Encryption and decryption method and system based on national and cryptographic hybrid algorithm

Abstract

The invention provides an encryption and decryption method and system based on a national and cryptographic hybrid algorithm, and the method comprises the steps: carrying out the signing calculation of to-be-encrypted data through a first end, and obtaining a first message signature; performing symmetric encryption calculation on the to-be-encrypted data through a symmetric encryption algorithm to obtain a first ciphertext; performing asymmetric encryption calculation on the first message signature through an asymmetric encryption algorithm to obtain a second ciphertext; an access request is initiated to the second end, and the second end receives a request parameter sent by the first end and performs decryption calculation on the second ciphertext through an asymmetric encryption algorithm to obtain a first message signature; performing decryption calculation on the first ciphertext through a symmetric encryption algorithm to obtain to-be-encrypted data; when the first message signature is complete, processing the to-be-encrypted data to obtain return data; and the returned data ciphertext is sent to the first end, so that the problem that data transmission is easily attacked and tampered is solved, and the data security is improved.

Description

Technical Field

[0001] The present application relates to the field of cryptography, and in particular to an encryption and decryption method and system based on a national secret hybrid algorithm. Background Art

[0002] The basic process of data encryption is to process the original plain text file or data according to a certain algorithm, making it an unreadable code as ciphertext, so that the content can only be displayed after the corresponding secret key is entered. In this way, the purpose of protecting data from being stolen or read by illegal persons is achieved. The reverse process of this process is decryption, which is the process of converting the encoded information into its original data.

[0003] Due to the requirements for data security, when we, as an interface provider, connect to a third-party system, we need to ensure the confidentiality and integrity of data transmission. We need to define a more secure and reliable interface encryption and decryption rule and implementation. In the field of cryptography, the commonly used traditional international standard encryption algorithm is selected for use in more scenarios because of its long launch time and relatively complete algorithm. The national secret algorithm is a relatively new domestic encryption algorithm with a relatively small number of users, but it is more secure and reliable in the process of network information transmission and storage. The existing technical solutions generally use traditional international standard encryption algorithms. Although this method is safe and reliable, it cannot guarantee the security of its source code, and there is a problem of source code being deliberately attacked, penetrated and tampered with by external parties. Summary of the invention

[0004] The embodiments of the present application provide an encryption and decryption method and system based on a national secret hybrid algorithm, which is used to solve the problem in the prior art that data is easily infiltrated and tampered with by external intentional attacks.

[0005] In a first aspect, an embodiment of the present application provides an encryption and decryption method based on a national secret hybrid algorithm, the method is applied to a first end in an encryption and decryption system, the encryption and decryption system also includes a second end connected to the first end, the method includes:

[0006] The data to be encrypted is signed by a message digest algorithm to obtain a first message signature, wherein the first message signature is used to verify the integrity of the data to be encrypted;

[0007] Perform symmetric encryption calculation on the data to be encrypted by using a symmetric encryption algorithm to obtain a first ciphertext;

[0008] Performing an asymmetric encryption calculation on the first message signature by using an asymmetric encryption algorithm to obtain a second ciphertext;

[0009] Based on a preset concatenation rule, concatenate the first ciphertext and the second ciphertext to obtain a third ciphertext;

[0010] A request parameter is obtained according to the third ciphertext, and an access request is initiated to the second end, so as to send the request parameter to the second end.

[0011] In a possible design, after the signature calculation is performed on the encrypted data by using a message digest algorithm to obtain the first message signature, the method further includes:

[0012] Perform hash processing on the first message signature to obtain a character string;

[0013] A generator generates a first key and a second key according to a character string, wherein the first key is used to encrypt the data to be encrypted to obtain a first ciphertext; and the second key is used to decrypt the first ciphertext.

[0014] In a possible design, a symmetric encryption algorithm is used to perform symmetric encryption calculation on the data to be encrypted to obtain a first ciphertext, including:

[0015] Split the data to be encrypted into multiple data blocks of fixed size;

[0016] Perform encryption calculation on each data block respectively using the first secret key to obtain an encryption result of each data block;

[0017] A first ciphertext is obtained according to the multiple encryption results.

[0018] In a possible design, an asymmetric encryption algorithm is used to perform an asymmetric encryption calculation on the first message signature to obtain a second ciphertext, including:

[0019] Generate a private key and a public key corresponding to the private key through an asymmetric encryption algorithm;

[0020] The first message signature is encrypted and calculated based on the private key to obtain a second ciphertext.

[0021] In a possible design, the request parameters are obtained according to the third ciphertext, including:

[0022] Encapsulate the second secret key, the public key and the third ciphertext to obtain a ciphertext container;

[0023] Get the request parameters based on the ciphertext container.

[0024] In a second aspect, an embodiment of the present application provides an encryption and decryption method based on a national secret hybrid algorithm, the method is applied to a second end in an encryption and decryption system, the encryption and decryption system also includes a first end that is communicatively connected to the second end, and the method includes:

[0025] receiving a request parameter sent by the first end, and decapsulating and restoring the request parameter to obtain a ciphertext container; wherein the ciphertext container includes the third ciphertext;

[0026] Decompose the third ciphertext by using a preset concatenation rule to obtain the first ciphertext and the second ciphertext;

[0027] Decrypt the second ciphertext using an asymmetric encryption algorithm to obtain a first message signature;

[0028] Decrypt the first ciphertext using a symmetric encryption algorithm to obtain data to be encrypted;

[0029] Verify the integrity of the first message signature; when the first message signature is complete, process the data to be encrypted to obtain return data;

[0030] The return data is encrypted using a preset encryption algorithm to generate a ciphertext of the return data, which is then sent to the first end.

