Message communication method, device, equipment and medium

Abstract

The invention discloses a message communication method and device, equipment and a medium, and relates to the technical field of information technology security. The method is applied to a client, and comprises the following steps: generating an asymmetric key pair based on a first national cryptographic algorithm, and exchanging with a public key in the asymmetric key pair generated by a server to determine an initial key pair corresponding to the client and generate a shared key; performing identity authentication with the server, and encrypting the to-be-sent message by using the shared key based on a second cryptographic algorithm after the authentication is passed to obtain encrypted data; determining a hash value corresponding to the to-be-sent message, and adding the hash value to a pre-constructed Merkel tree to obtain a root hash value; signing the root hash value to generate a corresponding signature result, and splicing the signature result with the encrypted data to generate a complete data packet; and sending the complete data packet to a server, so that the server performs data consistency verification based on a locally maintained Merkel tree. Through the technical scheme of the invention, more reliable message communication can be realized.

Description

Technical Field

[0001] The present invention relates to the field of information technology security technology, and in particular to a message communication method, device, equipment and medium. Background Art

[0002] The Internet of Things (IoT) plays an increasingly important role in today's production processes, and the systems running on IoT devices need to be as lightweight as possible. With the rapid development of the IoT, MQTT (Message Queuing Telemetry Transport) technology is widely used for network transmission between devices. As a publish / subscribe communication protocol, MQTT is widely used in resource-constrained network environments due to its low bandwidth usage and efficient communication. However, the MQTT protocol has significant security flaws: message publishers are not authenticated; user authentication is only performed when clients connect to the MQTT server. This means that any entity with knowledge of a specific topic can publish data without further verification of their identity. This mechanism can lead to anomalous publishing behavior, causing subscribers to receive erroneous or unreliable information. Therefore, ensuring the trustworthiness of publisher identities and the authenticity of published data has become a critical issue that needs to be addressed. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide a message communication method, apparatus, device and medium that can achieve security and reliability of the communication process based on the MQTT protocol. The specific solution is as follows:

[0004] In a first aspect, the present application discloses a message communication method, applied to a client, comprising:

[0005] Generate an asymmetric key pair based on the first national secret algorithm, and exchange the public key in the asymmetric key pair with the public key in the asymmetric key pair generated by the server to determine the initial key pair corresponding to the client and generate a shared key;

[0006] Use the initial key pair to authenticate with the server, and after the authentication is passed, encrypt the message to be sent using the shared key based on the second national secret algorithm to obtain encrypted data;

[0007] Determine the hash value corresponding to the message to be sent and add the hash value to the pre-built Merkle tree to obtain the root hash value;

[0008] Use the first national secret algorithm to sign the root hash value to generate the corresponding signature result, and then concatenate the signature result with the encrypted data to generate a complete data packet;

[0009] Send the complete data packet to the server so that the server can perform data consistency verification using the complete data packet based on the Merkle tree maintained locally.

[0010] Optionally, generate an asymmetric key pair based on the first national cryptography algorithm, and exchange the public key in the asymmetric key pair generated by the client with the public key in the asymmetric key pair generated by the server to determine the initial key pair corresponding to the client and generate a shared key, including:

[0011] Randomly determine the target private key, and perform a first point multiplication operation with the base point of the elliptic curve on the corresponding elliptic curve based on the first national cryptography algorithm to generate the public key corresponding to the target private key;

[0012] Exchange the public key generated by the client with the public key in the asymmetric key pair generated by the server so as to determine the initial key pair corresponding to the client using the target private key and the public key of the server;

[0013] Perform a second point multiplication operation on the public key and private key in the initial key pair, and perform a hash process on the result of the second point multiplication operation to generate a shared key.

[0014] Optionally, perform identity authentication with the server using the initial key pair, including:

[0015] Generate a connection request message, and sign the connection request message using the private key in the initial key pair to generate a first signature result;

[0016] Send the first signature result to the server so that the server can perform signature verification on the first signature result using the public key exchanged by the client, and reply with a corresponding confirmation message to the client after the verification passes;

[0017] Establish a communication connection with the server according to the confirmation message replied by the server.

[0018] Optionally, determine the hash value corresponding to the message to be sent, and add the hash value to the pre-constructed Merkle tree to obtain the root hash value, including:

[0019] Construct a Merkle tree, and store the message to be sent as the first tree node of the Merkle tree;

[0020] Determine the hash value corresponding to the first tree node, and sequentially update the hash values of the second tree nodes in the path from the first tree node to the root node of the Merkle tree from bottom to top, so as to determine the root hash value based on the hash values of the second tree nodes.

[0021] Optionally, sign the root hash value using the first national cryptography algorithm to generate a corresponding signature result, and splice the signature result and the encrypted data to generate a complete data packet, including:

[0022] Sign the root hash value using the first national cryptographic algorithm to generate a second signature result;

[0023] Add the second signature result to the header of the data to be sent, and attach the encrypted data to the second signature result in the data to be sent to generate a complete data packet.

