Message push system and method

Abstract

The present application discloses a message push system, including: a smart terminal, which is used to generate a carrier identifier and an asymmetric key, and send a user identifier, the carrier identifier and a public key in the asymmetric key; a server, which is used to receive the user identifier, the carrier identifier and the public key in the asymmetric key to establish an association relationship between the three; the server is also used to encrypt a message based on the public key and send the encrypted message, and the smart terminal receives the encrypted message after the corresponding user logs in, and uses the private key in the asymmetric key to decrypt the received encrypted message. According to an embodiment of the present invention, the server pushes encrypted messages to the smart terminal via the Internet, which helps to reduce costs, and the encrypted message helps to reduce message leakage.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a message push system and method. Background Art

[0002] Short message push is an important operating method for mobile products and is widely used in financial transactions such as daily payment, identity verification, and account information reminders in the financial industry. However, the short message push method relies on the SMS channel provided by the operator, so financial companies need to invest a lot of money in the use of short messages every year. Therefore, in recent years, financial companies have begun to use Internet communications to push messages to various applications in smart terminals. This method does not require operators to provide SMS channels, so the cost can be greatly reduced. However, due to the complexity and diversity of network links, during the message push process, it may be stolen by a third party, resulting in message leakage. For example, if the message is pushed directly in plain text, the fake base station "GSM hijacking + SMS sniffing technology" can obtain the message content in real time, which may lead to network fraud and security risks.

[0003] Therefore, it is desirable to propose a safer message push method and system for this scenario. Summary of the invention

[0004] In view of the above problems, an object of the present invention is to provide a message push system and method with higher security.

[0005] According to a first aspect of an embodiment of the present invention, a message push system is provided, including:

[0006] A client, deployed in a smart terminal, for generating a carrier identification and obtaining a private key in an asymmetric key of the smart terminal based on the carrier identification, wherein the asymmetric key includes a public key and a private key;

[0007] A server, deployed on the server, for establishing a relationship between the carrier identifier and the public key;

[0008] The server is also used to encrypt a message based on the public key and send the encrypted message. After the corresponding user logs in, the client receives the encrypted message and decrypts the received encrypted message using the private key.

[0009] Optionally, the smart terminal includes a security unit, and the smart terminal stores the private key in the security unit.

[0010] Optionally, the client generates the carrier identifier and the asymmetric key in the security unit; and / or

[0011] The client performs, in the security unit, the operation of decrypting the received encrypted message using the private key.

[0012] Optionally, the client generates the carrier identifier, and sends the carrier identifier to the server, so that the server generates the asymmetric key.

[0013] Optionally, the client includes an eID client and a business application client, and the server includes an eID server and a business application server.

[0014] The eID client and the eID server collaborate to establish a relationship between the carrier identifier and the asymmetric key;

[0015] The service application client is used to obtain the carrier identification from the eID client, obtain the private key according to the carrier identification, and decrypt the received encrypted message.

[0016] The business application server is used to obtain the carrier identification from the eID server, obtain the public key according to the carrier identification, and use the public key to encrypt the message.

[0017] Optionally, the eID service composed of the eID client and the eID server is independent of the application service composed of the business application client and the business application server, and the eID service can only be used after the application service is bound to the eID service.

[0018] Optionally, multiple users of the application service use the same asymmetric key.

[0019] Optionally, the service application server and the service application client negotiate a session key using the asymmetric key, and:

[0020] The business application server encrypts a message based on the session key and sends the encrypted message. After the corresponding user logs in, the business application client receives the encrypted message and decrypts the received encrypted message using the session key.

[0021] Optionally, the business application server and the business application client negotiate a session key using the asymmetric key, including:

[0022] The business application server sends a second random number encrypted by the public key to the business application client. The business application client decrypts the encrypted second random number based on the private key in the asymmetric key and uses the second random number as the session key.

[0023] Optionally, the business application server and the business application client negotiate a session key using the asymmetric key, including:

[0024] The business application client generates and sends a first random number, the business application server generates a second random number and sends the second random number encrypted by the public key, and the business application client decrypts the encrypted second random number using the private key to obtain the second random number.

[0025] The business application client and the business application server respectively calculate the first random number and the second random number by setting formulas to obtain the session key.

