Bidirectional authentication security mobile communication method and system based on public key digital fingerprint

Abstract

The invention discloses a bidirectional authentication secure mobile communication method and system based on a public key digital fingerprint, and belongs to the technical field of communication security. The method specifically comprises the following steps: S1, digital certificate application and issuing: a mobile terminal and a service server respectively use an encryption algorithm to generate an asymmetric key pair which comprises a public key and a private key, an entity submits a CSR file which comprises a public key, entity identity information and an extension field to a CA, and the CA strictly audits the entity identity and issues a digital certificate; and performing digital signature on the public key and the entity information by using a CA private key after the auditing is passed. Two-way identity authentication is achieved, communication safety is improved, a traditional scheme only supports one-way authentication of a client to a server and is prone to phishing attack and identity false use, digital certificates are exchanged before communication between a mobile terminal and a service server, the legality of the certificates is verified through a public key of a CA root certificate, and the authenticity of the identities of the two parties is ensured. A bidirectional authentication mechanism effectively prevents man-in-the-middle attack and identity counterfeiting problems, and the security risk is greatly reduced.

Description

Technical Field

[0001] The present invention relates to the field of communication security technology, and in particular to a two-way authentication secure mobile communication method and system based on public key digital fingerprint. Background Art

[0002] A WAP gateway, located between mobile devices and the Internet, converts HTML information stored on Internet servers into WML information supported by mobile devices. In mobile communications, the WAP protocol stack converts data between wired and wireless networks. Due to differences in network environments, the WAP gateway's protocol stack differs from the TCP / IP stack. The WAP architecture provides a flexible development environment for mobile communication devices, employing a layered structure similar to TCP / IP, with each protocol layer providing an interface for its upper-layer protocol.

[0003] However, traditional mobile communication systems suffer from the following drawbacks: one-way authentication: only the client authenticates the server, making it vulnerable to phishing attacks and identity theft; risk of data exposure: data is converted to plaintext in the WAP gateway's memory, making it vulnerable to theft by high-speed computer attacks; high security costs: reliance on firewalls, intrusion detection devices, and other equipment to protect the WAP gateway increases operational costs; and low encryption efficiency: traditional single encryption mechanisms, such as pure symmetric or asymmetric encryption, struggle to balance security and performance. Existing hybrid encryption technologies, while combining the advantages of symmetric and asymmetric encryption, fail to effectively address key distribution security and bidirectional authentication. Summary of the Invention

[0004] Purpose of the invention: The purpose of the present invention is to provide a two-way authentication secure mobile communication method and system based on public key digital fingerprint; problems that can be solved.

[0005] Technical solution: To solve the above technical problems, according to one aspect of the present invention, more specifically, a two-way authentication secure mobile communication method and system based on public key digital fingerprint, specifically comprising the following steps:

[0006] S1. Digital certificate application and issuance: The mobile terminal and the service server each use an encryption algorithm to generate an asymmetric key pair, including a public key and a private key. The entity submits a CSR file to the CA, which includes the public key, entity identity information, and extension fields. The CA Certification Center conducts a strict review of the entity's identity. Once the review is passed, the public key and entity information are digitally signed using the CA's private key.

[0007] S2. Certificate exchange and legitimacy verification: Before communication, the mobile terminal and the service server exchange digital certificates through a secure channel. The recipient uses the public key of the preset CA root certificate to decrypt the CA signature in the certificate, calculates the certificate hash value and compares it with the decryption result to confirm that the certificate has not been tampered with. The certificate validity period, issuer information, and usage fields are verified to ensure that the certificate is applicable to the current communication scenario.

[0008] S3. Session key generation and encryption: The sender generates a high-strength random symmetric key using a pseudo-random number generator, asymmetrically encrypts the session key using the receiver's public key, and generates the encrypted session key ciphertext.

[0009] S4. Data encryption and transmission: The sender uses the session key to encrypt the original data to generate data ciphertext, performs a hash operation on the original data to generate a digest, and signs the digest using the sender's private key to form a digital signature. The data ciphertext, encrypted session key, and digital signature are combined into a composite data packet and transmitted to the WAP gateway via the wireless network.

