Data processing method, device, system, electronic device and storage medium

Abstract

The embodiment of the present invention provides a data processing method and device, including: generating a pre-master key, generating a symmetric key according to the pre-master key, encrypting the pre-master key using a national secret public key cryptographic algorithm, encrypting a first handshake message using a national secret block cipher algorithm using a symmetric key to obtain first encrypted data, sending the encrypted pre-master key and the first encrypted data to a server, receiving second encrypted data, decrypting the second encrypted data using a national secret block cipher algorithm using a symmetric key, detecting whether the second handshake message is complete, and if the message is complete, determining to use a national secret block cipher algorithm and a symmetric key for data encryption and decryption, so that a national secret cryptographic algorithm and a corresponding handshake process are added to a secure socket layer module, a client and a server reach an agreement on the algorithm and key used, and secure communication between a browser and a server using relevant algorithms of the national secret protocol is achieved, with a small amount of changes to the browser code and stable and reliable.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data processing method, a data processing device, a data processing system, an electronic device and a readable storage medium. Background Art

[0002] HTTPS (Hyper Text Transfer Protocol over Secure Socket Layer) is a network protocol that can perform encrypted transmission and identity authentication, which is constructed by HTTP (Hyper Text Transfer Protocol Layer) plus TLS (Transport Layer Security) / SSL (Secure Socket Layer). It mainly uses digital certificates, encryption algorithms, asymmetric keys and other technologies to encrypt Internet data transmission and achieve Internet transmission security protection.

[0003] At present, the international TLS / SSL protocol standards include TLS1.2, TLS1.3 and other international standards. Various international algorithms such as RSA (RSA algorithm, RSA encryption algorithm), ECC (Error Correcting Code, error checking and correction), SM3 (hash function algorithm), SM4 (symmetric encryption algorithm) are used in the implementation of international standards.

[0004] From the perspective of information security, the National Cryptography Administration has defined the National Cryptography Protocol Standard Specification "GM_T 0024-2014-SSL VPN Technical Specification", and used national cryptographic algorithms such as SM2, SM3, and SM4 in the National Cryptography Standard, which are widely used in the financial and other fields. However, many browsers do not support the National Cryptography Protocol Standard Specification, and browsers and national cryptography servers cannot use the relevant algorithms of the National Cryptography Protocol for secure communication. Summary of the invention

[0005] The technical problem to be solved by the embodiments of the present invention is to provide a data processing method, device, system, electronic device and readable storage medium to solve the problem that the browser and the national encryption server cannot use the relevant algorithms of the national encryption protocol for secure communication.

[0006] In order to solve the above problems, the present invention provides a data processing method, which is applied to a browser and comprises:

[0007] Calling a secure socket layer module to generate a pre-master key, generating a symmetric key based on the pre-master key, and encrypting the pre-master key using a national secret public key cryptographic algorithm, and using a national secret block cipher algorithm and the symmetric key to encrypt a first handshake message between the browser and the server to obtain first encrypted data;

[0008] Calling the secure socket layer module, sending the encrypted pre-master key and the first encrypted data to the server, so that the server generates the symmetric key according to the pre-master key, and adopts the national secret block cipher algorithm and the symmetric key to decrypt the first encrypted data, and detects whether the first handshake message obtained by decryption is complete, and if the first handshake message is complete, sending the second encrypted data to the browser;

[0009] The secure socket layer module is called to receive the second encrypted data sent by the server, and the national secret block cipher algorithm and the symmetric key are used to decrypt the second encrypted data, and whether the decrypted second handshake message is complete is detected. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server.

[0010] Optionally, before calling the secure socket layer module to generate a pre-master key, generating a symmetric key based on the pre-master key, encrypting the pre-master key using a national secret public key cryptographic algorithm, and encrypting the first handshake message between the browser and the server using a national secret block cipher algorithm and the symmetric key to obtain the first encrypted data, the method further includes:

[0011] Calling the secure socket layer module, sending the latest national secret protocol version number supported by the browser to the server, so that the server selects a target national secret protocol version number according to the latest national secret protocol version number, and sends the target national secret protocol version number, the server digital certificate and the certificate request to the browser;

[0012] Calling the secure socket layer module to receive the target national encryption protocol version number, server digital certificate and certificate request sent by the server;

[0013] The secure socket layer module is called to verify the legitimacy of the server digital certificate according to the national secret public key cryptographic algorithm corresponding to the target national secret protocol version number, and to parse the certification authority information of the client digital certificate that the server can recognize from the certificate request.

[0014] Optionally, the method further comprises:

[0015] Calling the secure socket layer module, reading the corresponding client digital certificate from the cryptographic device according to the certification authority information, and using the national secret hashing algorithm to hash the first handshake message to obtain hash data, and using the cryptographic device to perform a private key signature on the hash data to obtain signature data;

[0016] The client digital certificate and signature data are sent to the server so that the server can verify the identity of the browser.

[0017] Accordingly, the present invention also provides a data processing method, which is applied to a server, comprising:

[0018] Receive an encrypted pre-master key and first encrypted data sent by a secure socket layer module of the browser, wherein the pre-master key is generated by the browser calling the secure socket layer module, and is encrypted using a national secret public key cryptographic algorithm and then sent to the server, and the first encrypted data is obtained by the browser calling the secure socket layer module, generating a symmetric key based on the pre-master key, and using a national secret block cipher algorithm and the symmetric key to encrypt a first handshake message between the browser and the server;

[0019] Generate the symmetric key according to the pre-master key, adopt the national secret block cipher algorithm, use the symmetric key to decrypt the first encrypted data, and detect whether the first handshake message obtained by decryption is complete;

[0020] If the first handshake message is complete, the national secret block cipher algorithm is used, and the symmetric key is used to encrypt the second handshake message between the browser and the server to obtain second encrypted data, and the second encrypted data is sent to the browser, so that the browser can call the secure socket layer module, receive the second encrypted data, and use the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detect whether the decrypted second handshake message is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server.

[0021] Optionally, before receiving the encrypted pre-master key and the first encrypted data sent by the secure socket layer module of the browser, the method further comprises:

[0022] Receive the latest national encryption protocol version number supported by the browser;

[0023] The target national encryption protocol version number is selected according to the latest national encryption protocol version number, and the target national encryption protocol version number, the server digital certificate and the certificate request are sent to the browser.

[0024] Optionally, the method further comprises:

[0025] Receive client digital certificate and signature data;

[0026] The identity of the browser is verified based on the client digital certificate and signature data.

[0027] Accordingly, the present invention also provides a data processing method, applied to a browser, comprising:

[0028] An encryption module, used to call a secure socket layer module to generate a pre-master key, generate a symmetric key based on the pre-master key, encrypt the pre-master key using a national secret public key cryptographic algorithm, and encrypt a first handshake message between the browser and the server using a national secret block cipher algorithm and the symmetric key to obtain first encrypted data;

[0029] a sending module, configured to call the secure socket layer module, and send the encrypted pre-master key and the first encrypted data to the server, so that the server generates the symmetric key according to the pre-master key, and adopts the national secret block cipher algorithm and the symmetric key to decrypt the first encrypted data, and detect whether the first handshake message obtained by decryption is complete; if the first handshake message is complete, the second encrypted data is sent to the browser;

[0030] The integrity detection module is used to call the secure socket layer module, receive the second encrypted data sent by the server, and adopt the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detect whether the second handshake message obtained by decryption is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server.