[0026] Optionally, before the service application client and the service application server calculate the first random number and the second random number by setting a formula to obtain the session key, the service application client and the service application server further include:

[0027] The business application client calculates the session key by setting a formula and sends the result to the business application server. The business application server obtains the session key from the result and compares it with the session key obtained locally based on the first random number and the second random number, and determines whether the session key is correct based on the result.

[0028] Optionally, the business application client does not store the session key. When sending an encrypted message, the business application server encrypts the session key into a digital envelope and pushes it to the business application client, so that the business application client can retrieve the session key from the digital envelope and decrypt the encrypted message.

[0029] Optionally, the server also includes: a message push service to execute message sending and message receiving.

[0030] Optionally, the eID service consisting of the eID client and the eID server, the application service consisting of the business application client and the business application server, and the message push service are provided by different service providers.

[0031] According to a second aspect of an embodiment of the present invention, a message push method is provided, involving a client and a server, wherein the client includes an eID client and a service application client, and the server includes an eID server and a service application server.

[0032] The eID client and the eID server collaborate to establish a relationship between the carrier identifier and the asymmetric key;

[0033] The service application client is used to obtain the carrier identification from the eID client, obtain the private key according to the carrier identification, and decrypt the received encrypted message.

[0034] The business application server is used to obtain the carrier identification from the eID server, obtain the public key according to the carrier identification, and use the public key to encrypt the message.

[0035] Optionally, the eID service composed of the eID client and the eID server is independent of the application service composed of the business application client and the business application server, and the eID service can only be used after the application service is bound to the eID service.

[0036] Optionally, the service application server and the service application client negotiate a session key using the asymmetric key, and:

[0037] The business application server encrypts a message based on the session key and sends the encrypted message. After the corresponding user logs in, the business application client receives the encrypted message and decrypts the received encrypted message using the session key.

[0038] Optionally, the business application server and the business application client negotiate a session key by using the asymmetric key to encrypt and decrypt messages, including:

[0039] The business application server sends a second random number encrypted by the public key to the business application client. The business application client decrypts the encrypted second random number based on the private key in the asymmetric key and uses the second random number as the session key.

[0040] Optionally, the business application server and the business application client negotiate a session key using the asymmetric key, including:

[0041] The business application client generates and sends a first random number, the business application server generates a second random number and sends the second random number encrypted by the public key, and the business application client decrypts the encrypted second random number using the private key to obtain the second random number.

[0042] The business application client and the business application server respectively calculate the first random number and the second random number by setting formulas to obtain the session key.

[0043] Optionally, the business application client does not store the session key. When sending an encrypted message, the business application server encrypts the session key into a digital envelope and pushes it to the business application client, so that the business application client can retrieve the session key from the digital envelope and decrypt the encrypted message.

[0044] The embodiments of the present invention have the following advantages:

[0045] First, the server and the smart terminal transmit messages through the Internet without using SMS channels, which helps to reduce costs and prevent message leakage by encrypting messages. The message encryption methods include but are not limited to asymmetric keys, symmetric keys, digital envelopes, etc.;

[0046] Second, use physical-level security chips to store sensitive data, and rely on security chips to perform operations on sensitive data. Sensitive data includes but is not limited to keys, facial information, ID card information, and fingerprint information;

[0047] Third, when the application user logs in, a liveness and authentication test is required to ensure that the encrypted message can only be decrypted by the user himself, ensuring the accurate delivery of the message.

[0048] Fourth, as an independent service, each application can access the eID service to achieve secure storage and encryption and decryption of passwords, and it is very convenient and quick to implement. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The above and other objects, features and advantages of the present invention will become more apparent through the following description of the embodiments of the present invention with reference to the accompanying drawings, in which:

[0050] Figure 1 A system structure diagram showing an exemplary message push system according to an embodiment of the present invention;

[0051] Figure 2 yes Figure 1 The interaction diagram of the smart terminal and the server in the message push system shown;

[0052] Figure 3 is a system structure diagram of another exemplary message push system provided by an embodiment of the present invention;

[0053] Figure 4A yes Figure 3 An exemplary interaction diagram between the eID client and the eID server in FIG.

