A message encryption method, decryption method, device and program product

Abstract

The application provides a message encryption method, a decryption method, a device and a program product. It relates to the technical field of blockchains and comprises the following steps: sending a message assembly request to a policy server and receiving an encryption policy rule and a global tracking number fed back by the policy server according to the message assembly request; encrypting an original message by using symmetric encryption information to obtain an encrypted message and encrypting the symmetric encryption information by using asymmetric encryption information to obtain a ciphertext, wherein the original message comprises an interface and a gateway; and sending the encrypted message, the ciphertext and the global tracking number to the gateway through the interface. The policy server is introduced to configure the encryption policy rule required by the client, so that the client directly encrypts the message according to the encryption policy rule allocated by the policy server, the dynamic hot update can take effect without modifying the code and redeploying the application system, and the security of message transmission is improved.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and in particular to a message encryption method, decryption method, device, and program product. Background Art

[0002] When existing application systems are transmitting over the network, there is a risk that network data packets may be intercepted and viewed by others. If these data packets are transmitted in plain text or their encryption method is known, there is a risk of information leakage. Currently, symmetric encryption algorithms and asymmetric encryption algorithms are usually combined with direct transmission of messages for encryption to ensure data transmission security.

[0003] However, current encryption algorithms are rigid, and when an algorithm needs to be replaced or added, the code usually needs to be modified and recompiled, which affects hot updates. In addition, the algorithms currently used are usually relatively simple, which affects the security of message transmission. Summary of the Invention

[0004] The present application provides a message encryption method, a decryption method, a device and a program product to achieve secure transmission of messages.

[0005] In a first aspect, the present application provides a message encryption method, applied to a client, comprising:

[0006] Sending a message assembly request to a policy server, and receiving an encryption policy rule and a global tracking number fed back by the policy server according to the message assembly request, wherein the encryption policy rule includes symmetric encryption information and asymmetric encryption information;

[0007] Encrypting an original message using the symmetric encryption information to obtain an encrypted message, and encrypting the symmetric encryption information using the asymmetric encryption information to obtain a ciphertext, wherein the original message includes an interface and a gateway;

[0008] The encrypted message, the ciphertext and the global tracking number are sent to the gateway through the interface.

[0009] In a second aspect, the present application provides a message decryption method, which is applied to a gateway, comprising:

[0010] Receive the encrypted message, ciphertext and global tracking number sent by the client;

[0011] Obtaining encryption policy rules according to the global tracking number query rule table, wherein the rule table contains a correspondence between global tracking numbers and encryption policy rules;

[0012] Extracting asymmetric encryption information from the encryption policy rule, and using the asymmetric encryption information to decrypt the ciphertext to obtain symmetric encryption information;

[0013] The encrypted message is decrypted using the symmetric encryption information to obtain the original message.

[0014] In a third aspect, the present application provides a message encryption device, comprising:

[0015] A message assembly request sending module is used to send a message assembly request to a policy server and receive an encryption policy rule and a global tracking number fed back by the policy server according to the message assembly request, wherein the encryption policy rule includes symmetric encryption information and asymmetric encryption information;

[0016] an encryption module, configured to encrypt an original message using the symmetric encryption information to obtain an encrypted message, and to encrypt the symmetric encryption information using the asymmetric encryption information to obtain a ciphertext, wherein the original message includes an interface and a gateway;

[0017] The encrypted information sending module is used to send the encrypted message, the ciphertext and the global tracking number to the gateway through the interface.

[0018] In a fourth aspect, the present application provides a message decryption device, comprising:

[0019] Encrypted information receiving module, used to receive encrypted messages, ciphertext and global tracking number sent by the client;

[0020] an encryption policy rule acquisition module, configured to query a rule table according to the global tracking number to acquire encryption policy rules, wherein the rule table contains a correspondence between global tracking numbers and encryption policy rules;

[0021] A first decryption module is configured to extract asymmetric encryption information from the encryption policy rule, and use the asymmetric encryption information to decrypt the ciphertext to obtain symmetric encryption information;

[0022] The second decryption module is used to decrypt the encrypted message using the symmetric encryption information to obtain the original message.

[0023] In a fifth aspect, the present application provides a client, comprising: a processor, and a memory communicatively connected to the processor;

[0024] The memory stores computer-executable instructions;

[0025] The processor executes the computer-executable instructions stored in the memory to implement the message encryption method as described in this application.

[0026] In a sixth aspect, the present application provides a gateway, comprising: a processor, and a memory communicatively connected to the processor;

[0027] The memory stores computer-executable instructions;

[0028] The processor executes the computer-executable instructions stored in the memory to implement the message decryption method as described in the application.

[0029] In a seventh aspect, the present application provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by a processor, they are used to implement the message encryption method or the message decryption method described in the present application.