[0031] Optionally, the device further comprises:

[0032] A sending module, used to generate a pre-master key in the calling secure socket layer module, generate a symmetric key based on the pre-master key, encrypt the pre-master key using a national secret public key cryptographic algorithm, and use a national secret block cipher algorithm to encrypt the first handshake message between the browser and the server using the symmetric key, and before obtaining the first encrypted data, call the secure socket layer module to send the latest national secret protocol version number supported by the browser to the server, so that the server can select a target national secret protocol version number according to the latest national secret protocol version number, and send the target national secret protocol version number, the server digital certificate and the certificate request to the browser;

[0033] A receiving module, used to call the secure socket layer module to receive the target national encryption protocol version number, the server digital certificate and the certificate request sent by the server;

[0034] The verification module is used to call the secure socket layer module, verify the legitimacy of the server digital certificate according to the national secret public key cryptographic algorithm corresponding to the target national secret protocol version number, and parse the certification authority information of the client digital certificate that the server can recognize from the certificate request.

[0035] Optionally, the device further comprises:

[0036] A hash module, configured to call the secure socket layer module, read the corresponding client digital certificate from the cryptographic device according to the certification authority information, and hash the first handshake message using a national secret hash algorithm to obtain hash data, and use the cryptographic device to perform a private key signature on the hash data to obtain signature data;

[0037] The certificate sending module is used to send the client digital certificate and signature data to the server so that the server can verify the identity of the browser.

[0038] Accordingly, the present invention also provides a data processing method, which is applied to a server, comprising:

[0039] A receiving module, used for receiving an encrypted pre-master key and first encrypted data sent by a secure socket layer module of a browser, wherein the pre-master key is generated by the browser calling the secure socket layer module, and is encrypted by using a national secret public key cryptographic algorithm and then sent to the server, and the first encrypted data is obtained by the browser calling the secure socket layer module, generating a symmetric key according to the pre-master key, and using a national secret block cipher algorithm and the symmetric key to encrypt a first handshake message between the browser and the server;

[0040] A decryption module, used to generate the symmetric key according to the pre-master key, and adopt the national secret block cipher algorithm, use the symmetric key to decrypt the first encrypted data, and detect whether the first handshake message obtained by decryption is complete;

[0041] An integrity detection module is used to, if the first handshake message is complete, use the national secret block cipher algorithm and the symmetric key to encrypt the second handshake message between the browser and the server to obtain second encrypted data, and send the second encrypted data to the browser, so that the browser can call the secure socket layer module, receive the second encrypted data, and use the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detect whether the second handshake message obtained by decryption is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server.

[0042] Optionally, the device further comprises:

[0043] A version number receiving module, used for receiving the latest national encryption protocol version number supported by the browser before receiving the encrypted pre-master key and the first encrypted data sent by the secure socket layer module of the browser;

[0044] The request sending module is used to select a target national encryption protocol version number according to the latest national encryption protocol version number, and send the target national encryption protocol version number, the server digital certificate and the certificate request to the browser.

[0045] Optionally, the device further comprises:

[0046] The certificate receiving module is used to receive the client digital certificate and signature data;

[0047] The verification module is used to verify the identity of the browser according to the client digital certificate and signature data.

[0048] Accordingly, the present invention also provides a data processing system, including a browser and a server;

[0049] The browser comprises:

[0050] An encryption module, used to call a secure socket layer module to generate a pre-master key, generate a symmetric key based on the pre-master key, encrypt the pre-master key using a national secret public key cryptographic algorithm, and encrypt a first handshake message between the browser and the server using a national secret block cipher algorithm and the symmetric key to obtain first encrypted data;

[0051] A sending module, used for calling the secure socket layer module, and sending the encrypted pre-master key and the first encrypted data to the server;

[0052] an integrity detection module, configured to call the secure socket layer module, receive the second encrypted data sent by the server, and adopt the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detect whether the second handshake message obtained by decryption is complete; if the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server;

[0053] The server includes:

[0054] A receiving module, used for receiving the encrypted pre-master key and the first encrypted data sent by the secure socket layer module of the browser;

[0055] A decryption module, used to generate the symmetric key according to the pre-master key, and adopt the national secret block cipher algorithm, use the symmetric key to decrypt the first encrypted data, and detect whether the first handshake message obtained by decryption is complete;

[0056] The integrity detection module is used to, if the first handshake message is complete, adopt the national secret block cipher algorithm and use the symmetric key to encrypt the second handshake message between the browser and the server to obtain second encrypted data, and send the second encrypted data to the browser.

[0057] Optionally include:

[0058] The browser comprises:

[0059] A sending module, configured to generate a pre-master key when calling the secure socket layer module, generate a symmetric key based on the pre-master key, encrypt the pre-master key using a national secret public key cryptographic algorithm, and encrypt a first handshake message between the browser and the server using a national secret block cipher algorithm and the symmetric key, and before obtaining the first encrypted data, call the secure socket layer module to send the latest national secret protocol version number supported by the browser to the server;

[0060] A receiving module, used to call the secure socket layer module to receive the target national encryption protocol version number, the server digital certificate and the certificate request sent by the server;

[0061] A verification module, used to call the secure socket layer module, verify the legitimacy of the server digital certificate according to the national secret public key cryptographic algorithm corresponding to the target national secret protocol version number, and parse the certification authority information of the client digital certificate that can be recognized by the server from the certificate request;

[0062] The server includes:

[0063] A version number receiving module, used for receiving the latest national encryption protocol version number supported by the browser before receiving the encrypted pre-master key and the first encrypted data sent by the secure socket layer module of the browser;

[0064] The request sending module is used to select a target national encryption protocol version number according to the latest national encryption protocol version number, and send the target national encryption protocol version number, the server digital certificate and the certificate request to the browser.

[0065] Optionally include:

[0066] The browser comprises:

[0067] A hash module, configured to call the secure socket layer module, read the corresponding client digital certificate from the cryptographic device according to the certification authority information, and hash the first handshake message using a national secret hash algorithm to obtain hash data, and use the cryptographic device to perform a private key signature on the hash data to obtain signature data;

[0068] A certificate sending module, used to send the client digital certificate and signature data to the server, so that the server can verify the identity of the browser;

[0069] The server includes:

[0070] The certificate receiving module is used to receive the client digital certificate and signature data;

[0071] The verification module is used to verify the identity of the browser according to the client digital certificate and signature data.

[0072] Accordingly, the present invention also provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0073] Memory, used to store computer programs;

[0074] The processor is used to implement any of the above-mentioned method steps when executing the program stored in the memory.

[0075] Correspondingly, the present invention also provides a readable storage medium, when the instructions in the storage medium are executed by the processor of the electronic device, the electronic device can execute the above data processing method.

