A message transmission method and system based on end-to-end encryption

Abstract

This invention provides a message transmission method and system based on end-to-end encryption. The method includes: an encryption preparation phase, an encryption channel construction phase, and a message transmission phase. The encryption channel construction phase includes: endpoint A obtaining endpoint B's public key from the server and generating an SM4 algorithm key locally. Endpoint A uses endpoint B's public key to encrypt the SM4 algorithm key and the message channel connection request to obtain first encrypted information, which is then pushed to endpoint B by the server. Endpoint B decrypts the first encrypted information using its private key. If decryption is successful, endpoint B selects whether to agree to endpoint A's message channel connection request. If agreed, endpoint B saves endpoint A's SM4 algorithm key locally and uses this key to encrypt a confirmation response header to obtain second encrypted information, which is then pushed to endpoint A by the server. Endpoint A decrypts the second encrypted information. If decryption is successful and an confirmation response is received, the message channel connection is successful.

Description

Technical Field

[0001] This invention relates to the field of communication security technology, and in particular to a message transmission method and system based on end-to-end encryption. Background Technology

[0002] Currently, there are encryption algorithms designed for specific scenarios, such as the asymmetric encryption algorithm used in SSH connections. In this algorithm, the user generates a public / private key pair locally and then manually uploads the public key to the server to establish the connection, thus ensuring encrypted message transmission. However, this method is clearly unsuitable for application scenarios like user chat, where manually exchanging keys for symmetric / asymmetric encryption algorithms would obviously lead to many problems. Similarly, HTTPS certificate encryption algorithms guarantee the security of HTTPS message transmission. HTTPS itself guarantees the security of message transmission, but this security is not inherent to the application itself; rather, it encrypts messages for a specific service and involves third-party CA certificates (trust chain issues). Therefore, if developers want the messages transmitted by the application itself to be secure, HTTPS cannot achieve this. Summary of the Invention

[0003] To address network security issues during message transmission at the application level, this invention provides a message transmission method and system based on end-to-end encryption. This method and system prevents transmitted messages from being eavesdropped on, modified, or forged by malicious hackers on the network transmission line, thereby ensuring the secure transmission of core secrets.

[0004] On the one hand, the present invention provides a message transmission method based on end-to-end encryption, including: an encryption preparation stage, an encryption channel construction stage, and a message transmission stage;

[0005] Encryption preparation phase:

[0006] Endpoint users register on the server and generate their own public / private key pair using the SM2 algorithm. They then send the public key to the server for persistent storage so that other endpoint users on the network can view it, while the private key is stored locally on the endpoint.

[0007] Encrypted channel construction phase:

[0008] The endpoints of the two communicating parties are denoted as endpoint A and endpoint B, respectively.

[0009] Endpoint A obtains the public key of endpoint B from the server, generates an SM4 algorithm key locally, stores the SM4 algorithm key locally, encrypts the SM4 algorithm key and the message channel connection request using the public key of endpoint B to obtain the first encrypted information, and sends the first encrypted information to the server so that the server can push it to endpoint B.

[0010] After receiving the first encrypted information, endpoint B uses its own private key to decrypt the first encrypted information. If the decryption is successful, it chooses whether to agree to the message channel connection request of endpoint A. If it agrees, it saves the SM4 algorithm key of endpoint A locally, and uses the SM4 algorithm key of endpoint A to encrypt the confirmation response header to obtain the second encrypted information. It then sends the second encrypted information to the server so that the server can push it to endpoint A.

[0011] After receiving the second encrypted information, endpoint A uses its own SM4 algorithm key to decrypt the second encrypted information. If it successfully decrypts the information and receives a message channel connection confirmation response from endpoint B, it means that the message channel connection is successful at this time.

[0012] Message transmission phase:

[0013] Both communicating parties use the SM4 algorithm key of endpoint A to encrypt and decrypt the message to be transmitted. The encrypted message between the two parties is transmitted through the server.