[0031] In one possible design, the ciphertext container also includes a public key;

[0032] The second ciphertext is decrypted and calculated by using an asymmetric encryption algorithm to obtain the first message signature, including:

[0033] The second ciphertext is decrypted and calculated according to the public key through an asymmetric encryption algorithm to obtain the first message signature.

[0034] In one possible design, the ciphertext container further includes a second secret key;

[0035] The first ciphertext is decrypted by a symmetric encryption algorithm to obtain the data to be encrypted, including:

[0036] Through the symmetric encryption algorithm, the first ciphertext is decrypted according to the second secret key to obtain the data to be encrypted.

[0037] In a possible design, encrypting the returned data by using a preset encryption algorithm to generate a ciphertext of the returned data, and sending the ciphertext of the returned data to the first end includes:

[0038] The returned data is signed and calculated using a preset encryption algorithm to obtain a second message signature;

[0039] Perform encryption calculation on the returned data by using a second encryption algorithm to obtain a ciphertext of the returned data;

[0040] Respond to the access request and send the return data ciphertext to the first end.

[0041] In a third aspect, the present application provides an encryption and decryption system based on a national secret hybrid algorithm, the system comprising: a first end and a second end

[0042] The first end is used to implement an encryption and decryption method based on a national secret hybrid algorithm as in any one of the first aspects, and the second end is used to implement an encryption and decryption method based on a national secret hybrid algorithm as in any one of the second aspects.

[0043] In a fourth aspect, an embodiment of the present application provides an encryption device based on a national secret hybrid algorithm, the device comprising:

[0044] A signature calculation module, used to perform signature calculation on the data to be encrypted by using a message digest algorithm to obtain a first message signature, wherein the first message signature is used to verify the integrity of the data to be encrypted;

[0045] A symmetric encryption calculation module, used for performing symmetric encryption calculation on the data to be encrypted by using a symmetric encryption algorithm to obtain a first ciphertext;

[0046] an asymmetric encryption calculation module, used to perform an asymmetric encryption calculation on the first message signature through an asymmetric encryption algorithm to obtain a second ciphertext;

[0047] A first concatenation module, configured to concatenate the first ciphertext and the second ciphertext to obtain a third ciphertext based on a preset concatenation rule;

[0048] The access module is used to obtain the request parameter according to the third ciphertext and initiate an access request to the second end so as to send the request parameter to the second end.

[0049] In a fifth aspect, an embodiment of the present application provides a decryption device based on a national secret hybrid algorithm, the decryption device comprising:

[0050] A receiving module, configured to receive the request parameters sent by the first end, and decapsulate and restore the request parameters to obtain a ciphertext container; wherein the ciphertext container includes the third ciphertext;

[0051] A second concatenation module is used to decompose the third ciphertext according to a preset concatenation rule to obtain the first ciphertext and the second ciphertext;

[0052] A first decryption module, used to perform decryption calculation on the second ciphertext by using an asymmetric encryption algorithm to obtain a first message signature;

[0053] A second decryption calculation module is used to perform a decryption calculation on the first ciphertext by using a symmetric encryption algorithm to obtain data to be encrypted;

[0054] A verification module, used to verify the integrity of the first message signature; when the first message signature is complete, processing the data to be encrypted to obtain return data;

[0055] The return module is used to perform encryption calculation on the return data through a preset encryption algorithm, generate the return data ciphertext, and send the return data ciphertext to the first end.

[0056] In a sixth aspect, an embodiment of the present application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0057] Memory stores computer-executable instructions;

[0058] When the processor executes the computer execution instructions stored in the memory, it is used to implement an encryption and decryption method based on a national secret hybrid algorithm of the first aspect or the second aspect.

[0059] In the seventh aspect, an embodiment of the present application provides a computer-readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed by a processor, they are used to implement an encryption and decryption method based on a national secret hybrid algorithm of the first aspect or the second aspect.

[0060] In an eighth aspect, an embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, it is used to implement an encryption and decryption method based on a national secret hybrid algorithm of the first aspect or the second aspect.