[0054] Figure 4B yes Figure 3 Another exemplary interaction diagram between the eID client and the eID server in

[0055] Figure 4C yes Figure 3 Interaction diagram of the business application client, eID client, security unit and business application server in ;

[0056] Figure 5 yes Figure 3 The interaction diagram of the business application server, message push service and business application client in ;

[0057] Figure 6 Shows Figure 3 A more detailed interaction diagram of multiple applications in ;

[0058] Figure 7 Shows Figure 3 An interactive diagram of key negotiation performed by multiple applications in order to obtain a session key;

[0059] Figure 8 Shows Figure 3 Interaction diagram of the business application server and eID server generating a digital envelope;

[0060] Fig. 9 Shows Figure 3 Interaction diagram of multiple applications in which digital envelopes are used to communicate. DETAILED DESCRIPTION

[0061] Various embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. In each of the accompanying drawings, identical elements are represented by identical or similar reference numerals. For the sake of clarity, the various parts in the accompanying drawings are not drawn to scale. In addition, some well-known parts may not be shown in the drawings.

[0062] The terms used herein are only used to describe specific embodiments, and unless clearly indicated in the context, the terms themselves are not used to limit the disclosure of this application. In order to clearly describe specific embodiments, only exemplary descriptions of some terms are given below.

[0063] the term

[0064] "Smart terminals" include but are not limited to mobile phones, mobile computers, tablet computers, personal digital assistants (PDAs), media players, smart TVs, smart watches, smart glasses, smart bracelets, etc.

[0065] "Operating System" (OS) is a computer program that manages computer hardware and software resources, and is the core and cornerstone of the computer system.

[0066] "Secure Element" (SE) is an electronic component with anti-tampering function, which can be installed on smart terminals to provide a secure and confidential data storage and operation environment. By extension, any hardware device that provides storage space for installing applications and has installed application management functions can be regarded as a security unit. For example, a smartphone with an Android system can install third-party applications, and the Android operating system can manage these third-party applications and provide certain protection, so it can be regarded as a generalized security unit. SE is composed of software and anti-tampering hardware, supports high-level security, such as SIM cards, financial IC cards, smart SD cards, etc., and can run with TEE.

[0067] "Business application client" and "business application server". Business application client and business application server are deployed in conjunction with each other to complete specific business processing through their respective functions and the interaction between them. The business processing includes mobile banking, e-commerce online shopping, online fund handling, online voting, etc. Business application client generally provides a GUI interface and interacts with users through the GUI interface.

[0068] eID: Electronic Citizen Identity, the Chinese name is "Citizen Network Electronic Identity". In the present invention, the eID service involves the eID client and the eID server, which are mainly used to process eID-related services such as identity verification and password-related algorithms.

[0069] Carrier ID: The carrier ID is used to uniquely represent a smart terminal.

[0070] The specific implementation of the present invention is further described in detail below in conjunction with the drawings and examples.

[0071] Figure 1 The system structure diagram of the message push system according to the embodiment of the present invention is shown. As shown in the figure, the message push system includes a smart terminal 110 and a server 120 connected via a network 130 .

[0072] The server 120 is a dedicated computer system that provides services to smart terminals in a network environment by a service provider (SP). The server 120 includes but is not limited to a CISC (complex instruction set) architecture server, a RISC (reduced instruction set) architecture server, and an EPIC architecture server. For example, services include: online banking, online business, online education, online voting, etc.

[0073] The smart terminal 110 is a communication device that can be used in a mobile state. The smart terminal 110 includes, but is not limited to, a mobile phone, a mobile computer, a tablet computer, a personal digital assistant (PDA), a media player, a smart TV, a smart watch, smart glasses, a smart bracelet, etc. The smart terminal 110 supports a variety of application services, which can be deployed on the same server or on multiple servers. For example, in the application scenario of mobile banking, the smart terminal 110 is, for example, a smart phone used by a user, the service provider of the server 120 is, for example, a bank, and the application services are, for example, online inquiries, transfers, password management, etc. provided by the bank.

[0074] The network 130 is one or a combination of various communication technologies based on exchanged signals, including but not limited to wired technologies using electrical and / or optical transmission cables, and wireless technologies using infrared, radio frequency and / or other forms. In different application scenarios, the network 130 can be the Internet, a wide area network or a local area network, such as a company's proprietary network. The network 130 can also be a wired network or a wireless network.

[0075] During the message push process, the server deployed on the server 120 encrypts the message with a key and pushes it to the client on the smart terminal 110, and the client deployed on the smart terminal 110 decrypts it with the key. The encryption and decryption algorithms used by the client of the server 120 and the server of the smart terminal 110 include but are not limited to symmetric key algorithms and asymmetric key algorithms.