[0014] Furthermore, endpoint A randomly generates a string locally and uses this string as the SM4 algorithm key.

[0015] Furthermore, the message passing phase specifically includes:

[0016] Endpoint A encrypts the message to be transmitted using its own SM4 algorithm key and sends the encrypted message to the server so that the server can push it to endpoint B;

[0017] Endpoint B uses the SM4 algorithm key of endpoint A to decrypt the encrypted message; when it needs to transmit a message to endpoint A, it uses the SM4 algorithm key of endpoint A to encrypt the message to be transmitted, and sends the encrypted message to the server so that the server can push it to endpoint A.

[0018] Endpoint A uses its own SM4 algorithm key to decrypt the encrypted message.

[0019] On the other hand, the present invention provides a message transmission system based on end-to-end encryption, including a user terminal and a server;

[0020] On the user side, during the encryption preparation phase, endpoint users register with the server and generate their own public / private key pair using the SM2 algorithm. The public key is then sent to the server for persistent storage so that other endpoint users in the network can view it, while the private key is stored locally on the endpoint.

[0021] And during the construction phase of the encrypted channel, the endpoints of the two communicating parties are respectively designated as endpoint A and endpoint B;

[0022] Endpoint A obtains the public key of endpoint B from the server, generates an SM4 algorithm key locally, stores the SM4 algorithm key locally, encrypts the SM4 algorithm key and the message channel connection request using the public key of endpoint B to obtain the first encrypted information, and sends the first encrypted information to the server so that the server can push it to endpoint B.

[0023] After receiving the first encrypted information, endpoint B uses its own private key to decrypt the first encrypted information. If the decryption is successful, it chooses whether to agree to the message channel connection request of endpoint A. If it agrees, it saves the SM4 algorithm key of endpoint A locally, and uses the SM4 algorithm key of endpoint A to encrypt the confirmation response header to obtain the second encrypted information. It then sends the second encrypted information to the server so that the server can push it to endpoint A.

[0024] After receiving the second encrypted information, endpoint A uses its own SM4 algorithm key to decrypt the second encrypted information. If it successfully decrypts the information and receives a message channel connection confirmation response from endpoint B, it means that the message channel connection is successful at this time.

[0025] During the message passing phase, the two communicating parties use the SM4 algorithm key of endpoint A to encrypt and decrypt the message to be transmitted, with the encrypted message between the two communicating parties being transmitted through the server.

[0026] Furthermore, the user terminal is used to allow endpoint A to randomly generate a string locally, and to use the string as the SM4 algorithm key.

[0027] Furthermore, the user terminal, during the message transmission phase, is specifically used for:

[0028] Endpoint A encrypts the message to be transmitted using its own SM4 algorithm key and sends the encrypted message to the server so that the server can push it to endpoint B;

[0029] Endpoint B uses the SM4 algorithm key of endpoint A to decrypt the encrypted message; when it needs to transmit a message to endpoint A, it uses the SM4 algorithm key of endpoint A to encrypt the message to be transmitted, and sends the encrypted message to the server so that the server can push it to endpoint A.

[0030] Endpoint A uses its own SM4 algorithm key to decrypt the encrypted message.

[0031] The beneficial effects of this invention are:

[0032] (1) After the encrypted channel in this invention is built, even if the message between the two communication endpoints is intercepted by a malicious endpoint device, it cannot be decrypted, and the message traffic already in the channel cannot be modified, nor can it impersonate one of the communication endpoints to send a message to the other end.

[0033] (2) In theory, messages transmitted through the method or system of this invention cannot be cracked or the cost of cracking them is far higher than the value of the messages themselves;

[0034] (3) The message between the two communication endpoints cannot be recognized by the server, and the server only plays the role of message forwarding. Attached Figure Description

[0035] Figure 1 This is a flowchart illustrating the encryption preparation phase in the end-to-end encrypted message transmission method provided in an embodiment of the present invention.