[0061] The embodiment of the present application provides an encryption and decryption method and system based on a national secret hybrid algorithm. The first end uses a message digest algorithm to sign the encrypted data to obtain a first message signature, wherein the first message signature is used to verify the integrity of the encrypted data; a symmetric encryption algorithm is used to perform symmetric encryption calculation on the encrypted data to obtain a first ciphertext; an asymmetric encryption algorithm is used to perform asymmetric encryption calculation on the first message signature to obtain a second ciphertext; based on a preset splicing rule, the first ciphertext and the second ciphertext are spliced ​​to obtain a third ciphertext; a request parameter is obtained according to the third ciphertext, and an access request is initiated to the second end so as to send the request parameter to the second end; the second ciphertext is used to perform asymmetric encryption calculation on the first message signature to obtain a second ciphertext; the first ciphertext and the second ciphertext are spliced ​​to obtain a third ciphertext based on a preset splicing rule; the request parameter is obtained according to the third ciphertext, and an access request is initiated to the second end so as to send the request parameter to the second end; the second The end receives the request parameters sent by the first end, and decapsulates and restores the request parameters to obtain a ciphertext container; wherein the ciphertext container includes a third ciphertext; the third ciphertext is decomposed by a preset splicing rule to obtain a first ciphertext and a second ciphertext; the second ciphertext is decrypted and calculated by an asymmetric encryption algorithm to obtain a first message signature; the first ciphertext is decrypted and calculated by a symmetric encryption algorithm to obtain the data to be encrypted; the integrity of the first message signature is verified; when the first message signature is complete, the data to be encrypted is processed to obtain the return data; the return data is encrypted and calculated by a preset encryption algorithm to generate a return data ciphertext, and the return data ciphertext is sent to the first end. The following technical effects are achieved: the security of data is enhanced by a hybrid encryption method of symmetric encryption and asymmetric encryption, and a symmetric encryption algorithm is used for encrypted data, which has a smaller data capacity requirement, a faster data processing speed, and reduces the performance of the first end device; the asymmetric encryption algorithm is more complex, which is convenient for processing message signatures with a smaller data volume to improve the security of data and transmission; the nested encryption method hides the secret key and public key for decryption, which further improves the security performance of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0063] Figure 1 A schematic diagram of an encryption and decryption system based on a national secret hybrid algorithm provided in an embodiment of the present application;

[0064] Figure 2 A schematic diagram of a method for encryption and decryption based on a national secret hybrid algorithm provided in an embodiment of the present application Figure 1 ;

[0065] Figure 3 A schematic diagram of a method for encryption and decryption based on a national secret hybrid algorithm provided in an embodiment of the present application Figure 2 ;

[0066] Figure 4 A schematic diagram of a method for encryption and decryption based on a national secret hybrid algorithm provided in an embodiment of the present application Figure 3 ;

[0067] Figure 5 A schematic diagram of a method for encryption and decryption based on a national secret hybrid algorithm provided in an embodiment of the present application Figure 4 ;

[0068] Figure 6 An electronic device is provided in an embodiment of the present application.

[0069] Reference numerals:

[0070] 110-first end; 120-second end; 130-base station;

[0071] 610 - processor; 620 - memory; 630 - communication component; 640 - bus. DETAILED DESCRIPTION

[0072] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0073] In the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with substantially the same functions and effects. Those skilled in the art will understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference. It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or design. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way. In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more.

[0074] It should be noted that the "at..." in the embodiment of the present application can be the instant when a certain situation occurs, or it can be a period of time after a certain situation occurs, and the embodiment of the present application does not specifically limit this. In addition, the multi-protocol label switching message transmission method provided in the embodiment of the present application is only used as an example, and the multi-protocol label switching message transmission method can also include more or less content.

[0075] In order to clearly describe the technical solutions of the embodiments of the present application, some terms and technologies involved in the embodiments of the present application are briefly introduced below:

[0076] Symmetric encryption: The same secret key can be used for both encryption and decryption of information. This encryption method is called symmetric encryption, also known as single-key encryption.

[0077] Asymmetric encryption: Asymmetric encryption algorithms require two keys for encryption and decryption. One of the two keys is a public key that can be published at will, and the other is a private key that can only be held by oneself.

[0078] Message digest algorithm: A function that compresses a message of any length to a fixed length.

[0079] In order to clearly understand the technical solution of the present application, the solution of the prior art is first introduced in detail.

[0080] The National Cryptography Algorithm is a set of cryptographic algorithm standards developed by the Cryptography Administration. It was born out of a high regard and deep understanding of information security. In the process of network information transmission and storage, the confidentiality, integrity and availability of data are critical security requirements. Although the traditional international standard encryption algorithm is safe and reliable, it has the problem of being infiltrated or tampered by external intentional attackers because the security of the source code cannot be guaranteed. In order to solve this problem, a set of national cryptographic algorithm systems with independent intellectual property rights has been developed.

[0081] Figure 1 A schematic diagram of an encryption and decryption system based on a national secret hybrid algorithm provided for an embodiment of the present application. The embodiment of the present application is mainly used in a scenario where a first end 110 and a second end 120 interact, and the optional first end 110 is the first end 110 and the second end 120 is the second end 120. The first end 110 initiates an access request and sends a request parameter to the second end 120, wherein the first end 110 and the second end 120 can be connected by wire or can be transmitted through a base station 130. Data is easily infiltrated or tampered with by an external intentional attacker during transmission. In order to avoid this situation, the request parameter is encrypted before the first end 110 sends the request parameter, a symmetric encryption algorithm is used to symmetrically encrypt the encrypted data, and the message signature of the encrypted data is asymmetrically encrypted using an asymmetric encryption algorithm. The whole adopts a hybrid nested encryption method to improve the security of data and secret keys during transmission; on the contrary, the first end 110 is the second end 120 and the second end 120 is the first end 110. After the second end 120 receives the access request sent by the first end 110, the generated return data can also be performed using the same encryption and decryption method to ensure the security of data transmission.