[0076] Figure 2 yes Figure 1 The interaction diagram of the smart terminal and the server in the message push system shown in FIG. As shown in the figure, in step S21, the client deployed on the smart terminal 110 generates a carrier identifier and an asymmetric key.

[0077] In step S22 , the client of the smart terminal 110 sends the carrier identifier and the public key in the asymmetric key to the server 120 .

[0078] In step S23 , the service end of the server 120 establishes a relationship between the carrier identifier and the public key in the asymmetric key, that is, stores the association relationship between the carrier identifier and the public key in the asymmetric key in the server 120 .

[0079] In step S24, the server 120 encrypts the message using a public key.

[0080] In step S25 , the service end of the server 120 sends the encrypted message to the client end of the smart terminal 110 .

[0081] In step S26, after the corresponding user logs in, the client of the smart terminal 110 receives the encrypted message and decrypts the message using the private key.

[0082] In this embodiment, a public key and a private key are generated in the smart terminal, and the public key and the carrier identifier are passed to the server, and the server stores the relationship data. When the server needs to push a message to the smart terminal later, the server sends a message encrypted based on the public key. After the corresponding user logs in, the smart terminal can receive the pushed encrypted message and obtain the private key using the relationship data stored on the smart terminal. The private key is used to decrypt the encrypted message, thereby completing the message push from the server to the smart terminal. Since the message pushed by the server to the smart terminal is no longer in plain text, it helps prevent a third party from stealing the message. Alternatively, in this embodiment, the server can also generate an asymmetric key for the smart terminal on the server and push the asymmetric key to the smart terminal.

[0083] It should be understood that, usually, a smart terminal has only one carrier identification in use. In this case, an asymmetric key can be generated for the smart terminal, and multiple applications deployed on the same smart terminal use the same set of asymmetric keys, so that multiple application service identifications correspond to the same carrier identification and correspond to a set of asymmetric keys at the same time. However, this is not necessary in the embodiments of the present invention. For example, asymmetric keys can also be generated for applications and / or users. Specifically, for example, multiple applications of the same smart terminal use different asymmetric keys for different applications, but multiple users under the same application use the same asymmetric key. For another example, multiple users of the same application of the same smart terminal use different asymmetric keys for different users. However, when designed in this way, the smart terminal and the server should also store the relationship data about at least two of the carrier identification, user identification, application identification and asymmetric key accordingly.

[0084] Figure 3 It is a system structure diagram of another exemplary message push system provided by an embodiment of the present invention.

[0085] As shown in the figure, the functional modules of the client of the smart terminal 110 are the business application client 1101 and the eID client 1102 , and the functional modules of the service end on the server 120 are the eID server 1201 , the business application server 1202 and the message push service 1203 .

[0086] The eID service (including the eID server 1201 and the eID client 1102) mainly performs security-related operations such as identity authentication, password management, encryption and decryption. The business application client 1101 and the business application server 1202 provide business processing, such as transfer, deposit and loan, account query and other functions in mobile banking. The message push service 1203 is mainly responsible for pushing messages. Usually, business processing, eID services and message push services are provided by different service providers. In order to achieve collaboration, each service provider will open a part of the public interface to facilitate other service providers to use the functions they provide.

[0087] In some embodiments, the smart terminal 110 is deployed with a physical-level security unit SE. A chip operating system (Chip Operating System) may be deployed in the security unit SE, and the security unit SE may also include a communication module, through which the security unit SE may send messages to other applications deployed within the smart terminal and outside the security unit or receive messages from other applications. The security unit SE may also include some applets for performing some functions with high security requirements in the security unit SE, such as identity authentication, digital signature verification, etc. The operating system of the smart terminal usually includes an SE driver to achieve communication capabilities with the security unit SE. The security unit SE may also open an SE access interface so that other applications in the smart terminal can access the functions therein. In addition, the security unit SE may also store some sensitive information and perform some operations involving sensitive data, such as identity card information, face information, basic personal information, fingerprint information, carrier identification, key, digital certificate, etc. The application may send a request to the eID client 1102 to require the eID client 1102 to perform operations such as password generation, encryption and decryption, identity authentication, etc., and return the result.

[0088] Figure 4A yes Figure 3 An exemplary interaction diagram between the eID client and the eID server in FIG. As shown in the figure, in step S401, the eID client 1102 generates an asymmetric key and a carrier identifier in the security unit.

