CN1604534A - Method for acquiring key by user through service data carried key information - Google Patents

Abstract

The invention discloses a method for a user to obtain a key by carrying key information in business data. A multicast/broadcast server and a multicast/broadcast service user establish a corresponding relationship between a key parameter and a key parameter identifier; the multicast/broadcast The broadcast server sends encrypted multicast/broadcast service information and key parameter identification to the multicast/broadcast service user at the same time, and the multicast/broadcast service user uses the received key parameter identification and the stored key parameter and key parameter identification The corresponding relationship to obtain the current group encryption key. According to the method proposed by the present invention, while sending multicast/broadcast service information, only a few bits of key parameter identifiers need to be sent to enable the multicast/broadcast service user to obtain a group encryption key, so that the multicast/broadcast Broadcasting service information enables efficient use of transmission space. The invention enables multicast/broadcast service users to acquire different group encryption keys by continuously changing the key parameter identification, and realizes updating of the group encryption keys.

Description

The method for the user to obtain the key by carrying the key information in the business data

technical field

The invention relates to data transmission technology, in particular to a method for a user in a wireless communication network to obtain an encryption key by carrying key information in service data.

Background technique

In a wireless communication network, multicast/broadcast services refer to point-to-multipoint unidirectional bearer services. Multicast/broadcast service information is sent by one original entity and received by multiple entities. As shown in Figure 1, multicast/broadcast Service information is broadcasted to multiple terminals by the multicast/broadcast server. In a certain area, users who have subscribed to the multicast/broadcast service can enjoy the service of the multicast/broadcast service. A multicast/broadcast server refers to a functional entity that can provide multicast/broadcast services and also has key generation and management functions. It can be a new functional entity in the wireless communication network, or one of the existing wireless communication networks. A functional entity or a combination of multiple functional entities.

In the multicast/broadcast service, in order to prevent users who have not subscribed to the multicast/broadcast service or have not paid for the service of the multicast/broadcast service, it is necessary to set a shared group encryption key in the multicast/broadcast service, and The group encryption key is only known to the multicast/broadcast service user and the multicast/broadcast server providing the multicast/broadcast service, but users who have not subscribed to the multicast/broadcast service or have not paid have no right to know the group encryption key. The multicast/broadcast server uses the group encryption key to encrypt the multicast/broadcast service information, and then sends it to the multicast/broadcast service user; after the multicast/broadcast service user receives the encrypted multicast/broadcast service information, Use the group encryption key to decrypt the multicast/broadcast service information, obtain the multicast/broadcast service information, and finally enjoy the multicast/broadcast service.

Multicast/broadcast services need to use multiple keys, and these keys are generated at different levels in multicast/broadcast services. As shown in Figure 2, the process of generating various keys in multicast/broadcast services Include the following steps:

Step 201: when the multicast/broadcast service user joins the multicast/broadcast service, authentication is performed between the multicast/broadcast server and the multicast/broadcast service user, and authentication and key agreement (AKA) is passed during the authentication process, The multicast/broadcast server and the multicast/broadcast service user simultaneously generate the same root key RK. The RKs of different multicast/broadcast service users are different from each other. RK can be assigned by the operator when the multicast/broadcast service user subscribes to the multicast/broadcast service, and the multicast/broadcast service user will use the RK every time he joins the multicast/broadcast service; RK can also be multicast/broadcast Each time a service user joins a multicast/broadcast service, it is generated simultaneously by the multicast/broadcast server and the multicast/broadcast service user during the authentication process, and is valid until the multicast/broadcast service user quits the current multicast/broadcast service. When the multicast/broadcast service user joins the multicast/broadcast service next time, a new RK is generated together with the multicast/broadcast server.

Step 202: After the multicast/broadcast server and the multicast/broadcast service user generate RK, they jointly generate the same TK for encrypting the group shared key BAK. The process of generating TK can be: the multicast/broadcast server generates a random number for generating TK, and then sends the random number to the multicast/broadcast service user, the multicast/broadcast server and the multicast/broadcast service user according to RK and The random numbers collectively generate the same TK. The TKs of different multicast/broadcast service users are different from each other. In order to improve the security of TK, TK can be updated after TK encrypts BAK, that is, the multicast/broadcast server and multicast/broadcast service users can generate a new TK together.

