式的描述，本领域的技术人员易于理解，这里描述的示例实施方式可以通过软件实现，也可以通过软件结合必要的硬件的方式来实现。因此，根据本公开实施方式的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在一个非易失性存储介质（可以是CD-ROM，U盘，移动硬盘等）中或网络上，包括若干指令以使得一台计算设备（可以是个人计算机、服务器、终端装置、或者网络设备等）执行根据本公开实施方式的方法。
在本公开的示例性实施例中，还提供了一种计算机可读存储介质，其上存储有能够实现本说明书上述方法的程序产品。在一些可能的实施方式中，本申请的各个方面还可以实现为一种程序产品的形式，其包括计算机可读指令，当所述程序产品在终端设备上运行时，所述计算机可读指令用于使所述终端设备执行本说明书上述“示例性方法”部分中描述的根据本申请各种示例性实施方式的步骤。参考图6所示，描述了根据本申请的实施方式的用于实现上述方法的程序产品600，其可以采用便携式紧凑盘只读存储器(CD-ROM)并包括计算机可读指令，并可以在终端设备，例如个人电脑上运行。然而，本申请的程序产品不限于此，在本文件中，计算机可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行***、装置或者器件使用或者与其结合使用。
所述程序产品可以采用一个或多个计算机可读存储介质的任意组合。计算机可读存储介质例如可以为但不限于电、磁、光、电磁、红外线、或半导体的***、装置或器件，或者任意以上的组合。计算机可读存储介质的更具体的例子（非穷举的列表）包括：具有一个或多个导线的电连接、便携式盘、硬盘、随机存取存储器（RAM）、只读存储器（ROM）、可擦式可编程只读存储器（EPROM或闪存）、光纤、便携式紧凑盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。
可以以一种或多种程序设计语言的任意组合来编写用于执行本申请操作的计算机可读指令，所述程序设计语言包括面向对象的程序设计语言—诸如Java、C++等，还包括常规的过程式程序设计语言—诸如“C”语言或类似的程序设计语言。计算机可读指令可以完全地在用户计算设备上执行、部分地在用户设备上执行、作为一个独立的软件包执行、部分在用户计算设备上部分在远程计算设备上执行、或者完全在远程计算设备或服务器上执行。在涉及远程计算设备的情形中，远程计算设备可以通过任意种类的网络，包括局域网（LAN）或广域网（WAN），连接到用户计算设备，或者，可以连接到外部计算设备（例如利用因特网服务提供商来通过因特网连接）。
此外，上述附图仅是根据本申请示例性实施例的方法所包括的处理的示意性说明，而不是限制目的。易于理解，上述附图所示的处理并不表明或限制这些处理的时间顺序。另外，也易于理解，这些处理可以是例如在多个模块中同步或异步执行的。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本公开的其他实施例。本申请旨在涵盖本公开的任何变型、用途或适应性变化，这些变型、用途或适应性变化遵循本公开的一般性原理并包括本公开未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本公开的真正范围和精神由权利要求指出。
 

Claims (20)