[0010] S5. Data decryption and integrity verification: The receiver uses its own private key to decrypt the session key ciphertext, restore the original session key, and use the session key to decrypt the data ciphertext to obtain the plaintext data. The receiver recalculates the hash summary of the decrypted plaintext data and uses the sender's public key to decrypt the signature. The receiver compares the hash values to confirm that the data has not been tampered with and the source is legitimate.

[0011] Furthermore, in step S3, the pseudo-random number generator generates a session key based on a system entropy source, and the key length is 256 bits.

[0012] Furthermore, in step S4, the communication data is encrypted using a symmetric encryption algorithm, the symmetric encrypted session key is encrypted using an asymmetric encryption algorithm, and the session key is dynamically generated by a pseudo-random number generator.

[0013] According to another aspect of the present invention, a two-way authentication secure mobile communication system based on public key digital fingerprint is provided, which is used to implement the above-mentioned two-way authentication secure mobile communication method based on public key digital fingerprint, including: a mobile terminal module, a WAP gateway module, a service server module and a CA certificate authentication center module;

[0014] Mobile terminal module: used to generate an asymmetric key pair, submit a CSR request to the CA certification center module, obtain a digital certificate, dynamically generate a session key to encrypt communication data, encrypt the session key using the recipient's public key, attach a digital signature to the data packet, and send the encrypted data to the WAP gateway via the wireless network;

[0015] WAP gateway module: After receiving encrypted data packets, it only converts the protocol header without parsing or modifying the data payload, and prohibits external access to sensitive memory areas;

[0016] Business server module: used to decrypt the session key ciphertext using the private key, recover the session key, decrypt the data ciphertext using the session key, obtain the plaintext data, calculate the hash digest of the decrypted data, compare it with the hash value in the sender's signature, verify the data integrity, check the certificate status to ensure the legitimacy of the communicating party, generate response data for the business request, reverse the encryption process and return it to the mobile terminal;

[0017] CA Certificate Authority Module: It is used to build on the open source system, generate CA root certificates and private keys, review CSR requests submitted by entities, issue digital certificates and maintain certificate databases, maintain certificate revocation lists and online certificate status protocol services, update certificate status in real time, support lifecycle management functions such as certificate renewal and key rotation, provide certificate query, download and verification interfaces for both communicating parties to obtain certificate information in real time, support transparent certificate logs, and prevent the issuance of illegal certificates.

[0018] Furthermore, the protocol conversion unit of the WAP gateway module only modifies the protocol header field, and the data payload remains encrypted.

[0019] Furthermore, the key management unit of the mobile terminal module is integrated with a trusted execution environment to protect the security of private keys.

[0020] Furthermore, the verification unit of the business server module is integrated with a hardware security module for accelerating decryption and signature verification.

[0021] Furthermore, the CA certification center module supports the online certificate status protocol and responds to certificate status queries in real time.

[0022] Beneficial effects:

[0023] 1. Implementing two-way identity authentication improves communication security. Traditional solutions only support one-way authentication between the client and the server, making them vulnerable to phishing attacks and identity theft. The mobile terminal and the service server exchange digital certificates before communication, and use the public key of the CA root certificate to verify the legitimacy of the certificates, ensuring the authenticity of both parties. This two-way authentication mechanism effectively prevents man-in-the-middle attacks and identity forgery, significantly reducing security risks.

[0024] 2. Data is fully encrypted throughout the transmission process, preventing the risk of plaintext exposure. Data remains in ciphertext form during transmission: the sender encrypts the original data using a dynamically generated session key, and then encrypts the session key using the receiver's public key, forming a composite encrypted data packet. Crucially, the WAP gateway only converts the protocol header fields and does not parse or modify the encrypted payload, ensuring that data remains encrypted at the gateway. This completely eliminates the security risk of traditional solutions where plaintext data is exposed in gateway memory.

[0025] 3. A highly efficient hybrid encryption mechanism balances security and performance, employing a combination of symmetric and asymmetric encryption. Session keys are dynamically generated using a pseudo-random number generator, leveraging the efficiency of symmetric encryption for data processing; asymmetric encryption is used to securely transmit session keys. This design significantly improves encryption and decryption efficiency while ensuring secure key distribution, making it suitable for high-concurrency communication scenarios.

