A commercial password security transmission method and system based on a trusted network

Abstract

The present invention provides a commercial password security transmission method and system based on a trusted innovation network, which relates to the field of commercial password transmission, including a service terminal, a user verification and authorization module, an encryption module, a conversion module and a key transmission module, wherein the user verification and authorization module performs real-name verification on the user and generates a user network node in the service terminal, and constructs a communication transmission channel in these nodes, and the encryption module is used for constructing encryption nodes; in the process of information transmission, the present invention encrypts the transmitted information by randomly selecting an encryption algorithm, thereby ensuring the difficulty of cracking the information after being intercepted, and in the process of distributing the decryption key, the key is divided, and the divided key segments are encrypted and decrypted by the encryption formula of the encryption end, so that even if the key is intercepted during distribution, all the decryption key information cannot be obtained.

Description

Technical Field

[0001] The present invention relates to the field of commercial password transmission technology, and in particular to a commercial password security transmission method and system based on a trusted network. Background Art

[0002] Commercial cryptographic secure transmission mainly refers to the use of commercial cryptographic technology to ensure the confidentiality, integrity and authenticity of information during transmission;

[0003] Although commercial encryption can provide encryption protection through symmetric encryption, asymmetric encryption, and digital signatures, the cryptographic algorithm itself may have loopholes or the risk of being hacked. In addition, improper key management may also lead to security issues. Therefore, the present invention proposes a commercial encryption security transmission method based on a trusted network to solve the problems existing in the prior art. Summary of the invention

[0004] In response to the above problems, the present invention proposes a commercial password security transmission method based on a trusted network and a system thereof. During the information transmission process, the commercial password security transmission method based on the trusted network encrypts the transmission information by randomly selecting an encryption algorithm, thereby ensuring the difficulty of cracking the information after it is intercepted. At the same time, during the distribution of decryption keys, the key is split, and the split key segments are encrypted and decrypted through the encryption formula of the encryption end. Even if the distribution is intercepted, all decryption key information cannot be obtained.

[0005] To achieve the purpose of the present invention, the present invention is implemented by the following technical solutions: a commercial password security transmission method based on a trusted network, comprising the following steps;

[0006] S1. Construct a service terminal for commercial encryption. Specifically, fill the service terminal through a user network node, an encryption node and a key transmission node. At the same time, the user qualifications are reviewed through the user network node. The user network node stores a key transmission node encryption model and an encryption terminal.

[0007] S2. The encryption node responds to the encryption model of the key transmission node and generates a key. The encryption node obtains the encryption algorithm in the encryption model of the key transmission node, and when the encryption node transmits information, randomly selects one of the encryption algorithms in the obtained encryption model of the key transmission node for encrypting the information transmitted by the encryption node, and generates a corresponding decryption key according to the encryption algorithm in the encryption model of the key transmission node;

[0008] S3, the key transmission node analyzes the decryption key after segmentation, generates decryption key segmentation information after segmentation of the decryption key, performs a second calculation on the segmented key through the encryption formula of the encryption end to obtain calculation information and segmented key result information, and sends the calculation information and the segmented key result information to the user network node at the same time, and the user network node obtains the segmented key result information through the encryption end;

[0009] S4. The user network node decrypts the divided key result information according to the encryption formula of the encryption end and the calculation information and obtains the decryption key division information, and then integrates it to generate complete decryption key information, and decrypts the transmission information according to the complete decryption key information.

[0010] A further improvement is that in the step S1, the user network node is constructed by performing real-name authentication on the user, and the identity of the user is authenticated when the user network node logs in.

[0011] A further improvement is that in the S2 step, the encryption model of the key transmission node stores encryption algorithms, including AES, RSA and ECC. When the encryption node encrypts the transmitted information, it encrypts the transmitted data and generates a corresponding decryption key by randomly selecting an algorithm therefrom.

[0012] Further improvement lies in: by randomly selecting a group of encryption algorithms in the key transmission node encryption model, encrypting the data according to the encryption principle of the algorithm, and generating corresponding decryption keys at the same time. When using the ECC algorithm, the generation of the key depends on the points on the elliptic curve. An elliptic curve and a base point are selected, the private key is a randomly selected integer, and the public key is the product of the private key and the base point. When encrypting, encryption is performed using the public key, and the private key is used as the decryption key.