Steps 203 to 205: the multicast/broadcast server generates the group shared key BAK used to encrypt the group encryption key, then encrypts the BAK with TK, and sends the encrypted BAK to the multicast/broadcast service users. After receiving the encrypted BAK, the multicast/broadcast service user decrypts the BAK with its own stored TK, obtains and stores the BAK.

Step 206: Generate a group encryption key TEK for encrypting multicast/broadcast service information. The generation of TEK can be: the multicast/broadcast server generates a random number for generating TEK, and then sends the random number to the multicast/broadcast service user, the multicast/broadcast server and the multicast/broadcast service user Numbers together generate the same TEK. The process of generating the TEK can also be: the multicast/broadcast server generates a random number for generating the TEK, generates the TEK according to the BAK and the random number, encrypts the TEK with the BAK, and sends the encrypted TEK to the multicast/broadcast service user. After receiving the encrypted TEK, the multicast/broadcast service user decrypts the TEK with its own stored BAK to obtain the TEK.

In order to prevent users outside the group from enjoying multicast/broadcast services, the TEK used to encrypt multicast/broadcast service information is not static and needs to be updated frequently. In practical applications, each encrypted multicast/broadcast service can be encrypted The TEKs of the information are different, that is, the multicast/broadcast server uses different TEKs to encrypt the data packets of the multicast/broadcast service information sent to the multicast/broadcast service users each time, which can greatly increase the security of the multicast/broadcast service information. safety.

In order to improve the confidentiality of TK, TK can be updated after TK encrypts BAK, that is, the multicast/broadcast server and multicast/broadcast service users jointly generate a new TK.

FIG. 3 is a schematic diagram of the process of obtaining a group encryption key in the prior art. As shown in FIG. 3 , the process for a multicast/broadcast service user to obtain a group encryption key includes the following steps:

Steps 301 to 303: the multicast/broadcast server generates a group shared key BAK for encrypting the group encryption key, then encrypts the BAK with TK, and sends the encrypted BAK to the multicast/broadcast service users. After receiving the encrypted BAK, the multicast/broadcast service user decrypts the BAK with its own stored TK, obtains and stores the BAK.

In addition, the multicast/broadcast server can simultaneously generate multiple BAKs for different ranges of multicast/broadcast service information. BAK and BAK identifier are sent to multicast/broadcast service users. In this way, the multicast/broadcast service user stores a series of BAKs.

Step 304: The multicast/broadcast server generates a random number for generating TEK, and generates TEK according to the BAK and the random number.

Steps 305 to 307: the multicast/broadcast server encrypts the multicast/broadcast service information with TEK, encrypts the TEK with BAK, and then sends the encrypted multicast/broadcast service information and encrypted TEK to the multicast/broadcast service user. After receiving the encrypted multicast/broadcast service information and encrypted TEK, the multicast/broadcast service user decrypts the TEK with its own stored BAK to obtain the TEK; then uses the TEK to decrypt the multicast/broadcast service information to obtain the multicast/broadcast business information.

If the multicast/broadcast service user stores a series of BAKs, the multicast/broadcast server needs to send the encrypted multicast/broadcast service information and encrypted TEK to the multicast/broadcast service user The BAK identifier is sent, so that the multicast/broadcast service user determines the BAK of the current encrypted TEK according to the BAK identifier and the corresponding relationship between the BAK and the BAK identifier stored by itself.