[0024] Optionally, send the complete data packet to the server so that the server can perform data consistency verification using the complete data packet based on the Merkle tree maintained locally, including:

[0025] Send the complete data packet to the server so that the server can parse the complete data packet to separate the signature result and the encrypted data in the complete data packet;

[0026] Verify the signature of the signature result using the first national cryptographic algorithm through the server to obtain the first root hash value;

[0027] Decrypt the encrypted data using the second national cryptographic algorithm through the server to obtain the decrypted data, and update the Merkle tree maintained locally by the server using the decrypted data to obtain the second root hash value;

[0028] Compare the first root hash value with the second root hash value. When the first root hash value is the same as the second root hash value, it is determined that the data consistency verification of the complete data packet passes;

[0029] Correspondingly, after sending the complete data packet to the server so that the server can perform data consistency verification using the complete data packet based on the Merkle tree maintained locally, it further includes:

[0030] When there are subscribers subscribing to the topic corresponding to the Merkle tree of the server, send the complete data packet to the subscribers through the server so that the subscribers can perform data consistency verification using the complete data packet based on the Merkle tree maintained locally.

[0031] In a second aspect, the present application discloses a message communication method applied to a server, including:

[0032] Generate an asymmetric key pair based on the first national cryptographic algorithm, and exchange the public key in the asymmetric key pair with the public key in the asymmetric key pair generated by the client to determine the initial key pair corresponding to the server and generate a shared key;

[0033] Authenticate the identity with the client using the initial key pair, and receive the complete data packet sent by the client after the authentication passes;

[0034] Separate the complete data packet, and decrypt the encrypted data in the complete data packet using the shared key based on the second national cryptographic algorithm to obtain the decrypted data;

[0035] Verify the signature result in the complete data packet using the first national cryptographic algorithm to obtain the root hash value in the complete data packet; wherein, the client determines the root hash value by adding the hash value corresponding to the message to be sent to the pre-constructed Merkle tree.

[0036] Determine the target root hash value in the locally maintained Merkle tree based on the decrypted data, and compare the target root hash value with the root hash value in the complete data packet to perform data consistency verification.

[0037] Thirdly, the present application discloses a message communication device, which is applied to a client and includes:

[0038] A key generation and exchange module, configured to generate an asymmetric key pair based on the first national cryptographic algorithm, and exchange the public key in the asymmetric key pair with the public key in the asymmetric key pair generated by the server to determine the initial key pair corresponding to the client and generate a shared key;

[0039] An identity authentication module, configured to perform identity authentication with the server using the initial key pair;

[0040] A data encryption module, configured to encrypt the message to be sent using the shared key based on the second national cryptographic algorithm after the authentication is passed to obtain encrypted data;

[0041] A Merkle tree maintenance module, configured to determine the hash value corresponding to the message to be sent, and add the hash value to the pre-constructed Merkle tree to obtain the root hash value; sign the root hash value using the first national cryptographic algorithm to generate a corresponding signature result;

[0042] A data sending module, configured to splice the signature result and the encrypted data to generate a complete data packet; send the complete data packet to the server so that the server performs data consistency verification using the complete data packet based on the locally maintained Merkle tree.

[0043] Fourthly, the present application discloses an electronic device, which includes a processor and a memory; wherein, the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the foregoing message communication method.

[0044] Fifthly, the present application discloses a computer-readable storage medium, which is used to store a computer program; wherein, when the computer program is executed by a processor, the foregoing message communication method is implemented.

[0045] The beneficial effects of this application are as follows: first, by introducing the national secret algorithm for signing and verification, two-way identity authentication between the client and the server is achieved, which effectively prevents identity fraud and man-in-the-middle attacks, and significantly improves the reliability and security of identity authentication; second, based on the national secret algorithm, data is encrypted for transmission, which enhances the confidentiality of the data, prevents sensitive information from being stolen or leaked during transmission, and improves communication security; finally, the Merkle tree structure is used to perform data consistency verification on the transmitted data. The local verification capability of the Merkle tree can efficiently detect whether the data has been tampered with, ensure the integrity and consistency of the data during transmission, and significantly improve the security and efficiency of the system. It can be seen that on the basis of the traditional communication mechanism, the combination of the national secret algorithm and the Merkle tree structure not only takes advantage of the advantages of the national secret algorithm in security and compliance, but also efficiently verifies the data integrity through the Merkle tree, providing a stronger security guarantee for the communication mechanism.

[0046] In addition, the message communication device, equipment and storage medium provided by this application correspond to the above-mentioned message communication method and have the same effect as above. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0048] Figure 1 A flow chart of a message communication method disclosed in this application;

[0049] Figure 2 A flow chart of Merkle tree construction and data encryption at the sending end disclosed in this application;

[0050] Figure 3 This is a flow chart of an MQTT reliable communication method based on Merkle tree disclosed in this application;

[0051] Figure 4 This is a SM2 key negotiation flow chart disclosed in this application;

[0052] Figure 5 This is a schematic diagram of a receiving end data integrity check disclosed in this application;

[0053] Figure 6 A flow chart of a message communication method disclosed in this application;

[0054] Figure 7 This is a schematic diagram of the structure of a message communication device disclosed in this application;

[0055] Figure 8 A structural diagram of an electronic device disclosed in this application. Detailed implementation manners

[0056] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0057] Currently, the network transmission of the systems operated by Internet of Things devices widely adopts the MQTT technology. MQTT is a lightweight messaging protocol, specifically designed for the Internet of Things (IOT) and resource-constrained network environments. It realizes efficient and reliable data transmission by reducing network bandwidth occupancy and simplifying the communication process. Although lightweight systems have advantages in terms of power consumption and computing resource performance, there are also security issues at different levels.

[0058] Although the MQTT protocol provides the ability of encrypted communication through TLS (Transport Layer Security), this combination still faces some problems and challenges in practical applications. These mainly include increased computing and communication overhead, complex certificate management, potential configuration errors, as well as network latency and connection reliability issues. These need to be weighed and optimized during system design and deployment to ensure the efficiency and stability of the system while guaranteeing security.