[0013] A further improvement is that in the step S3, before the decryption key is divided, the decryption key is converted into an integer Z, and then the decryption key is divided.

[0014] Further improvements are as follows: regarding the determination of the split point in the S3 step, subset information is created based on the key result information split by the split point, and parent set information is created based on the complete decryption key information, an association threshold detection algorithm is set based on the subset information and the parent set information, which is used to perform a correlation analysis between the subset information and the parent set information, generate association result information between the key result information split by the split point and the decryption key information, determine the update frequency of the decryption key based on the association result information, and dynamically adjust the key result information split by the split point.

[0015] Further improvement lies in: in the detection process of the association threshold detection algorithm, a feature quantity comparison mechanism is defined, a feature quantity comparison function is introduced, feature quantities are compared between the subset information and the parent set information, and common feature quantity data is generated. The common feature quantity data is compared with the preset association threshold, that is, when the common feature quantity is greater than the preset association threshold, the correlation is large, otherwise it is small. When the common feature quantity is greater than the preset association threshold or less than the preset association threshold, the feature points of the subset information and the parent set information are reselected.

[0016] A further improvement is that when the decryption key is divided, the decryption key is divided into n points to generate decryption key division information, which is divided into j0, j1, j2, j3...jn. The key transmission node encrypts and calculates the decryption key division information through the encryption formula of the encryption end. The encryption formula is shown in formula (1):

[0017] Ki = bji moda (1);

[0018] In formula (1), Ki is the encrypted value of the ji-segment key, a is the base, b is the prime modulus, ji is the split key segment, and the value of i ranges from 0 to n;

[0019] The key transmission node sends the calculation information to the user network node. The calculation information includes the encrypted value Ki, base a and prime modulus b of the ji segment key. The user network node reversely deduce the value of ji through the encryption formula of the encryption end and the calculation information.

[0020] A further improvement is that: after the user network node reversely derives the value of ji, the values ​​of n+1 ji are integrated, and the integration step includes:

[0021] W1, determine n segmentation points xi;

[0022] W2. For each segmentation point xi, calculate the corresponding function value f(xi), and f(x) is the key to be segmented;

[0023] W3, the split points and the corresponding function values ​​are combined into a data set (xi, f(xi)), and a polynomial is constructed as shown in formula (2);

[0024]

[0025] In formula (2) is the Lagrange basic polynomial;

[0026] W4. The user network node inputs the inversely derived value of (xi, f(xi)) into the polynomial formula (2) and combines them through product and sum operations to reconstruct the integer Z. Z is then converted through the conversion module to obtain the decryption key.

[0027] The transmission system applied to the above-mentioned commercial password security transmission method based on the Xinchuang network includes a service terminal, a user verification and authorization module, an encryption module, a conversion module and a key transmission module;

[0028] The user verification and authorization module verifies the user's real name and generates user network nodes in the service terminal, and builds communication transmission channels among these nodes;

[0029] The encryption module is used to construct an encryption node, and a storage module for storing a key transmission node encryption model and an encryption end is provided in the encryption module;

[0030] The key transmission module is used to construct a key transmission node. The key transmission module divides the decryption key and generates key division information. Then, the encryption formula is obtained from the encryption end in the encryption module to perform a second calculation on the key division information to obtain calculation information and divided key result information and send them to the user verification and authorization module.

[0031] The conversion module is used for converting the decryption key into an integer that can be divided.

[0032] The beneficial effects of the present invention are as follows: in the process of information transmission, the present invention encrypts the transmitted information by randomly selecting an encryption algorithm, thereby ensuring the difficulty of cracking the information after being intercepted; at the same time, in the process of distributing the decryption key, the key is split, and the split key segments are encrypted and decrypted by the encryption formula of the encryption end. Even if the distribution is intercepted, all the decryption key information cannot be obtained, which increases the difficulty of cracking; and under the premise of not knowing the encryption formula, even if all the large-amount confidential key split information is intercepted, the key split information cannot be decrypted, which greatly increases the security of the system; at the same time, according to the correlation between the subset information and the parent set information, it is determined whether the key split information split after the feature point selection is safe and whether it is too split, which further ensures the security of the key transmission; at the same time, it also provides inspiration for the selection of the next split point, reduces the range and avoids unnecessary multi-layer splitting, can speed up the splitting efficiency and accuracy, and further increases the overall efficiency of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is an architecture diagram of the transmission system of the present invention.