From the description of the above process, it can be seen that when the multicast/broadcast server sends encrypted multicast/broadcast service information to multicast/broadcast service users, it also needs to send an encrypted TEK. Usually, TEK is at least 128 bytes (bit). Sending TEK together with multicast/broadcast service information will cause TEK to occupy too much transmission space in the fixed transmission bandwidth, greatly reducing the transmission of multicast/broadcast service information. The transmission space that can be used at that time cannot make the multicast/broadcast service information effectively use the transmission space. In addition, the multicast/broadcast service information is sent together with the TEK, which brings hidden dangers to the security of the multicast/broadcast service information and greatly reduces the security of the multicast/broadcast service information. In addition, the BAK needs to be used to encrypt the TEK every time the multicast/broadcast service information is transmitted, and the frequent use of the BAK also poses a threat to the security of the BAK.

FIG. 4 is a schematic diagram of the acquisition process of two group encryption keys in the prior art. As shown in FIG. 4, the process for a multicast/broadcast service user to obtain a group encryption key includes the following steps:

Steps 401 to 403 are basically the same as steps 301 to 303.

Step 404 is basically the same as step 304 .

Steps 405 to 407: the multicast/broadcast server uses TEK to encrypt the multicast/broadcast service information, and then sends the encrypted multicast/broadcast service information and the generated random number to the multicast/broadcast service user. After multicast/broadcast service users receive encrypted multicast/broadcast service information and random numbers, they generate TEK according to their stored BAK and random numbers; then use the generated TEK to decrypt multicast/broadcast service information and obtain multicast/broadcast business information.

If the multicast/broadcast service user stores a series of BAKs, the multicast/broadcast server needs to send the encrypted multicast/broadcast service information and the random number used to generate the TEK to the multicast/broadcast service user. The /broadcast service user sends the BAK identifier, so that the multicast/broadcast service user can determine the currently used BAK for generating the TEK according to the BAK identifier and the corresponding relationship between the BAK and the BAK identifier stored by itself.

From the description of the above process, it can be seen that when the multicast/broadcast server sends encrypted multicast/broadcast service information to the multicast/broadcast service user, it also needs to send a random number for generating TEK. Usually, the random number is at least 32 bits. Sending the random number together with the multicast/broadcast service information will cause the random number to occupy the transmission space in the fixed transmission bandwidth, reducing the transmission space that can be used when transmitting the multicast/broadcast service information. , it is impossible to make the multicast/broadcast service information effectively use the transmission space.

Contents of the invention

In view of this, the main purpose of the present invention is to provide a method for a user to obtain a key by carrying key information in service data, so that the multicast/broadcast service information can effectively use the transmission space.

In order to achieve the above object, the present invention provides a method for a user to obtain a key by carrying key information in business data, the method includes the following steps:

A. The multicast/broadcast server and the multicast/broadcast service user pre-establish the corresponding relationship between key parameters and key parameter identifiers;

B. The multicast/broadcast server sends encrypted multicast/broadcast service information and key parameter identification to the multicast/broadcast service user at the same time, and the multicast/broadcast service user uses the received key parameter identification and stored key parameter Corresponding relationship with the key parameter identifier to obtain the current group encryption key.

Further include before the step A:

A0. The multicast/broadcast server generates more than one key parameter, assigns an identifier to the key parameter, and then sends the correspondence between the key parameter and the key parameter identifier to the multicast/broadcast service user.

The key parameter in step A is a random number used to generate a group encryption key, and the key parameter identifier is a random number identifier,

The step B further includes: the multicast/broadcast server simultaneously sends encrypted multicast/broadcast service information and random number identification to the multicast/broadcast service user, and the multicast/broadcast service user receives the random number identification and stored The corresponding relationship between the random number and the random number identifier, finding the random number, and then generating the current group encryption key according to the stored group shared key and the random number.

Before the step A0, it further includes: the multicast/broadcast server generates more than one group shared key, and assigns an identifier to the group shared key, and then sends the encrypted group shared key to the multicast/broadcast service user. The corresponding relationship between the key and the group shared key identifier, and the corresponding relationship between the group shared key stored and decrypted in advance by the multicast/broadcast service user and the group shared key identifier;

Before the multicast/broadcast service user generates the current group encryption key according to the stored group shared key and the random number in step B, it further includes: the multicast/broadcast server sends the multicast/broadcast service user The multicast/broadcast service information carries the group shared key identifier, and the multicast/broadcast service user, according to the received group shared key identifier and the stored corresponding relationship between the group shared key and the group shared key identifier, Find the group shared secret.