[0082] Figure 2 A schematic diagram of a method for encryption and decryption based on a national secret hybrid algorithm provided in an embodiment of the present application Figure 1 .like Figure 2 As shown, an encryption and decryption method based on a national secret hybrid algorithm provided by an embodiment of the present invention includes the following steps:

[0083] S201. Perform signature calculation on the encrypted data using a message digest algorithm to obtain a first message signature.

[0084] Specifically, the data to be encrypted is processed by a message digest algorithm, and a corresponding function is called for calculation, wherein the function is in a cryptographic algorithm library; the data to be encrypted is used to generate a function value of a fixed length, and the first message signature is used to verify the integrity of the data to be encrypted, and the data to be encrypted can be text data or binary data;

[0085] Input the data to be encrypted into the hash algorithm to generate a hash value of a fixed length. This hash value is the summary of the data and represents the "fingerprint" of the data. The summary value is the message signature.

[0086] S202. Perform symmetric encryption calculation on the data to be encrypted using a symmetric encryption algorithm to obtain a first ciphertext.

[0087] Specifically, import the encryption library and generate a pair of symmetric keys for the fixed-length symmetric encryption algorithm. This pair of keys must be kept confidential and only the sender and receiver of the encrypted data know it. The length and complexity of the key directly affect the security of the encryption. The grouped data to be encrypted is encrypted using the key and converted into a hexadecimal string, which is the encrypted ciphertext. Finally, the hexadecimal string can be encoded for easy storage and transmission.

[0088] S203. Perform an asymmetric encryption calculation on the first message signature using an asymmetric encryption algorithm to obtain a second ciphertext.

[0089] Specifically, first, an asymmetric encryption algorithm is used to generate a pair of keys, including a public key and a private key. The public key can be shared publicly, while the private key must be kept secret.

[0090] The encrypted data is processed using a message digest algorithm to generate a fixed-length digest value, and the first message signature is encrypted using a private key, that is, the message signature is hashed, and then the hash value is encrypted to obtain a second ciphertext.

[0091] S204: Based on a preset concatenation rule, concatenate the first ciphertext and the second ciphertext to obtain a third ciphertext.

[0092] Specifically, the first ciphertext is the ciphertext obtained by encrypting the data to be encrypted using a symmetric encryption algorithm, and the second ciphertext is the ciphertext obtained by encrypting the message signature using an asymmetric encryption algorithm;

[0093] In the embodiment of the present application, a byte array is used to calculate the number of bytes occupied by the first ciphertext information and the number of bytes occupied by the second ciphertext information;

[0094] Create a new byte array to assemble the first ciphertext and the second ciphertext together, and add their respective length information in front of them so that they can be correctly divided and processed during decryption. The new byte array is transmitted as the third ciphertext.

[0095] S205. Obtain request parameters according to the third ciphertext, and initiate an access request to the second end.

[0096] Specifically, you first need to know the concatenation rules and encryption algorithm of the third ciphertext. If it is symmetric encryption, you need to obtain the symmetric key; if it is asymmetric encryption, you need to have the corresponding private key or public key. For symmetric encryption, the key may be stored in the local configuration file, key management system, etc. Ensuring the secure storage and correct acquisition of the key is the key to decryption;

[0097] The third ciphertext, the symmetric encryption key, and the asymmetric encryption public key are encapsulated together, and the encapsulated data is converted into a data transmission format between the first end and the second end as a request parameter.

[0098] An encryption and decryption method based on a national secret hybrid algorithm in an embodiment of the present invention comprises the following steps: a first end performs a signature calculation on encrypted data through a message digest algorithm to obtain a first message signature, wherein the first message signature is used to verify the integrity of the data to be encrypted; a symmetric encryption algorithm is used to perform symmetric encryption calculation on the encrypted data to obtain a first ciphertext; an asymmetric encryption algorithm is used to perform asymmetric encryption calculation on the first message signature to obtain a second ciphertext; based on a preset splicing rule, the first ciphertext and the second ciphertext are spliced ​​to obtain a third ciphertext; a request parameter is obtained according to the third ciphertext, and an access request is initiated to the second end so as to send the request parameter to the second end; the following technical effects are achieved: data security is enhanced through a hybrid encryption method of symmetric encryption and asymmetric encryption, a symmetric encryption algorithm is used for encrypted data, the data capacity requirement is relatively small, the data processing speed is fast, and the performance of the first-end device is reduced; the asymmetric encryption algorithm is more complex, which is convenient for processing message signatures with smaller data volumes, thereby improving the security of data and transmission.

[0099] Figure 3 A schematic diagram of a method for encryption and decryption based on a national secret hybrid algorithm provided in an embodiment of the present application Figure 2 .like Figure 3 As shown, the encryption and decryption method based on the national secret hybrid algorithm provided in this embodiment includes the following steps:

[0100] S301: Receive request parameters sent by the first end, and decapsulate and restore the request parameters to obtain a ciphertext container.

[0101] Specifically, the ciphertext container includes a third ciphertext;

[0102] The request parameters are obtained by encapsulating the third ciphertext, the symmetric encryption key and the asymmetric encryption public key according to the data transmission format of the first and second ends. After receiving the request parameters, the second end decapsulates them according to the format requirements to obtain a ciphertext container storing the above-mentioned third ciphertext.

[0103] S302. Decompose the third ciphertext according to a preset concatenation rule to obtain a first ciphertext and a second ciphertext.

