A secure file transmission method, device, electronic device and storage medium

Abstract

The present application provides a secure file transmission method, device, electronic device and storage medium, which are used to improve the problem of low security of file transmission. The method includes: sending a random number to a client so that the client obtains authentication information corresponding to a password hash value, and encrypting the random number using the password hash value to obtain and return a pseudo password value and authentication information; searching for an authentication hash value corresponding to the authentication information, the authentication hash value is a hash value generated based on a password string corresponding to the authentication information; encrypting the random number using the authentication hash value to obtain a password value to be authenticated, and determining an authentication result based on the pseudo password value and the password value to be authenticated; sending the authentication result to the client, and the authentication result is used for file transmission.

Description

Technical Field

[0001] The present application relates to the technical fields of file transmission, computer security and network infrastructure security, and in particular to a secure file transmission method, device, electronic device and storage medium. Background Art

[0002] Most of the current file transfer protocols are based on username and password authentication, or rely on the third-party open source OpenSSL code library to complete the encryption security of the entire file transfer system, such as the File Transfer Protocol (FTP) and the Secret File Transfer Protocol (SFTP). In the actual practice, it is found that the password in the authentication method using username and password is easily vulnerable to exhaustive cracking attacks. As a third-party open source library, the OpenSSL code library often has security vulnerabilities that are exploited by attackers. Therefore, the security of using the current file transfer protocol for file transfer is low. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a secure file transmission method, device, electronic device and storage medium, which are used to improve the problem of low security in file transmission.

[0004] The embodiment of the present application provides a secure file transfer method, which is applied to the server, including: sending a random number to the client so that the client obtains the authentication information corresponding to the password hash value, and encrypting the random number with the password hash value to obtain and return a pseudo-password value and the authentication information; searching for the authentication hash value corresponding to the authentication information, the authentication hash value is a hash value generated based on the password string corresponding to the authentication information; encrypting the random number with the authentication hash value to obtain the password value to be authenticated, and determining the authentication result based on the pseudo-password value and the password value to be authenticated; sending the authentication result to the client, and the authentication result is used for file transfer. In the implementation process of the above scheme, the pseudo-password value is obtained by encrypting the random number sent by the server with the password hash value, and the pseudo-password value is used instead of the real password to perform server authentication, which effectively improves the situation where the password is attacked by exhaustive cracking, and effectively gets rid of the dependence on the OpenSSL code library, thereby improving the security of file transmission.

[0005] Optionally, in an embodiment of the present application, sending a random number to the client includes: obtaining a secure socket layer SSL protocol channel or a transport layer security TLS protocol channel established between the client and the server; and sending the random number to the client through the SSL protocol channel or the TLS protocol channel. In the implementation process of the above scheme, sending the random number to the client through the SSL protocol channel or the TLS protocol channel effectively increases the difficulty of the random number being exhaustively cracked, thereby improving the communication security between the client and the server.

[0006] Optionally, in an embodiment of the present application, searching for an authentication hash value corresponding to the authentication information includes: parsing a user identifier from the authentication information, searching for a password string corresponding to the user identifier in a database; and performing hash processing on the password string corresponding to the user identifier to obtain an authentication hash value. In the implementation process of the above scheme, by parsing the user identifier from the authentication information, searching for a password string corresponding to the user identifier in a database, and performing hash processing on the password string corresponding to the user identifier to obtain an authentication hash value, authentication can be completed without transmitting a password, thereby improving the situation where the password is subject to exhaustive cracking attacks and effectively improving the security of file transmission.

[0007] Optionally, in an embodiment of the present application, determining the authentication result based on the pseudo-password value and the password value to be authenticated includes: determining whether the pseudo-password value and the password value to be authenticated are the same; if so, determining the authentication result as authentication passed, otherwise, determining the authentication result as authentication failed. In the implementation of the above scheme, by determining the authentication result based on whether the pseudo-password value and the password value to be authenticated are the same, the authentication can be completed without transmitting the password, thereby improving the situation where the password is attacked by exhaustive cracking, and effectively improving the security of file transmission.