Before the step B, it further includes: the multicast/broadcast server generates the current group encryption key according to the selected random number and the stored group shared key, and then uses the current group encryption key to encrypt the multicast/broadcast business information.

The key parameter in step A is the group encryption key generated by the multicast/broadcast server, and the key parameter identifier is the group encryption key identifier,

The step B includes: the multicast/broadcast server simultaneously sends encrypted multicast/broadcast service information and group encryption key identification to the multicast/broadcast service user, and the multicast/broadcast service user Find the current group encryption key based on the corresponding relationship between the key identifier and the stored group encryption key and the group encryption key identifier.

Step A00 is further included before the step A0: the multicast/broadcast server generates the group shared key, and sends the encrypted group shared key to the multicast/broadcast service user, the multicast/broadcast server and the multicast/broadcast The business user pre-stores the decrypted group shared key;

Before the multicast/broadcast server in step A0 sends the correspondence between the group encryption key and the group encryption key identifier to the multicast/broadcast service user, step A01 is further included: the multicast/broadcast server uses the stored group shared key encryption group encryption key;

After the multicast/broadcast service user in step B finds the current group encryption key according to the received group encryption key identifier and the stored correspondence between the group encryption key and the group encryption key identifier, further include : The multicast/broadcast service user uses the stored group shared key to decrypt the group encryption key.

The step A00 further includes: the multicast/broadcast server generates more than one group shared key, and assigns an identifier to the group shared key, and then sends the group shared key and the group shared key to the multicast/broadcast service user. The corresponding relationship between group shared key identifiers, multicast/broadcast service users pre-store the corresponding relationship between group shared keys and group shared key identifiers;

The step A01 includes: the multicast/broadcast server encrypts different group encryption keys using different stored group shared keys, and then sends the encrypted group encryption key and the group encryption key to the multicast/broadcast service user The corresponding relationship of the identification, the multicast/broadcast server stores the corresponding relationship between the group shared key identification and the group encryption key identification encrypted by the group shared key;

Before the multicast/broadcast service user in step B finds the current group encryption key according to the received group encryption key ID and the stored correspondence between the group encryption key and the group encryption key ID, it further includes : When the multicast/broadcast server sends the multicast/broadcast service information to the multicast/broadcast service user, it carries the group shared key identifier, and the multicast/broadcast service user uses the received group shared key identifier and stored group The corresponding relationship between the shared key and the group shared key identifier is used to find the group shared key.

Before the step B, it further includes: the multicast/broadcast server encrypts the multicast/broadcast service information with the selected group encryption key.

The multicast/broadcast server sends the encrypted multicast/broadcast service information and the key parameter identifier carried at the same time to the multicast/broadcast service user by broadcasting.

If the multicast/broadcast service information is divided into more than one data packet and sent, it is characterized in that each data packet carries a different key parameter identifier.

The present invention proposes: store the corresponding relationship between the key parameter and the key parameter identifier in the multicast/broadcast server and the multicast/broadcast service user in advance; the multicast/broadcast server sends the encrypted multicast/broadcast service user When broadcasting service information, the key parameter identifier is sent together; after the multicast/broadcast service user receives the encrypted multicast/broadcast service information and key parameter identifier, according to the key parameter identifier and the key parameter and key stored in itself, The corresponding relationship identified by the parameter obtains the TEK. In this way, multicast/broadcast service users can obtain TEK by only sending the key parameter identification. Usually, the key parameter identification only needs to occupy a few bits of the transmission bandwidth, which is less than 128 bits of the key or 32 bits of the random number more, so that the multicast/broadcast service information can effectively use the transmission space. In addition, in the present invention, the BAK is only used when the multicast/broadcast service user obtains the TEK, and the BAK is not used every time the multicast/broadcast service information is transmitted, thus significantly improving the security of the BAK. In addition, in the present invention, the user of the multicast/broadcast service can acquire different TEKs by continuously changing the key parameter identifier, so as to realize the updating of the TEK.