[0076] According to an embodiment of the present invention, a pre-master key is generated by calling a secure socket layer module, a symmetric key is generated based on the pre-master key, and the pre-master key is encrypted by using a national secret public key cryptographic algorithm, and a national secret block cipher algorithm is used to encrypt a first handshake message between the browser and the server using the symmetric key to obtain first encrypted data, and the secure socket layer module is called to send the encrypted pre-master key and the first encrypted data to the server, so that the server generates the symmetric key based on the pre-master key, and uses the national secret block cipher algorithm to decrypt the first encrypted data using the symmetric key, and detects whether the first handshake message obtained by decryption is complete. If the first handshake message is complete, a second handshake message is sent. Encrypt data to the browser, call the secure socket layer module, receive the second encrypted data sent by the server, and adopt the national secret block cipher algorithm, use the symmetric key to decrypt the second encrypted data, and detect whether the second handshake message obtained by decryption is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server, so that the national secret cryptographic algorithm and the corresponding handshake process are added to the secure socket layer module of the browser, and the client and the server reach an agreement on the algorithm and key used, so as to realize secure communication between the browser and the national secret server using the relevant algorithms of the national secret protocol, and the browser code is changed little and is stable and reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Figure 1 A flowchart showing the steps of a data processing method according to the first embodiment of the present invention is shown;

[0078] Figure 2 A flowchart showing the steps of a data processing method according to the second embodiment of the present invention is shown;

[0079] Figure 3 A schematic diagram showing the handshake process between the browser and the server;

[0080] Figure 4 A structural block diagram of a data processing device embodiment of the third embodiment of the present invention is shown;

[0081] Figure 5 A structural block diagram of a data processing device embodiment of the fourth embodiment of the present invention is shown;

[0082] Figure 6 A structural block diagram of a data processing system embodiment of Embodiment 5 of the present invention is shown; Figure 7 A structural block diagram of an electronic device for data processing according to an exemplary embodiment is shown. DETAILED DESCRIPTION

[0083] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0084] Reference Figure 1 , shows a flow chart of the steps of a data processing method according to the first embodiment of the present invention, which is applied to a browser and may specifically include the following steps:

[0085] Step 101, calling the secure socket layer module to generate a pre-master key, generating a symmetric key based on the pre-master key, and encrypting the pre-master key using a national secret public key cryptographic algorithm, and using a national secret block cipher algorithm and the symmetric key to encrypt a first handshake message between the browser and the server to obtain first encrypted data.

[0086] In the embodiment of the present invention, Secure Socket Layer (SSL) is a security protocol implemented on the transmission communication protocol TCP / IP (Transmission Control Protocol / Internet Protocol), which adopts public key technology, widely supports various types of networks, and provides three basic security services. In many browsers, the Secure Socket Layer module is used for the secure transmission of data, for example, the BoringSSL module in the Chromium browser (Google browser) and the NSS (Network Security Services) network security service module in the Firefox browser (Firefox browser). In order to realize the browser's support for the national secret protocol standard specification, the interface code of the browser's Secure Socket Layer module can be modified, and the cryptographic algorithm related to the national secret protocol and the handshake protocol process related code can be added.

[0087] In the embodiment of the present invention, the pre-master key is a key used to generate a master key. The master key is used to encrypt and decrypt data transmitted between the browser and the server. The secure socket layer module of the client browser generates the pre-master key, and then generates a symmetric key based on the pre-master key to serve as the master key. Both parties sending and receiving data must use the same key to encrypt and decrypt plaintext. The key used is called a symmetric key.

[0088] In the embodiment of the present invention, the national secret public key cryptographic algorithm refers to an algorithm issued by the State Cryptography Administration that uses public key encryption and private key decryption. For example, SM2 is an elliptic curve public key cryptographic algorithm issued by the State Cryptography Administration. The pre-master key is encrypted using the national secret public key cryptographic algorithm. Specifically, the server digital certificate of the server can be obtained in advance, and the pre-master key is encrypted using the public key in the server digital certificate.

[0089] In the embodiment of the present invention, the national secret block cipher algorithm refers to the block cipher algorithm issued by the State Cryptography Administration. In cryptography, block cipher, also known as block encryption or block cipher, is a symmetric key algorithm. It divides the plaintext into multiple equal-length modules (blocks), and uses a certain algorithm and symmetric key to encrypt and decrypt each group separately. Block encryption is an extremely important component of encryption protocols. For example, SM4 is a block key algorithm issued by the State Cryptography Administration. The national secret block algorithm is used to encrypt the first handshake message between the browser and the server using a symmetric key to obtain the first encrypted data, wherein the first handshake message refers to the message transmitted by the browser and the server during this handshake process stored by the browser.

[0090] In an embodiment of the present invention, optionally, before the calling of the secure socket layer module, generating a pre-master key, generating a symmetric key based on the pre-master key, encrypting the pre-master key using a national secret public key cryptographic algorithm, and encrypting the first handshake message between the browser and the server using a national secret block cipher algorithm and the symmetric key, to obtain the first encrypted data, it may also include: calling the secure socket layer module, sending the latest national secret protocol version number supported by the browser to the server, so that the server selects a target national secret protocol version number according to the latest national secret protocol version number, and sends the target national secret protocol version number, the server digital certificate and the certificate request to the browser; calling the secure socket layer module, receiving the target national secret protocol version number, the server digital certificate and the certificate request sent by the server; calling the secure socket layer module, verifying the legitimacy of the server digital certificate according to the national secret public key cryptographic algorithm corresponding to the target national secret protocol version number, and parsing the certification authority information of the client digital certificate that the server can recognize from the certificate request.

[0091] When the browser and the server start this handshake, they need to first send the latest national secret protocol version number supported by the browser to the server, so that the server can select the national secret protocol version number that the browser can support based on the latest national secret protocol version number, which is recorded as the target national secret protocol version number. For example, the browser sends the latest national secret protocol version number supported by the browser, the client random number and other information to the server. The server will send the target national secret protocol version number, the server digital certificate and the certificate request to the browser. The browser receives the target national secret protocol version number, the server digital certificate and the certificate request sent by the server.

[0092] Then, according to the national secret public key cryptographic algorithm corresponding to the target national secret protocol version number, verify whether the server digital certificate is legal. Specifically, it is necessary to verify whether the server digital certificate is legal in combination with the certification authority certificate stored in the browser. If the server digital certificate is legal, the certification authority information of the client digital certificate that the server can recognize is parsed from the certificate request, that is, the CA (Certificate Authority, certificate issuing) agency of the client certificate.

[0093] In an embodiment of the present invention, optionally, the method further includes: calling the secure socket layer module, reading the corresponding client digital certificate from the cryptographic device according to the certification authority information, and using a national secret hashing algorithm to hash the first handshake message to obtain hashed data, using the cryptographic device to perform a private key signature on the hashed data to obtain signature data; and sending the client digital certificate and signature data to the server for the server to verify the identity of the browser.

[0094] A password device refers to a device that stores a unique user identity, such as an online banking device USB shield, a fingerprint password device, etc. When a password device is used in a browser, it generally stores the user's private key, personal certificate, etc., and even completes encryption and decryption during network transmission. The password device standard interface refers to the specification standard between the application and the password device. According to the certification authority information, the corresponding client digital certificate is read from the password device.

[0095] The national secret hash algorithm refers to the hash algorithm (i.e. hash algorithm) issued by the State Cryptography Administration. For example, SM3 is a national secret hash algorithm. In the commercial cryptographic system, the hash algorithm is mainly used for digital signature and verification, message authentication code generation and verification, random number generation, etc., and its algorithm is public. The national secret hash algorithm is used to hash the first handshake message to obtain hash data, and the hash data is signed with a private key using a cryptographic device to obtain signature data; the client digital certificate and signature data are sent to the server for the server to verify the identity of the browser.

[0096] Step 102, calling the secure socket layer module, sending the encrypted pre-master key and the first encrypted data to the server, so that the server generates the symmetric key according to the pre-master key, and adopts the national secret block cipher algorithm, uses the symmetric key to decrypt the first encrypted data, and detects whether the first handshake message obtained by decryption is complete. If the first handshake message is complete, the second encrypted data is sent to the browser.

[0097] In an embodiment of the present invention, the encrypted pre-master key and the first encrypted data are sent to the server. The server first decrypts the encrypted pre-master key. Specifically, the national secret public key cryptographic algorithm can be used to decrypt the pre-master key using the private key in the server digital certificate, and then a symmetric key is generated based on the pre-master key. The national secret block cipher algorithm is used to decrypt the first encrypted data using the symmetric key to obtain the first handshake message, and then the first handshake message obtained by decryption is detected to be complete. Specifically, the handshake message of this handshake process stored locally on the server can be compared with the first handshake message obtained by decryption to determine whether the first handshake message is complete. If the first handshake message is complete, the server sends the second encrypted data to the browser.