[0026] 4. Dynamic key management enhances attack resistance. Session keys are generated based on the system's entropy source, ensuring randomness and unpredictability. Key lifecycles are short and dynamically changing, so even if a single session key is cracked, it will not affect other communications. Furthermore, the mobile terminal's key management unit integrates a trusted execution environment, and the service server uses a hardware security module to protect private keys at the hardware level and prevent key leakage.

[0027] 5. Real-time certificate status verification prevents the misuse of illegal certificates. The CA certification center module supports the online certificate status protocol and certificate revocation list, allowing both parties to query the validity of certificates in real time. Combined with certificate transparency logging technology, it can quickly detect and prevent the issuance and use of illegal certificates, preventing middleman attacks using expired or forged certificates.

[0028] 6. Reduce security and maintenance costs and optimize system architecture. Traditional solutions rely on external devices such as firewalls and intrusion detection to protect WAP gateways. However, this invention uses the gateway module's protocol conversion unit to restrict external access to sensitive memory areas, reducing the attack surface. Furthermore, encryption logic is built into the terminal and server modules, eliminating the need for additional complex security infrastructure and significantly reducing maintenance costs.

[0029] 7. Dual protection of data integrity and source legitimacy: The sender generates a hash digest of the original data and signs it with a private key. The receiver verifies whether the data has been tampered with by comparing the hash value and confirms the legitimacy of the data source by decrypting the signature with the sender's public key. This mechanism effectively resists data tampering and forgery attacks, ensuring the integrity and credibility of end-to-end communications.

[0030] 8. Supporting flexible expansion and lifecycle management, the CA module provides certificate renewal and key rotation functions to meet long-term security needs. The modular design of business servers and mobile terminals facilitates hardware upgrades and algorithm replacements. For example, in the future, it can seamlessly integrate national secret algorithms or quantum-resistant encryption solutions to ensure technological foresight. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 is a flow chart of the method. DETAILED DESCRIPTION

[0032] In order to make the technical solution of the present invention clearer, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0033] Example 1

[0034] The first step is to apply for and issue a digital certificate: the mobile terminal and the business server use encryption algorithms to generate an asymmetric key pair, including a public key and a private key. The entity submits a CSR file to the CA, which includes the public key, entity identity information and extension fields. The CA certification center conducts a strict review of the entity identity. After the review is passed, the public key and entity information are digitally signed using the CA private key.

[0035] The second step is certificate exchange and legitimacy verification: before communication, the mobile terminal and the business server exchange digital certificates through a secure channel. The recipient uses the public key of the preset CA root certificate to decrypt the CA signature in the certificate, calculates the certificate hash value and compares it with the decryption result, confirms that the certificate has not been tampered with, verifies the certificate validity period, issuer information and purpose field, and ensures that the certificate is suitable for the current communication scenario. The traditional solution only supports one-way authentication of the client to the server, which is vulnerable to phishing attacks and identity fraud. The present invention exchanges digital certificates with the mobile terminal and the business server before communication, and uses the public key of the CA root certificate to verify the legitimacy of the certificate to ensure the authenticity of the identities of both parties. The two-way authentication mechanism effectively prevents man-in-the-middle attacks and identity forgery problems, greatly reducing security risks.

[0036] The third step is session key generation and encryption: The sender generates a high-strength random symmetric key through a pseudo-random number generator, uses the receiver's public key to asymmetrically encrypt the session key, and generates an encrypted session key ciphertext. The pseudo-random number generator generates the session key based on the system entropy source. The key length is 256 bits, which significantly improves encryption and decryption efficiency while ensuring the security of key distribution, making it suitable for high-concurrency communication scenarios.