[0008] Optionally, in an embodiment of the present application, after sending the authentication result to the client, it also includes: receiving a file transfer command sent by the client; determining whether the authentication result is authentication passed; if so, using the file transfer method negotiated and selected by the client and the server to perform file transfer. In the implementation process of the above scheme, after the authentication is passed, the file transfer method negotiated and selected by the client and the server is used to perform file transfer, which improves the situation where the complex encryption technology of the SSL encryption channel causes a large computing load, thereby effectively improving the efficiency of file transfer.

[0009] Optionally, in an embodiment of the present application, the file transmission method includes: a random packet transmission method, a fragment identifier encryption transmission method and / or an interface transmission method of a preset software library package.

[0010] The embodiment of the present application also provides a secure file transfer method, which is applied to the client, including: receiving a random number sent by the server; obtaining a password hash value, and encrypting the random number with the password hash value to obtain a pseudo-password value; sending authentication information and a pseudo-password value corresponding to the password hash value to the server, so that the server returns an authentication result according to the authentication information and the pseudo-password value corresponding to the password hash value; receiving the authentication result sent by the server, and performing file transfer according to the authentication result. In the implementation process of the above scheme, the pseudo-password value obtained by encrypting the random number sent by the server with the password hash value, and using the pseudo-password value instead of the real password to perform server authentication, effectively improves the situation where the password is attacked by exhaustive cracking, and effectively gets rid of the dependence on the OpenSSL code library, thereby improving the security of file transfer.

[0011] The embodiment of the present application also provides a secure file transmission device, which is applied to a server, including: a random number sending module, which is used to send a random number to a client, so that the client obtains authentication information corresponding to a password hash value, and uses the password hash value to encrypt the random number, obtains and returns a pseudo-password value and authentication information; a hash value search module, which is used to search for an authentication hash value corresponding to the authentication information, and the authentication hash value is a hash value generated based on the password string corresponding to the authentication information; a hash value encryption module, which is used to encrypt the random number using the authentication hash value, obtain the password value to be authenticated, and determine the authentication result according to the pseudo-password value and the password value to be authenticated; a file transmission module, which is used to send the authentication result to the client, and the authentication result is used for file transmission.

[0012] Optionally, in an embodiment of the present application, the random number sending module includes: a protocol channel acquisition submodule, used to obtain a secure socket layer SSL protocol channel or a transport layer security TLS protocol channel established between the client and the server; a random number sending submodule, used to send a random number to the client through the SSL protocol channel or the TLS protocol channel.

[0013] Optionally, in an embodiment of the present application, the hash value search module includes: a password search submodule, used to parse the user identifier from the authentication information and search for the password string corresponding to the user identifier in the database; a hash processing submodule, used to hash the password string corresponding to the user identifier to obtain an authentication hash value.

[0014] Optionally, in an embodiment of the present application, the hash value encryption module includes: a pseudo-password value judgment sub-module, used to judge whether the pseudo-password value and the password value to be authenticated are the same; an authentication result determination sub-module, used to determine the authentication result as authentication passed if the pseudo-password value and the password value to be authenticated are the same, otherwise, determine the authentication result as authentication failed.

[0015] Optionally, in an embodiment of the present application, the secure file transfer device also includes: a transmission command receiving submodule, used to receive a file transfer command sent by the client; an authentication result judgment submodule, used to judge whether the authentication result is authentication passed; a transmission mode negotiation submodule, used to use the file transfer mode negotiated and selected by the client and the server to perform file transfer if the authentication result is authentication passed.

[0016] Optionally, in an embodiment of the present application, the file transmission method includes: a random packet transmission method, a fragment identifier encryption transmission method and / or an interface transmission method of a preset software library package.

[0017] The embodiment of the present application also provides a secure file transfer device, which is applied to a client and includes: a random number receiving module, which is used to receive a random number sent by a server; a random number encryption module, which is used to obtain a password hash value and use the password hash value to encrypt the random number to obtain a pseudo-password value; an authentication result returning module, which is used to send authentication information and a pseudo-password value corresponding to the password hash value to the server, so that the server returns an authentication result; an authentication result receiving module, which is used to receive the authentication result sent by the server and perform file transfer according to the authentication result.

[0018] An embodiment of the present application further provides an electronic device, including: a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the machine-readable instructions are executed by the processor, the method described above is performed.

[0019] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method described above is executed.