[0030] In an eighth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the message encryption method or the message decryption method described in the present application.

[0031] When obtaining the project packaging instructions, this application obtains the reuse parameters written for the common project according to the project packaging instructions, and deploys the deployment package generated according to the unique parameters and reuse parameters on the specified application end, thereby reducing the complexity of project management and realizing rapid application of the target project according to the deployment results. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0033] Figure 1 Flowchart of the message encryption method provided in Example 1 of the present application;

[0034] Figure 2 A schematic diagram of the structure of the symmetric encryption information provided in Example 1 of the present application;

[0035] Figure 3 A schematic diagram of the structure of asymmetric encryption information provided in Example 1 of the present application;

[0036] Figure 4 Flowchart of the message encryption method provided in Example 2 of the present application;

[0037] Figure 5 A schematic diagram of the structure of the message encryption device provided in Example 3 of the present application;

[0038] Figure 6 A schematic diagram of the structure of the message decryption device provided in Example 4 of the present application;

[0039] Figure 7 A schematic diagram of the structure of the application terminal provided in Example 5 of the present application;

[0040] Figure 8A schematic diagram of the structure of the gateway provided in Example 6 of the present application.

[0041] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0042] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0043] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings. The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0044] Example 1

[0045] Figure 1 The flowchart of the message encryption method provided in the embodiment of the present application is applicable to the case where the message is encrypted. The method can be executed by a message encryption device, which can be implemented by software and / or hardware, such as Figure 1 As shown, the method includes the following steps:

[0046] Step S101: Send a message assembly request to a policy server, and receive encryption policy rules and a global tracking number fed back by the policy server according to the message assembly request.

[0047] Optionally, a message assembly request is sent to a policy server, and encryption policy rules and a global tracking number are received from the policy server based on the message assembly request, including: sending a message assembly request to the policy server, wherein the message assembly request includes a client identity identifier; receiving encryption policy rules determined by the policy server based on the client identity identifier, wherein the policy configuration rules are pre-configured for the user group where the client identity is located; receiving a global tracking number generated in real time by the policy server based on the encryption policy rules, wherein the global tracking number is used to identify the encryption policy rules.

[0048] Specifically, when a client needs to encrypt a message, it sends a message assembly request to the policy server. The message request includes the client's identity. The client's identity can be, for example, the work ID or ID number of the user making the login request. This embodiment does not specify the client's identity. After receiving the client's identity, the policy server queries the identity to obtain the user group corresponding to it. User groups include employee groups and management groups, for example. This embodiment does not specify the specific types of user groups. The policy server pre-configures encryption policy configuration rules for each type of user group. The encryption policy rules include symmetric encryption information and asymmetric encryption information. For example, the client's identity is 00a. A query determines that the client with the identity 00a belongs to the employee group, and the encryption policy configuration rule corresponding to the employee group is X. Upon determining X, the policy server also generates a global tracking number 1000, which can be used to identify the encryption policy rule.

[0049] It should be noted that the symmetric encryption information in the encryption policy rule includes a symmetric algorithm chain and a key chain that matches the symmetric algorithm chain. The symmetric algorithm chain is composed of multiple different types of symmetric algorithms arranged in a specified order. Figure 2 The diagram below shows the structure of symmetric encryption information. A symmetric group is a database of symmetric encryption algorithms, including commonly used symmetric encryption algorithms such as the U.S. Data Encryption Standard (3DES), the Triple Data Encryption Algorithm (TDEA), and the International Data Encryption Algorithm (IDEA). It can also include administrator-developed proprietary algorithms. This embodiment does not limit the type or number of symmetric encryption algorithms included in the symmetric group. Administrators can select symmetric encryption algorithms of a specific type and combine them to construct a symmetric algorithm chain. For example, they can select DES, RC5, 3DES, and Blowfish and sequentially concatenate them to form the symmetric algorithm chain DES-RC5-3DES-Blowfish. Since each symmetric encryption algorithm has its own key—for example, DES has key a, RC5 has key b, 3DES has key c, and Blowfish has key d—the corresponding keys are concatenated in the order of the symmetric encryption algorithms to create the key chain abcd. Of course, this embodiment is only an example and does not limit the specific form of the symmetric algorithm chain.