[0098] The second encrypted data is obtained by the server using the national secret block cipher algorithm and the symmetric key to encrypt the second handshake message of the server, and then send it to the browser. The second handshake message refers to the message transmitted by the browser and the server during the handshake process stored by the server.

[0099] Step 103, calling the secure socket layer module, receiving the second encrypted data sent by the server, and adopting the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detecting whether the decrypted second handshake message is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server.

[0100] In the embodiment of the present invention, the second encrypted data sent by the server is received, and the national secret block cipher algorithm is used to decrypt the second encrypted data using a symmetric key to obtain a second handshake message. Then, it is detected whether the decrypted second handshake message is complete. Specifically, the handshake message of this handshake process stored locally in the browser can be compared with the decrypted second handshake message to determine whether the second handshake message is complete, that is, the server message integrity detection is performed. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server. At this point, the national secret protocol of the "GM_T 0024-2014-SSL VPN Technical Specification" is fully supported.

[0101] According to an embodiment of the present invention, a pre-master key is generated by calling a secure socket layer module, a symmetric key is generated based on the pre-master key, and the pre-master key is encrypted by using a national secret public key cryptographic algorithm, and the first handshake message between the browser and the server is encrypted by using a national secret block cipher algorithm and the symmetric key to obtain first encrypted data, and the secure socket layer module is called to send the encrypted pre-master key and the first encrypted data to the server, so that the server generates the symmetric key based on the pre-master key, and the national secret block cipher algorithm is used to decrypt the first encrypted data by using the symmetric key, and detect whether the first handshake message obtained by decryption is complete. If the first handshake message is complete, the second Encrypt data to the browser, call the secure socket layer module, receive the second encrypted data sent by the server, and adopt the national secret block cipher algorithm, use the symmetric key to decrypt the second encrypted data, and detect whether the second handshake message obtained by decryption is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server, so that the national secret cryptographic algorithm and the corresponding handshake process are added to the secure socket layer module of the browser, and the client and the server reach an agreement on the algorithm and key used, so as to realize secure communication between the browser and the national secret server using the relevant algorithms of the national secret protocol, and the browser code is changed little and is stable and reliable.

[0102] Reference Figure 2 , shows a flow chart of the steps of a data processing method of Embodiment 2 of the present invention, which is applied to the server and may specifically include the following steps:

[0103] Step 201, receiving an encrypted pre-master key and first encrypted data sent by a secure socket layer module of a browser, wherein the pre-master key is generated by the browser calling the secure socket layer module, and is encrypted using a national secret public key cryptographic algorithm and then sent to the server, and the first encrypted data is obtained by the browser calling the secure socket layer module, generating a symmetric key based on the pre-master key, and using a national secret block cipher algorithm and the symmetric key to encrypt a first handshake message between the browser and the server.

[0104] In the embodiment of the present invention, the specific implementation method of this step can refer to the description in the above embodiment and will not be repeated here.

[0105] In the embodiment of the present invention, optionally, before receiving the encrypted pre-master key and the first encrypted data sent by the secure socket layer module of the browser, it also includes: receiving the latest national secret protocol version number supported by the browser; selecting a target national secret protocol version number according to the latest national secret protocol version number, and sending the target national secret protocol version number, the server digital certificate and the certificate request to the browser. The specific implementation method of this step can be referred to the description in the above embodiment, which will not be repeated here.

[0106] In the embodiment of the present invention, optionally, the method further comprises: receiving a client digital certificate and signature data; and verifying the identity of the browser according to the client digital certificate and signature data. The specific implementation of this step can be referred to the description in the above embodiment, which will not be described here.

[0107] Step 202: Generate the symmetric key according to the pre-master key, adopt the national secret block cipher algorithm, use the symmetric key to decrypt the first encrypted data, and detect whether the first handshake message obtained by decryption is complete.

[0108] In the embodiment of the present invention, the specific implementation method of this step can refer to the description in the above embodiment and will not be repeated here.

[0109] Step 203: If the first handshake message is complete, the national secret block cipher algorithm is used, and the symmetric key is used to encrypt the second handshake message between the browser and the server to obtain second encrypted data, and the second encrypted data is sent to the browser, so that the browser can call the secure socket layer module, receive the second encrypted data, and use the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detect whether the second handshake message obtained by decryption is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server.

[0110] In the embodiment of the present invention, the specific implementation method of this step can refer to the description in the above embodiment and will not be repeated here.

[0111] According to an embodiment of the present invention, an encrypted pre-master key and first encrypted data are received from a secure socket layer module of a browser, wherein the pre-master key is generated by the browser calling the secure socket layer module, and is encrypted by using a national secret public key cryptographic algorithm and then sent to the server. The first encrypted data is obtained by the browser calling the secure socket layer module, generating a symmetric key according to the pre-master key, and using a national secret block cipher algorithm to encrypt a first handshake message between the browser and the server using the symmetric key. The symmetric key is generated according to the pre-master key, and the national secret block cipher algorithm is used to decrypt the first encrypted data using the symmetric key. It is detected whether the first handshake message obtained by decryption is complete. If the first handshake message is complete, the national secret block cipher algorithm is used to encrypt the first handshake message using the symmetric key. The second handshake message between the browser and the server is encrypted to obtain second encrypted data, and the second encrypted data is sent to the browser, so that the browser calls the secure socket layer module, receives the second encrypted data, and adopts the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detects whether the decrypted second handshake message is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server, so that the national secret cryptographic algorithm and the corresponding handshake process are added to the secure socket layer module of the browser, and the client and the server reach an agreement on the algorithm and key to be used, so as to realize secure communication between the browser and the national secret server using the relevant algorithms of the national secret protocol, and the browser code is changed little and is stable and reliable.

[0112] In order to enable those skilled in the art to better understand the present application, an implementation method of the present application is described below through specific examples.

[0113] like Figure 3 Schematic diagram of the handshake process between the browser and the server.

[0114] The browser calls the ssl_write_client_hello interface to send the protocol version number, client random number and other information to the server; the server processes the client_hello message and sends the selected version number, server digital certificate, certificate request message, end mark message and other information to the browser.

[0115] The browser calls the do_read_server_hello interface to receive the version number sent by the server; the browser calls the do_read_server_certificate interface and the do_read_server_key_exchange interface to parse the server digital certificate, and verify the legitimacy of the server identity based on the certification authority certificate stored in the browser; the browser calls the do_read_certificate_request interface to process the certificate request message sent by the server, and parses out the CA organization of the client certificate that the server can recognize; the browser calls the do_read_server_hello_done interface to process the end mark message of the server.

[0116] The browser calls the do_send_client_certificate interface to read the client digital certificate from the cryptographic device and sends it to the server; the browser calls the do_send_client_key_exchange interface to generate a pre-master key and uses the public key in the server encryption certificate for SM2 encryption; the browser calls the do_send_client_certificate_verify interface to perform SM3 hashing on the current handshake message, and calls the cryptographic device interface to perform private key signing for the server to authenticate the identity; the browser calls the do_send_client_finish interface to encrypt the handshake message using SM4 and send it to the server for message integrity detection.

[0117] The browser calls the do_read_server_finished interface to perform server-side message integrity detection; the handshake is completed, and the browser and server will subsequently call the SM4 algorithm and use the negotiated symmetric key to encrypt data transmission. At this point, the national encryption protocol of "GM_T 0024-2014-SSL VPN Technical Specification" is fully supported.