[0037] Step 4: Data encryption and transmission: The sender uses the session key to encrypt the original data to generate data ciphertext, performs a hash operation on the original data to generate a summary, and uses the sender's private key to sign the summary to form a digital signature. The data ciphertext, encrypted session key and digital signature are combined into a composite data packet, which is transmitted to the WAP gateway via the wireless network. A symmetric encryption algorithm is used to encrypt the communication data, and an asymmetric encryption algorithm is used to encrypt the symmetrically encrypted session key. The session key is dynamically generated through a pseudo-random number generator. The sender uses the dynamically generated session key to encrypt the original data and encrypts the session key using the receiver's public key to form a composite encrypted data packet, ensuring that the data remains encrypted at the gateway. This completely solves the security risks of traditional solutions in which plaintext data is exposed to the gateway memory. The sender generates a hash summary of the original data and signs it with a private key, effectively resisting data tampering and forgery attacks and ensuring the integrity and credibility of end-to-end communication.

[0038] Step 5: Data decryption and integrity verification: The receiver uses its own private key to decrypt the session key ciphertext, restore the original session key, and use the session key to decrypt the data ciphertext to obtain the plaintext data. The hash summary of the decrypted plaintext data is recalculated and the signature is decrypted using the sender's public key. The hash values are compared to confirm that the data has not been tampered with and the source is legitimate. The receiver verifies whether the data has been tampered with by comparing the hash values and confirms the legality of the data source by combining the sender's public key decryption signature, effectively resisting data tampering and forgery attacks and ensuring the integrity and credibility of end-to-end communication.

[0039] Example 2

[0040] A two-way authentication security mobile communication system based on public key digital fingerprint includes: a mobile terminal module, a WAP gateway module, a service server module and a CA certificate authentication center module;

[0041] Mobile terminal module: used to generate asymmetric key pairs, submit CSR requests to the CA certification center module, obtain digital certificates, dynamically generate session keys to encrypt communication data, encrypt session keys using the recipient's public key, and attach digital signatures to data packets, and send encrypted data to the WAP gateway via the wireless network. The key management unit of the mobile terminal module is integrated with a trusted execution environment to protect the security of private keys, protecting private keys from the hardware level and preventing key leakage.

[0042] WAP gateway module: After receiving encrypted data packets, it only converts the protocol header and does not parse or modify the data payload. External access to sensitive memory areas is prohibited. The protocol conversion unit of the WAP gateway module only modifies the protocol header field, and the data payload remains encrypted, ensuring that the data remains encrypted at the gateway. This completely resolves the security risks of traditional solutions where plain text data is exposed in the gateway memory, restricts external access to sensitive memory areas and reduces the attack surface. At the same time, the encryption logic is built into the terminal and server modules, eliminating the need to deploy additional complex security facilities, significantly reducing operation and maintenance costs.

[0043] Business server module: used to use the private key to decrypt the session key ciphertext, recover the session key, decrypt the data ciphertext using the session key, obtain the plaintext data, calculate the hash summary of the decrypted data, compare it with the hash value in the sender's signature, verify the data integrity, check the certificate status to ensure the legality of the communicating party, generate response data for the business request, reverse the encryption process and return it to the mobile terminal. The verification unit of the business server module integrates a hardware security module to accelerate decryption and signature verification, protect the private key security from the hardware level, and prevent key leakage.

[0044] CA certificate authentication center module: used to build on open source systems, generate CA root certificates and private keys, review CSR requests submitted by entities, issue digital certificates and maintain certificate databases, maintain certificate revocation lists and online certificate status protocol services, update certificate status in real time, support lifecycle management functions such as certificate renewal and key rotation, provide certificate query, download and verification interfaces for both communicating parties to obtain certificate information in real time, support certificate transparency logs, and prevent the issuance of illegal certificates. The CA authentication center module supports the online certificate status protocol and responds to certificate status queries in real time. Combined with certificate transparency log technology, it can quickly discover and prevent the issuance and use of illegal certificates, and prevent middlemen from launching attacks using expired or forged certificates.