[0089] In step S402 , the eID client 1102 sends the public key and the carrier identifier to the eID server 1201 .

[0090] In step S403, the eID server 1201 stores the association relationship between the public key and the carrier identifier.

[0091] Figure 4B yes Figure 3Another exemplary interaction diagram between the eID client and the eID server in FIG. As shown in the figure, in step S451, the eID client 1102 generates a carrier identification in the security unit.

[0092] In step S452 , the eID client 1102 sends the carrier identification to the eID server 1201 .

[0093] In step S453, the eID server 1201 generates an asymmetric key for the smart terminal and stores the association between the public key and the carrier identifier.

[0094] In step S454 , the eID server 1201 sends the private key to the eID client 1102 .

[0095] In step S455, the relationship data between the carrier identification and the private key is stored in the security unit.

[0096] Figure 4C yes Figure 3 The interaction diagram of the business application client, eID client, security unit and business application server is shown.

[0097] In step S412 , the service application client 1301 requests a carrier identification from the eID client 1102 .

[0098] In step S413, the eID client 1102 requests a carrier identification from the security unit.

[0099] In step S414 , the security unit returns the carrier identification to the eID client 1102 .

[0100] The operations of steps S413 and S414 are, for example: the carrier identification is stored in the security unit as sensitive data, and the security unit provides an interface for obtaining the carrier identification, so that the eID client 1102 can obtain the carrier identification from the security unit.

[0101] In step S415 , the eID client 1102 returns the carrier identification to the service application client 1301 .

[0102] In step S416 , the service application client 1301 sends the carrier information and the user identification to the service application server 1202 .

[0103] In step S417, the business application server 1202 stores the relationship between the user identifier and the carrier identifier.

[0104] In step S418 , the business application server 1202 returns the binding result to the business application client 1301 .

[0105] based on Figure 4A-4CIn the embodiment shown, the client of the smart terminal and the server establish the association between the user, the carrier identifier and the key twice. First, the eID client and the eID server establish the association between the carrier identifier and the key; then the business application client and the business application server establish the association between the user and the carrier identifier. In this way, the eID service can exist independently of the application service. When the application service needs the eID service, the application service is bound to the eID service or the user of the application service is bound to the eID service. This method is conducive to the expansion of application services.

[0106] In some embodiments, when a user logs in to the business application client 1301 for the first time using the eID method, the user identifier is bound to the carrier identifier of the smart terminal. In some embodiments, when a user logs in to the business application client 1301 for the first time using the eID method, the business application client 1301 prompts the user to fill in personal information by face entry, fingerprint entry, form entry, etc., and then generates a user identifier and binds the user identifier to the carrier identifier of the smart terminal. When the user subsequently logs in to the business application client 1301 by eID, it is verified by face recognition, fingerprint recognition, password recognition, etc. If it passes, it means that the login is successful. Only under the condition of successful login can the user receive encrypted messages.

[0107] Figure 5 yes Figure 3 The interaction diagram of the business application server, the message push service and the business application client is shown. As shown in the figure, in step S501, the business application server 1202 encrypts the message using the public key.

[0108] In step S502 , the business application server 1202 pushes the encrypted message to the message push service 1203 .

[0109] In step S503 , the message push service 1203 pushes the encrypted message to the business application client 1301 .

[0110] In step S504, the service application client 1301 uses the private key to decrypt the encrypted message. Specifically, if the smart terminal includes a security unit SE, the encrypted message can be provided to the SE for decryption. Otherwise, if the smart terminal does not include a security unit SE, the private key is extracted by itself for decryption.

[0111] In step S505 , the business application client 1301 returns the result to the message push service 1203 .

[0112] In step S506 , the message push service 1203 returns the result to the business application server 1202 .

[0113] Figure 6 Shows Figure 3 A more detailed interaction diagram of the multiple applications shown.

[0114] In step S601, the business application server 1202 obtains a carrier identification.

[0115] In step S602 , the business application server 1202 calls the encryption interface provided by the eID server 1201 to provide a plaintext message to the eID server 1201 .

[0116] In step S603, the eID server 1201 encrypts the message.

[0117] In step S604 , the eID server 1201 returns an encrypted message to the business application server 1202 .

[0118] In step S605 , the business application server 1202 pushes the encrypted message to the message push service 1203 .

