A method and system for encrypted communication of metadata business services

Abstract

The present invention discloses an encryption communication method and system for metadata business services, the method comprising: a first business application party sends a business metadata call request to a second business application party, the second business application party generates a second random number according to the business metadata call request, and the second business application party generates a second intermediate parameter according to the second random number; the first business application party generates a first random number by itself, wherein the first business application party generates a first intermediate parameter according to the first random number; the first business application party sends the first intermediate parameter to the second business application party, and the second business application party sends the second intermediate parameter to the first business application party; the first business application party and the second business application party respectively calculate a shared key according to the second intermediate parameter and the first intermediate parameter, and determine the business metadata call authorization according to the shared key.

Description

Technical Field

[0001] The present invention relates to the field of metadata technology, and in particular to an encryption communication method and system for metadata business services. Background Art

[0002] At present, the interaction of enterprises in related business applications is still based on their own data middle platform. The data middle platform requires enterprises to build metadata assets independently. There are still certain barriers to the calls of metadata business services between different business application parties. In addition, since the metadata assets related to different businesses are the core digital assets of the corresponding businesses, the core digital assets of different businesses require a certain degree of encryption protection. At present, there is no effective encrypted communication method for existing metadata assets at different business ends, which makes the existing metadata assets have a greater security risk of information leakage. Summary of the invention

[0003] One of the inventive purposes of the present invention is to provide an encrypted communication method and system for metadata business services. The method and system establish data calls to the metadata asset center by different business application parties and use encrypted verification. When different business application parties call the metadata assets, it is necessary to calculate the shared keys of different business application parties respectively. The metadata asset center verifies the consistency of the shared keys to determine whether different business application parties agree to each other's business metadata calls, thereby ensuring that different business application parties can achieve encrypted communication verification and reduce the risk of leakage of the core metadata of the business application parties.

[0004] Another inventive object of the present invention is to provide an encrypted communication method and system for metadata business services. In the method and system, each current business application party generates a random number each time it makes a metadata call to other corresponding business application parties, and generates an intermediate parameter for encryption verification based on the random number. The intermediate parameter is made public, and the shared key is calculated based on the public intermediate parameter. By judging whether the shared key is the same, it is judged whether the corresponding business application party authorizes the other business application party to call. Since the intermediate parameter generated each time is encrypted by a different random number, the intermediate parameter is dynamically encrypted and protected during the transmission process, thereby improving the security of the business metadata call.

[0005] Another inventive object of the present invention is to provide an encrypted communication method and system for metadata business services. After two business application parties obtain publicly available intermediate parameters, the method and system further calculate a shared key in combination with their own random numbers on each business application party, and send the shared key to a metadata service center for verification of the shared key, thereby determining whether the current business application layer and other business application layers are authorized to share. The metadata service center has no relevant metadata involved in the verification process, and the risk of core metadata leakage can be effectively reduced through the isolated architecture of the metadata service center and the business application party.

[0006] In order to achieve at least one of the above-mentioned invention objects, the present invention further provides an encrypted communication method for metadata business services, the method comprising:

[0007] The first service application sends a service metadata call request to the second service application, the second service application generates a second random number according to the service metadata call request, and the second service application generates a second intermediate parameter according to the second random number;

[0008] The first service application party generates a first random number by itself, wherein the first service application party generates a first intermediate parameter according to the first random number;

[0009] The first service application party sends the first intermediate parameter to the second service application party, and the second service application party sends the second intermediate parameter to the first service application party;

[0010] The first service application party and the second service application party calculate a shared key according to the second intermediate parameter and the first intermediate parameter respectively, and determine the service metadata call authorization according to the shared key.

[0011] According to one of the preferred embodiments of the present invention, the first service application party and the second service application party simultaneously obtain a first encryption parameter P and a second encryption parameter G, wherein the first encryption parameter P is a large prime number and the second encryption parameter G is a number related to the first encryption parameter P; the first service application party calculates the first intermediate parameter based on the first encryption parameter P and the second encryption parameter G; the second service application party calculates the second intermediate parameter based on the first encryption parameter P and the second encryption parameter G.

[0012] According to another preferred embodiment of the present invention, the calculation method of the first intermediate parameter m1 includes: defining the first random number generated by the first service application party as A, and calculating the first intermediate parameter according to the first encryption parameter P and the second encryption parameter G according to the following formula: m1=G^A mod P, the above formula represents the modulus calculation of the first encryption parameter P after raising the second encryption parameter G to the power of the first random number A, and sending the first intermediate parameter m1 to the second service application party.

[0013] According to another preferred embodiment of the present invention, the calculation method of the second intermediate parameter m2 includes: defining the second random number generated by the second service application party as B, and calculating the second intermediate parameter according to the first encryption parameter P and the second encryption parameter G according to the following formula: m2=G^B mod P, the above formula represents the modulus calculation of the first encryption parameter P after raising the second encryption parameter G to the power of the first random number B, and sending the first intermediate parameter m2 to the first service application party.