[0104] Specifically, the first ciphertext is the ciphertext obtained by encrypting the data to be encrypted using a symmetric encryption algorithm, and the second ciphertext is the ciphertext obtained by encrypting the message signature using an asymmetric encryption algorithm;

[0105] In the embodiment of the present application, the new byte array is parsed, and during decryption, the number of bytes occupied by the first ciphertext information and the number of bytes occupied by the second ciphertext information are identified according to their respective length information, and the first ciphertext and the second ciphertext are separated.

[0106] S303. Decrypt the second ciphertext using an asymmetric encryption algorithm to obtain a first message signature.

[0107] Specifically, the asymmetric encryption algorithm generates a pair of secret keys, including a public key and a private key. The private key is used at the first end to encrypt the first message signature, and the public key is transmitted to the second end along with the ciphertext. The second end decrypts the encrypted hash value based on the public key to obtain the hash value, and then reversely calculates the hash value through the hash algorithm to obtain the first message signature.

[0108] S304: Decrypt the first ciphertext using a symmetric encryption algorithm to obtain data to be encrypted.

[0109] Specifically, the symmetric encryption algorithm generates a pair of identical 128-bit symmetric keys, one of which is used at the first end to perform encryption calculations on the encrypted data, and the other symmetric key is transmitted to the second end to decrypt the first ciphertext to obtain the encrypted data.

[0110] S305. Verify the integrity of the first message signature; when the first message signature is complete, process the data to be encrypted to obtain return data.

[0111] Specifically, the first message signature is used to verify the integrity of the data to be encrypted;

[0112] The decrypted hash value is reversely calculated through the hash function to obtain a fixed-length summary value. A fixed-length summary value is also generated during the first-end encryption process. The two summary values ​​are compared to see if they are the same. If they are the same, it means that the message signature has not been tampered with during the transmission process, and the encrypted data has not been tampered with either, and the transmitted data is complete.

[0113] The second end reads the request method, timestamp, etc. of the data information to be encrypted and obtains the returned data according to the access request of the first end.

[0114] S306: Encrypt the returned data using a preset encryption algorithm to generate a ciphertext of the returned data, and send the ciphertext of the returned data to the first end.

[0115] Specifically, the returned data is encrypted by the same hybrid encryption method as the first end in steps S101-S105 to obtain the returned data ciphertext, and the returned data ciphertext is sent to the first end to complete the first end access process.

[0116] An encryption and decryption method based on a national secret hybrid algorithm according to an embodiment of the present invention comprises: a second end receives a request parameter sent by a first end, and decapsulates and restores the request parameter to obtain a ciphertext container; wherein the ciphertext container comprises a third ciphertext; the third ciphertext is decomposed by a preset splicing rule to obtain a first ciphertext and a second ciphertext; the second ciphertext is decrypted and calculated by an asymmetric encryption algorithm to obtain a first message signature; the first ciphertext is decrypted and calculated by a symmetric encryption algorithm to obtain data to be encrypted; the integrity of the first message signature is verified; when the first message signature is complete, the data to be encrypted is processed to obtain return data; the return data is encrypted and calculated by a preset encryption algorithm to generate a return data ciphertext, and the return data ciphertext is sent to the first end, thereby achieving the following technical effects: data security is enhanced by a nested encryption method, and a secret key used for decryption is also encrypted while encrypting the data, thereby solving the problem that data cannot be decrypted due to the loss of the secret key during data transmission.

[0117] Figure 4 A schematic diagram of a method for encryption and decryption based on a national secret hybrid algorithm provided in an embodiment of the present application Figure 3 .like Figure 4 As shown, the encryption and decryption method based on the national secret hybrid algorithm provided in this embodiment includes the following steps:

[0118] S401. Perform hash processing on the first message signature to obtain a character string.

[0119] Specifically, the message signature is hashed to obtain a string, usually to ensure the integrity of the data and verify the source of the message;

[0120] The first message signature is processed using a hash algorithm to generate a hash value. The hash algorithm usually generates binary data. In order to facilitate storage and transmission, the hash value needs to be converted into a string form in the embodiment of the present application.

[0121] S402: Generate a first key and a second key according to the character string through a generator.

[0122] Specifically, the first secret key is used to encrypt the data to be encrypted to obtain the first ciphertext; the second secret key is used to decrypt the first ciphertext to obtain the data to be encrypted;

[0123] The generator randomly generates a byte sequence, which is used to increase the randomness of the secret key. The string is iterated to generate the first secret key and the second secret key. The first secret key and the second secret key here can be the same and used for symmetric encryption algorithms. The first secret key and the second secret key can also be different, then the secret key is used for asymmetric encryption algorithms.

[0124] S403: Split the data to be encrypted into multiple data blocks of fixed size.

[0125] Specifically, the length of the data to be encrypted must be an integer multiple of 512 bits. If the length of the data to be encrypted does not meet the requirements, the data to be encrypted needs to be padded. First, add a 1 to the end of the data, and then add several 0s until the total length of the data to be encrypted is equal to 448 modulo 512 after adding the 1 and 0. Finally, append the 64-bit length of the data to be encrypted to the end of the data. The padded data to be encrypted is grouped into 512-bit blocks, and the data in each group is message expanded, and then compressed iteratively into multiple fixed-size data blocks using a compression function.

[0126] S404: Perform encryption calculation on each data block using the first secret key to obtain an encryption result for each data block.