  1. 一种基于非对称加密技术的数据交换方法，其特征在于，应用于发送终端，所述方法包括：
    获取待发送至接收终端的待发送消息；
    根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥；
    使用发送终端私钥对所述待发送消息加密，得到第一加密消息；
    使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息；
    将第二加密消息发送至接收终端，以便接收终端使用接收终端私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息解密成所述待发送消息。
  2. 根据权利要求1所述的方法，其特征在于，所述终端IP地址与公钥对应关系表中，与每个终端IP地址对应地存储多个终端公钥，所述多个终端公钥分别对应着多个终端私钥；所述发送终端和接收终端预先存储同样的函数集合，所述函数集合中具有P个函数，P为正整数，每个函数具有多个输入变量、一个输出变量；在根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥之前，所述方法还包括：
    将接收终端的IP地址的字符数取模P的余数，作为选取所述函数集合中的函数序号；
    按照所述函数序号选取所述函数集合中的函数；
    将选取的函数的输入变量发送给接收终端；
    接收所述接收终端对所述输入变量的赋值；
    将所述输入变量的赋值代入选取的函数，得到所述函数的输出变量值；
    将所述输出变量值取模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数；所述从终端IP地址与公钥对应关系表中获取接收终端公钥包括：
    从终端IP地址与公钥对应关系表中获取与接收终端IP地址对应的所述序号的接收终端公钥。
  3. 根据权利要求1所述的方法，其特征在于，所述终端IP地址与公钥对应关系表中，与每个终端IP地址对应地存储多个终端公钥，所述多个终端公钥分别对应着多个终端私钥；在根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥之前，所述方法还包括：
    向接收终端发送随机字符串请求；
    接收接收终端发送的随机字符串；
    对所述随机字符串应用摘要算法，得到所述随机字符串的摘要；
    将摘要的字符数取模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数；所述从终端IP地址与公钥对应关系表中获取接收终端公钥包括：
    从终端IP地址与公钥对应关系表中获取与接收终端IP地址对应的所述序号的接收终端公钥。
  4. 根据权利要求1所述的方法，其特征在于，所述待发送消息包括：多个待发送至多个接收终端的子待发送消息；
    所述根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥，包括：
    根据所述多个接收终端的IP地址，分别从终端IP地址与公钥对应关系表中获取接收所述多个终端的公钥；
    所述使用发送终端私钥对所述待发送消息加密，得到第一加密消息，包括：使用发送终端私钥对所述多个子待发送消息加密，得到多个子第一加密消息；
    所述使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息，包括：使用获取的所述多个接收终端的公钥分别对各自的多个子第一加密消息加密，得到多个子第二加密消息；将所述多个子第二加密消息合成第二加密消息；
    所述将第二加密消息发送至接收终端，以便接收终端使用接收终端私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息解密成所述待发送消息，包括: 将第二加密消息广播至所有接收终端，以便各接收终端使用所述接收终端的私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息中的各子第二加密消息进行解密。
  5. 根据权利要求1所述的方法，其特征在于，所述使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息，具体包括；
    使用获取的所述多个接收终端的公钥分别对各自的多个子第一加密消息加密，得到多个子第二加密消息；将所述多个子第二加密消息合成第二加密消息。
  6. 一种发送终端，其特征在于，所述发送终端包括：
    待发送消息获取单元，用于获取待发送至接收终端的待发送消息；
    接收终端公钥获取单元，用于根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥；
    第一加密消息获得单元，用于使用发送终端私钥对所述待发送消息加密，得到第一加密消息；
    第二加密消息获得单元，用于使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息；
    第二加密消息发送单元，用于将第二加密消息发送至接收终端，以便接收终端使用接收终端私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息解密成所述待发送消息。
  7. 根据权利要求6所述的发送终端，其特征在于，所述终端IP地址与公钥对应关系表中，与每个终端IP地址对应地存储多个终端公钥，所述多个终端公钥分别对应着多个终端私钥；所述发送终端和接收终端预先存储同样的函数集合，所述函数集合中具有P个函数，P为正整数，每个函数具有多个输入变量、一个输出变量；所述发送终端还包括：
    函数序号确定单元，用于将接收终端的IP地址的字符数取模P的余数，作为选取所述函数集合中的函数序号；
    函数选取单元，用于按照所述函数序号选取所述函数集合中的函数；
    输入编号发送单元，用于将选取的函数的输入变量发送给接收终端；
    赋值接收单元，用于接收所述接收终端对所述输入变量的赋值；