[0059] Therefore, this application provides a message communication solution, which can effectively improve the integrity and security of messages during the communication of MQTT messages, providing a more reliable guarantee for communication.

[0060] The embodiments of the present invention disclose a message communication method. Refer to Figure 1 As shown, it is applied to a client, and the method includes:

[0061] Step S11: Generate an asymmetric key pair based on the first national cryptography algorithm, and exchange the public key in the asymmetric key pair with the public key in the asymmetric key pair generated by the server to determine the initial key pair corresponding to the client and generate a shared key.

[0062] In the embodiments of this application, message communication based on the MQTT protocol is taken as an example for illustration in the case of being applied to a client.

[0063] First, the MQTT client and the server independently generate an asymmetric key pair based on the first national cryptographic algorithm, including a private key and a public key. In a feasible implementation, the first national cryptographic algorithm can be the SM2 algorithm. Subsequently, the two parties exchange their public keys through a key exchange mechanism based on SM2, so that the private key of the client and the public key of the server form the initial key pair of the client. And, in this process, the client also interacts the public key of the other party with its own private key to negotiate a shared key. This shared key is then used to encrypt the data in transmission to ensure the confidentiality and integrity of the data during transmission.

[0064] Step S12: Use the initial key pair to authenticate with the server, and after the authentication passes, encrypt the message to be sent based on the second national cryptographic algorithm using the shared key to obtain encrypted data.

[0065] In the embodiment of the present application, the client and the server perform signature and signature verification based on the SM2 algorithm and the initial key pair, so as to realize the secure identity authentication between the server and the client.

[0066] Specifically, the client generates a connection request message, and signs the connection request message using the private key in the initial key pair to generate a first signature result. At this time, the first signature result contains the encrypted username and password; the first signature result is sent to the server. After receiving the connection request message, the server uses the same asymmetric key pair and decrypts the first signature result using the public key exchanged by the client, and verifies the username and password of the client. If the verification passes, the server will reply a corresponding confirmation message to the client, and the two parties establish a secure communication connection; if the verification fails, the connection is terminated.

[0067] Further, after the identity authentication passes, based on the second national cryptographic algorithm, the message to be sent is encrypted using the shared key to obtain encrypted data. In a feasible implementation, the second national cryptographic algorithm can be the SM4 algorithm.

[0068] Step S13: Determine the hash value corresponding to the message to be sent, and add the hash value to the pre-constructed Merkle tree to obtain the root hash value.

[0069] In this embodiment, by constructing a Merkle tree, the integrity and reliability of the transmitted data are verified. A Merkle tree is a binary tree structure based on hash pointers and is widely used in blockchain technology to ensure data integrity and security. In a blockchain, the main role of a Merkle tree is to efficiently verify the existence and integrity of transactions in a block while reducing the burden of data storage and transmission. The Merkle root is stored in the block header of the blockchain as the digital fingerprint of all transactions in the block. Any modification to a transaction will cause a change in the Merkle root, which can be easily detected. Therefore, by introducing a Merkle tree into the MQTT protocol, the integrity and security of messages can be effectively improved, providing a more reliable guarantee for communication.

[0070] It should be noted that for each topic, a corresponding Merkle tree is maintained. For each message to be sent, the hash value of the message is calculated and added to the Merkle tree to complete the tree update operation and determine the root hash value.

[0071] Specifically, a Merkle tree is constructed, and the message to be sent is stored as the first tree node of the Merkle tree; the hash value corresponding to the first tree node is determined, and the hash values of the second tree nodes in the path from the first tree node to the root node of the Merkle tree are sequentially updated from bottom to top, so as to determine the root hash value based on the hash values of the second tree nodes.

[0072] As Figure 2 shown, the construction and update process of the Merkle tree adopts a bottom-up hash calculation method to ensure the efficient processing and verification of data. D1 - D4 are the original data corresponding to the messages to be sent. For each message to be sent, the hash value of the message is calculated to obtain N0 - N3, and so on, to update the Merkle tree to determine the root hash value.

[0073] Step S14: Sign the root hash value using the first national cryptography algorithm to generate a corresponding signature result, and splice the signature result with the encrypted data to generate a complete data packet.

[0074] In the embodiment of this application, the SM2 asymmetric encryption algorithm is used to sign the root hash value determined by the updated Merkle tree to generate a second signature result; the second signature result is placed at the head of the data to be sent. The encrypted data obtained by encrypting the original data using the SM4 symmetric encryption algorithm with the shared key obtained through key exchange negotiation is appended after the signature to generate a complete data packet containing the signed Merkle tree root hash value and the encrypted data.

[0075] As Figure 2As shown, the signature result of signing the root hash value determined by step S13 is located at the head of the data to be sent, and the encrypted data of the original data corresponding to the message to be sent is located after the signature result, and the two are spliced to generate a complete data packet.

[0076] Step S15: Send the complete data packet to the server so that the server can perform data consistency verification using the complete data packet based on the locally maintained Merkle tree.

[0077] In this embodiment of the present application, the client sends a complete data packet containing the signed Merkle root hash value and the encrypted data to the server. The server maintains a corresponding Merkle tree, parses the received data packet, and performs a data consistency check by comparing the received Merkle root hash value with the calculated Merkle root hash value to ensure the reliability of the transmitted data.