[0127] Specifically, the divided data blocks are optionally encrypted one by one using a secret key to obtain an encryption result for each data block.

[0128] S405. Obtain a first ciphertext according to the multiple encryption results.

[0129] Specifically, the encryption result of each data block is incomplete. The overall encryption of the entire data to be encrypted has a high computational cost due to the large amount of data. Multiple encryption results are arranged and combined in the order of segmentation to form the first ciphertext.

[0130] S406: Generate a private key and a public key corresponding to the private key through an asymmetric encryption algorithm.

[0131] Specifically, the private key is used to encrypt the message signature to obtain the second ciphertext; the public key is used to decrypt the second ciphertext to obtain the message signature;

[0132] Import the asymmetric encryption package, and the generated private key is stored in the secure hardware device or encrypted file at the first end to prevent the private key from being leaked. The generated public key is stored publicly and transmitted to the second end along with the ciphertext.

[0133] S407: Encrypt the first message signature based on the private key to obtain a second ciphertext.

[0134] Specifically, the first message signature is encrypted using the private key, that is, the message signature is hashed, and then the hash value is encrypted to obtain the second ciphertext.

[0135] S408. Encapsulate the second secret key, the public key and the third ciphertext to obtain a ciphertext container.

[0136] Specifically, the first ciphertext and the second ciphertext are obtained through the encryption algorithm. During the encryption process, the encryption algorithm will also generate a secret key and a public key, which need to be transmitted to the second end together with the ciphertext to create a new ciphertext container. The second secret key, the public key, and the third ciphertext assembled are encapsulated to obtain the ciphertext container.

[0137] S409: Obtain request parameters according to the ciphertext container.

[0138] Specifically, construct the request parameters, convert the format of the third ciphertext in the ciphertext container into JSON format, XML format or other formats required by the second end, so that the second end can accurately identify the request parameters; wherein, the JSON object is an unordered set of "key" and "value" pairs, JSON is a lightweight data exchange format that can be used by multiple programming languages; XML documents are composed of elements, and elements are composed of start tags, end tags and content between tags, XML is a markup language used to store and transmit data;

[0139] Use the HTTP first-end library to initiate an access request to the second end and send the constructed request parameters to the second end; HTTP is an application layer protocol for distributed, collaborative and hypermedia information systems. It is the basis of World Wide Web data communication and is used to transmit data between the first end and the second end.

[0140] The embodiment of the present application provides an encryption and decryption method based on a national secret hybrid algorithm. The encrypted data is signed by a message digest algorithm. After obtaining a first message signature, the message is processed to obtain a secret key of a symmetric encryption algorithm. The encrypted data is encrypted by a symmetric encryption algorithm based on the secret key. The message signature is pre-processed before symmetric encryption, and an algorithm program is added to improve security.

[0141] Figure 5 A schematic diagram of a method for encryption and decryption based on a national secret hybrid algorithm provided in an embodiment of the present application Figure 4 .like Figure 5 As shown, the encryption and decryption method based on the national secret hybrid algorithm provided in this embodiment includes the following steps:

[0142] S501. Decrypt the second ciphertext using an asymmetric encryption algorithm according to a public key to obtain a first message signature.

[0143] Specifically, the second end decrypts the encrypted hash value according to the public key to obtain a hash value, and then reversely calculates the hash value through a hash algorithm to obtain the first message signature.

[0144] S502: Using a symmetric encryption algorithm and according to a second secret key, decrypt the first ciphertext to obtain data to be encrypted.

[0145] Specifically, the second end receives the second secret key, decrypts the first ciphertext according to the symmetric encryption algorithm, and obtains the data to be encrypted.

[0146] S503: Perform signature calculation on the returned data using a preset encryption algorithm to obtain a second message signature.

[0147] Specifically, the returned data is processed by a message digest algorithm, and a corresponding function is called for calculation, wherein the function is in a cryptographic algorithm library; a function value of a fixed length is generated from the returned data, and the second message signature is used to verify the integrity of the returned data.

[0148] S504: Encrypt the returned data using a second encryption algorithm to obtain a ciphertext of the returned data.

[0149] Specifically, import the encryption library, generate a pair of 128-bit symmetric keys for the symmetric encryption algorithm, use the keys to encrypt the grouped return data, and convert it into a hexadecimal string, which is the encrypted ciphertext. Finally, encode the hexadecimal string for easy storage and transmission.

[0150] S505: Respond to the access request and send a return data ciphertext to the first end.

[0151] Specifically, the second end identifies the data to be encrypted, obtains the data requested to be accessed by the first end, generates return data after processing, responds to the access request of the first end, and sends the return data to the first end.

[0152] An encryption and decryption method based on a national secret hybrid algorithm is provided in an embodiment of the present application. A message signature and a secret key are first decrypted through a nested decryption method, and then the first ciphertext is decrypted according to the secret key, thereby increasing the complexity of data encryption. Even if the data is tampered with, it will not cause the encrypted data to be incomplete, and only the integrity of the external secret key and the message signature will be affected.