[0020] Other features and advantages of the embodiments of the present application will be described in the subsequent description, and in part will become apparent from the description, or will be understood by implementing the embodiments of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A schematic diagram of a process flow of a secure file transmission method applied to a server provided in an embodiment of the present application is shown;

[0023] Figure 2A schematic diagram of the transmission process of a hello message and an authentication result message provided in an embodiment of the present application is shown;

[0024] Figure 3 A schematic diagram of an implementation framework of a secure file transfer protocol provided in an embodiment of the present application is shown;

[0025] Figure 4 A schematic diagram of a process flow of a secure file transmission method provided by an embodiment of the present application is shown;

[0026] Figure 5 A schematic diagram of the structure of a secure file transmission device provided in an embodiment of the present application is shown;

[0027] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0028] To make the purpose, technical scheme and advantages of the embodiment of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. It should be understood that the drawings in the embodiment of the present application only serve the purpose of explanation and description, and are not used to limit the protection scope of the embodiment of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in the embodiment of the present application shows the operation implemented according to some embodiments of the embodiment of the present application. It should be understood that the operation of the flowchart can be implemented out of order, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the embodiment of the present application, or remove one or more operations from the flowchart.

[0029] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all embodiments. The components of the embodiments of the present application described and shown in the drawings generally here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the embodiments of the present application claimed, but merely represents the selected embodiments of the embodiments of the present application.

[0030] It is understandable that the "first" and "second" in the embodiments of the present application are used to distinguish similar objects. Those skilled in the art will understand that the words "first" and "second" do not limit the quantity and execution order, and the words "first" and "second" do not necessarily limit the difference. In the description of the embodiments of the present application, the term "and / or" is merely a description of the association relationship of the associated objects, indicating that there may be three relationships, such as A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the related objects before and after are in an "or" relationship. The term "multiple" refers to more than two (including two), and similarly, "multiple groups" refers to more than two groups (including two groups).

[0031] Before introducing the secure file transmission method provided in the embodiment of the present application, some concepts involved in the embodiment of the present application are first introduced:

[0032] Secure Sockets Layer (SSL) is a security protocol that aims to provide security and data integrity for Internet communications. SSL includes the record layer and the transport layer. The record layer protocol determines the encapsulation format of the transport layer data.

[0033] The Transport Layer Security (TLS) protocol is a security protocol that aims to provide security and data integrity for Internet communications. The TLS protocol uses a master-slave architecture model to create a secure connection between two applications over the network to prevent eavesdropping and tampering when exchanging data.

[0034] OpenSSL is an open source software library package that applications can use to communicate securely, avoid eavesdropping, and confirm the identity of the other end of the connection. On computer networks, this package is widely used on Internet web servers. The main library of OpenSSL is written in C language and implements basic encryption functions.

[0035] It should be noted that the secure file transfer method provided in the embodiments of the present application can be executed by an electronic device, where the electronic device refers to a terminal device or server with the function of executing a computer program. For example, the secure file transfer method applied to the client can be executed on the terminal device, and the secure file transfer method applied to the server can be executed on the server. The above-mentioned terminal devices are, for example, smart phones, personal computers, tablet computers, personal digital assistants, or mobile Internet devices. The above-mentioned server refers to a device that provides computing services through the network, such as an x86 server and a non-x86 server. The non-x86 server includes: mainframes, minicomputers, and UNIX servers.

[0036] The following introduces the application scenarios in which the secure file transfer method is applicable, and the application scenarios here include but are not limited to: the secure file transfer method can be used to design a new secure file transfer protocol, or the secure file transfer method can be used to improve the existing file transfer protocol. Since the secure file transfer method can complete the authentication without transmitting the password during the authentication process before the file transfer, it improves the situation where the password is attacked by exhaustive cracking, etc. Furthermore, the implementation of the secure file transfer method does not rely on the OpenSSL code library, which improves the situation where the security vulnerabilities exposed in the OpenSSL code library are exploited by attackers. Therefore, the secure file transfer method can effectively improve the security of file transfer.

[0037] See also Figure 1 The flowchart of the secure file transmission method applied to the server provided in the embodiment of the present application is shown; the implementation method of the secure file transmission method applied to the server here may include:

[0038] Step S110: The server sends a random number to the client so that the client obtains the authentication information corresponding to the password hash value, and uses the password hash value to encrypt the random number to obtain and return a pseudo password value and authentication information.