[0078] The beneficial effects of this application are as follows: first, by introducing the national secret algorithm for signing and verification, two-way identity authentication between the client and the server is achieved, which effectively prevents identity fraud and man-in-the-middle attacks, and significantly improves the reliability and security of identity authentication; second, based on the national secret algorithm, data is encrypted for transmission, which enhances the confidentiality of the data, prevents sensitive information from being stolen or leaked during transmission, and improves communication security; finally, the Merkle tree structure is used to perform data consistency verification on the transmitted data. The local verification capability of the Merkle tree can efficiently detect whether the data has been tampered with, ensure the integrity and consistency of the data during transmission, and significantly improve the security and efficiency of the system. It can be seen that on the basis of the traditional communication mechanism, the combination of the national secret algorithm and the Merkle tree structure not only takes advantage of the advantages of the national secret algorithm in security and compliance, but also efficiently verifies the data integrity through the Merkle tree, providing a stronger security guarantee for the communication mechanism.

[0079] like Figure 3 The figure below shows a flow chart for applying Merkle trees to MQTT message communication to achieve more reliable message communication. First, the client and server each generate a local asymmetric key pair and negotiate a shared key through the SM2 key exchange mechanism. This shared key is used to encrypt the transmitted data. The client and server then sign and verify the initial key pair using the SM2 algorithm to achieve secure identity authentication. The client maintains a Merkle tree for each topic and sends the root hash value of the Merkle tree along with the encrypted data each time it transmits data. Upon receiving the data, the server adds the data to its locally maintained Merkle tree, calculates the root hash value, and verifies it against the received root hash value. Leveraging the structural characteristics of the Merkle tree, efficient integrity verification of transmitted data is achieved.

[0080] It can be seen that the SM2 algorithm is used for identity authentication, and the SM4 algorithm is used for data encryption. The combination of the two ensures the identity reliability and data confidentiality during the communication process. Combined with the Merkle tree structure, by embedding the Merkle root hash value in the message, the receiving end can quickly verify the integrity of the data. The local verification ability of the Merkle tree enables efficient detection of whether a certain part of the data has been tampered with even when only a part of the data needs to be verified, without having to recalculate the entire data set. This method significantly improves the security and efficiency of the system without adding excessive computational overhead.

[0081] In a feasible implementation, if the server compares the received Merkle root hash value with the locally updated Merkle root hash value and the verification fails, that is, the two values are inconsistent, it indicates that the data may have been tampered with, damaged, or lost during transmission, and the retransmission or error handling mechanism can be triggered. In addition, the above embodiments ensure the identity reliability and data confidentiality during the communication process based on the national cryptography algorithm. In the future, a lightweight post-quantum national cryptography fusion scheme can be considered to achieve the "quantum-resistant smooth transition" of MQTT communication. For example, retain SM4 as the core of data encryption and expand the SM2 key exchange: including two modes. The basic mode uses the SM2 elliptic curve algorithm; the quantum warning mode runs SM2 and the post-quantum algorithm in parallel to generate a hybrid key pair. Then, add an identification bit for the cryptographic algorithm version to the Merkle tree to support the negotiation of the encryption algorithm combination between the client and the server. In this way, it is possible to layout quantum-resistant security in advance and adapt to long-term data storage scenarios without subverting the existing architecture. In another feasible implementation, the historical data chain of the Merkle tree can also be combined with federated learning to achieve real-time anomaly detection and attack path anti-tracing in MQTT communication. For example, the Merkle tree leaf nodes are extended to store the message metadata hash (such as timestamp, device ID, QoS level, etc.) to form a complete communication log chain; the edge nodes use federated learning to train an anomaly detection model and learn the hash value distribution characteristics of normal communication based on the historical Merkle tree versions; when it is detected that the root hash value comparison fails, quickly locate the tampered leaf node through the Merkle fast proof and trace back the device behavior sequence associated with this node to generate an attack traceability report. In this way, it can be upgraded from "passive verification" to "active defense" to solve the problem that only tampering can be detected and the source of the attack cannot be located.

[0082] Based on the above embodiments, this embodiment will specifically elaborate on S11 in the above embodiments. Among them, the process of key generation and exchange between the client and the server can include the following steps:

[0083] Randomly determine the target private key, and perform a first point multiplication operation with the base point of the elliptic curve on the corresponding elliptic curve based on the first national cryptography algorithm to generate a public key corresponding to the target private key;

[0084] Exchange the public key generated by the client with the public key generated by the server, so as to determine the initial key pair corresponding to the client by using the target private key and the public key of the server;

[0085] Perform a second point multiplication operation on the public key and private key in the initial key pair, and perform a hash processing on the result of the second point multiplication operation to generate a shared key.

[0086] In the embodiments of the present application, the SM2 key exchange is based on the Elliptic Curve Discrete Logarithm Problem (ECDLP), and uses the mathematical properties of the elliptic curve to achieve secure key negotiation. Its core idea is that through the point multiplication operation on the elliptic curve, the communication parties can independently generate the same shared key without directly transmitting the key itself.

[0087] The following combines Figure 4 to illustrate the key exchange process. First, perform parameter selection and key pair generation. Select an elliptic curve E and a base point G (generator), and the order of the base point G is n. The server selects a random private key d A , satisfying 1 < d A < n, and calculate the corresponding public key P A = d A ·G; The client selects a random private key d B , satisfying 1 < d B < n, and calculate the corresponding public key P B = d B ·G. Secondly, perform public key exchange and shared key calculation. The client sends the public key P B to the server, and the server sends the public key P A to the client. The server calculates the shared key K = d A ·P B , and the client calculates the shared key K = d B ·P A . Finally, perform key derivation. To improve security, perform further hash processing on the shared key K to generate the final shared key.