[0034] Figure 2 It is a schematic diagram of the key decryption of the present invention.

[0035] Figure 3 It is a flow chart of the transmission system of the present invention. DETAILED DESCRIPTION

[0036] In order to deepen the understanding of the present invention, the present invention will be further described in detail below in conjunction with examples. The examples are only used to explain the present invention and do not constitute a limitation on the protection scope of the present invention.

[0037] according to Figure 1-3 As shown, this embodiment proposes a commercial password security transmission method based on a trusted network, comprising the following steps:

[0038] S1. Construct a service terminal for commercial encryption. Specifically, fill the service terminal through a user network node, an encryption node and a key transmission node. At the same time, the user qualifications are reviewed through the user network node. The user network node stores a key transmission node encryption model and an encryption terminal.

[0039] S2. The encryption node responds to the encryption model of the key transmission node and generates a key. The encryption node obtains the encryption algorithm in the encryption model of the key transmission node, and when the encryption node transmits information, randomly selects one of the encryption algorithms in the obtained encryption model of the key transmission node for encrypting the information transmitted by the encryption node, and generates a corresponding decryption key according to the encryption algorithm in the encryption model of the key transmission node;

[0040] S3, the key transmission node analyzes the decryption key after segmentation, generates decryption key segmentation information after segmentation of the decryption key, performs a second calculation on the segmented key through the encryption formula of the encryption end to obtain calculation information and segmented key result information, and sends the calculation information and the segmented key result information to the user network node at the same time, and the user network node obtains the segmented key result information through the encryption end;

[0041] S4. The user network node decrypts the divided key result information according to the encryption formula of the encryption end and the calculation information and obtains the decryption key division information, and then integrates it to generate complete decryption key information, and decrypts the transmission information according to the complete decryption key information.

[0042] In step S1, the user network node is constructed by performing real-name authentication on the user, and the user's identity is authenticated when logging into the user network node to ensure the safe use of the user network node.

[0043] In step S2, the encryption model of the key transmission node stores encryption algorithms, including AES, RSA, and ECC, among which AES is a symmetric encryption algorithm, and RSA and ECC are asymmetric encryption algorithms. When encrypting data, the encryption node encrypts the transmitted data by randomly selecting an algorithm from the encryption node when encrypting the transmitted information and generates a corresponding decryption key. For example, the ECC algorithm is randomly selected as the encryption algorithm. The ECC encryption algorithm uses the public key to encrypt the data, and the receiver uses the private key to decrypt. The encryption process includes selecting a random number, calculating the product of the plaintext and the random number as part of the ciphertext, and taking the product of the random number and the receiver's public key as another part of the ciphertext. The decryption process calculates the value of the random number through the private key, and then restores the plaintext. The generation of the key mainly depends on the point on the elliptic curve. A suitable elliptic curve and a base point (generator) are selected. The private key is a randomly selected integer, and the public key is the product of the private key and the base point, thereby generating a decryption key.

[0044] In step S3, before the decryption key is divided, the decryption key is converted into an integer Z, and then the decryption key is divided.

[0045] In step S3, regarding the determination of the split point, subset information is created based on the key result information split by the split point, and parent set information is created based on the complete decryption key information. An association threshold detection algorithm is set based on the subset information and parent set information to perform a correlation analysis between the subset information and the parent set information, generate correlation result information between the key result information split by the split point and the decryption key information, determine the update frequency of the decryption key based on the correlation result information, and dynamically adjust the key result information split by the split point.

[0046] During the detection process of the association threshold detection algorithm, a feature quantity comparison mechanism is defined, a feature quantity comparison function is introduced, feature quantities are compared between the subset information and the parent set information, and common feature quantity data is generated. The common feature quantity data is compared with the preset association threshold, that is, when the common feature quantity is greater than the preset association threshold, the correlation is large, otherwise it is small. When the common feature quantity is greater than the preset association threshold or less than the preset association threshold, the feature points of the subset information and the parent set information are reselected.

[0047] When the decryption key is divided, the decryption key is divided into n points to generate decryption key division information, which is divided into j0, j1, j2, j3...jn. The key transmission node encrypts and calculates the decryption key division information through the encryption formula of the encryption end. The encryption formula is shown in formula (1):

[0048] Ki = bji moda (1);

[0049] In formula (1), Ki is the encrypted value of the ji-segment key, a is the base, b is the prime modulus, ji is the split key segment, and the value of i ranges from 0 to n;

[0050] The key transmission node sends the calculation information to the user network node. The calculation information includes the encrypted value Ki, base a and prime modulus b of the ji segment key. The user network node reversely deduce the value of ji through the encryption formula of the encryption end and the calculation information.