[0118] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0119] Reference Figure 4 , shows a structural block diagram of a data processing device embodiment of the third embodiment of the present invention, which is applied to a browser and may specifically include the following modules:

[0120] The encryption module 301 is used to call the secure socket layer module to generate a pre-master key, generate a symmetric key based on the pre-master key, and encrypt the pre-master key using a national secret public key cryptographic algorithm, and use a national secret block cipher algorithm and the symmetric key to encrypt the first handshake message between the browser and the server to obtain first encrypted data;

[0121] The sending module 302 is used to call the secure socket layer module to send the encrypted pre-master key and the first encrypted data to the server, so that the server generates the symmetric key according to the pre-master key, and adopts the national secret block cipher algorithm and the symmetric key to decrypt the first encrypted data, and detect whether the first handshake message obtained by decryption is complete. If the first handshake message is complete, the second encrypted data is sent to the browser;

[0122] The integrity detection module 303 is used to call the secure socket layer module, receive the second encrypted data sent by the server, and adopt the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detect whether the second handshake message obtained by decryption is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server.

[0123] In the embodiment of the present invention, optionally, the device further includes:

[0124] A sending module, used to generate a pre-master key in the calling secure socket layer module, generate a symmetric key based on the pre-master key, encrypt the pre-master key using a national secret public key cryptographic algorithm, and use a national secret block cipher algorithm to encrypt the first handshake message between the browser and the server using the symmetric key, and before obtaining the first encrypted data, call the secure socket layer module to send the latest national secret protocol version number supported by the browser to the server, so that the server can select a target national secret protocol version number according to the latest national secret protocol version number, and send the target national secret protocol version number, the server digital certificate and the certificate request to the browser;

[0125] A receiving module, used to call the secure socket layer module to receive the target national encryption protocol version number, the server digital certificate and the certificate request sent by the server;

[0126] The verification module is used to call the secure socket layer module, verify the legitimacy of the server digital certificate according to the national secret public key cryptographic algorithm corresponding to the target national secret protocol version number, and parse the certification authority information of the client digital certificate that the server can recognize from the certificate request.

[0127] In the embodiment of the present invention, optionally, the device further includes:

[0128] A hash module, configured to call the secure socket layer module, read the corresponding client digital certificate from the cryptographic device according to the certification authority information, and hash the first handshake message using a national secret hash algorithm to obtain hash data, and use the cryptographic device to perform a private key signature on the hash data to obtain signature data;

[0129] The certificate sending module is used to send the client digital certificate and signature data to the server so that the server can verify the identity of the browser.

[0130] According to an embodiment of the present invention, a pre-master key is generated by calling a secure socket layer module, a symmetric key is generated based on the pre-master key, and the pre-master key is encrypted by using a national secret public key cryptographic algorithm, and the first handshake message between the browser and the server is encrypted by using a national secret block cipher algorithm and the symmetric key to obtain first encrypted data, and the secure socket layer module is called to send the encrypted pre-master key and the first encrypted data to the server, so that the server generates the symmetric key based on the pre-master key, and the national secret block cipher algorithm is used to decrypt the first encrypted data by using the symmetric key, and detect whether the first handshake message obtained by decryption is complete. If the first handshake message is complete, the second Encrypt data to the browser, call the secure socket layer module, receive the second encrypted data sent by the server, and adopt the national secret block cipher algorithm, use the symmetric key to decrypt the second encrypted data, and detect whether the second handshake message obtained by decryption is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server, so that the national secret cryptographic algorithm and the corresponding handshake process are added to the secure socket layer module of the browser, and the client and the server reach an agreement on the algorithm and key used, so as to realize secure communication between the browser and the national secret server using the relevant algorithms of the national secret protocol, and the browser code is changed little and is stable and reliable.

[0131] Reference Figure 5 , shows a structural block diagram of a data processing device embodiment of the fourth embodiment of the present invention, which is applied to the server and may specifically include the following modules:

[0132] The receiving module 401 is used to receive the encrypted pre-master key and the first encrypted data sent by the secure socket layer module of the browser, wherein the pre-master key is generated by the browser calling the secure socket layer module, and is encrypted by using the national secret public key cryptographic algorithm and then sent to the server, and the first encrypted data is obtained by the browser calling the secure socket layer module, generating a symmetric key according to the pre-master key, and using the national secret block cipher algorithm and the symmetric key to encrypt the first handshake message between the browser and the server;

[0133] The decryption module 402 is used to generate the symmetric key according to the pre-master key, and adopt the national secret block cipher algorithm and the symmetric key to decrypt the first encrypted data, and detect whether the first handshake message obtained by decryption is complete;

[0134] The integrity detection module 403 is used to, if the first handshake message is complete, adopt the national secret block cipher algorithm and use the symmetric key to encrypt the second handshake message between the browser and the server to obtain second encrypted data, and send the second encrypted data to the browser, so that the browser can call the secure socket layer module, receive the second encrypted data, and adopt the national secret block cipher algorithm and use the symmetric key to decrypt the second encrypted data, and detect whether the second handshake message obtained by decryption is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server.

[0135] In the embodiment of the present invention, optionally, the device further includes:

[0136] A version number receiving module, used for receiving the latest national encryption protocol version number supported by the browser before receiving the encrypted pre-master key and the first encrypted data sent by the secure socket layer module of the browser;

[0137] The request sending module is used to select a target national encryption protocol version number according to the latest national encryption protocol version number, and send the target national encryption protocol version number, the server digital certificate and the certificate request to the browser.

[0138] In the embodiment of the present invention, optionally, the device further includes:

[0139] The certificate receiving module is used to receive the client digital certificate and signature data;

[0140] The verification module is used to verify the identity of the browser according to the client digital certificate and signature data.

[0141] According to an embodiment of the present invention, an encrypted pre-master key and first encrypted data are received from a secure socket layer module of a browser, wherein the pre-master key is generated by the browser calling the secure socket layer module, and is encrypted by using a national secret public key cryptographic algorithm and then sent to the server. The first encrypted data is obtained by the browser calling the secure socket layer module, generating a symmetric key according to the pre-master key, and using a national secret block cipher algorithm to encrypt a first handshake message between the browser and the server using the symmetric key. The symmetric key is generated according to the pre-master key, and the national secret block cipher algorithm is used to decrypt the first encrypted data using the symmetric key. It is detected whether the first handshake message obtained by decryption is complete. If the first handshake message is complete, the national secret block cipher algorithm is used to encrypt the first handshake message using the symmetric key. The second handshake message between the browser and the server is encrypted to obtain second encrypted data, and the second encrypted data is sent to the browser, so that the browser calls the secure socket layer module, receives the second encrypted data, and adopts the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detects whether the decrypted second handshake message is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server, so that the national secret cryptographic algorithm and the corresponding handshake process are added to the secure socket layer module of the browser, and the client and the server reach an agreement on the algorithm and key to be used, so as to realize secure communication between the browser and the national secret server using the relevant algorithms of the national secret protocol, and the browser code is changed little and is stable and reliable.