[0036] Figure 2 This is a flowchart illustrating the encrypted channel construction phase in the end-to-end encrypted message transmission method provided in an embodiment of the present invention.

[0037] Figure 3 This is a flowchart illustrating the message transmission phase in the end-to-end encrypted message transmission method provided in an embodiment of the present invention. Detailed Implementation

[0038] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0039] Example 1

[0040] This invention provides a message transmission method based on end-to-end encryption, such as... Figures 1 to 3 As shown, it includes: the encryption preparation phase, the encryption channel construction phase, and the message transmission phase;

[0041] Encryption preparation phase, such as Figure 1 As shown:

[0042] Endpoint users register on the server and generate their own public / private key pair using the SM2 algorithm. They then send the public key to the server for persistent storage so that other endpoint users on the network can view it, while the private key is stored locally on the endpoint.

[0043] Specifically, the server uses a database to persistently store the public key corresponding to the endpoint. Once persistence is complete, the public key can be viewed by all other endpoint users on the Internet.

[0044] During the construction phase of the encrypted channel, such as Figure 2 As shown:

[0045] The endpoints of the two communicating parties are denoted as endpoint A and endpoint B, respectively.

[0046] If endpoint A wants to establish communication with endpoint B, it needs to interact with the server first to obtain the public key of endpoint B from the server. Then, endpoint A generates an SM4 algorithm key locally, stores the SM4 algorithm key locally, uses the public key of endpoint B to encrypt the SM4 algorithm key and the message channel connection request to obtain the first encrypted information, and sends the first encrypted information to the server so that the server can push it to endpoint B.

[0047] As one possible implementation, endpoint A randomly generates a string locally and uses the string as the SM4 algorithm key.

[0048] After receiving the first encrypted information, endpoint B uses its own private key to decrypt the first encrypted information. If the decryption is successful, it chooses whether to agree to the message channel connection request of endpoint A. If it agrees, it saves the SM4 algorithm key of endpoint A locally, and uses the SM4 algorithm key of endpoint A to encrypt the confirmation response header to obtain the second encrypted information. It then sends the second encrypted information to the server so that the server can push it to endpoint A.

[0049] Specifically, if endpoint B fails to decrypt using its own private key, it indicates that the first encrypted information has been tampered with or forged during transmission, and the encrypted channel construction fails. If endpoint B successfully decrypts using its own private key but does not agree to establish an encrypted channel with endpoint A, it does not need to store endpoint A's SM4 algorithm key locally, and the encrypted channel construction also fails. In practical applications, if endpoint B does not agree to establish an encrypted channel with endpoint A, it can also use endpoint A's SM4 algorithm key to encrypt the rejection confirmation header to obtain second encrypted information, and send the second encrypted information to the server so that the server can push it to endpoint A.

[0050] After receiving the second encrypted information, endpoint A uses its own SM4 algorithm key to decrypt the second encrypted information. If it successfully decrypts the information and receives a message channel connection confirmation response from endpoint B, it means that the message channel connection is successful at this time.

[0051] Specifically, if endpoint A fails to decrypt, it indicates that the second encrypted information has been tampered with or forged during transmission, and the encryption channel construction fails. If endpoint A successfully decrypts, but learns that endpoint B refuses to connect to the message channel, the encryption channel construction also fails.

[0052] During the message passing phase, such as Figure 3 As shown:

[0053] Both communicating parties use the SM4 algorithm key of endpoint A to encrypt and decrypt the message to be transmitted, with the encrypted message between the two parties being transmitted through the server;

[0054] Specifically, endpoint A encrypts the message to be transmitted using its own SM4 algorithm key and sends the encrypted message to the server so that the server can push it to endpoint B. Endpoint B has already confirmed its connection with endpoint A, so endpoint B knows that it can decrypt the encrypted message using endpoint A's SM4 algorithm key and read the message content. When endpoint B needs to transmit a message to endpoint A, it encrypts the message to be transmitted using endpoint A's SM4 algorithm key and sends the encrypted message to the server so that the server can push it to endpoint A. Endpoint A decrypts the encrypted message using its own SM4 algorithm key.