[0051] The user network node integrates the values ​​of n+1 ji after inverting the value of ji, and the integration step includes:

[0052] W1, determine n segmentation points xi;

[0053] W2. For each segmentation point xi, calculate the corresponding function value f(xi), and f(x) is the key to be segmented;

[0054] W3, the split points and the corresponding function values ​​are combined into a data set (xi, f(xi)), and a polynomial is constructed as shown in formula (2);

[0055]

[0056] In formula (2) is the Lagrange basic polynomial;

[0057] W4. The user network node inputs the inversely derived value of (xi, f(xi)) into the polynomial formula (2) and combines them through product and sum operations to reconstruct the integer Z. Z is then converted through the conversion module to obtain the decryption key.

[0058] A transmission system for the above-mentioned commercial password security transmission method based on the Xinchuang network, including a service terminal, a user verification and authorization module, an encryption module, a conversion module and a key transmission module;

[0059] The user verification and authorization module verifies the user's real name and generates user network nodes in the service terminal, and builds communication transmission channels in these nodes. At the same time, the user verification and authorization module is provided with a storage module for storing the encryption model of the key transmission node and the encryption end;

[0060] The encryption module is used to construct an encryption node;

[0061] The key transmission module is used to construct a key transmission node. The key transmission module divides the decryption key and generates key division information. Then, the encryption formula is obtained from the encryption end in the encryption module to perform a second calculation on the key division information to obtain calculation information and divided key result information and send them to the user verification and authorization module.

[0062] The conversion module is used for converting the decryption key into an integer that can be divided.

[0063] During the information transmission process, the transmission information is encrypted by randomly selecting an encryption algorithm to ensure the difficulty of cracking after the information is intercepted. At the same time, during the distribution of the decryption key, the key is split, and the split key segments are encrypted and decrypted through the encryption formula of the encryption end. Even if it is intercepted during distribution, all the decryption key information cannot be obtained, which increases the difficulty of cracking. Without knowing the encryption formula, even if all large-scale confidential key split information is intercepted, the key split information cannot be decrypted, which greatly increases the security of the system. At the same time, according to the correlation between the subset information and the parent set information, it is determined whether the key split information split after the feature point selection is safe and whether it is too split, which further ensures the security of the key transmission. At the same time, it also provides inspiration for the selection of the next split point, reducing the range to avoid unnecessary multi-layer splitting, which can speed up the splitting efficiency and accuracy, and further increase the overall efficiency of the system.

[0064] The above shows and describes the basic principles, main features and advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A commercial password security transmission method based on a trusted network, characterized by: The steps include: S1. Construct a service terminal for commercial encryption. Specifically, fill the service terminal through a user network node, an encryption node and a key transmission node. At the same time, the user qualifications are reviewed through the user network node. The user network node stores a key transmission node encryption model and an encryption terminal. S2. The encryption node responds to the encryption model of the key transmission node and generates a key. The encryption node obtains the encryption algorithm in the encryption model of the key transmission node, and when the encryption node transmits information, randomly selects one of the encryption algorithms in the obtained encryption model of the key transmission node for encrypting the information transmitted by the encryption node, and generates a corresponding decryption key according to the encryption algorithm in the encryption model of the key transmission node; S3, the key transmission node analyzes the decryption key after segmentation, generates decryption key segmentation information after segmentation of the decryption key, performs a second calculation on the segmented key through the encryption formula of the encryption end to obtain calculation information and segmented key result information, and sends the calculation information and the segmented key result information to the user network node at the same time, and the user network node obtains the segmented key result information through the encryption end; S4. The user network node decrypts the divided key result information according to the encryption formula of the encryption end and the calculation information and obtains the decryption key division information, and then integrates it to generate complete decryption key information, and decrypts the transmission information according to the complete decryption key information.

2. According to claim 1, a commercial password security transmission method based on a trusted network is characterized in that: In the step S1, the user network node is constructed by performing real-name authentication on the user, and the identity of the user is authenticated when the user network node logs in.