[0050] The asymmetric encryption information in the encryption policy rules includes the asymmetric algorithm chain, and the private key chain and public key chain that match the asymmetric algorithm chain. Figure 3 This is a schematic diagram of the structure of asymmetric encryption information. The asymmetric group is a database of asymmetric encryption algorithms, including commonly used asymmetric encryption algorithms such as RSA, Elgamal, and Rabin. It can also include administrator-developed proprietary algorithms. This embodiment limits the types and number of asymmetric encryption algorithms included in the asymmetric group. The administrator can select asymmetric encryption algorithms of a specified type and combine them to construct an asymmetric algorithm chain. For example, RSA and Rabin can be selected and concatenated sequentially to construct the asymmetric algorithm chain RSA-Rabin. For example, RSA and Rabin can be selected and concatenated sequentially to construct an asymmetric algorithm chain. Since each asymmetric algorithm has a private key and a public key, for example, RSA has a public key A and a private key C, and Rabin has a public key B and a private key D, the corresponding public keys can be concatenated sequentially according to the order of the asymmetric encryption algorithms to obtain a public key chain AB. Similarly, the corresponding private keys can be concatenated sequentially according to the order of the asymmetric encryption algorithms to obtain a private key chain CD. Of course, this embodiment is merely illustrative and does not limit the specific form of the asymmetric algorithm chain. The symmetric algorithm chain DES-RC5-3DES-Blowfish obtained above, along with the key chain abcd that matches the symmetric algorithm chain, the asymmetric algorithm chain RSA-Rabin, the public key chain AB that matches the asymmetric algorithm chain, and the private key chain CD that matches the asymmetric algorithm chain, can be combined to form encryption policy configuration rule X. This encryption policy configuration rule X can then be assigned to the employee group. The administrator can also determine the specific content of the client identities included in the employee group. For example, the client identities included in the employee group can be 00a, 00b, and 00c. Of course, this embodiment is merely illustrative and does not limit the specific content of the client identities included in the employee group.

[0051] Step S102: encrypt the original message using symmetric encryption information to obtain an encrypted message, and encrypt the symmetric encryption information using asymmetric encryption information to obtain a ciphertext.

[0052] Optionally, symmetric encryption information is used to encrypt the original message to obtain an encrypted message, and asymmetric encryption information is used to encrypt the symmetric encryption information to obtain a ciphertext, including: using a symmetric algorithm chain and a key chain to encrypt the original message to obtain an encrypted message; using an asymmetric algorithm chain and a public key chain to encrypt the key chain to obtain a ciphertext.

[0053] Optionally, the original message includes a message header and a message body, and the interface and the gateway are located in the message header; using a symmetric algorithm chain and a key chain to encrypt the original message to obtain an encrypted message includes: using a symmetric algorithm chain and a key chain to encrypt the message body in the original message to obtain an encrypted message.

[0054] Specifically, after the client obtains encryption policy rule X: symmetric algorithm chain DES-RC5-3DES-Blowfish, key chain abcd matching the symmetric algorithm chain, asymmetric algorithm chain RSA-Rabin, public key chain AB matching the asymmetric algorithm chain, and private key chain CD, it uses the symmetric algorithm chain and secret key chain UI to encrypt the original message P to obtain the encrypted message CP. During encryption, the original message P is first encrypted using the symmetric encryption algorithm DES and secret key a according to the algorithm sequence in the symmetric algorithm chain to obtain P1. Then, P1 is encrypted again using the symmetric encryption algorithm RC5 and secret key b to obtain P2. Then, P2 is encrypted thirdly using the symmetric encryption algorithm 3DES and secret key c to obtain P3. Finally, P3 is encrypted fourthly using the symmetric encryption algorithm Blowfish and secret key d to obtain the encrypted message CP. Performing multiple symmetric encryptions significantly improves message encryption security compared to single encryption. Of course, this embodiment is only an example and does not limit the number of encryptions performed according to the symmetric algorithm chain. As long as the number of encryptions matches the symmetric algorithm included in the symmetric algorithm chain, it is within the scope of protection of this application.

[0055] In addition, the client will also use the asymmetric algorithm chain RSA-Rabin and the public key chain AB to encrypt the key chain abcd to obtain the ciphertext. Among them, when encrypting, the asymmetric encryption algorithm RSA and the public key A are first used to encrypt the key chain abcd in accordance with the algorithm sequence in the asymmetric algorithm chain to obtain the key chain a'b'c'd', and then the asymmetric encryption algorithm Rabin and the public key B are used to encrypt a'b'c'd' for the second time to obtain the ciphertext CK. The security of the key can be further guaranteed by multiple asymmetric encryptions. Of course, this embodiment is only an example, and does not limit the number of encryptions performed according to the asymmetric algorithm chain. As long as the number of encryptions matches the asymmetric algorithm included in the asymmetric algorithm chain, it is within the scope of protection of this application.

[0056] It should be noted that the original message in this embodiment includes a message header and a message body, and the message header includes an interface and a gateway, that is, the specific receiving object of the message. When the original message is encrypted through a symmetric algorithm chain and a secret key chain, the message body in the original message is specifically encrypted to obtain an encrypted message.

[0057] Optionally, the method further includes: receiving a policy update message sent by a policy server; and updating the encryption policy rules according to the policy update message.