[0088] Based on the above embodiments, this embodiment will specifically elaborate on S15 in the above embodiments. Among them, after receiving the data packet, the server uses the national cryptography algorithm to decrypt the data, and combines the Merkle tree to efficiently verify the data integrity, so as to ensure the reliability of the identity authentication of both communication parties and the integrity during the data transmission process. The process of data consistency verification may include the following steps:

[0089] Send the complete data packet to the server so that the server can parse the complete data packet to separate the signature result and the encrypted data in the complete data packet;

[0090] The server uses the first national cryptography algorithm to verify the signature result to obtain the first root hash value;

[0091] The server uses the second national cryptography algorithm to decrypt the encrypted data to obtain the decrypted data, and uses the decrypted data to update the Merkle tree maintained locally by the server to obtain the second root hash value;

[0092] Compare the first root hash value with the second root hash value. When the first root hash value is the same as the second root hash value, it is determined that the data consistency check of the complete data packet passes;

[0093] When there are subscribers who subscribe to the topic corresponding to the Merkle tree of the server, the server sends the complete data packet to the subscribers so that the subscribers can perform data consistency checks using the complete data packet based on the Merkle tree maintained locally.

[0094] In the embodiments of the present application, after receiving the data packet, the server uses the SM2 public key to verify the signature to obtain the first root hash value. And use the SM4 algorithm to decrypt the encrypted data to restore the original data and obtain the decrypted data. The server calculates the hash value of the decrypted data and adds the hash value to the Merkle tree maintained locally, updates the Merkle tree to generate a new root hash value, which is the second root hash value. Subsequently, the server compares the received Merkle tree root hash value (that is, the first root hash value obtained after signature verification) with the locally updated Merkle tree root hash value (the second root hash value). If the two are the same, the verification passes, otherwise the verification fails.

[0095] It can be understood that since MQTT is a "lightweight" communication protocol based on the publish / subscribe mode. And for each published topic, the publisher maintains a corresponding Merkle tree. Therefore, another client can receive messages from the server by subscribing to the topic. Similar to the steps of the server maintaining the local Merkle tree, the client, as the receiver, parses the received complete data packet to obtain the Merkle tree root hash value at the header. For this topic, the receiver also maintains a corresponding Merkle tree and uses the SM4 algorithm to decrypt the original data. Subsequently, calculate the hash value of the data and add it to the Merkle tree to update the Merkle tree. By comparing the received Merkle tree root hash value with the calculated Merkle tree root hash value, the reliability of the transmitted data is ensured.

[0096] Such as Figure 5The figure shows the process of data integrity verification at the receiving end, which can be a server or another client that subscribes to the topic from the server. When the receiving end receives a complete data packet from the publishing end, it parses the received message and verifies its validity.

[0097] First, perform message parsing and separation. Parse the received message and separate the SM2 signature of the Merkle root hash value in the message header and the encrypted message content. Second, perform signature verification and data decryption. Use the SM2 public key to verify the signature in the message header, and at the same time use the SM4 algorithm to decrypt the encrypted message content to restore the original data. Finally, calculate the hash value of the decrypted data, add this hash value to the Merkle tree maintained locally, and update the Merkle tree to generate a new root hash value. Compare the received Merkle root hash value with the locally updated Merkle root hash value. If the two are the same, it indicates that the transmitted data is reliable.

[0098] It can be seen that on the basis of maintaining the lightweight characteristics of the MQTT protocol, by optimizing the encryption and verification mechanisms, the identities of both communicating parties are verified through the signature and signature verification mechanisms, effectively resisting man-in-the-middle attacks. At the same time, a flexible encrypted communication framework is provided, which is applicable to a variety of application scenarios. Combining national cryptographic algorithms such as SM4 to encrypt and transmit data enhances the confidentiality of the data and prevents sensitive information from being stolen or leaked during transmission. The combination of this encryption mechanism and the Merkle tree provides a higher level of security for MQTT communication. By comparing the Merkle root hash values, it is possible to quickly detect whether the data has been tampered with, thus ensuring the reliability of data transmission.

[0099] An embodiment of this application discloses a message communication method. See Figure 6 As shown, it is applied to the server, and this method includes:

[0100] Step S21: Generate an asymmetric key pair based on the first national cryptographic algorithm, and exchange the public key in the asymmetric key pair with the public key in the asymmetric key pair generated by the client to determine the initial key pair corresponding to the server and generate a shared key.

[0101] In the embodiment of this application, message communication based on the MQTT protocol is taken as an example for illustration when applied to the server.

[0102] First, the MQTT client and the server independently generate an asymmetric key pair based on the first national cryptography algorithm, including a private key and a public key. In a feasible implementation, the first national cryptography algorithm can be the SM2 algorithm. Subsequently, the two parties exchange their public keys through the SM2-based key exchange mechanism, so that the private key of the server and the public key of the client form the initial key pair of the server. And, during this process, the server also interacts the public key of the other party with its own private key to negotiate a shared key. This shared key is then used to decrypt the data in transmission to ensure the confidentiality and integrity of the data during transmission.

[0103] Step S22: Authenticate the client using the initial key pair and receive the complete data packet sent by the client after the authentication passes.

[0104] In the embodiment of the present application, the client and the server perform signature and signature verification based on the SM2 algorithm and the initial key pair, so as to realize the secure identity authentication between the server and the client.