[0119] In step S606 , the message push service 1203 pushes the encrypted message to the business application client 1301 .

[0120] In step S607 , the service application client 1301 provides the encrypted message to the eID client 1302 .

[0121] In step S608 , the eID client 1302 calls a decryption interface to provide the encrypted message to the security unit.

[0122] In step S609, the security unit decrypts the encrypted message.

[0123] In step S610 , the security unit returns the plain text message to the eID client 1302 .

[0124] In step S611 , the eID client 1302 returns a plain text message to the service application client 1301 .

[0125] In step S612 , the business application client 1301 returns the result to the message push service 1203 .

[0126] In step S613 , the message push service 1203 returns the result to the business application server 1202 .

[0127] In the above embodiment, the intelligent terminal and the server transmit encrypted messages and encrypt and decrypt them using asymmetric keys. Figure 7 In the illustrated embodiment, a service application client of the intelligent terminal and a service application server on the server perform key negotiation to obtain a symmetric session key for communication.

[0128] like Figure 7 As shown, in step S701 , the business application client 1301 generates a random number R1 .

[0129] In step S702 , the business application client 1301 sends a request to the business application server 1202 to transfer R1 to the business application server 1202 .

[0130] In step S703, the business application server 1202 generates a random number R2.

[0131] In step S704 , the business application server 1202 sends R2 to the eID server 1201 .

[0132] In step S705, the eID server 1201 searches for the public key to encrypt R2 and obtains the ciphertext R2'.

[0133] In step S706 , the eID server 1201 returns an encrypted message R2 ′ to the business application server 1202 .

[0134] In step S707 , the business application server 1202 calculates the session key K=cal(R1, R2).

[0135] In step S708 , the business application server 1202 returns R2 ′ to the business application client 1301 .

[0136] In step S709, R2' is decrypted to obtain R2. The decryption method is generally to provide R2' to the eID client 1302, and the eID client 1302 decrypts it through the interface of the security unit.

[0137] In step S710 , the service application client 1301 calculates the session key K′=cal(R1, R2).

[0138] In step S711, the business application client 1301 generates a random number R3, and uses the key K' to assemble a verification request, that is, cal(K',R3)ⅡR3, where cal(K',R3) is similar to f(K',R3)+R3, f is a function that the application client and the application service negotiate to use, and ⅡR3 represents the concatenation of the above calculation result with R3.

[0139] In step S712 , the business application client 1301 sends a verification request to the business application server 1202 .

[0140] In step S713, the business application server 1202 uses the session key K to calculate the result with the same algorithm and compares it with the verification request. Specifically, after receiving the request, the business application server 1202 splits the request message into a verification code and a random number R3, encrypts R3 with the session key K, and compares the result with the verification code. If the two are consistent, it means that the key negotiation is successful.

[0141] In step S714 , the business application server 1202 returns the verification result to the business application client 1301 .

[0142] It should be noted that the above embodiment can be simplified. For example, the business application server generates a random number R2, and then sends the encrypted R2' to the business application client. The business application client decrypts R2' to obtain R2. At this time, both the business application server and the business application client have the random number R2, and R2 can be directly used as the session key. For another example, when both the business application server and the business application client have R1 and R2, R3 can be omitted, and the same formula can be directly used to obtain K=cal(R1, R2), and the calculation result K is used as the session key.

[0143] In addition, it should be noted that in actual applications, in the above steps S710 and S711, the calculation method of the key K' and the key verification request packet is not limited to the method and steps described, and can be defined independently according to the developer's own needs.

[0144] According to this embodiment, after the symmetric session key is negotiated, the message can be encrypted and decrypted based on the session key. The process is similar to Figure 5 As shown (the public key is replaced with the session key generated in this embodiment). In addition, it should be pointed out that the session key is an application-level key, and is generally stored in one copy each on the business application client and the business application server. When the session key is subsequently used for communication, there is no need to perform encryption and decryption operations on the eID client and the eID server, so the execution efficiency is higher.

[0145] In some embodiments, by using a digital envelope, the business application client 1301 does not need to store the session key, which further enhances security. Figure 8 The process of using digital envelopes for communication is as follows Fig. 9 shown.

[0146] In step S801, the business application server 1202 generates a session key and searches for a carrier identifier.

[0147] In step S802 , the business application server 1202 sends a request for generating a digital envelope to the eID server 1201 .