[0058] It's worth noting that, in this embodiment, the administrator on the policy server can adjust the encryption policy rules for each user group based on actual needs. For example, if client 00a is determined to be in the employee group and the original encryption policy configuration rule for the employee group is X, and the administrator adjusts the encryption policy configuration for the employee group to Y based on actual needs, client 00a will receive a policy update message from the policy server, which includes the adjusted encryption policy configuration rule Y. The client then encrypts the original message P according to encryption policy configuration rule Y based on the policy update message.

[0059] Step S103: Send the encrypted message, ciphertext and global tracking number to the gateway through the interface.

[0060] Specifically, in this embodiment, since only the message body of the original message is encrypted, the client can obtain the message recipient, namely the interface and gateway, by reading the message header. The client extracts the interface and gateway from the message header, searches the surrounding network environment, obtains an available network capable of communicating with the gateway, and then sends a transmission request to the gateway via the network, specifically via the interface specified in the message header. Because the transmission request includes a client identifier, the gateway verifies the client's identity based on the client identifier. If the verification is successful, the gateway receives, via the interface, the encrypted message obtained by encrypting the message, the ciphertext obtained by encrypting the key chain, and the global tracking number corresponding to the encryption policy rule.

[0061] Among them, after receiving the encrypted message, ciphertext and global tracking number, the gateway in this implementation will decrypt the encrypted message using the global tracking number and ciphertext, and send the original message obtained by decryption to the server associated with the interface. The gateway and the interacting server are located in the same local area network, and this implementation does not explain the information interaction process between the gateway and the server.

[0062] It is worth mentioning that the present embodiment uses an independent policy server, which can flexibly encrypt the original message according to the encryption algorithm and type configured in the encryption policy rules, and innovatively introduces the algorithm chain and secret key quantity, thereby increasing the security of the encryption. And by decoupling the policy server from the business, the dynamic update of the encryption algorithm is realized, thereby achieving hot deployment, further improving the security and reliability of the application system. In addition, the present application can also configure encryption rules for the message size during message transmission, perform complex encryption on sensitive small messages within the scope of system security and reliability, and perform simple encryption on insensitive large messages, so as to reduce system overhead and optimize performance. And the application system can also use the bg-debug field in the message header to decide whether to enable the encryption and decryption mode, which is convenient for debugging in the development and testing phase and security and confidentiality in the production phase. Of course, this embodiment is only an example, and does not limit the specific strategy for message encryption.

[0063] This embodiment introduces a policy server to configure the encryption policy rules required by the client, so that the client directly encrypts the message according to the encryption policy rules assigned by the policy server, realizing dynamic hot updates without modifying the code and redeploying the application system, and improving the security of message transmission.

[0064] Example 2

[0065] Figure 4 The process of the message decryption method provided in the embodiment of the present application is applicable to the case of decrypting a message. The method can be executed by a message decryption device, which can be implemented by software and / or hardware, such as Figure 4 , the method comprises the following steps:

[0066] Step S201: receiving an encrypted message, ciphertext and global tracking number sent by a client.

[0067] Optionally, receiving the encrypted message, ciphertext, and global tracking number sent by the client includes: receiving a transmission request sent by the client via an interface, wherein the transmission request includes a client identifier; performing identity verification on the client based on the client identifier, and receiving the encrypted message, ciphertext, and global tracking number sent by the client via the interface when the verification is determined to be successful. For example, the global tracking number is 1000, the encrypted message is CP, and the ciphertext is CK. Of course, this embodiment is merely illustrative and does not limit the specific contents of the global tracking number, encrypted message, and ciphertext.

[0068] Specifically, the encrypted message in this embodiment only encrypts the message body, and does not encrypt the message header. Therefore, the client can obtain the recipient of the message, namely the interface and gateway, by reading the message header. The client will extract the interface and gateway from the message header, search the surrounding network environment, obtain an available network that can communicate with the gateway, and send a transmission request to the gateway through the network, specifically to the gateway via the interface recorded in the message header. Because the transmission request includes a client identifier, the gateway will verify the identity of the client based on the client identifier. If the verification is successful, it will receive the encrypted message sent by the client through the interface, the ciphertext obtained by encrypting the key chain, and the global tracking number corresponding to the encryption policy rule.

[0069] It should be noted that, in this embodiment, when authenticating the client identifier, the client may specifically query whether the client has a history of attacking, such as repeatedly sending a large number of messages within a short period of time. If such a history is determined, the client is determined to have engaged in attacking behavior, and the client is determined to be an illegal user, and the information sent by the client is blocked. Of course, this embodiment is merely an example, and the client identifier verification process is not specifically limited in this embodiment.

[0070] Step S202: Obtain encryption policy rules according to the global tracking number query rule table.