[0105] The client generates and sends a connection request message encrypted with the symmetric key to the server, and the message includes the encrypted user name and password. After receiving the connection request message, the server decrypts it using the same symmetric key and verifies the user name and password of the client. If the verification passes, the server sends a confirmation reply message to the client, and the two parties establish a secure connection and receive the complete data packet sent by the client; if the verification fails, the connection is terminated.

[0106] Step S23: Separate the complete data packet and decrypt the encrypted data in the complete data packet using the shared key based on the second national cryptography algorithm to obtain the decrypted data.

[0107] In the embodiment of the present application, the server parses and separates the received complete data packet, separates the SM2 signature of the Merkle root hash value of the message header and the encrypted message content. Decrypt the encrypted data in the complete data packet to obtain the decrypted data.

[0108] Step S24: Verify the signature result in the complete data packet using the first national cryptography algorithm to obtain the root hash value in the complete data packet.

[0109] In the embodiment of the present application, the signature of the message header is verified using the SM2 public key, and the obtained root hash value is the root hash value determined by the client adding the hash value corresponding to the message to be sent to the pre-constructed Merkle tree, that is, the received Merkle root hash value.

[0110] Step S25: Determine the target root hash value in the locally maintained Merkle tree based on the decrypted data, and compare the target root hash value with the root hash value in the complete data packet to perform data consistency verification.

[0111] In the embodiment of the present application, the hash value of the decrypted data is calculated according to the process of constructing and updating the Merkle tree disclosed in the aforementioned embodiment, and the hash value is added to the locally maintained Merkle tree. The Merkle tree is updated to generate a target root hash value, which serves as the locally calculated Merkle tree root hash value. The received Merkle tree root hash value is compared with the calculated Merkle tree root hash value. If the two are consistent, it indicates that the transmitted data is reliable.

[0112] The beneficial effects of this application are as follows: first, by introducing the national secret algorithm for signing and verification, two-way identity authentication between the client and the server is achieved, which effectively prevents identity fraud and man-in-the-middle attacks, and significantly improves the reliability and security of identity authentication; second, based on the national secret algorithm, data is encrypted for transmission, which enhances the confidentiality of the data, prevents sensitive information from being stolen or leaked during transmission, and improves communication security; finally, the Merkle tree structure is used to perform data consistency verification on the transmitted data. The local verification capability of the Merkle tree can efficiently detect whether the data has been tampered with, ensure the integrity and consistency of the data during transmission, and significantly improve the security and efficiency of the system. It can be seen that on the basis of the traditional communication mechanism, the combination of the national secret algorithm and the Merkle tree structure not only takes advantage of the advantages of the national secret algorithm in security and compliance, but also efficiently verifies the data integrity through the Merkle tree, providing a stronger security guarantee for the communication mechanism.

[0113] Correspondingly, the embodiment of the present application also discloses a message communication device, see Figure 7 As shown, applied to a client, the device includes:

[0114] The key generation and exchange module 11 is used to generate an asymmetric key pair based on the first national secret algorithm, and exchange the public key in the asymmetric key pair with the public key in the asymmetric key pair generated by the server to determine the initial key pair corresponding to the client and generate a shared key;

[0115] Identity authentication module 12, used to perform identity authentication with the server using the initial key pair;

[0116] The data encryption module 13 is used to encrypt the message to be sent using the shared key based on the second national secret algorithm after the authentication is passed to obtain encrypted data;

[0117] The Merkle tree maintenance module 14 is used to determine the hash value corresponding to the message to be sent, add the hash value to the pre-constructed Merkle tree to obtain the root hash value, and sign the root hash value using the first national cryptography algorithm to generate the corresponding signature result.

[0118] The data sending module 15 is used to splice the signature result and the encrypted data to generate a complete data packet, and send the complete data packet to the server so that the server can perform data consistency verification using the complete data packet based on the locally maintained Merkle tree.

[0119] Among them, for the more specific working processes of the above-mentioned various modules, reference can be made to the corresponding content disclosed in the foregoing embodiments, and details will not be elaborated here.

[0120] The beneficial effects of this application are as follows: First, by introducing the national cryptography algorithm for signature and verification, two-way authentication between the client and the server is realized, effectively preventing identity theft and man-in-the-middle attacks, and significantly improving the reliability and security of identity authentication. Second, encrypting data transmission based on the national cryptography algorithm enhances data confidentiality, prevents sensitive information from being stolen or leaked during transmission, and improves communication security. Finally, using the Merkle tree structure to perform data consistency verification on the transmitted data, the local verification ability of the Merkle tree can efficiently detect whether the data has been tampered with, ensuring the integrity and consistency of the data during transmission, and significantly improving the security and efficiency of the system. It can be seen that on the basis of the traditional communication mechanism, combining the national cryptography algorithm with the Merkle tree structure not only utilizes the advantages of the national cryptography algorithm in terms of security and compliance, but also efficiently verifies data integrity through the Merkle tree, providing a more powerful security guarantee for the communication mechanism.

[0121] In a feasible implementation, the key generation and exchange module is specifically used for:

[0122] Randomly determine the target private key, and perform the first point multiplication operation with the base point of the elliptic curve based on the first national cryptography algorithm on the corresponding elliptic curve to generate the public key corresponding to the target private key.

[0123] Exchange the public key generated by the client with the public key generated by the server, so as to determine the initial key pair corresponding to the client using the target private key and the public key of the server.

[0124] Perform the second point multiplication operation on the public key and private key in the initial key pair, and perform a hash process on the result of the second point multiplication operation to generate the shared key.