Description of drawings

FIG. 1 is a schematic diagram of a multicast/broadcast service;

Fig. 2 is a schematic diagram of multicast/broadcast service key hierarchy;

Fig. 3 is a schematic diagram of the acquisition process of a group encryption key in the prior art;

Fig. 4 is a schematic diagram of the acquisition process of two groups of encryption keys in the prior art;

Fig. 5 is a schematic diagram of the acquisition process of the group encryption key in the present invention;

Fig. 6 is a schematic diagram of an embodiment of the present invention;

Fig. 7 is a schematic diagram of another embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings.

In the present invention, the correspondence between the key parameter and the key parameter identifier is stored in the multicast/broadcast server and the multicast/broadcast service user in advance; the multicast/broadcast server sends the encrypted multicast/broadcast service user to the multicast/broadcast service user. When broadcasting service information, the key parameter identifier is sent together; after the multicast/broadcast service user receives the encrypted multicast/broadcast service information and key parameter identifier, according to the key parameter identifier and the key parameter and key stored in itself, The corresponding relationship of the parameter identification obtains the TEK, and then uses the TEK to decrypt the multicast/broadcast service information to obtain the multicast/broadcast service information. Usually, the key parameter identification only needs to occupy a few bits of the transmission bandwidth, which is much less than 128 bits of the key or 32 bits of the random number, so that the multicast/broadcast service information can effectively use the transmission space.

Fig. 5 is a schematic diagram of the acquisition process of the group encryption key in the present invention. As shown in Fig. 5, the process for the multicast/broadcast service user to obtain the group encryption key includes the following steps:

Steps 501 to 502: the multicast/broadcast server sends the correspondence between key parameters and key parameter identifiers to multicast/broadcast service users. The multicast/broadcast service user stores the corresponding relationship between the received key parameter and the key parameter identifier.

Steps 503 to 505: the multicast/broadcast server encrypts the multicast/broadcast service information with the TEK, and then sends the encrypted multicast/broadcast service information and the key parameter identifier corresponding to the TEK to the multicast/broadcast service user. After the multicast/broadcast service user receives the multicast/broadcast service information and the key parameter identifier, according to the key parameter identifier and the corresponding relationship between the key parameter and the key parameter identifier stored by itself, obtain the encrypted multicast/broadcast service information The TEK; then use the TEK to decrypt the multicast/broadcast service information to obtain the multicast/broadcast service information.

Due to different usage purposes or usage time, for example, each BAK is aimed at different ranges of multicast/broadcast service information, or to ensure that the BAK is constantly changed to increase the security of the BAK, the multicast/broadcast server can generate multiple BAKs at the same time. , the multicast/broadcast server assigns an identifier to the generated BAK, then encrypts the BAK with TK, and sends the encrypted BAK and BAK identifier to the multicast/broadcast service user. Therefore, the multicast/broadcast service user stores a series of BAKs. Different BAKs are distinguished by BAK identification.

If the multicast/broadcast service user stores a series of BAKs, while the multicast/broadcast service user sends the encrypted multicast/broadcast service information and key parameter identification to the multicast/broadcast service user, it also needs to send The user sends the BAK identifier, so that the multicast/broadcast service user determines the currently used BAK according to the BAK identifier and the corresponding relationship between the BAK and the BAK identifier stored in itself.

FIG. 6 is a schematic diagram of an embodiment of the present invention. As shown in FIG. 6, the process for a multicast/broadcast service user to obtain a group encryption key in this embodiment includes the following steps:

Steps 601 to 605 are basically the same as steps 201 to 205.

In this embodiment, the multicast/broadcast server generates multiple BAKs at the same time, and the multicast/broadcast server assigns identifiers to the generated BAKs, then uses TK to encrypt the BAKs, and sends the encrypted BAKs and BAK identifiers to the multicast/broadcast service User, multicast/broadcast service user stores the corresponding relationship between BAK and BAK ID.