[0039] See also Figure 2 The schematic diagram of the transmission process of the hello message and the authentication result message provided by the embodiment of the present application is shown; it can be understood that the server can send a random number to the client through the SSL protocol channel or the TLS protocol channel, thereby improving the communication security between the client and the server. For example: the server can first encapsulate the above random number into a ServerHello message, and then the server sends a ServerHello message to the client through the SSL protocol channel or the TLS protocol channel.

[0040] After receiving the random number sent by the server, the client can obtain the authentication information corresponding to the password hash value, and use the password hash value to encrypt the random number to obtain the pseudo password value and authentication information. Then, the pseudo password value and authentication information are encapsulated into a ClientHello message, and the ClientHello message is sent to the server through the SSL protocol channel or the TLS protocol channel.

[0041] Step S120: The server searches for an authentication hash value corresponding to the authentication information. The authentication hash value is a hash value generated based on a password character string corresponding to the authentication information.

[0042] Step S130: The server uses the authentication hash value to encrypt the random number to obtain the password value to be authenticated, and determines the authentication result according to the pseudo-password value and the password value to be authenticated.

[0043] Optionally, the communication between the above-mentioned client and server (for example, a ServerHello message encapsulated with a random number, or a ClientHello message encapsulated with a pseudo password value and authentication information) can be encapsulated using a control information message structure, where the control information message structure may include: a message identifier (Protocal ID), a security level (SecurityLevel), a retransmission flag (Retrans_Flag), a command type (Command Type), etc.; wherein the message identifier is used to identify the application layer protocol type of the packet, the security level is used to negotiate and indicate the file transfer method, for example, to select a file transfer method from three methods: a random packet transmission method, a fragment identifier encryption transmission method, and / or an interface transmission method of a preset software library package. The retransmission flag indicates whether the control message is a retransmission message, for example, 1 indicates that it is a retransmission message, and 0 indicates that it is not a retransmission message. The command type includes: a ServerHello message of an authentication start command, a ClientHello message of a client sending an authentication information command, an authentication result message (AUTH) of an authentication result command, an upload command (UPLOAD) and a download command (DOWNLOAD), etc. It can be understood that since there are many implementation methods of the above-mentioned steps S120 to S130, the implementation methods of steps S120 to S130 will be described in detail below.

[0044] Step S140: The server sends an authentication result to the client, and the authentication result is used for file transmission.

[0045] It is understandable that after obtaining the authentication result, the server can encapsulate the authentication result into an authentication result message (AUTH), and send the authentication result message to the client through the SSL protocol channel or the TLS protocol channel, so that the client can perform file transfer according to the authentication result message.

[0046] In the above implementation process, the pseudo-password value is obtained by encrypting the random number sent by the server with the password hash value, and the pseudo-password value is used instead of the real password for server authentication, which effectively improves the situation where the password is attacked by brute force cracking, and effectively gets rid of the dependence on the OpenSSL code library, thereby improving the security of file transmission.

[0047] See also Figure 3 The schematic diagram of the implementation framework of the secure file transfer protocol provided by the embodiment of the present application is shown; optionally, in the process of designing a new secure file transfer protocol using the secure file transfer method, the secure file transfer protocol can also be designed into three stages, which include: application processing stage, file transfer command stage and file transfer stage. It can be understood that the three stages of application processing stage, file transfer command stage and file transfer stage all require the above-mentioned client and server to participate, for example: in the application processing stage, the client and the server can negotiate and select compression mode, encryption mode and file transfer mode, etc., and the client and the server can also perform an authentication process in the application processing stage. In the file transfer command stage, the client and the server can transmit upload commands, download commands and rename commands, etc., and of course, the control message of the control information such as the file transfer command can be checked, and the control message can be retransmitted when the check code of the control message is incorrect to avoid the control message being tampered with. At the file transfer stage, the client and the server can negotiate the selected file transfer mode for file transfer, such as selecting a random packet transmission mode, a fragmentation identification encryption transmission mode and / or a preset software library package interface transmission mode for file transfer.