[0142] Reference Figure 6 , shows a structural block diagram of a data processing system embodiment of the fifth embodiment of the present invention, which may specifically include a browser 501 and a server 502;

[0143] The browser comprises:

[0144] An encryption module, used to call a secure socket layer module to generate a pre-master key, generate a symmetric key based on the pre-master key, encrypt the pre-master key using a national secret public key cryptographic algorithm, and encrypt a first handshake message between the browser and the server using a national secret block cipher algorithm and the symmetric key to obtain first encrypted data;

[0145] A sending module, used for calling the secure socket layer module, and sending the encrypted pre-master key and the first encrypted data to the server;

[0146] an integrity detection module, configured to call the secure socket layer module, receive the second encrypted data sent by the server, and adopt the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detect whether the second handshake message obtained by decryption is complete; if the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server;

[0147] The server includes:

[0148] A receiving module, used for receiving the encrypted pre-master key and the first encrypted data sent by the secure socket layer module of the browser;

[0149] A decryption module, used to generate the symmetric key according to the pre-master key, and adopt the national secret block cipher algorithm, use the symmetric key to decrypt the first encrypted data, and detect whether the first handshake message obtained by decryption is complete;

[0150] The integrity detection module is used to, if the first handshake message is complete, adopt the national secret block cipher algorithm and use the symmetric key to encrypt the second handshake message between the browser and the server to obtain second encrypted data, and send the second encrypted data to the browser.

[0151] In an embodiment of the present invention, optionally, the method includes:

[0152] The browser comprises:

[0153] A sending module, configured to generate a pre-master key when calling the secure socket layer module, generate a symmetric key based on the pre-master key, encrypt the pre-master key using a national secret public key cryptographic algorithm, and encrypt a first handshake message between the browser and the server using a national secret block cipher algorithm and the symmetric key, and before obtaining the first encrypted data, call the secure socket layer module to send the latest national secret protocol version number supported by the browser to the server;

[0154] A receiving module, used to call the secure socket layer module to receive the target national encryption protocol version number, the server digital certificate and the certificate request sent by the server;

[0155] A verification module, used to call the secure socket layer module, verify the legitimacy of the server digital certificate according to the national secret public key cryptographic algorithm corresponding to the target national secret protocol version number, and parse the certification authority information of the client digital certificate that can be recognized by the server from the certificate request;

[0156] The server includes:

[0157] A version number receiving module, used for receiving the latest national encryption protocol version number supported by the browser before receiving the encrypted pre-master key and the first encrypted data sent by the secure socket layer module of the browser;

[0158] The request sending module is used to select a target national encryption protocol version number according to the latest national encryption protocol version number, and send the target national encryption protocol version number, the server digital certificate and the certificate request to the browser.

[0159] In an embodiment of the present invention, optionally, the method includes:

[0160] The browser comprises:

[0161] A hash module, configured to call the secure socket layer module, read the corresponding client digital certificate from the cryptographic device according to the certification authority information, and hash the first handshake message using a national secret hash algorithm to obtain hash data, and use the cryptographic device to perform a private key signature on the hash data to obtain signature data;

[0162] A certificate sending module, used to send the client digital certificate and signature data to the server, so that the server can verify the identity of the browser;

[0163] The server includes:

[0164] The certificate receiving module is used to receive the client digital certificate and signature data;

[0165] The verification module is used to verify the identity of the browser according to the client digital certificate and signature data.

[0166] According to an embodiment of the present invention, an encrypted pre-master key and first encrypted data are received from a secure socket layer module of a browser, wherein the pre-master key is generated by the browser calling the secure socket layer module, and is encrypted by using a national secret public key cryptographic algorithm and then sent to the server. The first encrypted data is obtained by the browser calling the secure socket layer module, generating a symmetric key according to the pre-master key, and using a national secret block cipher algorithm to encrypt a first handshake message between the browser and the server using the symmetric key. The symmetric key is generated according to the pre-master key, and the national secret block cipher algorithm is used to decrypt the first encrypted data using the symmetric key. It is detected whether the first handshake message obtained by decryption is complete. If the first handshake message is complete, the national secret block cipher algorithm is used to encrypt the first handshake message using the symmetric key. The second handshake message between the browser and the server is encrypted to obtain second encrypted data, and the second encrypted data is sent to the browser, so that the browser calls the secure socket layer module, receives the second encrypted data, and adopts the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detects whether the decrypted second handshake message is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server, so that the national secret cryptographic algorithm and the corresponding handshake process are added to the secure socket layer module of the browser, and the client and the server reach an agreement on the algorithm and key to be used, so as to realize secure communication between the browser and the national secret server using the relevant algorithms of the national secret protocol, and the browser code is changed little and is stable and reliable.

[0167] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0168] Figure 7 1 is a block diagram of an electronic device 700 for data processing according to an exemplary embodiment. For example, the electronic device 700 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0169] Reference Figure 7 , the electronic device 700 may include one or more of the following components: a processing component 702 , a memory 704 , a power component 706 , a multimedia component 708 , an audio component 710 , an input / output (I / O) interface 712 , a sensor component 714 , and a communication component 716 .

[0170] The processing component 702 generally controls the overall operation of the electronic device 700, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 702 may include one or more processors 720 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 702 may include one or more modules to facilitate the interaction between the processing component 702 and other components. For example, the processing component 702 may include a multimedia module to facilitate the interaction between the multimedia component 708 and the processing component 702.

[0171] The memory 704 is configured to store various types of data to support operations on the device 700. Examples of such data include instructions for any application or method operating on the electronic device 700, contact data, phone book data, messages, pictures, videos, etc. The memory 704 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0172] The power component 704 provides power to various components of the electronic device 700. The power component 704 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 700.

[0173] The multimedia component 708 includes a screen that provides an output interface between the electronic device 700 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 708 includes a front camera and / or a rear camera. When the electronic device 700 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0174] The audio component 710 is configured to output and / or input audio signals. For example, the audio component 710 includes a microphone (MIC), and when the electronic device 700 is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 704 or sent via the communication component 716. In some embodiments, the audio component 710 also includes a speaker for outputting audio signals.

[0175] I / O interface 712 provides an interface between processing component 702 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.

[0176] The sensor assembly 714 includes one or more sensors for providing various aspects of status assessment for the electronic device 700. For example, the sensor assembly 714 can detect the open / closed state of the device 700, the relative positioning of components, such as the display and keypad of the electronic device 700, and the sensor assembly 714 can also detect the position change of the electronic device 700 or a component of the electronic device 700, the presence or absence of contact between the user and the electronic device 700, the orientation or acceleration / deceleration of the electronic device 700, and the temperature change of the electronic device 700. The sensor assembly 714 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 714 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 714 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0177] The communication component 716 is configured to facilitate wired or wireless communication between the electronic device 700 and other devices. The electronic device 700 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 714 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 714 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0178] In an exemplary embodiment, the electronic device 700 may be implemented by one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0179] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 704 including instructions, and the instructions can be executed by a processor 720 of an electronic device 700 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0180] A non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by a processor of a terminal, enables the terminal to execute a data processing method, applied to a browser, the method comprising:

[0181] Calling a secure socket layer module to generate a pre-master key, generating a symmetric key based on the pre-master key, and encrypting the pre-master key using a national secret public key cryptographic algorithm, and using a national secret block cipher algorithm and the symmetric key to encrypt a first handshake message between the browser and the server to obtain first encrypted data;

[0182] Calling the secure socket layer module, sending the encrypted pre-master key and the first encrypted data to the server, so that the server generates the symmetric key according to the pre-master key, and adopts the national secret block cipher algorithm and the symmetric key to decrypt the first encrypted data, and detects whether the first handshake message obtained by decryption is complete, and if the first handshake message is complete, sending the second encrypted data to the browser;

[0183] The secure socket layer module is called to receive the second encrypted data sent by the server, and the national secret block cipher algorithm and the symmetric key are used to decrypt the second encrypted data, and whether the decrypted second handshake message is complete is detected. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server.