Steps 606 to 608: The multicast/broadcast server generates multiple random numbers, assigns identifiers to the generated random numbers, stores the correspondence between random numbers and random number identifiers, and then sends the random numbers and random numbers to multicast/broadcast service users. Corresponding relationship of number identification. The multicast/broadcast service user stores the corresponding relationship between the received random number and the random number identifier.

Step 609 to Step 612: When the multicast/broadcast server needs to send multicast/broadcast service information to multicast/broadcast service users, select BAK and random number for the currently sent multicast/broadcast service information, and then according to the selected BAK and random number generate TEK, use TEK to encrypt the current multicast/broadcast service information to be sent, and then send the encrypted multicast/broadcast service information, the identifier of the selected random number and the BAK identifier to the multicast/broadcast service user. The multicast/broadcast server can broadcast the encrypted multicast/broadcast service information, the identifier of the selected random number and the BAK identifier to the multicast/broadcast service users in a broadcast manner. After the multicast/broadcast service user receives the encrypted multicast/broadcast service information, the identifier of the selected random number and the BAK identifier, he finds the corresponding BAK according to the corresponding relationship between the BAK identifier and the stored BAK and BAK identifier, Find the corresponding random number according to the corresponding relationship between the number ID and the random number stored in itself and the random number ID, and then generate a TEK according to the found BAK and random number, use the TEK to encrypt multicast/broadcast service information, and obtain multicast/broadcast service information .

Due to the limitation of transmission bandwidth, the multicast/broadcast service information that needs to be sent currently may need to be sent in segments, that is, the multicast/broadcast service information that needs to be sent currently needs to be sent in multiple data packets, so that the multicast/broadcast service users can Obtain complete multicast/broadcast service information. At this time, the multicast/broadcast server can select a random number or multiple random numbers according to the security requirements of the multicast/broadcast service information that needs to be sent currently. If the multicast/broadcast service information has high security requirements, the multicast/broadcast server selects a different random number for each data packet sent; If the requirements are low, the multicast/broadcast server selects the same random number for each data packet sent, regardless of whether the multicast/broadcast server selects one random number or multiple random numbers for the current multicast/broadcast service information to be sent. number, each time an encrypted data packet is sent to a multicast/broadcast service user, a random number identifier needs to be sent to the multicast/broadcast service user.

After the multicast/broadcast server has basically selected all the stored random numbers, or when the multicast/broadcast server thinks that the security is not enough, it can generate multiple new random numbers again, and assign identities to these random numbers, and then The new correspondence between the random number and the random number identifier is sent to the multicast/broadcast service user, and the multicast/broadcast service user stores the received correspondence between the random number and the random number identifier.

FIG. 7 is a schematic diagram of another embodiment of the present invention. As shown in FIG. 7, the process for a multicast/broadcast service user to obtain a group encryption key in this embodiment includes the following steps:

Steps 701 to 705 are basically the same as steps 201 to 205.

In this embodiment, the multicast/broadcast server generates multiple BAKs at the same time, and assigns identifications to the generated BAKs, then uses TK to encrypt the BAKs, stores the correspondence between BAKs and BAK identifications, and sends the encrypted BAKs and BAK identifications to For multicast/broadcast service users, the multicast/broadcast service users store the correspondence between BAKs and BAK identifiers.

Steps 706 to 708: the multicast/broadcast server generates multiple random numbers for generating TEKs, generates multiple TEKs according to the BAK and random numbers, then encrypts the TEKs with the BAKs, and assigns identifiers to the encrypted TEKs. These TEKs can be generated according to different BAKs, and different BAKs can be used for encryption. At this time, the multicast/broadcast server stores the corresponding relationship between the TEK, the TEK identifier and the BAK that encrypts the TEK. Using different BAKs to encrypt TEKs can enhance the security of multiple TEKs and prevent non-multicast/broadcast service users from obtaining encrypted multiple TEKs. After successfully decrypting with one BAK, use this BAK to successfully decrypt other TEKs. If you don't want the management of TEK to be too complicated, you can use the same BAK to encrypt TEK. The multicast/broadcast server sends the encrypted correspondence between the TEK and the TEK identifier to the multicast/broadcast service user, and the multicast/broadcast service user stores the received encrypted correspondence between the TEK and the TEK identifier. At this time, the multicast/broadcast service user does not need to decrypt the TEK, but directly stores it.