[0148] In step S803, the eID server 1201 searches for the public key to encrypt the session key and generates a digital envelope.

[0149] In step S804 , the eID server 1201 sends a digital envelope to the business application server 1202 .

[0150] In step S805, the business application server 1202 takes out the session key from the digital envelope and saves the session key and the digital envelope.

[0151] refer to Fig. 9 As shown, in step S901, the business application server 1202 encrypts the message using the session key.

[0152] In step S902 , the business application server 1202 pushes the encrypted message and the digital envelope together to the message push service 1203 .

[0153] In step S903 , the message push service 1203 pushes the encrypted message and the digital envelope together to the business application client 1301 .

[0154] In step S904 , the service application client 1301 sends a decryption request to the eID client 1302 .

[0155] In step S905 , the eID client 1302 calls the decryption interface opened by the security unit.

[0156] In step S906, the security unit decrypts the digital envelope using the private key.

[0157] In step S907 , the security unit sends the plaintext session key to the eID client 1302 .

[0158] In step S908 , the eID client 1302 sends the plaintext session key to the service application client 1301 .

[0159] In step S909 , the service application client 1301 decrypts the message using the session key.

[0160] In step S910 , the business application client 1301 returns a result to the message push service 1203 .

[0161] In step S911 , the message push service 1203 returns a result to the business application server 1202 .

[0162] According to this embodiment, the business application server uses the session key to encrypt the pushed message, and sends it together with the digital envelope and the ciphertext message to the push service. After the business application client 1301 receives the message, it first uses the eID client to open the digital envelope to obtain the session key, and then the business application client 1301 uses the session key to decrypt the ciphertext message to obtain the plaintext message.

[0163] Based on various embodiments of the present invention, the present invention has the following advantages:

[0164] First, the server and the smart terminal transmit messages through the Internet without using SMS channels, which helps to reduce costs and prevent message leakage by encrypting messages. The message encryption methods include but are not limited to asymmetric keys, symmetric keys, digital envelopes, etc.;

[0165] Second, use physical-level security chips to store sensitive data, and rely on security chips to perform operations on sensitive data. Sensitive data includes but is not limited to keys, facial information, ID card information, and fingerprint information;

[0166] Third, when the application user logs in, a liveness and authentication test is required to ensure that the encrypted message can only be decrypted by the user himself, ensuring the accurate delivery of the message.

[0167] Fourth, as an independent service, each application can access the eID service to achieve secure storage and encryption and decryption of passwords, and it is very convenient and quick to implement.

[0168] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0169] According to the embodiments of the present invention as described above, these embodiments do not describe all the details in detail, nor do they limit the invention to the specific embodiments described. Obviously, many modifications and changes can be made based on the above description. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can make good use of the present invention and the modified use based on the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A message push system, comprising: A client, deployed in a smart terminal, for generating a carrier identification and obtaining a private key in an asymmetric key of the smart terminal based on the carrier identification, wherein the asymmetric key includes a public key and a private key; A server, deployed on the server, for establishing a relationship between the carrier identifier and the public key; The server is also used to encrypt a message based on the public key and send the encrypted message. After the corresponding user logs in, the client receives the encrypted message and decrypts the received encrypted message using the private key. The client includes an eID client and a business application client, the server includes an eID server and a business application server, the eID service composed of the eID client and the eID server is independent of the application service composed of the business application client and the business application server, the eID client and the eID server collaborate to establish the relationship between the carrier identifier and the asymmetric key, the eID client stores the carrier identifier and the private key, the eID server stores the association relationship between the public key and the carrier identifier, and the application service can only use the eID service after being bound to the eID service, wherein, The binding of the application service with the eID service includes: the eID client provides the carrier identifier to the business application client, the business application client sends the carrier identifier and the user identifier to the business application server, and the business application server stores the relationship between the user identifier and the carrier identifier.

2. The message push system according to claim 1, wherein: The smart terminal includes a security unit, and the smart terminal stores the private key in the security unit.

3. The message push system according to claim 2, wherein: The client generates the carrier identification and the asymmetric key in the security unit; and / or The client performs, in the security unit, the operation of decrypting the received encrypted message using the private key.

4. The message push system according to claim 2, wherein: The client generates the carrier identifier and sends the carrier identifier to the server so that the server can generate the asymmetric key.