    输出变量值获得单元，用于将所述输入变量的赋值代入选取的函数，得到所述函数的输出变量值；
    终端公钥序号确定单元，用于将所述输出变量值取模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数；
    所述接收终端公钥获取单元进一步用于：
    从终端IP地址与公钥对应关系表中获取与接收终端IP地址对应的所述序号的接收终端公钥。
  8. 根据权利要求6所述的发送终端，其特征在于，所述终端IP地址与公钥对应关系表中，与每个终端IP地址对应地存储多个终端公钥，所述多个终端公钥分别对应着多个终端私钥；所述发送终端还包括：
    随机字符串请求发送单元，用于向接收终端发送随机字符串请求；
    随机字符串接收单元，用于接收接收终端发送的随机字符串；
    摘要获得单元，用于对所述随机字符串应用摘要算法，得到所述随机字符串的摘要；
    取余数单元，用于将摘要的字符数取模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数；
    所述接收终端公钥获取单元进一步用于：
    从终端IP地址与公钥对应关系表中获取与接收终端IP地址对应的所述序号的接收终端公钥。
  9. 根据权利要求6所述的发送终端，其特征在于，所述待发送消息包括：多个待发送至多个接收终端的子待发送消息；
    所述接收终端公钥获取单元进一步用于：根据所述多个接收终端的IP地址，分别从终端IP地址与公钥对应关系表中获取接收所述多个终端的公钥。
    所述第一加密消息获得单元进一步用于：使用发送终端私钥对所述多个子待发送消息加密，得到多个子第一加密消息；
    所述第二加密消息获得单元进一步用于：使用获取的所述多个接收终端的公钥分别对各自的多个子第一加密消息加密，得到多个子第二加密消息；将所述多个子第二加密消息合成第二加密消息；
    所述第二加密消息发送单元进一步用于：将第二加密消息广播至所有接收终端，以便各接收终端使用所述接收终端的私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息中的各子第二加密消息进行解密。
  10. 根据权利要求6所述的发送终端，其特征在于，所述第二加密消息获得单元进一步用于：使用获取的所述多个接收终端的公钥分别对各自的多个子第一加密消息加密，得到多个子第二加密消息；将所述多个子第二加密消息合成第二加密消息。
  11. 一种发送终端，特征在于，包括处理器及存储器，所述存储器上存储有计算机可读指令，所述计算机可读指令被所述处理器执行时，所述处理器用于执行以下处理：
    获取待发送至接收终端的待发送消息；
    根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥；
    使用发送终端私钥对所述待发送消息加密，得到第一加密消息；
    使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息；
    将第二加密消息发送至接收终端，以便接收终端使用接收终端私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息解密成所述待发送消息。
  12. 根据权利要求11所述的装置，其特征在于，所述终端IP地址与公钥对应关系表中，与每个终端IP地址对应地存储多个终端公钥，所述多个终端公钥分别对应着多个终端私钥；所述发送终端和接收终端预先存储同样的函数集合，所述函数集合中具有P个函数，P为正整数，每个函数具有多个输入变量、一个输出变量；在根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥之前，所述处理器还用于实现以下步骤：
    将接收终端的IP地址的字符数取模P的余数，作为选取所述函数集合中的函数序号；
    按照所述函数序号选取所述函数集合中的函数；
    将选取的函数的输入变量发送给接收终端；
    接收所述接收终端对所述输入变量的赋值；
    将所述输入变量的赋值代入选取的函数，得到所述函数的输出变量值；
    将所述输出变量值取模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数；所述从终端IP地址与公钥对应关系表中获取接收终端公钥包括：
    从终端IP地址与公钥对应关系表中获取与接收终端IP地址对应的所述序号的接收终端公钥。
  13. 根据权利要求11所述的装置，其特征在于，所述终端IP地址与公钥对应关系表中，与每个终端IP地址对应地存储多个终端公钥，所述多个终端公钥分别对应着多个终端私钥；在根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥之前，所述处理器还用于实现以下步骤：：
    向接收终端发送随机字符串请求；
    接收接收终端发送的随机字符串；
    对所述随机字符串应用摘要算法，得到所述随机字符串的摘要；
    将摘要的字符数取模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数；所述从终端IP地址与公钥对应关系表中获取接收终端公钥包括：
    从终端IP地址与公钥对应关系表中获取与接收终端IP地址对应的所述序号的接收终端公钥。
  14. 根据权利要求11所述的装置，其特征在于，所述待发送消息包括：
    多个待发送至多个接收终端的子待发送消息；
    所述根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥，包括：根据所述多个接收终端的IP地址，分别从终端IP地址与公钥对应关系表中获取接收所述多个终端的公钥；
    所述使用发送终端私钥对所述待发送消息加密，得到第一加密消息，包括：使用发送终端私钥对所述多个子待发送消息加密，得到多个子第一加密消息；
    所述使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息，包括：使用获取的所述多个接收终端的公钥分别对各自的多个子第一加密消息加密，得到多个子第二加密消息；将所述多个子第二加密消息合成第二加密消息；