[0048] As an optional implementation of the above step S110, when sending the random number to the client, the random number may also be sent through a secure protocol channel. This implementation may include:

[0049] Step S111: Acquire a Secure Sockets Layer (SSL) protocol channel or a Transport Layer Security (TLS) protocol channel established between the client and the server.

[0050] Step S112: Send a random number to the client through the SSL protocol channel or the TLS protocol channel.

[0051] An implementation example of the above steps S111 to S112 is as follows: the client first establishes a secure socket layer SSL protocol channel or a transport layer security TLS protocol channel with the server, and then the server can obtain the SSL protocol channel or TLS protocol channel established between the client and the server, and send a random number to the client through the SSL protocol channel or TLS protocol channel.

[0052] In the above implementation process, sending a random number to the client through the SSL protocol channel or the TLS protocol channel effectively increases the difficulty of exhaustively cracking the random number, thereby improving the communication security between the client and the server.

[0053] As an optional implementation of the above step S120, when searching for the authentication hash value corresponding to the authentication information, the password string corresponding to the user identification (such as the user name) may be searched first, and then the authentication hash value may be calculated using the hash of the password string. This implementation may include:

[0054] Step S121: parse the user ID from the authentication information, and search the database for the password string corresponding to the user ID.

[0055] The user identification mentioned above refers to information that can be used to identify a user, and the user identification here includes but is not limited to: a user name or a user ID, etc.

[0056] Step S122: Perform hash processing on the password character string corresponding to the user identification to obtain an authentication hash value.

[0057] The implementation method of the above steps S121 to S122 is, for example: parsing the user identifier (eg, username) from the authentication information, and searching the database for the password string (eg, password field in the database) corresponding to the user identifier (eg, username).

[0058] In the above implementation process, the user ID is parsed from the authentication information, the password string corresponding to the user ID is searched in the database, and the password string corresponding to the user ID is hashed to obtain the authentication hash value, so that the authentication can be completed without transmitting the password, thereby improving the situation where the password is subject to brute force cracking attacks and effectively improving the security of file transmission.

[0059] As an optional implementation of the above step S130, the authentication result may be determined according to whether the pseudo password value and the password value to be authenticated are the same. This implementation may include:

[0060] Step S131: Determine whether the pseudo password value and the password value to be authenticated are the same.

[0061] The implementation method of the above step S131 is, for example: using an executable program compiled or interpreted by a preset programming language to determine whether the pseudo-password value and the password value to be authenticated are the same. The programming languages ​​that can be used are, for example: C, C++, Java, BASIC, JavaScript, LISP, Shell, Perl, Ruby, Python and PHP, etc.

[0062] Step S132: If the pseudo password value is the same as the password value to be authenticated, the authentication result is determined as authentication passed.

[0063] Step S133: If the pseudo password value is not the same as the password value to be authenticated, the authentication result is determined as authentication failure.

[0064] The implementation of the above steps S132 to S133 is, for example: if the pseudo password value and the password value to be authenticated are the same, then the authentication result is determined as authentication passed by the executable program compiled or interpreted using the preset programming language. If the pseudo password value and the password value to be authenticated are not the same, then the authentication result is determined as authentication failed by the executable program compiled or interpreted using the preset programming language.

[0065] As an optional implementation of the above step S140, after sending the authentication result to the client, the method further includes:

[0066] Step S141: The server receives a file transfer command sent by the client.

[0067] Step S142: The server determines whether the authentication result is authentication passed.

[0068] Step S143: If the authentication result is authentication passed, the server uses the file transfer method selected by the client and the server through negotiation to perform file transfer.

[0069] The implementation method of the above steps S141 to S143 is, for example: the server receives the file transfer command sent by the client through the SSL protocol channel or the TLS protocol channel, and then the server uses an executable program compiled or interpreted by a preset programming language to determine whether the authentication result is authentication passed. If the authentication result is authentication passed, the server uses the file transfer method (such as a random packet transmission method, a fragment identification encryption transmission method, or an interface transmission method of a preset software library package) negotiated and selected by the client and the server to perform file transfer. Among them, the programming languages ​​that can be used are, for example: C, C++, Java, BASIC, JavaScript, LISP, Shell, Perl, Ruby, Python, PHP, etc.