[0071] Among them, the rule table contains the correspondence between the global tracking number and the encryption policy rule. Therefore, when the global tracking number is known, the corresponding encryption policy rule can be determined by querying the rule table, for example, encryption policy rule X. And the encryption policy rule specifically includes symmetric encryption information, and the symmetric encryption information is mainly composed of a symmetric algorithm chain and a secret key chain. At the same time, the encryption policy rule also includes asymmetric encryption information, and the asymmetric encryption information is mainly composed of an asymmetric algorithm chain, a private key chain and a public key chain. For example, the symmetric algorithm chain is DES-RC5-3DES-Blowfish, the asymmetric algorithm chain is RSA-Rabin, the public key chain is AB, and the private key chain is CD. Of course, this embodiment is only an example, and does not limit the specific content contained in the encryption policy rule.

[0072] Step S203: extract asymmetric encryption information from the encryption policy rules, and use the asymmetric encryption information to decrypt the ciphertext to obtain symmetric encryption information.

[0073] Optionally, the asymmetric encryption information includes an asymmetric algorithm chain, and a public key chain and a private key chain that match the symmetric algorithm chain; using the asymmetric encryption information to decrypt the ciphertext to obtain the symmetric encryption information includes: using the asymmetric algorithm chain and the private key chain to decrypt the ciphertext to obtain the symmetric encryption information, wherein the symmetric encryption information includes the key chain.

[0074] Specifically, this embodiment extracts an asymmetric encryption signal from the obtained encryption policy X, where the asymmetric algorithm chain is RSA-Rabin and the private key chain is CD. The asymmetric algorithm chain RSA-Rabin and the private key chain CD are then used to decrypt the ciphertext CK to obtain the key chain abcd in the symmetric information. The process of decrypting the ciphertext using the asymmetric algorithm chain and the private key chain to obtain the secret key chain is the reverse of the process of encrypting the secret key chain using the asymmetric algorithm chain and the public key chain to obtain the ciphertext, and will not be further described in this embodiment.

[0075] Step S204: Decrypt the encrypted message using the symmetric encryption information to obtain the original message.

[0076] Optionally, before using symmetric encryption information to decrypt the encrypted message to obtain the original message, it also includes: extracting a symmetric algorithm chain from the encryption policy rules; using the symmetric encryption information to decrypt the encrypted message to obtain the original message, including: decrypting the encrypted message according to the symmetric algorithm chain and the key chain to obtain the original message.

[0077] Specifically, after obtaining the key chain abcd through initial decryption, this embodiment extracts the symmetric algorithm chain DES-RC5-3DES-Blowfish from the encryption policy rule X, and uses the obtained symmetric algorithm chain DES-RC5-3DES-Blowfish and the key chain abcd to decrypt the encrypted message CP to obtain the original message P. The process of decrypting the encrypted message using the symmetric algorithm chain and the key chain to obtain the original message is the reverse process of encrypting the original message using the symmetric algorithm and the key chain to obtain the encrypted message, and will not be described in detail in this embodiment.

[0078] Optionally, after decrypting the encrypted message using the symmetric encryption information to obtain the original message, the method further includes: determining the server connected to the interface; and sending the original message to the server, so that the server responds to the original message.

[0079] It should be noted that, in this embodiment, after obtaining the original message, the server connected to the interface will also be determined. For example, the gateway includes three interfaces: interface 1, interface 2, and interface 3, and interface 1 is connected to server 1, interface 2 is connected to server 2, and interface 3 is connected to server 3. Therefore, when it is determined that the transmission request sent by the client is obtained through interface 1, the original message P obtained after decryption will be sent to server 1. After receiving the original message P, server 1 will parse the original message P and generate a corresponding response message Q, and feed back the response message Q to the client. In addition, the process of the server feeding back the response message to the client is roughly the same as the process of the client transmitting to the server mentioned above. It can also be transmitted in an encrypted manner to ensure the security of the response message transmission. In this embodiment, the encryption and decryption of the response message and the transmission process are not described in detail.

[0080] This embodiment introduces a policy server to configure the encryption policy rules required by the client, so that the client directly encrypts the message according to the encryption policy rules assigned by the policy server, realizing dynamic hot updates without modifying the code and redeploying the application system, and improving the security of message transmission.

[0081] Example 3

[0082] Figure 5 This is a schematic diagram of the structure of the message encryption device provided in the embodiment of the present application. Figure 5 As shown, the message encryption device includes: a message assembly request sending module 310, an encryption module 320 and an encryption information sending module 330.

[0083] The message assembly request sending module 310 is configured to send a message assembly request to the policy server and receive encryption policy rules and a global tracking number fed back by the policy server based on the message assembly request, wherein the encryption policy rules include symmetric encryption information and asymmetric encryption information;

[0084] An encryption module 320 is configured to encrypt an original message using symmetric encryption information to obtain an encrypted message, and to encrypt the symmetric encryption information using asymmetric encryption information to obtain a ciphertext, wherein the original message includes an interface and a gateway;

[0085] The encrypted information sending module 330 is used to send the encrypted message, ciphertext and global tracking number to the gateway through the interface.