[0153] The embodiment of the present application provides an encryption device based on a national secret hybrid algorithm, the device comprising:

[0154] A first signature calculation module is used to perform signature calculation on the data to be encrypted by using a message digest algorithm to obtain a first message signature, wherein the first message signature is used to verify the integrity of the data to be encrypted;

[0155] A symmetric encryption calculation module, used for performing symmetric encryption calculation on the data to be encrypted by using a symmetric encryption algorithm to obtain a first ciphertext;

[0156] an asymmetric encryption calculation module, used to perform an asymmetric encryption calculation on the first message signature through an asymmetric encryption algorithm to obtain a second ciphertext;

[0157] A first concatenation module, configured to concatenate the first ciphertext and the second ciphertext to obtain a third ciphertext based on a preset concatenation rule;

[0158] The access module is used to obtain the request parameter according to the third ciphertext and initiate an access request to the second end so as to send the request parameter to the second end.

[0159] In a possible design, after the signature calculation module, it includes:

[0160] A hash module, used for performing hash processing on the first message signature to obtain a character string;

[0161] The generator module is used to generate a first key and a second key according to a character string through a generator, wherein the first key is used to encrypt the data to be encrypted to obtain a first ciphertext; and the second key is used to decrypt the first ciphertext.

[0162] In a possible design, the symmetric encryption computing module includes:

[0163] A splitting module, used for splitting the data to be encrypted into multiple data blocks of fixed size;

[0164] A first calculation module, used to perform encryption calculation on each data block respectively by using a first secret key to obtain an encryption result of each data block;

[0165] The first generating module is used to obtain a first ciphertext according to a plurality of encryption results.

[0166] In a possible design, the asymmetric encryption computing module includes:

[0167] An algorithm module, used to generate a private key and a public key corresponding to the private key through an asymmetric encryption algorithm;

[0168] The second calculation module is used to perform encryption calculation on the first message signature based on the private key to obtain a second ciphertext.

[0169] In one possible design, the access module includes:

[0170] An encapsulation module, used for encapsulating the second secret key, the public key and the third ciphertext to obtain a ciphertext container;

[0171] The second generating module is used to obtain the request parameters according to the ciphertext container.

[0172] The embodiment of the present application provides a decryption device based on a national secret hybrid algorithm, the decryption device comprising:

[0173] A receiving module, configured to receive the request parameters sent by the first end, and decapsulate and restore the request parameters to obtain a ciphertext container; wherein the ciphertext container includes the third ciphertext;

[0174] A second concatenation module is used to decompose the third ciphertext according to a preset concatenation rule to obtain the first ciphertext and the second ciphertext;

[0175] A first decryption module, used to perform decryption calculation on the second ciphertext by using an asymmetric encryption algorithm to obtain a first message signature;

[0176] A second decryption calculation module is used to perform a decryption calculation on the first ciphertext by using a symmetric encryption algorithm to obtain data to be encrypted;

[0177] A verification module, used to verify the integrity of the first message signature; when the first message signature is complete, processing the data to be encrypted to obtain return data;

[0178] The return module is used to perform encryption calculation on the return data through a preset encryption algorithm, generate the return data ciphertext, and send the return data ciphertext to the first end.

[0179] In one possible design, the ciphertext container also includes a public key;

[0180] The first decryption module comprises:

[0181] The third decryption module is used to perform decryption calculation on the second ciphertext according to the public key through an asymmetric encryption algorithm to obtain the first message signature.

[0182] In one possible design, the ciphertext container further includes a second secret key;

[0183] The second decryption calculation module includes:

[0184] The fourth decryption module is used to perform decryption calculation on the first ciphertext according to the second secret key through a symmetric encryption algorithm to obtain data to be encrypted.

[0185] In one possible design, the return module includes:

[0186] A second signature calculation module is used to perform signature calculation on the returned data using a preset encryption algorithm to obtain a second message signature;

[0187] The encryption calculation module is used to perform encryption calculation on the returned data by using a second encryption algorithm to obtain a ciphertext of the returned data;

[0188] The response module is used to respond to the access request and send the return data ciphertext to the first end.

[0189] The embodiment of the present application also provides an encryption and decryption system based on a national secret hybrid algorithm, wherein the first end and the second end are both used to implement an encryption and decryption method based on a national secret hybrid algorithm in the above embodiment; for a specific description, please refer to the above Figure 1 , this embodiment will not be described in detail here.

[0190] Figure 6 An electronic device provided in an embodiment of the present application includes: at least one processor 610 and a memory 620. The electronic device also includes a communication component 630. The processor 610, the memory 620 and the communication component 630 are connected via a bus 640.

[0191] In the specific implementation process, at least one processor 610 executes the computer execution instructions stored in the memory 620, so that at least one processor 610 is used to implement the encryption and decryption method based on the national secret hybrid algorithm of the above embodiment.

[0192] The specific implementation process of the processor 610 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0193] In the above embodiment, it should be understood that the processor 610 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the invention can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0194] The memory 620 may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk storage.

[0195] The bus 640 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus 640 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus 640 in the drawings of the present application is not limited to only one bus or one type of bus.

[0196] The above-mentioned functions implemented by the electronic device and the main control device introduce the scheme provided by the embodiment of the present invention. It can be understood that in order to implement the above-mentioned functions, the electronic device or the main control device includes a hardware structure and / or software module corresponding to the execution of each function. In combination with the units and algorithm steps of each example described in the embodiment disclosed in the embodiment of the present invention, the embodiment of the present invention can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the technical solution of the embodiment of the present invention.

