BACKGROUND

Technical Field

The disclosed embodiments relate to the field of network security technologies, and in particular, to key generation methods and apparatuses.

Description of the Related Art

In order to ensure secure transmission of data between a terminal device and a gateway device and between the gateway device and a public network server, respective secure transmission channels are usually established between the terminal device and the gateway device and between the gateway device and the public network server. The gateway device forwards data from one secure channel to another secure channel to implement data forwarding. However, during data forwarding, the gateway device needs to decrypt (with a key shared with the terminal device) data encrypted by the terminal device, and then encrypt the data with a key shared with the server before forwarding the data to the server. Therefore, the gateway device risks leaking data information.

SUMMARY

In view of this deficiency, the disclosure provides a novel technical solution, in which a gateway device will not be able to acquire a shared key between two devices, thereby reducing the risk of data being illegally captured during network transmission.

In order to achieve the aforementioned objective, the disclosure provides the following technical solutions.

According to a first aspect of the disclosure, a key generation method is provided, which is applied to a first device, the method comprising: encrypting a first key factor generated by the first device with an initial key, and sending the encrypted first key factor to a second device through a first secure channel, wherein the initial key is a key preset for the first device and the second device; receiving, through the first secure channel, a second key factor encrypted with the initial key, wherein the second key factor is generated by the second device; decrypting the second key factor encrypted with the initial key and received through the first secure channel, so as to obtain the second key factor; and generating a shared key between the first device and the second device according to the first key factor and the second key factor.

According to a second aspect of the disclosure, a key generation method is provided, which is applied to a second device, the method comprising: receiving, from a first device through a second secure channel, a first key factor encrypted with an initial key, wherein the initial key is a key preset between the first device and the second device; decrypting the first key factor encrypted with the initial key, so as to obtain the first key factor; and generating a shared key between the first device and the second device according to the first key factor and a second key factor generated by the second device.

According to a third aspect of the disclosure, a key generation apparatus is provided, which is applied to a first device, the method comprising: a first encryption module, configured to encrypt a first key factor generated by the first device with an initial key, and sending the encrypted first key factor to a second device through a first secure channel, wherein the initial key is a key preset for the first device and the second device; a first receiving module, configured to receive, through the first secure channel, a second key factor encrypted with the initial key, wherein the second key factor is generated by the second device; a first decryption module, configured to decrypt the second key factor encrypted with the initial key and received by the first receiving module through the first secure channel, so as to obtain the second key factor. A first key generation module, configured to generate a shared key between the first device and the second device according to the first key factor and the second key factor decrypted by the first decryption module.

According to a fourth aspect of the disclosure, a key generation apparatus is provided, which is applied to a second device, the method comprising: a third receiving module, configured to receive, from a first device through a second secure channel, a first key factor encrypted with an initial key, wherein the initial key is a key preset between the first device and the second device; a third decryption module, configured to decrypt the first key factor encrypted with the initial key, so as to obtain the first key factor. A second key generation module, configured to generate a shared key between the first device and the second device according to the first key factor and a second key factor generated by the second device.

As can be seen from the aforementioned technical solutions, a first key factor and a second key factor are both encrypted with an initial key when being forwarded by a gateway device. The initial key is a key preset for a first device and a second device. The gateway device, therefore, will not be able to know the first key factor and the second key factor; a shared key between the first device and the second device is generated through the first key factor and the second key factor. The finally negotiated shared key is therefore only known to the first device and the second device. The gateway device still is not able to acquire the negotiated shared key, thus ensuring a secure data transmission between the first device and the second device, and further reducing the risk of the data being illegally captured during transmission.