[0086] Optionally, a message assembly request sending module is used to send a message assembly request to the policy server, wherein the message assembly request includes the client identity;

[0087] Receiving encryption policy rules determined by the policy server according to the client identity, wherein the encryption policy configuration rules are pre-configured for the user group to which the client identity is located;

[0088] A global tracking number is received, which is generated in real time by the policy server according to the encryption policy rule, wherein the global tracking number is used to identify the encryption policy rule.

[0089] Optionally, the symmetric encryption information includes a symmetric algorithm chain and a key chain matching the symmetric algorithm chain, wherein the symmetric algorithm chain is composed of multiple symmetric algorithms of different types arranged in a specified order;

[0090] Asymmetric encryption information includes an asymmetric algorithm chain, and a public key chain and a private key chain that match the asymmetric algorithm chain. The asymmetric algorithm chain is composed of multiple different types of asymmetric algorithms arranged in a specified order.

[0091] Optionally, an encryption module, configured to encrypt the original message using a symmetric algorithm chain and a key chain to obtain an encrypted message;

[0092] The key chain is encrypted using an asymmetric algorithm chain and a public key chain to obtain ciphertext.

[0093] Optionally, the original message includes a message header and a message body, and the interface and the gateway are located in the message header; the encryption module is further used to encrypt the message body in the original message using a symmetric algorithm chain and a key chain to obtain an encrypted message.

[0094] Example 4

[0095] Figure 6 This is a schematic diagram of the structure of the message decryption device provided in the embodiment of the present application. Figure 6 As shown, the message decryption device includes:

[0096] The encrypted information receiving module 410 is used to receive the encrypted message, ciphertext and global tracking number sent by the client;

[0097] The encryption policy rule acquisition module 420 is used to query the rule table according to the global tracking number to obtain the encryption policy rule, wherein the rule table contains the correspondence between the global tracking number and the encryption policy rule;

[0098] A first decryption module 430 is configured to extract asymmetric encryption information from the encryption policy rules and decrypt the ciphertext using the asymmetric encryption information to obtain symmetric encryption information;

[0099] The second decryption module 440 is configured to decrypt the encrypted message using the symmetric encryption information to obtain the original message.

[0100] Optionally, an encrypted information receiving module is configured to receive a transmission request sent by a client through an interface, wherein the transmission request includes a client identifier;

[0101] The client's identity is verified according to the client's identification. When it is determined that the verification is passed, the encrypted message, ciphertext and global tracking number sent by the client are received through the interface.

[0102] Optionally, the asymmetric encryption information includes an asymmetric algorithm chain, and a public key chain and a private key chain that match the symmetric algorithm chain; the first decryption module is used to decrypt the ciphertext using the asymmetric algorithm chain and the private key chain to obtain the symmetric encryption information, wherein the symmetric encryption information includes the key chain.

[0103] Optionally, the device also includes a symmetric algorithm chain extraction module for extracting a symmetric algorithm chain from the encryption policy rules; and a second decryption module for decrypting the encrypted message according to the symmetric algorithm chain and the key chain to obtain the original message.

[0104] Optionally, the device further comprises an original message sending module, configured to determine a server connected to the interface;

[0105] Send the original message to the server so that the server can respond to the original message.

[0106] It should be noted that it should be understood that the division of the various modules of the above device is merely a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. Moreover, these modules can all be implemented in the form of software called by processing elements; they can also all be implemented in the form of hardware; some modules can also be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. In addition, these modules can be fully or partially integrated together or implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules can be completed by the hardware integrated logic circuit in the processor element or by instructions in the form of software.

[0107] Example 5

[0108] Figure 7A schematic diagram of the structure of a client 10 that can be used to implement an embodiment of the present invention is shown. The client is intended to represent various forms of digital computers, such as laptops, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The client can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0109] like Figure 7 As shown, the client 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. Various programs and data required for the operation of the client 10 can also be stored in the RAM 13. The processor 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0110] Multiple components in client 10 are connected to I / O interface 15, including: an input unit 16, such as a keyboard and mouse; an output unit 17, such as various types of displays and speakers; a storage unit 18, such as a magnetic disk and optical disk; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. Communication unit 19 allows client 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0111] Processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any other suitable processors, controllers, microcontrollers, etc. Processor 11 executes the various methods and processes described above, such as the message encryption method of the project.

[0112] In some embodiments, the message encryption method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on client 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the message encryption method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the message encryption method in any other appropriate manner (e.g., via firmware).