5. The message push system according to claim 1, wherein: The service application client is used to obtain the carrier identification from the eID client, obtain the private key according to the carrier identification, and decrypt the received encrypted message. The business application server is used to obtain the carrier identification from the eID server, obtain the public key according to the carrier identification, and use the public key to encrypt the message.

6. The message push system according to claim 5, wherein: Multiple users of the application service use the same asymmetric key.

7. The message push system according to claim 5, wherein: The service application server and the service application client negotiate a session key using the asymmetric key, and, The business application server encrypts a message based on the session key and sends the encrypted message. After the corresponding user logs in, the business application client receives the encrypted message and decrypts the received encrypted message using the session key.

8. The message push system according to claim 7, wherein: The service application server and the service application client negotiate a session key using the asymmetric key, including: The business application server sends a second random number encrypted by the public key to the business application client. The business application client decrypts the encrypted second random number based on the private key in the asymmetric key and uses the second random number as the session key.

9. The message push system according to claim 7, wherein: The service application server and the service application client negotiate a session key using the asymmetric key, including: The business application client generates and sends a first random number, the business application server generates a second random number and sends the second random number encrypted by the public key, and the business application client decrypts the encrypted second random number using the private key to obtain the second random number. The business application client and the business application server respectively calculate the first random number and the second random number by setting formulas to obtain the session key.

10. The message push system according to claim 9, wherein: Before the business application client and the business application server calculate the first random number and the second random number by setting a formula to obtain the session key, the method further includes: The business application client calculates the session key by setting a formula and sends the result to the business application server. The business application server obtains the session key from the result and compares it with the session key obtained locally based on the first random number and the second random number, and determines whether the session key is correct based on the result.

11. The message push system according to any one of claims 7 to 10, wherein: The business application client does not store the session key. When sending an encrypted message, the business application server encrypts the session key into a digital envelope and pushes it to the business application client so that the business application client can retrieve the session key from the digital envelope and decrypt the encrypted message.

12. The message push system according to claim 5, wherein: The server also includes: a message push service to execute message sending and message receiving.

13. The message push system according to claim 12, wherein: The eID service consisting of the eID client and the eID server, the application service consisting of the business application client and the business application server, and the message push service are provided by different service providers.

14. A message push method, involving a client and a server, wherein the client includes an eID client and a service application client, and the server includes an eID server and a service application server, wherein the eID service composed of the eID client and the eID server is independent of the application service composed of the service application client and the service application server, The eID client and the eID server collaborate to establish a relationship between a carrier identifier and an asymmetric key, the eID client stores the carrier identifier and a private key of the asymmetric key, and the eID server stores an association relationship between the carrier identifier and a public key of the asymmetric key; The eID service can be used only after the application service is bound to the eID service. The binding of the application service to the eID service includes: The eID client provides the carrier identifier to the service application client, the service application client sends the carrier identifier and the user identifier to the service application server, and the service application server stores the relationship between the user identifier and the carrier identifier; The service application client obtains the carrier identification from the eID client, obtains the private key according to the carrier identification, and decrypts the received encrypted message; as well as The business application server obtains the carrier identification from the eID server, obtains the public key according to the carrier identification, and uses the public key to encrypt the message.

15. The message push method according to claim 14, wherein: The service application server and the service application client negotiate a session key using the asymmetric key, and, The business application server encrypts a message based on the session key and sends the encrypted message. After the corresponding user logs in, the business application client receives the encrypted message and decrypts the received encrypted message using the session key.

16. The message push method according to claim 15, wherein: The service application server and the service application client negotiate a session key by using the asymmetric key to encrypt and decrypt messages, including: The business application server sends a second random number encrypted by the public key to the business application client. The business application client decrypts the encrypted second random number based on the private key in the asymmetric key and uses the second random number as the session key.

17. The message push method according to claim 15, wherein the business application server and the business application client negotiate a session key using the asymmetric key, comprising: The business application client generates and sends a first random number, the business application server generates a second random number and sends the second random number encrypted by the public key, and the business application client decrypts the encrypted second random number using the private key to obtain the second random number. The business application client and the business application server respectively calculate the first random number and the second random number by setting formulas to obtain the session key.

18. The message push method according to claim 15, wherein: The business application client does not store the session key. When sending an encrypted message, the business application server encrypts the session key into a digital envelope and pushes it to the business application client so that the business application client can retrieve the session key from the digital envelope and decrypt the encrypted message.

Images