[0070] In the above implementation process, after the authentication is passed, the file transfer method negotiated and selected by the client and the server is used for file transfer, which improves the situation where the complex encryption technology of the SSL encryption channel causes a large computing load, thereby effectively improving the efficiency of file transfer.

[0071] As an optional implementation of the above-mentioned secure file transfer method, the above-mentioned file transmission method may include: a random packet transmission method, a fragment identification encryption transmission method and / or an interface transmission method of a preset software library package; wherein, the interface transmission method of the preset software library package here can use the application programming interface (Application Programming Interface, API) in the OpenSSL code library to perform file transmission.

[0072] In the above implementation process, the file is transmitted through the fragment identification encryption transmission method, which improves the situation where the plain text serial number is brute-force cracked, thereby effectively improving the security of file transmission.

[0073] Optionally, the above-mentioned file transmission process may include file uploading and file downloading. For ease of understanding and explanation, the file downloading is taken as an example for detailed explanation. For example, after the server receives the file download command sent by the client, the file can be segmented into data packets of a preset size. The preset size here can be set according to the specific situation (the preset size should not be too large or too small. A data packet that is too large carries too much information and is not confidential enough. A data packet that is too small requires more transmissions, which will slow down the transmission efficiency). Then, the data packets are grouped, for example, 10 data packets are divided into a group of data packets. The number of data packets in a group here can be set according to the specific situation and can be set in accordance with the principle of maximizing the data processing efficiency and transmission efficiency of the server. For example, if there are too few data packets in each group, more MD5 check packets need to be sent, which slows down the transmission efficiency; if there are too many data packets in each group, too much system buffer area will be occupied, increasing the pressure of data processing on the server.

[0074] In the specific implementation process, after the data packets are grouped, they are sent directly according to the grouped data packets. Of course, the order of the grouped data packets can also be shuffled. Since each data packet is set with a corresponding data packet identifier (ID), the real original file can be restored according to the data packet identifier (ID) after shuffling. The specific shuffling method can use a random number remainder and move the data packet corresponding to the remainder to the end of the queue to shuffle the order of the grouped data packets. For example: assuming there are 1 to 10 data packets, and the random number obtained is 14, then the 14th%10=4th data packet can be exchanged with the last (or the first) data packet of the group, and so on, so that the order of all data packets (or most of the data packets) in the group is exchanged.

[0075] Optionally, before sending the above-mentioned grouped data packets or shuffled data packets, the data packet identifier (ID) can also be encrypted to prevent attackers from intercepting the data packet identifier (ID) and the data packet in transmission, and then restoring the original file based on the data packet identifier (ID). After encrypting the data packet identifier (ID), the receiving end (such as the client) needs to decrypt the encrypted data packet identifier (ID) to obtain the decrypted data packet identifier (ID), and then restore the decrypted data packet identifier (ID) to the original file.

[0076] Before restoring the original file, if a group of data packets is received, the check value (such as MD5 value) of the group of data packets can also be received, and the check value can be used to check the group of data packets. If the check passes, the next group of data packets can be received. If the check fails, the sequence number (Seq_id) of the group of data packets is recorded. Then, after all the group data tables are sent, the client can send the sequence number (Seq_id) of the group of data packets to the server to enable the server to resend the group of data packets.

[0077] See also Figure 4 The flowchart of the secure file transmission method provided by the embodiment of the present application is shown; the embodiment of the present application provides a secure file transmission method applied to a client, including:

[0078] Step S210: The client receives the random number sent by the server.

[0079] An implementation example of the above step S210 is: the server sends a random number to the client through an SSL protocol channel or a TLS protocol channel, and the client receives the random number sent by the server through the SSL protocol channel or the TLS protocol channel.

[0080] Step S220: The client obtains the password hash value, and uses the password hash value to encrypt the random number to obtain a pseudo password value.

[0081] The implementation method of the above step S220 is, for example, that the client uses an executable program compiled or interpreted by a preset programming language to obtain a password hash value, and uses the password hash value to encrypt a random number to obtain a pseudo password value. Programming languages ​​that can be used include, for example, C, C++, Java, BASIC, JavaScript, LISP, Shell, Perl, Ruby, Python, and PHP, etc.

[0082] Step S230: the client sends the authentication information and pseudo-password value corresponding to the password hash value to the server, so that the server returns the authentication result according to the authentication information and pseudo-password value corresponding to the password hash value.