    所述将第二加密消息发送至接收终端，以便接收终端使用接收终端私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息解密成所述待发送消息，包括: 将第二加密消息广播至所有接收终端，以便各接收终端使用所述接收终端的私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息中的各子第二加密消息进行解密。
  15. 根据权利要求11所述的装置，其特征在于，所述使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息，具体包括；
    使用获取的所述多个接收终端的公钥分别对各自的多个子第一加密消息加密，得到多个子第二加密消息；将所述多个子第二加密消息合成第二加密消息。
  16. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时，使得所述处理器用于实现以下步骤：
    获取待发送至接收终端的待发送消息；
    根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥；
    使用发送终端私钥对所述待发送消息加密，得到第一加密消息；
    使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息；
    将第二加密消息发送至接收终端，以便接收终端使用接收终端私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息解密成所述待发送消息。
  17. 根据权利要求16所述的计算机可读存储介质，其特征在于，所述终端IP地址与公钥对应关系表中，与每个终端IP地址对应地存储多个终端公钥，所述多个终端公钥分别对应着多个终端私钥；所述发送终端和接收终端预先存储同样的函数集合，所述函数集合中具有P个函数，P为正整数，每个函数具有多个输入变量、一个输出变量；在根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥之前，所述计算机程序被处理器执行时还使得所述处理器执行如下处理：
    将接收终端的IP地址的字符数取模P的余数，作为选取所述函数集合中的函数序号；
    按照所述函数序号选取所述函数集合中的函数；
    将选取的函数的输入变量发送给接收终端；
    接收所述接收终端对所述输入变量的赋值；
    将所述输入变量的赋值代入选取的函数，得到所述函数的输出变量值；
    将所述输出变量值取模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数；所述从终端IP地址与公钥对应关系表中获取接收终端公钥包括：
    从终端IP地址与公钥对应关系表中获取与接收终端IP地址对应的所述序号的接收终端公钥。
  18. 根据权利要求16所述的计算机可读存储介质，其特征在于，所述终端IP地址与公钥对应关系表中，与每个终端IP地址对应地存储多个终端公钥，所述多个终端公钥分别对应着多个终端私钥；在根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥之前，所述计算机程序被处理器执行时还使得所述处理器执行如下处理：
    向接收终端发送随机字符串请求；
    接收接收终端发送的随机字符串；
    对所述随机字符串应用摘要算法，得到所述随机字符串的摘要；
    将摘要的字符数取模M的余数，作为待选取的终端公钥的序号，其中M为与每个终端IP地址对应地存储的多个终端公钥的个数；所述从终端IP地址与公钥对应关系表中获取接收终端公钥包括：
    从终端IP地址与公钥对应关系表中获取与接收终端IP地址对应的所述序号的接收终端公钥。
  19. 根据权利要求16所述的计算机可读存储介质，其特征在于，所述待发送消息包括：多个待发送至多个接收终端的子待发送消息；
    所述根据接收终端的IP地址，从终端IP地址与公钥对应关系表中获取接收终端公钥，包括：根据所述多个接收终端的IP地址，分别从终端IP地址与公钥对应关系表中获取接收所述多个终端的公钥；
    所述使用发送终端私钥对所述待发送消息加密，得到第一加密消息，包括：使用发送终端私钥对所述多个子待发送消息加密，得到多个子第一加密消息；
    所述使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息，包括：使用获取的所述多个接收终端的公钥分别对各自的多个子第一加密消息加密，得到多个子第二加密消息；将所述多个子第二加密消息合成第二加密消息；
    所述将第二加密消息发送至接收终端，以便接收终端使用接收终端私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息解密成所述待发送消息，包括: 将第二加密消息广播至所有接收终端，以便各接收终端使用所述接收终端的私钥和从终端IP地址与公钥对应关系表中获取的发送终端公钥将第二加密消息中的各子第二加密消息进行解密。
  20. 根据权利要求16所述的计算机可读存储介质，其特征在于，所述使用获取的接收终端公钥对第一加密消息加密，得到第二加密消息，具体包括；
    使用获取的所述多个接收终端的公钥分别对各自的多个子第一加密消息加密，得到多个子第二加密消息；将所述多个子第二加密消息合成第二加密消息。
PCT/CN2019/103432 2019-05-28 2019-08-29 基于非对称加密技术的数据交换方法、发送终端和计算机可读存储介质 WO2020237880A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910450400.5A CN110177099B (zh) 2019-05-28 2019-05-28 基于非对称加密技术的数据交换方法、发送终端和介质
CN201910450400.5 2019-05-28