[0113] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0114] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0115] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0116] To provide interaction with a user, the systems and techniques described herein can be implemented on a client having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the client. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0117] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0118] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0119] Example 6

[0120] Figure 8 A schematic diagram of the structure of a gateway 20 that can be used to implement an embodiment of the present invention is shown. The gateway is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The gateway can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0121] like Figure 8 As shown, the gateway 20 includes at least one processor 21, and a memory connected to the at least one processor 21, such as a read-only memory (ROM) 22, a random access memory (RAM) 23, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 21 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 22 or the computer program loaded from the storage unit 28 to the random access memory (RAM) 23. Various programs and data required for the operation of the gateway 20 can also be stored in RAM23. The processor 21, ROM22 and RAM23 are connected to each other via a bus 24. An input / output (I / O) interface 25 is also connected to the bus 24.

[0122] Multiple components in the gateway 20 are connected to the I / O interface 25, including an input unit 26, such as a keyboard, mouse, etc.; an output unit 27, such as various types of displays, speakers, etc.; a storage unit 28, such as a magnetic disk, optical disk, etc.; and a communication unit 29, such as a network card, modem, wireless communication transceiver, etc. The communication unit 29 allows the gateway 20 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0123] The processor 21 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the processor 21 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 21 executes the various methods and processes described above, such as the message decryption method.

[0124] In some embodiments, the message decryption method may be implemented as a computer program that is tangibly contained in a computer-readable storage medium, such as a storage unit 28. In some embodiments, part or all of the computer program may be loaded and / or installed on the gateway 20 via the ROM 22 and / or the communication unit 29. When the computer program is loaded into the RAM 23 and executed by the processor 21, one or more steps of the message decryption method described above may be performed. Alternatively, in other embodiments, the processor 21 may be configured to perform the message decryption method in any other appropriate manner (e.g., by means of firmware).

[0125] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0126] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0127] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0128] To provide interaction with a user, the systems and techniques described herein can be implemented on a gateway having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the gateway. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0129] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0130] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0131] Example 7

[0132] An embodiment of the present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the message encryption method or the message decryption method provided in any embodiment of the present application.

[0133] The computer program product may be implemented by writing computer program code for performing the operations of the present invention in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0134] Note that the above are only preferred embodiments of the present invention and the technical principles employed. Those skilled in the art will appreciate that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments, and substitutions are possible for those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments and may include many other equivalent embodiments without departing from the scope of the present invention. The scope of the present invention is determined by the scope of the appended claims.

Claims

1. A message encryption method, applied to a client, characterized in that: include: Sending a message assembly request to a policy server, and receiving encryption policy rules and a global tracking number fed back by the policy server based on the message assembly request, wherein the encryption policy rules include symmetric encryption information and asymmetric encryption information, the symmetric encryption information includes a symmetric algorithm chain and a key chain matching the symmetric algorithm chain, and the asymmetric encryption information includes an asymmetric algorithm chain and a public key chain and a private key chain matching the asymmetric algorithm chain; Encrypting an original message using the symmetric encryption information to obtain an encrypted message, and encrypting the symmetric encryption information using the asymmetric encryption information to obtain a ciphertext, wherein the original message includes an interface and a gateway, the original message includes a message header and a message body, and the interface and the gateway are located in the message header; sending the encrypted message, the ciphertext and the global tracking number to the gateway via the interface; Encrypting the original message using the symmetric encryption information to obtain an encrypted message, and encrypting the symmetric encryption information using the asymmetric encryption information to obtain a ciphertext, including: encrypting the original message using the symmetric algorithm chain and the key chain to obtain the encrypted message; and encrypting the key chain using the asymmetric algorithm chain and the public key chain to obtain the ciphertext; The adopting the symmetric algorithm chain and the key chain to encrypt the original message to obtain the encrypted message includes: adopting the symmetric algorithm chain and the key chain to encrypt the message body in the original message to obtain the encrypted message.

2. The method according to claim 1, characterized in that The sending of a message assembly request to a policy server and receiving an encryption policy rule and a global tracking number fed back by the policy server according to the message assembly request include: Sending a message assembly request to the policy server, wherein the message assembly request includes a client identity; receiving an encryption policy rule determined by the policy server according to the client identity, wherein the encryption policy configuration rule is pre-configured for a user group to which the client identity belongs; The global tracking number generated by the policy server in real time according to the encryption policy rule is received, wherein the global tracking number is used to identify the encryption policy rule.

3. The method according to claim 1, characterized in that The symmetric algorithm chain is composed of multiple symmetric algorithms of different types arranged in a specified order; The asymmetric algorithm chain is composed of a plurality of asymmetric algorithms of different types arranged in a specified order.

4. The method according to claim 1, wherein The method further comprises: receiving a policy update message sent by the policy server; The encryption policy rules are updated according to the policy update message.