[0045] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A two-way authentication secure mobile communication method based on public key digital fingerprint, characterized in that: The specific steps include: S1. Digital certificate application and issuance: The mobile terminal and the service server each use an encryption algorithm to generate an asymmetric key pair, including a public key and a private key. The entity submits a CSR file to the CA, which includes the public key, entity identity information, and extension fields. The CA Certification Center conducts a strict review of the entity's identity. Once the review is passed, the public key and entity information are digitally signed using the CA's private key. S2. Certificate exchange and legitimacy verification: Before communication, the mobile terminal and the service server exchange digital certificates through a secure channel. The recipient uses the public key of the preset CA root certificate to decrypt the CA signature in the certificate, calculates the certificate hash value and compares it with the decryption result to confirm that the certificate has not been tampered with. The certificate validity period, issuer information, and usage fields are verified to ensure that the certificate is applicable to the current communication scenario. S3. Session key generation and encryption: The sender generates a high-strength random symmetric key using a pseudo-random number generator, asymmetrically encrypts the session key using the receiver's public key, and generates the encrypted session key ciphertext. S4. Data encryption and transmission: The sender uses the session key to encrypt the original data to generate data ciphertext, performs a hash operation on the original data to generate a digest, and signs the digest using the sender's private key to form a digital signature. The data ciphertext, encrypted session key, and digital signature are combined into a composite data packet and transmitted to the WAP gateway via the wireless network. S5. Data decryption and integrity verification: The receiver uses its own private key to decrypt the session key ciphertext, restore the original session key, and use the session key to decrypt the data ciphertext to obtain the plaintext data. The receiver recalculates the hash summary of the decrypted plaintext data and uses the sender's public key to decrypt the signature. The receiver compares the hash values to confirm that the data has not been tampered with and the source is legitimate.

2. The method for secure mobile communication based on two-way authentication using public key digital fingerprint according to claim 1, characterized in that: In step S3, a pseudo-random number generator generates a session key based on a system entropy source, and the key length is 256 bits.

3. The method for secure mobile communication based on two-way authentication using public key digital fingerprint according to claim 1, characterized in that: In step S4, the communication data is encrypted using a symmetric encryption algorithm, the symmetric encrypted session key is encrypted using an asymmetric encryption algorithm, and the session key is dynamically generated by a pseudo-random number generator.

4. A two-way authentication secure mobile communication system based on public key digital fingerprint, characterized by: The system is used to implement the two-way authentication secure mobile communication method based on public key digital fingerprint as described in any one of claims 1 to 3, comprising: a mobile terminal module, a WAP gateway module, a service server module and a CA certificate authentication center module; Mobile terminal module: used to generate an asymmetric key pair, submit a CSR request to the CA certification center module, obtain a digital certificate, dynamically generate a session key to encrypt communication data, encrypt the session key using the recipient's public key, attach a digital signature to the data packet, and send the encrypted data to the WAP gateway via the wireless network; WAP gateway module: After receiving encrypted data packets, it only converts the protocol header without parsing or modifying the data payload, and prohibits external access to sensitive memory areas; Business server module: used to decrypt the session key ciphertext using the private key, recover the session key, decrypt the data ciphertext using the session key, obtain the plaintext data, calculate the hash digest of the decrypted data, compare it with the hash value in the sender's signature, verify the data integrity, check the certificate status to ensure the legitimacy of the communicating party, generate response data for the business request, reverse the encryption process and return it to the mobile terminal; CA Certificate Authority Module: It is used to build on the open source system, generate CA root certificates and private keys, review CSR requests submitted by entities, issue digital certificates and maintain certificate databases, maintain certificate revocation lists and online certificate status protocol services, update certificate status in real time, support lifecycle management functions such as certificate renewal and key rotation, provide certificate query, download and verification interfaces for both communicating parties to obtain certificate information in real time, support transparent certificate logs, and prevent the issuance of illegal certificates.

5. The two-way authentication secure mobile communication system based on public key digital fingerprint according to claim 1, characterized in that: The protocol conversion unit of the WAP gateway module only modifies the protocol header field, and the data payload remains encrypted.

6. The two-way authentication secure mobile communication system based on public key digital fingerprint according to claim 1, characterized in that: The key management unit of the mobile terminal module is integrated with a trusted execution environment to protect the security of private keys.

7. The two-way authentication secure mobile communication system based on public key digital fingerprint according to claim 1, characterized in that: The verification unit of the business server module is integrated with a hardware security module for accelerating decryption and signature verification.

8. The two-way authentication secure mobile communication system based on public key digital fingerprint according to claim 1, characterized in that: The CA certification center module supports the online certificate status protocol and responds to certificate status queries in real time.

Images