3. According to claim 1, a commercial password security transmission method based on a trusted network is characterized in that: In the step S2, the encryption model of the key transmission node stores encryption algorithms, including AES, RSA and ECC. When the encryption node encrypts the transmitted information, it encrypts the transmitted data and generates a corresponding decryption key by randomly selecting an algorithm from them.

4. According to claim 3, a commercial password security transmission method based on a trusted network is characterized in that: By randomly selecting a group of encryption algorithms in the key transmission node encryption model, the data is encrypted according to the encryption principle of the algorithm, and the corresponding decryption key is generated. When the ECC algorithm is adopted, the generation of the key depends on the points on the elliptic curve. An elliptic curve and a base point are selected, the private key is a randomly selected integer, and the public key is the product of the private key and the base point. When encryption is performed, encryption is performed with the public key, and the private key is used as the decryption key.

5. According to claim 1, a commercial password security transmission method based on a trusted network is characterized in that: In the step S3, before the decryption key is divided, the decryption key is converted into an integer Z, and then the decryption key is divided.

6. According to claim 1, a commercial password security transmission method based on a trusted network is characterized in that: Regarding the determination of the split point in the said S3 step, subset information is created according to the key result information split by the split point, and parent set information is created according to the complete decryption key information, and an association threshold detection algorithm is set based on the subset information and parent set information to perform a correlation analysis between the subset information and the parent set information, generate association result information between the key result information split by the split point and the decryption key information, determine the update frequency of the decryption key according to the association result information, and thereby dynamically adjust the key result information split by the split point.

7. A commercial password security transmission method based on a trusted network according to claim 6, characterized in that: During the detection process of the association threshold detection algorithm, a feature quantity comparison mechanism is defined, a feature quantity comparison function is introduced, feature quantities are compared between the subset information and the parent set information, and common feature quantity data is generated. The common feature quantity data is compared with the preset association threshold, that is, when the common feature quantity is greater than the preset association threshold, the correlation is large, otherwise it is small. When the common feature quantity is greater than the preset association threshold or less than the preset association threshold, the feature points of the subset information and the parent set information are reselected.

8. According to claim 5, a commercial password security transmission method based on a trusted network is characterized in that: When the decryption key is divided, the decryption key is divided into n points to generate decryption key division information, which is divided into j0, j1, j2, j3...jn. The key transmission node encrypts and calculates the decryption key division information through the encryption formula of the encryption end. The encryption formula is shown in formula (1): Ki=bji mod a (1); In formula (1), Ki is the encrypted value of the ji-segment key, a is the base, b is the prime modulus, ji is the split key segment, and the value of i ranges from 0 to n; The key transmission node sends the calculation information to the user network node. The calculation information includes the encrypted value Ki, base a and prime modulus b of the ji segment key. The user network node reversely deduce the value of ji through the encryption formula of the encryption end and the calculation information.

9. A commercial password security transmission method based on a trusted network according to claim 8, characterized in that: The user network node integrates the values ​​of n+1 ji after inverting the value of ji, and the integration step includes: W1, determine n segmentation points xi; W2. For each segmentation point xi, calculate the corresponding function value f(xi), and f(x) is the key to be segmented; W3, the split points and the corresponding function values ​​are combined into a data set (xi, f(xi)), and a polynomial is constructed as shown in formula (2); In formula (2) is the Lagrange basic polynomial; W4. The user network node inputs the inversely derived value of (xi, f(xi)) into the polynomial formula (2) and combines them through product and sum operations to reconstruct the integer Z. Z is then converted through the conversion module to obtain the decryption key.

10. A transmission system applied to the secure transmission method of commercial encryption based on the Xinchuang network according to any one of claims 1 to 9, characterized in that: It includes a service terminal, a user authentication and authorization module, an encryption module, a conversion module and a key transmission module; The user verification and authorization module verifies the user's real name and generates user network nodes in the service terminal, and builds communication transmission channels among these nodes; The encryption module is used to construct an encryption node, and a storage module for storing a key transmission node encryption model and an encryption end is provided in the encryption module; The key transmission module is used to construct a key transmission node. The key transmission module divides the decryption key and generates key division information. Then, the encryption formula is obtained from the encryption end in the encryption module to perform a second calculation on the key division information to obtain calculation information and divided key result information and send them to the user verification and authorization module. The conversion module is used for converting the decryption key into an integer that can be divided.

Images