[0197] The embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the encryption and decryption method based on the national secret hybrid algorithm in the above embodiment. In the specific implementation of the aforementioned multi-protocol label switching message transmission method, each module can be implemented as a processor.

[0198] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0199] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist as discrete components in an electronic device or a main control device.

[0200] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, is used to implement the encryption and decryption method based on the national secret hybrid algorithm of the above embodiment.

[0201] The computer program is stored in a readable storage medium. At least one processor can read the computer program from the readable storage medium. At least one processor executes the computer program to execute the solution provided in any of the above embodiments.

[0202] Those skilled in the art can understand that all or part of the steps of the above method embodiment can be completed by hardware related to program instructions. The above program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above method embodiment are executed; and the above storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0203] So far, the technical solution of the present application has been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present application is obviously not limited to these specific embodiments, and the above embodiments are only used to illustrate the technical solution of the present application rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. An encryption and decryption method based on a national secret hybrid algorithm, characterized in that: The method is applied to a first end in an encryption and decryption system, and the encryption and decryption system further includes a second end in communication connection with the first end, and the method includes: The data to be encrypted is signed by a message digest algorithm to obtain a first message signature, wherein the first message signature is used to verify the integrity of the data to be encrypted; Performing symmetric encryption calculation on the data to be encrypted by using a symmetric encryption algorithm to obtain a first ciphertext; Perform an asymmetric encryption calculation on the first message signature by using an asymmetric encryption algorithm to obtain a second ciphertext; Based on a preset concatenation rule, concatenate the first ciphertext and the second ciphertext to obtain a third ciphertext; A request parameter is obtained according to the third ciphertext, and an access request is initiated to the second end, so as to send the request parameter to the second end.

2. The method according to claim 1, characterized in that After the encrypted data is signed by a message digest algorithm to obtain a first message signature, the method includes: Performing hash processing on the first message signature to obtain a character string; A generator generates a first key and a second key according to the character string, wherein the first key is used to encrypt the data to be encrypted to obtain the first ciphertext; and the second key is used to decrypt the first ciphertext.

3. The method according to claim 2, characterized in that The step of performing symmetric encryption calculation on the data to be encrypted by using a symmetric encryption algorithm to obtain a first ciphertext includes: Splitting the data to be encrypted into multiple data blocks of fixed size; Perform encryption calculation on each of the data blocks using the first secret key to obtain an encryption result of each of the data blocks; The first ciphertext is obtained according to the multiple encryption results.

4. The method according to claim 3, characterized in that The performing an asymmetric encryption calculation on the first message signature by using an asymmetric encryption algorithm to obtain a second ciphertext includes: Generate a private key and a public key corresponding to the private key through the asymmetric encryption algorithm; The first message signature is encrypted and calculated based on the private key to obtain a second ciphertext.

5. The method according to claim 4, characterized in that The obtaining the request parameter according to the third ciphertext includes: Encapsulating the second secret key, the public key and the third ciphertext to obtain a ciphertext container; The request parameters are obtained according to the ciphertext container.

6. An encryption and decryption method based on a national secret hybrid algorithm, characterized in that: The method is applied to a second end in an encryption and decryption system, and the encryption and decryption system further includes a first end in communication connection with the second end, and the method includes: receiving a request parameter sent by the first end, and decapsulating and restoring the request parameter to obtain a ciphertext container; wherein the ciphertext container includes a third ciphertext; Decomposing the third ciphertext by a preset concatenation rule to obtain a first ciphertext and a second ciphertext; Decrypt the second ciphertext using an asymmetric encryption algorithm to obtain a first message signature; Decrypt the first ciphertext using a symmetric encryption algorithm to obtain data to be encrypted; Verifying the integrity of the first message signature; when the first message signature is complete, processing the data to be encrypted to obtain return data; The returned data is encrypted by a preset encryption algorithm to generate a returned data ciphertext, and the returned data ciphertext is sent to the first end.

7. The method according to claim 6, characterized in that The ciphertext container also includes a public key; The decrypting and calculating the second ciphertext by using an asymmetric encryption algorithm to obtain the first message signature includes: The second ciphertext is decrypted and calculated according to the public key through an asymmetric encryption algorithm to obtain the first message signature.

8. The method according to claim 6, characterized in that The ciphertext container also includes a second secret key; The decrypting calculation of the first ciphertext by using a symmetric encryption algorithm to obtain the data to be encrypted includes: The first ciphertext is decrypted and calculated according to the second secret key by using a symmetric encryption algorithm to obtain the data to be encrypted.

9. The method according to claim 6, characterized in that The encrypting and calculating the returned data by using a preset encryption algorithm to generate a ciphertext of the returned data, and sending the ciphertext of the returned data to the first end includes: Performing a signature calculation on the returned data using the preset encryption algorithm to obtain a second message signature; Performing encryption calculation on the returned data by using a second encryption algorithm to obtain a ciphertext of the returned data; Respond to the access request and send the returned data ciphertext to the first end.

10. An encryption and decryption system based on a national secret hybrid algorithm, characterized in that: The system comprises: a first end and a second end; The first end is used to implement an encryption and decryption method based on a national secret hybrid algorithm as described in any one of claims 1 to 5, and the second end is used to implement an encryption and decryption method based on a national secret hybrid algorithm as described in any one of claims 6 to 9.

Images