5. A message decryption method, applied to a gateway, characterized in that: include: Receive the encrypted message, ciphertext and global tracking number sent by the client; Obtaining encryption policy rules according to the global tracking number query rule table, wherein the rule table contains a correspondence between global tracking numbers and encryption policy rules; Extracting asymmetric encryption information from the encryption policy rule, and decrypting the ciphertext using the asymmetric encryption information to obtain symmetric encryption information, wherein the asymmetric encryption information includes an asymmetric algorithm chain, and a public key chain and a private key chain matching the asymmetric algorithm chain; Decrypting the encrypted message using the symmetric encryption information to obtain the original message, wherein the symmetric encryption information includes a symmetric algorithm chain and a key chain matching the symmetric algorithm chain; Decrypting the ciphertext using the asymmetric encryption information to obtain the symmetric encryption information includes: decrypting the ciphertext using the asymmetric algorithm chain and the private key chain to obtain the symmetric encryption information; Before decrypting the encrypted message using the symmetric encryption information to obtain the original message, the method further includes: extracting a symmetric algorithm chain from the encryption policy rule; The use of the symmetric encryption information to decrypt the encrypted message to obtain the original message includes: decrypting the encrypted message according to the symmetric algorithm chain and the key chain to obtain the original message, wherein the original message includes a message header and a message body, and the interface and gateway are located in the message header.

6. The method according to claim 5, characterized in that The receiving client sends an encrypted message, ciphertext and global tracking number, including: receiving a transmission request sent by a client through an interface, wherein the transmission request includes a client identifier; The identity of the client is verified according to the client identifier, and when it is determined that the verification passes, the encrypted message, the ciphertext and the global tracking number sent by the client are received through the interface.

7. The method according to claim 5, characterized in that After decrypting the encrypted message using the symmetric encryption information to obtain the original message, the method further includes: Determine the server connected to the interface; The original message is sent to the server, so that the server responds to the original message.

8. A message encryption device, characterized in that: include: a message assembly request sending module, configured to send a message assembly request to a policy server, and receive encryption policy rules and a global tracking number fed back by the policy server based on the message assembly request, wherein the encryption policy rules include symmetric encryption information and asymmetric encryption information, the symmetric encryption information includes a symmetric algorithm chain and a key chain matching the symmetric algorithm chain, and the asymmetric encryption information includes an asymmetric algorithm chain and a public key chain and a private key chain matching the asymmetric algorithm chain; an encryption module, configured to encrypt an original message using the symmetric encryption information to obtain an encrypted message, and to encrypt the symmetric encryption information using the asymmetric encryption information to obtain a ciphertext, wherein the original message includes an interface and a gateway, the original message includes a message header and a message body, and the interface and the gateway are located in the message header; an encrypted information sending module, configured to send the encrypted message, the ciphertext, and the global tracking number to the gateway via the interface; The encryption module is configured to encrypt the original message using the symmetric algorithm chain and the key chain to obtain the encrypted message; and to encrypt the key chain using the asymmetric algorithm chain and the public key chain to obtain the ciphertext; The encryption module is used to encrypt the message body in the original message using the symmetric algorithm chain and the key chain to obtain the encrypted message when executing the encryption of the original message using the symmetric algorithm chain and the key chain to obtain the encrypted message.

9. A message decryption device, characterized in that: include: Encrypted information receiving module, used to receive encrypted messages, ciphertext and global tracking number sent by the client; an encryption policy rule acquisition module, configured to query a rule table according to the global tracking number to acquire encryption policy rules, wherein the rule table contains a correspondence between global tracking numbers and encryption policy rules; a first decryption module, configured to extract asymmetric encryption information from the encryption policy rule, and decrypt the ciphertext using the asymmetric encryption information to obtain symmetric encryption information, wherein the asymmetric encryption information includes an asymmetric algorithm chain, and a public key chain and a private key chain matching the asymmetric algorithm chain; a second decryption module, configured to decrypt the encrypted message using the symmetric encryption information to obtain an original message, wherein the symmetric encryption information includes a symmetric algorithm chain and a key chain matching the symmetric algorithm chain; The first decryption module is configured to decrypt the ciphertext using the asymmetric algorithm chain and the private key chain to obtain the symmetric encrypted information; The device further includes a symmetric algorithm chain extraction module for extracting a symmetric algorithm chain from the encryption policy rule before decrypting the encrypted message using the symmetric encryption information to obtain the original message; The second decryption module is used to decrypt the encrypted message according to the symmetric algorithm chain and the key chain to obtain the original message, wherein the original message includes a message header and a message body, and the interface and gateway are located in the message header.

10. A client, characterized in that: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the message encryption method according to any one of claims 1 to 4.

11. A gateway, characterized in that: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the message decryption method according to any one of claims 5 to 7.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the message encryption method or the message decryption method according to any one of claims 1 to 4 or claims 5 to 7.

13. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the message encryption method or the message decryption method according to any one of claims 1 to 4 or claims 5 to 7.

Images