Step 709 to Step 712: When the multicast/broadcast server needs to send multicast/broadcast service information to the multicast/broadcast service user, select a TEK for the currently sent multicast/broadcast service information, and use this TEK to encrypt the current message to be sent For multicast/broadcast service information, find the BAK identifier according to the corresponding relationship between the stored TEK and TEK identifier and the BAK of the encrypted TEK, and then send the encrypted multicast/broadcast service information and selected TEK to the multicast/broadcast service user logo and BAK logo. The multicast/broadcast server broadcasts the encrypted multicast/broadcast service information, the selected TEK identifier and the BAK identifier to the multicast/broadcast service user. After the multicast/broadcast service user receives the encrypted multicast/broadcast service information, selects the TEK ID and BAK ID, it finds the corresponding BAK according to the BAK ID and the corresponding relationship between the BAK and BAK ID stored in itself, and at the same time, according to the TEK ID Find the corresponding encrypted TEK with the corresponding relationship between the TEK and the TEK identifier stored in itself, use the BAK to decrypt the encrypted TEK, obtain the TEK, and then use the TEK to decrypt the multicast/broadcast service information to obtain the multicast/broadcast service information.

Due to the limitation of transmission bandwidth, the multicast/broadcast service information that needs to be sent currently may need to be sent in segments, that is, the multicast/broadcast service information that needs to be sent currently needs to be sent in multiple data packets, so that the multicast/broadcast service users can Obtain complete multicast/broadcast service information. At this time, the multicast/broadcast server can select one TEK or multiple TEKs according to the security requirements of the multicast/broadcast service information that needs to be sent currently. If the multicast/broadcast service information has high security requirements, the multicast/broadcast server selects a different TEK for each data packet sent; if the current multicast/broadcast service information to be sent has low security requirements , the multicast/broadcast server selects the same TEK for each data packet to be sent, regardless of whether the multicast/broadcast server selects one TEK or multiple TEKs for the current multicast/broadcast service information that needs to be sent. When the multicast/broadcast service user sends the encrypted data packet, it needs to send the TEK identifier to the multicast/broadcast service user.

After the multicast/broadcast server has basically selected all the stored TEKs, or when the multicast/broadcast server thinks that the security is not enough, it can generate multiple new TEKs again, assign identities to these TEKs, and use BAK to encrypt the new TEKs. TEK, and then send the newly encrypted correspondence between the TEK and the TEK identifier to the multicast/broadcast service user, and the multicast/broadcast service user stores the received correspondence between the TEK and the TEK identifier.

In a word, the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (11)