[0184] Optionally, before calling the secure socket layer module to generate a pre-master key, generating a symmetric key based on the pre-master key, encrypting the pre-master key using a national secret public key cryptographic algorithm, and encrypting the first handshake message between the browser and the server using a national secret block cipher algorithm and the symmetric key to obtain the first encrypted data, the method further includes:

[0185] Calling the secure socket layer module, sending the latest national secret protocol version number supported by the browser to the server, so that the server selects a target national secret protocol version number according to the latest national secret protocol version number, and sends the target national secret protocol version number, the server digital certificate and the certificate request to the browser;

[0186] Calling the secure socket layer module to receive the target national encryption protocol version number, server digital certificate and certificate request sent by the server;

[0187] The secure socket layer module is called to verify the legitimacy of the server digital certificate according to the national secret public key cryptographic algorithm corresponding to the target national secret protocol version number, and to parse the certification authority information of the client digital certificate that the server can recognize from the certificate request.

[0188] Optionally, the method further comprises:

[0189] Calling the secure socket layer module, reading the corresponding client digital certificate from the cryptographic device according to the certification authority information, and using the national secret hashing algorithm to hash the first handshake message to obtain hash data, and using the cryptographic device to perform a private key signature on the hash data to obtain signature data;

[0190] The client digital certificate and signature data are sent to the server so that the server can verify the identity of the browser.

[0191] A non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by a processor of a terminal, enables the terminal to execute a data processing method, applied to a server, the method comprising:

[0192] Receive an encrypted pre-master key and first encrypted data sent by a secure socket layer module of the browser, wherein the pre-master key is generated by the browser calling the secure socket layer module, and is encrypted using a national secret public key cryptographic algorithm and then sent to the server, and the first encrypted data is obtained by the browser calling the secure socket layer module, generating a symmetric key based on the pre-master key, and using a national secret block cipher algorithm and the symmetric key to encrypt a first handshake message between the browser and the server;

[0193] Generate the symmetric key according to the pre-master key, adopt the national secret block cipher algorithm, use the symmetric key to decrypt the first encrypted data, and detect whether the first handshake message obtained by decryption is complete;

[0194] If the first handshake message is complete, the national secret block cipher algorithm is used, and the symmetric key is used to encrypt the second handshake message between the browser and the server to obtain second encrypted data, and the second encrypted data is sent to the browser, so that the browser can call the secure socket layer module, receive the second encrypted data, and use the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detect whether the decrypted second handshake message is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server.

[0195] Optionally, before receiving the encrypted pre-master key and the first encrypted data sent by the secure socket layer module of the browser, the method further comprises:

[0196] Receive the latest national encryption protocol version number supported by the browser;

[0197] The target national encryption protocol version number is selected according to the latest national encryption protocol version number, and the target national encryption protocol version number, the server digital certificate and the certificate request are sent to the browser.

[0198] Optionally, the method further comprises:

[0199] Receive client digital certificate and signature data;

[0200] The identity of the browser is verified based on the client digital certificate and signature data.

[0201] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0202] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0203] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0204] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0205] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0206] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0207] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0208] The data processing method and the data processing device provided by the present invention are introduced in detail above. The principle and implementation mode of the present invention are explained by using specific examples in this article. The description of the above embodiments is only used to help understand the method and the core idea of ​​the present invention. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and the scope of application. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A data processing method, characterized in that: Applies to browsers, including: Calling a secure socket layer module to generate a pre-master key, generating a symmetric key based on the pre-master key, and encrypting the pre-master key using a national secret public key cryptographic algorithm, and using a national secret block cipher algorithm and the symmetric key to encrypt a first handshake message between the browser and the server to obtain first encrypted data; Call the secure socket layer module, send the encrypted pre-master key and the first encrypted data to the server, so that the server generates the symmetric key according to the pre-master key, and uses the national secret block cipher algorithm and the symmetric key to decrypt the first encrypted data, and detect whether the first handshake message obtained by decryption is complete. If the first handshake message is complete, send the second encrypted data to the browser; wherein the second encrypted data is obtained by the server using the national secret block cipher algorithm and the symmetric key to encrypt the second handshake message of the server; the second handshake message refers to the message transmitted by the browser and the server during this handshake process stored by the server; The secure socket layer module is called to receive the second encrypted data sent by the server, and the national secret block cipher algorithm and the symmetric key are used to decrypt the second encrypted data, and whether the decrypted second handshake message is complete is detected. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server.

2. The method according to claim 1, characterized in that Before calling the secure socket layer module to generate a pre-master key, generating a symmetric key based on the pre-master key, encrypting the pre-master key using a national secret public key cryptographic algorithm, and encrypting the first handshake message between the browser and the server using a national secret block cipher algorithm and the symmetric key to obtain the first encrypted data, the method further includes: Calling the secure socket layer module, sending the latest national secret protocol version number supported by the browser to the server, so that the server selects a target national secret protocol version number according to the latest national secret protocol version number, and sends the target national secret protocol version number, the server digital certificate and the certificate request to the browser; Calling the secure socket layer module to receive the target national encryption protocol version number, server digital certificate and certificate request sent by the server; The secure socket layer module is called to verify the legitimacy of the server digital certificate according to the national secret public key cryptographic algorithm corresponding to the target national secret protocol version number, and to parse the certification authority information of the client digital certificate that the server can recognize from the certificate request.

3. The method according to claim 2, characterized in that The method further comprises: Calling the secure socket layer module, reading the corresponding client digital certificate from the cryptographic device according to the certification authority information, and using the national secret hashing algorithm to hash the first handshake message to obtain hash data, and using the cryptographic device to perform a private key signature on the hash data to obtain signature data; The client digital certificate and signature data are sent to the server so that the server can verify the identity of the browser.

4. A data processing method, characterized in that: Applied to the server, including: Receive an encrypted pre-master key and first encrypted data sent by a secure socket layer module of the browser, wherein the pre-master key is generated by the browser calling the secure socket layer module, and is encrypted using a national secret public key cryptographic algorithm and then sent to the server, and the first encrypted data is obtained by the browser calling the secure socket layer module, generating a symmetric key based on the pre-master key, and using a national secret block cipher algorithm and the symmetric key to encrypt a first handshake message between the browser and the server; Generate the symmetric key according to the pre-master key, adopt the national secret block cipher algorithm, use the symmetric key to decrypt the first encrypted data, and detect whether the first handshake message obtained by decryption is complete; If the first handshake message is complete, the national secret block cipher algorithm is used, and the symmetric key is used to encrypt the second handshake message between the browser and the server to obtain second encrypted data, and the second encrypted data is sent to the browser, so that the browser can call the secure socket layer module, receive the second encrypted data, and use the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detect whether the decrypted second handshake message is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server.

5. The method according to claim 4, characterized in that Before receiving the encrypted pre-master key and the first encrypted data sent by the secure socket layer module of the browser, the method further comprises: Receive the latest national encryption protocol version number supported by the browser; The target national encryption protocol version number is selected according to the latest national encryption protocol version number, and the target national encryption protocol version number, the server digital certificate and the certificate request are sent to the browser.

6. The method according to claim 5, characterized in that The method further comprises: Receive client digital certificate and signature data; The identity of the browser is verified based on the client digital certificate and signature data.