[0055] It is understandable that once the symmetric encryption key is securely transmitted, the message transmission process using the symmetric encryption algorithm is secure. Therefore, once an encrypted message channel is established, both communicating endpoints can trust the security of the channel established by this method. Message transmission over the internet is insecure; specifically, messages on the internet are at risk of being eavesdropped on, modified, and forged. Using the method of this invention, when transmitting confidential messages, the message cannot be eavesdropped on and have its data modified or forged by other devices or malicious actors on the network. Only the two communicating parties know the symmetric encryption key; the server and any endpoint devices or proxies during the message transmission process can only intercept the message, but cannot decrypt it.

[0056] Example 2

[0057] Corresponding to the above method, this embodiment of the invention provides a message transmission system based on end-to-end encryption, including a user terminal and a server; wherein, the user terminal is configured as follows:

[0058] During the encryption preparation phase, endpoint users register on the server and generate their own public / private key pairs using the SM2 algorithm. The public key is then sent to the server for persistent storage so that other endpoint users on the network can view it, while the private key is stored locally on the endpoint.

[0059] And during the construction phase of the encrypted channel, the endpoints of the two communicating parties are respectively designated as endpoint A and endpoint B;

[0060] Endpoint A obtains the public key of endpoint B from the server, generates an SM4 algorithm key locally, stores the SM4 algorithm key locally, encrypts the SM4 algorithm key and the message channel connection request using the public key of endpoint B to obtain the first encrypted information, and sends the first encrypted information to the server so that the server can push it to endpoint B.

[0061] After receiving the first encrypted information, endpoint B uses its own private key to decrypt the first encrypted information. If the decryption is successful, it chooses whether to agree to the message channel connection request of endpoint A. If it agrees, it saves the SM4 algorithm key of endpoint A locally, and uses the SM4 algorithm key of endpoint A to encrypt the confirmation response header to obtain the second encrypted information. It then sends the second encrypted information to the server so that the server can push it to endpoint A.

[0062] After receiving the second encrypted information, endpoint A uses its own SM4 algorithm key to decrypt the second encrypted information. If it successfully decrypts the information and receives a message channel connection confirmation response from endpoint B, it means that the message channel connection is successful at this time.

[0063] During the message passing phase, the two communicating parties use the SM4 algorithm key of endpoint A to encrypt and decrypt the message to be passed, with the encrypted message between the two communicating parties being transmitted through the server.

[0064] In practical applications, the client can use the Electron framework, allowing it to run on macOS, Windows, and Linux operating systems simultaneously. System users can register an account by logging into the client using their personal terminals, and then send messages according to the message transmission method described above.

[0065] It should be noted that the encryption process between system user A (corresponding to endpoint A) and system user B (corresponding to endpoint B) is hidden. In other words, when system user A wants to establish communication with system user B, system user A simply sends a communication request, and system user B simply confirms the communication request, and the two parties establish a secure message channel.

[0066] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A message transmission method based on end-to-end encryption, characterized in that, Applied to user chat, it includes: encryption preparation stage, encryption channel construction stage, and message transmission stage; Encryption preparation phase: Endpoint users register on the server and generate their own public / private key pair using the SM2 algorithm. They then send the public key to the server for persistent storage so that other endpoint users on the network can view it, while the private key is stored locally on the endpoint. Encrypted channel construction phase: The endpoints of the two communicating parties are denoted as endpoint A and endpoint B, respectively. Endpoint A obtains the public key of endpoint B from the server and generates an SM4 algorithm key locally. Endpoint A randomly generates a string locally and uses the string as the SM4 algorithm key. Then, it stores the SM4 algorithm key locally and uses the public key of endpoint B to encrypt the SM4 algorithm key and the message channel connection request to obtain the first encrypted information. The first encrypted information is sent to the server so that the server can push it to endpoint B. After receiving the first encrypted information, endpoint B uses its own private key to decrypt the first encrypted information. If the decryption is successful, it chooses whether to agree to the message channel connection request of endpoint A. If it agrees, it saves the SM4 algorithm key of endpoint A locally, and uses the SM4 algorithm key of endpoint A to encrypt the confirmation response header to obtain the second encrypted information. It then sends the second encrypted information to the server so that the server can push it to endpoint A. After receiving the second encrypted information, endpoint A uses its own SM4 algorithm key to decrypt the second encrypted information. If it successfully decrypts the information and receives a message channel connection confirmation response from endpoint B, it means that the message channel connection is successful at this time. Message passing phase: Both communicating parties use the SM4 algorithm key of endpoint A to encrypt and decrypt the message to be transmitted. The encrypted message between the two communicating parties is transmitted through the server. The message between the two communicating endpoints cannot be recognized by the server, which only acts as a message forwarder.