1. A method for a user to obtain a key by means of carrying key information in business data, characterized in that the method comprises the following steps: A. The multicast/broadcast server and the multicast/broadcast service user pre-establish the corresponding relationship between key parameters and key parameter identifiers; B. The multicast/broadcast server sends encrypted multicast/broadcast service information and key parameter identification to the multicast/broadcast service user at the same time, and the multicast/broadcast service user uses the received key parameter identification and stored key parameter Corresponding relationship with the key parameter identifier to obtain the current group encryption key. 2. The method according to claim 1, characterized in that before the step A, further comprising: A0. The multicast/broadcast server generates more than one key parameter, assigns an identifier to the key parameter, and then sends the correspondence between the key parameter and the key parameter identifier to the multicast/broadcast service user. 3. The method of claim 2, wherein: The key parameter in step A is a random number used to generate a group encryption key, and the key parameter identifier is a random number identifier, The step B further includes: the multicast/broadcast server simultaneously sends encrypted multicast/broadcast service information and random number identification to the multicast/broadcast service user, and the multicast/broadcast service user receives the random number identification and stored The corresponding relationship between the random number and the random number identifier, finding the random number, and then generating the current group encryption key according to the stored group shared key and the random number. 4. The method of claim 3, wherein: Before the step A0, it further includes: the multicast/broadcast server generates more than one group shared key, and assigns an identifier to the group shared key, and then sends the encrypted group shared key to the multicast/broadcast service user. The corresponding relationship between the key and the group shared key identifier, and the corresponding relationship between the group shared key stored and decrypted in advance by the multicast/broadcast service user and the group shared key identifier; Before the multicast/broadcast service user generates the current group encryption key according to the stored group shared key and the random number in step B, it further includes: the multicast/broadcast server sends the multicast/broadcast service user The multicast/broadcast service information carries the group shared key identifier, and the multicast/broadcast service user, according to the received group shared key identifier and the stored corresponding relationship between the group shared key and the group shared key identifier, Find the group shared secret. 5. The method of claim 3, wherein: Before the step B, it further includes: the multicast/broadcast server generates the current group encryption key according to the selected random number and the stored group shared key, and then uses the current group encryption key to encrypt the multicast/broadcast Business preparation information. 6. The method of claim 2, wherein: The key parameter in step A is the group encryption key generated by the multicast/broadcast server, and the key parameter identifier is the group encryption key identifier, The step B includes: the multicast/broadcast server simultaneously sends encrypted multicast/broadcast service information and group encryption key identification to the multicast/broadcast service user, and the multicast/broadcast service user Find the current group encryption key based on the corresponding relationship between the key identifier and the stored group encryption key and the group encryption key identifier. 7. The method of claim 6, wherein: Step A00 is further included before the step A0: the multicast/broadcast server generates the group shared key, and sends the encrypted group shared key to the multicast/broadcast service user, the multicast/broadcast server and the multicast/broadcast The business user pre-stores the decrypted group shared key; Before the multicast/broadcast server in step A0 sends the correspondence between the group encryption key and the group encryption key identifier to the multicast/broadcast service user, step A01 is further included: the multicast/broadcast server uses the stored group shared key encryption group encryption key; After the multicast/broadcast service user in step B finds the current group encryption key according to the received group encryption key identifier and the stored correspondence between the group encryption key and the group encryption key identifier, further include : The multicast/broadcast service user uses the stored group shared key to decrypt the group encryption key. 8. The method of claim 7, wherein: The step A00 further includes: the multicast/broadcast server generates more than one group shared key, and assigns an identifier to the group shared key, and then sends the group shared key and the group shared key to the multicast/broadcast service user. The corresponding relationship between group shared key identifiers, multicast/broadcast service users pre-store the corresponding relationship between group shared keys and group shared key identifiers; The step A01 includes: the multicast/broadcast server encrypts different group encryption keys using different stored group shared keys, and then sends the encrypted group encryption key and the group encryption key to the multicast/broadcast service user The corresponding relationship of the identification, the multicast/broadcast server stores the corresponding relationship between the group shared key identification and the group encryption key identification encrypted by the group shared key; Before the multicast/broadcast service user in step B finds the current group encryption key according to the received group encryption key ID and the stored correspondence between the group encryption key and the group encryption key ID, it further includes : When the multicast/broadcast server sends the multicast/broadcast service information to the multicast/broadcast service user, it carries the group shared key identifier, and the multicast/broadcast service user uses the received group shared key identifier and stored group The corresponding relationship between the shared key and the group shared key identifier is used to find the group shared key. 9. The method of claim 6, wherein: Before the step B, it further includes: the multicast/broadcast server encrypts the multicast/broadcast service information with the selected group encryption key. 10. The method according to claim 5 or 9, characterized in that the multicast/broadcast server sends the encrypted multicast/broadcast service information and the key parameter identifier carried at the same time to the multicast/broadcast service user by broadcasting. 11. The method according to claim 1, if the multicast/broadcast service information is divided into more than one data packet for transmission, it is characterized in that each data packet carries a different key parameter identifier.

Images