7. A data processing device, characterized in that: Applies to browsers, including: An encryption module, used to call a secure socket layer module to generate a pre-master key, generate a symmetric key based on the pre-master key, encrypt the pre-master key using a national secret public key cryptographic algorithm, and encrypt a first handshake message between the browser and the server using a national secret block cipher algorithm and the symmetric key to obtain first encrypted data; A sending module, used to call the secure socket layer module, and send the encrypted pre-master key and the first encrypted data to the server, so that the server generates the symmetric key according to the pre-master key, and adopts the national secret block cipher algorithm and the symmetric key to decrypt the first encrypted data, and detect whether the first handshake message obtained by decryption is complete. If the first handshake message is complete, the second encrypted data is sent to the browser; wherein the second encrypted data is obtained by the server adopting the national secret block cipher algorithm and the symmetric key to encrypt the second handshake message of the server; the second handshake message refers to the message transmitted by the browser and the server during this handshake process stored by the server; The integrity detection module is used to call the secure socket layer module, receive the second encrypted data sent by the server, and adopt the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detect whether the second handshake message obtained by decryption is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server.

8. The device according to claim 7, characterized in that The device also includes: A sending module, used to generate a pre-master key in the calling secure socket layer module, generate a symmetric key based on the pre-master key, encrypt the pre-master key using a national secret public key cryptographic algorithm, and use a national secret block cipher algorithm to encrypt the first handshake message between the browser and the server using the symmetric key, and before obtaining the first encrypted data, call the secure socket layer module to send the latest national secret protocol version number supported by the browser to the server, so that the server can select a target national secret protocol version number according to the latest national secret protocol version number, and send the target national secret protocol version number, the server digital certificate and the certificate request to the browser; A receiving module, used to call the secure socket layer module to receive the target national encryption protocol version number, the server digital certificate and the certificate request sent by the server; The verification module is used to call the secure socket layer module, verify the legitimacy of the server digital certificate according to the national secret public key cryptographic algorithm corresponding to the target national secret protocol version number, and parse the certification authority information of the client digital certificate that the server can recognize from the certificate request.

9. The device according to claim 8, characterized in that The device also includes: A hash module, configured to call the secure socket layer module, read the corresponding client digital certificate from the cryptographic device according to the certification authority information, and hash the first handshake message using a national secret hash algorithm to obtain hash data, and use the cryptographic device to perform a private key signature on the hash data to obtain signature data; The certificate sending module is used to send the client digital certificate and signature data to the server so that the server can verify the identity of the browser.

10. A data processing device, characterized in that: Applied to the server, including: A receiving module, used for receiving an encrypted pre-master key and first encrypted data sent by a secure socket layer module of a browser, wherein the pre-master key is generated by the browser calling the secure socket layer module, and is encrypted by using a national secret public key cryptographic algorithm and then sent to the server, and the first encrypted data is obtained by the browser calling the secure socket layer module, generating a symmetric key according to the pre-master key, and using a national secret block cipher algorithm and the symmetric key to encrypt a first handshake message between the browser and the server; A decryption module, used to generate the symmetric key according to the pre-master key, and adopt the national secret block cipher algorithm, use the symmetric key to decrypt the first encrypted data, and detect whether the first handshake message obtained by decryption is complete; An integrity detection module is used to, if the first handshake message is complete, use the national secret block cipher algorithm and the symmetric key to encrypt the second handshake message between the browser and the server to obtain second encrypted data, and send the second encrypted data to the browser, so that the browser can call the secure socket layer module, receive the second encrypted data, and use the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detect whether the second handshake message obtained by decryption is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server.

11. The device according to claim 10, characterized in that The device also includes: A version number receiving module, used for receiving the latest national encryption protocol version number supported by the browser before receiving the encrypted pre-master key and the first encrypted data sent by the secure socket layer module of the browser; The request sending module is used to select a target national encryption protocol version number according to the latest national encryption protocol version number, and send the target national encryption protocol version number, the server digital certificate and the certificate request to the browser.

12. The device according to claim 11, characterized in that The device also includes: The certificate receiving module is used to receive the client digital certificate and signature data; The verification module is used to verify the identity of the browser according to the client digital certificate and signature data.

13. A data processing system, characterized in that: Including browser and server; The browser comprises: An encryption module, used to call a secure socket layer module to generate a pre-master key, generate a symmetric key based on the pre-master key, encrypt the pre-master key using a national secret public key cryptographic algorithm, and encrypt a first handshake message between the browser and the server using a national secret block cipher algorithm and the symmetric key to obtain first encrypted data; A sending module, used for calling the secure socket layer module, and sending the encrypted pre-master key and the first encrypted data to the server; An integrity detection module is used to call the secure socket layer module, receive the second encrypted data sent by the server, and use the national secret block cipher algorithm and the symmetric key to decrypt the second encrypted data, and detect whether the second handshake message obtained by decryption is complete. If the second handshake message is complete, it is determined that the national secret block cipher algorithm and the symmetric key are used to encrypt and decrypt data when transmitting data between the browser and the server; wherein, the second encrypted data is obtained by the server using the national secret block cipher algorithm and the symmetric key to encrypt the second handshake message of the server; the second handshake message refers to the message transmitted by the browser and the server during this handshake process stored by the server; The server includes: A receiving module, used for receiving the encrypted pre-master key and the first encrypted data sent by the secure socket layer module of the browser; A decryption module, used to generate the symmetric key according to the pre-master key, and adopt the national secret block cipher algorithm, use the symmetric key to decrypt the first encrypted data, and detect whether the first handshake message obtained by decryption is complete; The integrity detection module is used to, if the first handshake message is complete, adopt the national secret block cipher algorithm and use the symmetric key to encrypt the second handshake message between the browser and the server to obtain second encrypted data, and send the second encrypted data to the browser.

14. The system according to claim 13, characterized in that include: The browser comprises: A sending module, configured to generate a pre-master key when calling the secure socket layer module, generate a symmetric key based on the pre-master key, encrypt the pre-master key using a national secret public key cryptographic algorithm, and encrypt a first handshake message between the browser and the server using a national secret block cipher algorithm and the symmetric key, and before obtaining the first encrypted data, call the secure socket layer module to send the latest national secret protocol version number supported by the browser to the server; A receiving module, used to call the secure socket layer module and receive the target national encryption protocol version number, the server digital certificate and the certificate request sent by the server; A verification module, used to call the secure socket layer module, verify the legitimacy of the server digital certificate according to the national secret public key cryptographic algorithm corresponding to the target national secret protocol version number, and parse the certification authority information of the client digital certificate that can be recognized by the server from the certificate request; The server includes: A version number receiving module, used for receiving the latest national encryption protocol version number supported by the browser before receiving the encrypted pre-master key and the first encrypted data sent by the secure socket layer module of the browser; The request sending module is used to select a target national encryption protocol version number according to the latest national encryption protocol version number, and send the target national encryption protocol version number, the server digital certificate and the certificate request to the browser.

15. The system according to claim 14, characterized in that include: The browser comprises: A hash module, configured to call the secure socket layer module, read the corresponding client digital certificate from the cryptographic device according to the certification authority information, and hash the first handshake message using a national secret hash algorithm to obtain hash data, and use the cryptographic device to perform a private key signature on the hash data to obtain signature data; A certificate sending module, used to send the client digital certificate and signature data to the server, so that the server can verify the identity of the browser; The server includes: The certificate receiving module is used to receive the client digital certificate and signature data; The verification module is used to verify the identity of the browser according to the client digital certificate and signature data.

16. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor is used to implement the steps of the data processing method described in any one of claims 1 to 3 when executing a program stored in a memory.

17. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor is used to implement the steps of the data processing method described in any one of claims 4 to 6 when executing a program stored in a memory.

18. A readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the data processing method as described in one or more of method claims 1-3.

19. A readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the data processing method as described in one or more of method claims 4-6.

Images