Publications (1)

Publication Number Publication Date
WO2020237880A1 true WO2020237880A1 (zh) 2020-12-03

Family

ID=67696378

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/103432 WO2020237880A1 (zh) 2019-05-28 2019-08-29 基于非对称加密技术的数据交换方法、发送终端和计算机可读存储介质

Country Status (2)

Country Link
CN (1) CN110177099B (zh)
WO (1) WO2020237880A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113382399A (zh) * 2021-05-27 2021-09-10 广州朗国电子科技有限公司 一种基于电子白板的设置方法
CN114465976A (zh) * 2022-01-28 2022-05-10 深圳快银付信息科技有限公司 一种消息的分发与聚合方法及装置

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110177099B (zh) * 2019-05-28 2021-11-05 平安科技（深圳）有限公司 基于非对称加密技术的数据交换方法、发送终端和介质
CN112887972A (zh) * 2021-01-13 2021-06-01 浙江工业大学 一种基于非对称加密的安卓局域网安全通信方法及app
CN113542247B (zh) * 2021-07-06 2022-11-29 建信金融科技有限责任公司 一种基于数据加密的业务推送方法、装置及设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110173452A1 (en) * 2008-05-28 2011-07-14 Nan Xiang-Hao Method of generating compound type combined public key
CN103929299A (zh) * 2014-04-28 2014-07-16 王小峰 地址即公钥的自安全轻量级网络报文传输方法
CN106685907A (zh) * 2016-06-29 2017-05-17 腾讯科技（深圳）有限公司 一种会话密钥的生成方法及装置
CN110177099A (zh) * 2019-05-28 2019-08-27 平安科技（深圳）有限公司 基于非对称加密技术的数据交换方法、发送终端和介质

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105207774B (zh) * 2014-05-30 2019-03-01 北京奇虎科技有限公司 验证信息的密钥协商方法及装置
US10243744B2 (en) * 2016-06-21 2019-03-26 The King Abdulaziz City For Science And Technology Residue message authentication code
CN106548351A (zh) * 2016-11-24 2017-03-29 深圳市金立通信设备有限公司 一种指纹支付流程的优化方法及终端
CN107070909A (zh) * 2017-04-01 2017-08-18 广东欧珀移动通信有限公司 信息发送方法、信息接收方法、装置及***
CN108768930A (zh) * 2018-04-09 2018-11-06 华北水利水电大学 一种数据的加密传输方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110173452A1 (en) * 2008-05-28 2011-07-14 Nan Xiang-Hao Method of generating compound type combined public key
CN103929299A (zh) * 2014-04-28 2014-07-16 王小峰 地址即公钥的自安全轻量级网络报文传输方法
CN106685907A (zh) * 2016-06-29 2017-05-17 腾讯科技（深圳）有限公司 一种会话密钥的生成方法及装置
CN110177099A (zh) * 2019-05-28 2019-08-27 平安科技（深圳）有限公司 基于非对称加密技术的数据交换方法、发送终端和介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113382399A (zh) * 2021-05-27 2021-09-10 广州朗国电子科技有限公司 一种基于电子白板的设置方法
CN114465976A (zh) * 2022-01-28 2022-05-10 深圳快银付信息科技有限公司 一种消息的分发与聚合方法及装置

Also Published As

Publication number Publication date
CN110177099A (zh) 2019-08-27
CN110177099B (zh) 2021-11-05

Similar Documents

Publication Publication Date Title
TWI641258B (zh) Data transmission method, device and system
WO2020237880A1 (zh) 基于非对称加密技术的数据交换方法、发送终端和计算机可读存储介质
US11303431B2 (en) Method and system for performing SSL handshake
US10938554B2 (en) Managing private key access in multiple nodes
US20210006548A1 (en) Method for authorizing access and apparatus using the method
KR102433939B1 (ko) 무선 네트워크들에서 빠르고, 안전하며 프라이버시에 해가 되지 않는 인터넷 접속 발견을 위한 방법들
US11558361B2 (en) Communication method between mesh network and cloud server, mesh network system and node device thereof
CN113992346B (zh) 一种基于国密加固的安全云桌面的实现方法
JP2002508892A (ja) 双方向認証および暗号化システム
JP2023533319A (ja) ファームウェアデータ検証装置及び方法、並びにファームウェア更新装置、方法、及びシステム
WO2022126972A1 (zh) 数据通信方法、密钥管理***、设备及存储介质
EP4096160A1 (en) Shared secret implementation of proxied cryptographic keys
CN104135471A (zh) Dns防劫持通信方法
CN114173328A (zh) 密钥交换方法、装置、电子设备
WO2024041498A1 (zh) 一种保密通信处理方法、第一终端及存储介质
TW202231014A (zh) 訊息傳輸系統以及應用其中之使用者裝置與資訊安全硬體模組
WO2023174350A1 (zh) 身份认证方法、装置、设备及存储介质
CN112187726A (zh) 数据传输方法、装置、存储介质及终端
WO2024001037A1 (zh) 一种消息传输方法、装置、电子设备和存储介质
WO2023116266A1 (zh) 通信加密方法、***和装置
US20220345298A1 (en) Systems and methods for providing signatureless, confidential and authentication of data during handshake for classical and quantum computing environments
WO2018054144A1 (zh) 对称密钥动态生成方法、装置、设备及***
CN113727059B (zh) 多媒体会议终端入网认证方法、装置、设备及存储介质
CN111431846B (zh) 数据传输的方法、装置和***
KR20110053578A (ko) 유비쿼터스 컴퓨팅 네트워크 환경에서 커뮤니티 컴퓨팅을 위한 디바이스 멤버 인증방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19931335

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19931335

Country of ref document: EP

Kind code of ref document: A1