2. The message transmission method based on end-to-end encryption according to claim 1, characterized in that, The message passing phase specifically includes: Endpoint A encrypts the message to be transmitted using its own SM4 algorithm key and sends the encrypted message to the server so that the server can push it to endpoint B; Endpoint B uses the SM4 algorithm key of endpoint A to decrypt the encrypted message; when it needs to transmit a message to endpoint A, it uses the SM4 algorithm key of endpoint A to encrypt the message to be transmitted, and sends the encrypted message to the server so that the server can push it to endpoint A. Endpoint A uses its own SM4 algorithm key to decrypt the encrypted message.

3. A message transmission system based on end-to-end encryption, comprising a user terminal and a server, characterized in that, Used in user chat; On the user side, during the encryption preparation phase, endpoint users register with the server and generate their own public / private key pair using the SM2 algorithm. The public key is then sent to the server for persistent storage so that other endpoint users in the network can view it, while the private key is stored locally on the endpoint. And during the construction phase of the encrypted channel, the endpoints of the two communicating parties are respectively designated as endpoint A and endpoint B; Endpoint A obtains the public key of endpoint B from the server and generates an SM4 algorithm key locally. The user terminal is used to allow endpoint A to randomly generate a string locally, use the string as the SM4 algorithm key, store the SM4 algorithm key locally, encrypt the SM4 algorithm key and the message channel connection request using the public key of endpoint B to obtain the first encrypted information, and send the first encrypted information to the server so that the server can push it to endpoint B. After receiving the first encrypted information, endpoint B uses its own private key to decrypt the first encrypted information. If the decryption is successful, it chooses whether to agree to the message channel connection request of endpoint A. If it agrees, it saves the SM4 algorithm key of endpoint A locally, and uses the SM4 algorithm key of endpoint A to encrypt the confirmation response header to obtain the second encrypted information. It then sends the second encrypted information to the server so that the server can push it to endpoint A. After receiving the second encrypted information, endpoint A uses its own SM4 algorithm key to decrypt the second encrypted information. If it successfully decrypts the information and receives a message channel connection confirmation response from endpoint B, it means that the message channel connection is successful at this time. During the message passing phase, both communicating parties use the SM4 algorithm key of endpoint A to encrypt and decrypt the message to be transmitted. The encrypted messages between the two communicating parties are transmitted through the server. Messages between the two communication endpoints cannot be recognized by the server, which only acts as a message forwarder.

4. A message transmission system based on end-to-end encryption according to claim 3, characterized in that, The user terminal, during the message transmission phase, is specifically used for: Endpoint A encrypts the message to be transmitted using its own SM4 algorithm key and sends the encrypted message to the server so that the server can push it to endpoint B; Endpoint B uses the SM4 algorithm key from endpoint A to decrypt the encrypted message; When a message needs to be transmitted to endpoint A, the message to be transmitted is encrypted using the SM4 algorithm key of endpoint A, and the encrypted message is sent to the server so that the server can push it to endpoint A. Endpoint A uses its own SM4 algorithm key to decrypt the encrypted message.

Images