[0083] Step S240: The client receives the authentication result sent by the server, and performs file transfer according to the authentication result.

[0084] The implementation method of the above steps S230 to S240 is, for example: the client sends the authentication information and pseudo-password value corresponding to the password hash value to the server through the SSL protocol channel or the TLS protocol channel. The server parses the authentication information corresponding to the password hash value, and searches for the authentication hash value corresponding to the authentication information. Then, the authentication hash value is used to encrypt the random number to obtain the password value to be authenticated, and the authentication result is determined based on the pseudo-password value and the password value to be authenticated. Finally, the client receives the authentication result sent by the server through the SSL protocol channel or the TLS protocol channel, and performs file transfer based on the authentication result.

[0085] See also Figure 5 The structural diagram of the secure file transmission device provided in the embodiment of the present application is shown; the embodiment of the present application provides a secure file transmission device 300, which is applied to the server, including:

[0086] The random number sending module 310 is used to send a random number to the client so that the client can obtain the authentication information corresponding to the password hash value, and use the password hash value to encrypt the random number to obtain and return a pseudo password value and authentication information.

[0087] The hash value search module 320 is used to search for the authentication hash value corresponding to the authentication information. The authentication hash value is a hash value generated based on the password character string corresponding to the authentication information.

[0088] The hash value encryption module 330 is used to encrypt the random number using the authentication hash value to obtain the password value to be authenticated, and determine the authentication result according to the pseudo password value and the password value to be authenticated.

[0089] The file transmission module 340 is used to send the authentication result to the client, and the authentication result is used for file transmission.

[0090] Optionally, in an embodiment of the present application, the random number sending module includes:

[0091] The protocol channel acquisition submodule is used to obtain the Secure Sockets Layer SSL protocol channel or Transport Layer Security TLS protocol channel established between the client and the server.

[0092] The random number sending submodule is used to send random numbers to the client through the SSL protocol channel or the TLS protocol channel.

[0093] Optionally, in an embodiment of the present application, the hash value search module includes:

[0094] The password search submodule is used to parse the user ID from the authentication information and search the password string corresponding to the user ID in the database.

[0095] The hash processing submodule is used to perform hash processing on the password string corresponding to the user identification to obtain the authentication hash value.

[0096] Optionally, in an embodiment of the present application, the hash value encryption module includes:

[0097] The pseudo-password value judgment submodule is used to judge whether the pseudo-password value is the same as the password value to be authenticated.

[0098] The authentication result determination submodule is used to determine the authentication result as authentication success if the pseudo password value is the same as the password value to be authenticated, otherwise, determine the authentication result as authentication failure.

[0099] Optionally, in the embodiment of the present application, the secure file transmission device further includes:

[0100] The transfer command receiving submodule is used to receive the file transfer command sent by the client.

[0101] The authentication result judgment submodule is used to judge whether the authentication result is authentication passed.

[0102] The transmission mode negotiation submodule is used to perform file transmission using the file transmission mode selected by negotiation between the client and the server if the authentication result is authentication passed.

[0103] Optionally, in an embodiment of the present application, the file transmission method includes: a random packet transmission method, a fragment identifier encryption transmission method and / or an interface transmission method of a preset software library package.

[0104] The embodiment of the present application provides a secure file transmission device, which is applied to a client, including:

[0105] The random number receiving module is used to receive the random number sent by the server.

[0106] The random number encryption module is used to obtain a password hash value and use the password hash value to encrypt the random number to obtain a pseudo password value.

[0107] The authentication result returning module is used to send the authentication information and pseudo password value corresponding to the password hash value to the server, so that the server returns the authentication result.

[0108] The authentication result receiving module is used to receive the authentication result sent by the server and perform file transfer based on the authentication result.

[0109] It should be understood that the device corresponds to the above-mentioned secure file transmission method embodiment and can execute the various steps involved in the above-mentioned method embodiment. The specific functions of the device can be found in the above description. To improve repetition, the detailed description is appropriately omitted here. The device includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the operating system (OS) of the device.

[0110] See also Figure 6 An electronic device 400 provided in an embodiment of the present application includes: a processor 410 and a memory 420, wherein the memory 420 stores machine-readable instructions executable by the processor 410, and when the machine-readable instructions are executed by the processor 410, the above method is executed.