[0125] In a feasible implementation, the identity authentication module 12 is specifically used for:

[0126] Generate a connection request message, and sign the connection request message using the private key in the initial key pair to generate a first signature result;

[0127] Send the first signature result to the server so that the server can perform signature verification on the first signature result using the public key exchanged by the client, and reply with a corresponding confirmation message to the client after the verification passes;

[0128] Establish a communication connection with the server according to the confirmation message replied by the server.

[0129] In a feasible implementation manner, the Merkle tree maintenance module 14 includes:

[0130] A Merkle tree construction module, which is used to construct a Merkle tree, store the message to be sent as the first tree node of the Merkle tree; determine the hash value corresponding to the first tree node, and sequentially update the hash values of the second tree nodes in the path from the first tree node to the root node of the Merkle tree from bottom to top, so as to determine the root hash value based on the hash values of the second tree nodes.

[0131] A complete data packet generation module, which is used to sign the root hash value using the first national cryptography algorithm to generate a second signature result; add the second signature result to the header of the data to be sent, and attach the encrypted data to the second signature result in the data to be sent to generate a complete data packet.

[0132] In a feasible implementation manner, the data sending module 15 is specifically used for:

[0133] Send the complete data packet to the server so that the server can parse the complete data packet to separate the signature result and the encrypted data in the complete data packet;

[0134] Verify the signature of the signature result by the server using the first national cryptography algorithm to obtain the first root hash value;

[0135] Decrypt the encrypted data by the server using the second national cryptography algorithm to obtain the decrypted data, and update the Merkle tree locally maintained by the server using the decrypted data to obtain the second root hash value;

[0136] Compare the first root hash value with the second root hash value. When the first root hash value is the same as the second root hash value, it is determined that the data consistency check of the complete data packet passes;

[0137] Correspondingly, the message communication device further includes:

[0138] A data subscription module, which is used to send the complete data packet to the subscriber through the server when there is a subscriber subscribing to the topic corresponding to the Merkle tree of the server, so that the subscriber can perform data consistency check using the complete data packet based on the Merkle tree locally maintained.

[0139] Furthermore, an embodiment of the present application also discloses an electronic device. Figure 8 It is a structural diagram of an electronic device 20 shown according to an exemplary embodiment. The content in the figure should not be regarded as any limitation on the scope of use of the present application.

[0140] Figure 8 It is a schematic structural diagram of an electronic device 20 provided by an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the message communication method disclosed in any of the foregoing embodiments. In addition, the electronic device 20 in this embodiment may specifically be a computer.

[0141] In this embodiment, the power supply 23 is used to provide operating voltages for the various hardware devices on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows is any communication protocol applicable to the technical solution of the present application, and specific limitations are not imposed on it here; the input / output interface 25 is used to obtain external input data or output data to the outside, and its specific interface type can be selected according to specific application needs, and no specific limitations are made here.

[0142] In addition, as a carrier for resource storage, the memory 22 may be a read-only memory, a random access memory, a magnetic disk, or an optical disc, etc. The resources stored thereon may include an operating system 221, a computer program 222, and data 223, etc. The data 223 may include various kinds of data. The storage method may be transient storage or permanent storage.

[0143] Among them, the operating system 221 is used to manage and control the various hardware devices and the computer program 222 on the electronic device 20, and it may be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program that can be used to complete the message communication method executed by the electronic device 20 disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs that can be used to complete other specific tasks.

[0144] Further, the embodiments of the present application also disclose a computer-readable storage medium, where the computer-readable storage medium includes a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, magnetic disks, or optical disks, or any other form of storage medium known in the technical field. Among them, when the computer program is executed by a processor, the foregoing message communication method is implemented. For the specific steps of this method, reference may be made to the corresponding content disclosed in the foregoing embodiments, and details will not be repeated here.

[0145] Furthermore, the embodiments of the present application also provide a computer program product, including a computer program / instructions, and when the computer program / instructions are executed by a processor, any implementation method of the foregoing message communication method is implemented.

[0146] The various embodiments in this specification are described in a progressive manner. The key point of each embodiment is to illustrate the differences from other embodiments. For the same or similar parts among the various embodiments, reference can be made to each other. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and reference can be made to the description of the method part for related parts.

[0147] The steps of the message communication method or algorithm described in combination with the embodiments disclosed in this article can be directly implemented by hardware, software modules executed by a processor, or a combination of both. The software module can be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the technical field.

[0148] Finally, it should also be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variation thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. Without further limitations, an element defined by the statement "including a..." does not exclude the existence of additional identical elements in the process, method, article or device including the said element.

[0149] The above has introduced in detail a message communication method, apparatus, device and medium provided by the present invention. Specific examples are used in this article to elaborate on the principle and implementation manner of the present invention. The description of the above embodiments is only used to help understand the method and its core idea of the present invention; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation manner and application scope. In summary, the content of this specification should not be construed as a limitation to the present invention.

Claims

1. A message communication method, characterized in that, Applied to the client, including: Generating an asymmetric key pair based on the first national cryptography algorithm, and exchanging the public key in the asymmetric key pair with the public key in the asymmetric key pair generated by the server to determine the initial key pair corresponding to the client and generate a shared key; Performing identity authentication with the server using the initial key pair, and encrypting the message to be sent using the shared key based on the second national cryptography algorithm after successful authentication to obtain encrypted data; Determining the hash value corresponding to the message to be sent, and adding the hash value to a pre-constructed Merkle tree to obtain a root hash value; Signing the root hash value using the first national cryptography algorithm to generate a corresponding signature result, and concatenating the signature result with the encrypted data to generate a complete data packet; Sending the complete data packet to the server so that the server can perform data consistency verification using the complete data packet based on the Merkle tree maintained locally.

2. The message communication method according to claim 1, characterized in that The step of generating an asymmetric key pair based on the first national cryptography algorithm, and exchanging the public key in the asymmetric key pair with the public key in the asymmetric key pair generated by the server to determine the initial key pair corresponding to the client and generate a shared key includes: Randomly determining a target private key, and performing a first point multiplication operation with the base point of the corresponding elliptic curve based on the first national cryptography algorithm on the elliptic curve to generate a public key corresponding to the target private key; Exchanging the public key generated by the client with the public key in the asymmetric key pair generated by the server so as to determine the initial key pair corresponding to the client using the target private key and the public key of the server; Performing a second point multiplication operation on the public key and private key in the initial key pair, and performing a hash process on the result of the second point multiplication operation to generate a shared key.

3. The message communication method according to claim 1, characterized in that The step of performing identity authentication with the server using the initial key pair includes: Generating a connection request message, and signing the connection request message using the private key in the initial key pair to generate a first signature result; Sending the first signature result to the server so that the server can perform signature verification on the first signature result using the public key exchanged by the client, and sending a corresponding confirmation message to the client after successful verification; Establishing a communication connection with the server according to the confirmation message replied by the server.

4. The message communication method according to claim 1, wherein The step of determining the hash value corresponding to the message to be sent, and adding the hash value to a pre-constructed Merkle tree to obtain a root hash value includes: Constructing a Merkle tree, and storing the message to be sent as the first tree node of the Merkle tree; Determining the hash value corresponding to the first tree node, and sequentially updating the hash values of the second tree nodes in the path from the first tree node to the root node of the Merkle tree from bottom to top so as to determine the root hash value based on the hash values of the second tree nodes.

5. The message communication method according to claim 1, characterized in that The step of signing the root hash value using the first national cryptography algorithm to generate a corresponding signature result, and concatenating the signature result with the encrypted data to generate a complete data packet includes: Sign the root hash value using the first national cryptography algorithm to generate a second signature result; Add the second signature result to the header of the data to be sent, and append the encrypted data to the second signature result in the data to be sent to generate a complete data packet.

6. The message communication method according to any one of claims 1 to 5, characterized in that Sending the complete data packet to the server so that the server can perform data consistency verification using the complete data packet based on the Merkle tree maintained locally, including: Send the complete data packet to the server so that the server can parse the complete data packet to separate the signature result and the encrypted data in the complete data packet; Verify the signature of the signature result by the server using the first national cryptography algorithm to obtain a first root hash value; Decrypt the encrypted data by the server using the second national cryptography algorithm to obtain decrypted data, and update the Merkle tree maintained locally by the server using the decrypted data to obtain a second root hash value; Compare the first root hash value with the second root hash value. When the first root hash value is the same as the second root hash value, it is determined that the data consistency verification of the complete data packet passes; Correspondingly, after sending the complete data packet to the server so that the server can perform data consistency verification using the complete data packet based on the Merkle tree maintained locally, it further includes: When there are subscribers who subscribe to the topic corresponding to the Merkle tree of the server, send the complete data packet to the subscribers through the server so that the subscribers can perform data consistency verification using the complete data packet based on the Merkle tree maintained locally.

7. A message communication method, characterized in that Applied to the server, it includes: Generate an asymmetric key pair based on the first national cryptography algorithm, and exchange the public key in the asymmetric key pair with the public key in the asymmetric key pair generated by the client to determine the initial key pair corresponding to the server and generate a shared key; Authenticate the identity with the client using the initial key pair, and receive the complete data packet sent by the client after the authentication passes; [[ID=I12]]Separate the complete data packet, and decrypt the encrypted data in the complete data packet using the shared key based on the second national cryptography algorithm to obtain decrypted data; Verify the signature of the signature result in the complete data packet by the server using the first national cryptography algorithm to obtain the root hash value in the complete data packet; wherein, the root hash value is determined by the client adding the hash value corresponding to the message to be sent to the pre-constructed Merkle tree; Determine the target root hash value in the Merkle tree maintained locally based on the decrypted data, and compare the target root hash value with the root hash value in the complete data packet to perform data consistency verification.

8. A message communication device, characterized in that, Applied to the client, it includes: A key generation and exchange module, configured to generate an asymmetric key pair based on the first national cryptography algorithm, and exchange the public key in the asymmetric key pair with the public key in the asymmetric key pair generated by the server to determine the initial key pair corresponding to the client and generate a shared key; An identity authentication module, configured to perform identity authentication with the server by using the initial key; A data encryption module, configured to encrypt a message to be sent by using the shared key based on the second national cryptography algorithm after authentication is passed, so as to obtain encrypted data; A Merkle tree maintenance module, configured to determine a hash value corresponding to the message to be sent, and add the hash value to a pre-constructed Merkle tree to obtain a root hash value; sign the root hash value by using the first national cryptography algorithm to generate a corresponding signature result; A data sending module, configured to splice the signature result and the encrypted data to generate a complete data packet; send the complete data packet to the server, so that the server performs data consistency verification by using the complete data packet based on the locally maintained Merkle tree.

9. An electronic device, characterized in that, The electronic device includes a processor and a memory; wherein, the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the message communication method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, For storing a computer program; wherein the computer program, when executed by a processor, implements the message communication method according to any one of claims 1 to 7.

Images