[0111] The embodiment of the present application also provides a computer-readable storage medium 430, on which a computer program is stored, and the computer program is executed by the processor 410 to execute the above method. The computer-readable storage medium 430 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, disk or optical disk.

[0112] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0113] In several embodiments provided by the embodiments of the present application, it should be understood that the disclosed device and method can also be implemented in other ways. The device embodiments described above are only schematic, for example, the flowcharts and block diagrams in the accompanying drawings show the possible implementation architecture, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a part of a module, a program segment or a code, and a part of a module, a program segment or a code includes one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also be different from the order of occurrence marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which is mainly determined by the functions involved.

[0114] In addition, each functional module of each embodiment in the embodiment of the present application can be integrated together to form an independent part, or each module can exist separately, or two or more modules can be integrated to form an independent part. In addition, in the description of this specification, the description of reference terms "one embodiment", "some embodiments", "example", "specific example", "some examples", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of the present application. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples without contradiction.

[0115] The above description is only an optional implementation manner of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or replacements within the technical scope disclosed in the embodiments of the present application, which should be covered within the protection scope of the embodiments of the present application.

Claims

1. A secure file transmission method, characterized in that: Applied to the server, including: Sending a random number to a client so that the client obtains authentication information corresponding to a password hash value, and encrypting the random number using the password hash value to obtain and return a pseudo password value and the authentication information; Finding an authentication hash value corresponding to the authentication information, where the authentication hash value is a hash value generated based on a password character string corresponding to the authentication information; Encrypting the random number using the authentication hash value to obtain a password value to be authenticated, and determining an authentication result according to the pseudo password value and the password value to be authenticated; The authentication result is sent to the client, where the authentication result is used for file transmission.

2. The method according to claim 1, characterized in that The sending of a random number to the client comprises: Acquire a secure socket layer (SSL) protocol channel or a transport layer security (TLS) protocol channel established between the client and the server; The random number is sent to the client through the SSL protocol channel or the TLS protocol channel.

3. The method according to claim 1, characterized in that The searching for the authentication hash value corresponding to the authentication information includes: Parsing the user ID from the authentication information and searching the database for a password string corresponding to the user ID; The password character string corresponding to the user identification is hashed to obtain the authentication hash value.

4. The method according to claim 1, characterized in that The determining the authentication result according to the pseudo password value and the password value to be authenticated includes: Determine whether the pseudo password value is the same as the password value to be authenticated; If so, the authentication result is determined as authentication passed; otherwise, the authentication result is determined as authentication failed.

5. The method according to any one of claims 1 to 4, characterized in that: After sending the authentication result to the client, the method further includes: Receiving a file transfer command sent by the client; Determine whether the authentication result is authentication passed; If so, the file is transferred using the file transfer method selected by the client and the server through negotiation.

6. The method according to claim 5, characterized in that The file transmission mode includes: a random packet transmission mode, a fragment identification encryption transmission mode and / or a preset software library package interface transmission mode.

7. A secure file transmission method, characterized in that: Applied to the client, including: Receive the random number sent by the server; Obtaining a password hash value, and using the password hash value to encrypt the random number to obtain a pseudo password value; Sending the authentication information corresponding to the password hash value and the pseudo password value to the server, so that the server returns an authentication result according to the authentication information corresponding to the password hash value and the pseudo password value; Receive the authentication result sent by the server, and perform file transfer according to the authentication result.

8. A secure file transmission device, characterized in that: Applied to the server, including: A random number sending module is used to send a random number to a client so that the client obtains authentication information corresponding to a password hash value, and encrypts the random number using the password hash value to obtain and return a pseudo password value and the authentication information; A hash value search module, used to search for an authentication hash value corresponding to the authentication information, wherein the authentication hash value is a hash value generated based on a password character string corresponding to the authentication information; A hash value encryption module, used to encrypt the random number using the authentication hash value to obtain a password value to be authenticated, and determine an authentication result according to the pseudo password value and the password value to be authenticated; The file transmission module is used to send the authentication result to the client, and the authentication result is used for file transmission.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the machine-readable instructions are executed by the processor, the method according to any one of claims 1 to 7 is performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is executed.

Images