[0014] According to another preferred embodiment of the present invention, after the second service application party obtains the first intermediate parameter m1=G^A mod P, it further obtains the second random number B generated by itself and the first intermediate parameter m1 to perform the following calculation: F1=m1^B mod P=(G^A mod P)^B mod P=(G^A*B) mod P; obtains the first shared key F1, and sends the first shared key to the metadata service center.

[0015] According to another preferred embodiment of the present invention, after the first business application party obtains the second intermediate parameter m2=G^B mod P, it further obtains the first random number A generated by itself and the second intermediate parameter m2 to perform the following calculation: F2=m2^A mod P=(G^B mod P)^A mod P=(G^B*A) mod P; obtains the second shared key F2, and sends the second shared key F2 to the metadata service center.

[0016] According to another preferred embodiment of the present invention, after the metadata service center obtains the first shared key F1 and the second shared key F2 respectively, the metadata service center verifies whether the first shared key F1 and the second shared key F2 are equal. If the first shared key F1 and the second shared key F2 are equal, the metadata service center authorizes the first business application party and the second business application party to call the business metadata of both parties respectively, and returns an authorization verification success message; otherwise, it returns an authorization verification failure message to the first business application party and the second business application party respectively.

[0017] According to another preferred embodiment of the present invention, after the first business application party or the second business application party obtains the authorization verification success message returned by the metadata service center, the first business application party or the second business application party sends a second request message to the metadata service center, and the first business application party or the second business application party generates a key pair, wherein the second request message includes the first public key of the key pair, the metadata service center obtains the first public key of the second request message, and encrypts the requested business metadata resource according to the first public key and returns it to the first business application party or the second business application party, and the first business application party or the second business application party decrypts the requested business metadata resource according to the private key of its own key pair.

[0018] In order to achieve at least one of the above-mentioned invention purposes, the present invention further provides an encrypted communication system for metadata business services, wherein the system executes the above-mentioned encrypted communication method for metadata business services.

[0019] The present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the above-mentioned encryption communication method for metadata business services. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 Shown is a schematic flow chart of an encrypted communication method for a metadata business service of the present invention.

[0021] Figure 2 Shown is a system schematic diagram of encrypted communication of a metadata business service in the present invention. DETAILED DESCRIPTION

[0022] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art can think of other obvious variations. The basic principles of the present invention defined in the following description can be applied to other embodiments, variations, improvements, equivalents, and other technical solutions that do not deviate from the spirit and scope of the present invention.

[0023] It is to be understood that the term "one" should be understood as "at least one" or "one or more", that is, in one embodiment, the number of an element may be one, while in another embodiment, the number of the element may be multiple, and the term "one" should not be understood as a limitation on the quantity.

[0024] Please combine Figure 1 and Figure 2The present invention discloses an encrypted communication method and system for metadata business services, the system comprising the following parts: multiple business application parties, a metadata service center, wherein the multiple business application parties themselves include an encryption verification module, and the multiple business application parties establish a communication connection with the metadata service center. The metadata service center stores metadata of multiple business application parties. It should be noted that the metadata is basic data related to the business, and each metadata constitutes an object of a business application. For example, in a rental business application, the metadata may be a house source information and the landlord information corresponding to the house source, etc. The metadata in the rental business application may need to be called by other business applications, such as a town resident housing management business application. Therefore, the metadata of the above business application has a high business value as a data asset. When different business application parties call, the requirements of encryption and authorization call need to be met to improve the management level of different business metadata calls by different business application parties.

[0025] For more information, see Figure 2 In the present invention, a first service application party and a second service application party are defined, wherein the first service application party is Figure 2 The production service A in the above-mentioned first business application party is the production service B, and the metadata of the production service A and the production service B are stored in the metadata service center. The metadata service center performs verification based on the relevant verification keys of the first business application party and the second business application party. When the metadata center verifies the verification key, the second business application party or the first business application party can call the metadata of the other party's business application in the metadata service center.

[0026] The second business application party is defined to call the metadata stored in the metadata service center by the first business application party. The specific method includes the following steps: first, the second business application party generates a second random number by itself, and the second business application party calculates a first intermediate parameter according to the second random number, wherein the second random number can be generated by including but not limited to the linear congruential method (LCG) or the physical hardware noise method. After the second business application party generates a random number, it further generates a metadata call request, and the metadata call request is first sent to the first business application party. After the first business application party receives the metadata call request, the first business application party uses including but not limited to the linear congruential method (LCG) or the physical hardware noise method to generate the corresponding first random number, and the first business application party further calculates the first intermediate parameter according to the first random number. The second business application party generates the second intermediate parameter after generating the second random number. After completing the construction of the first intermediate parameter and the second intermediate parameter, the first business application party sends the first intermediate parameter to the second business application party, and the second business application party sends the second intermediate parameter to the first business application party. After obtaining the second intermediate parameter, the first business application party calculates the first shared key with its own random number, and after obtaining the first intermediate parameter, the second business application party calculates the first shared key with its own random number. The first business application party and the second business application party send the first shared key and the second shared key to the metadata service center respectively. The metadata service center further compares the first shared key and the second shared key. If the first shared key and the second shared key are the same, the metadata service center verifies the authorization of the metadata call of the first business application party and the second business application party, and the metadata service center sends verification authorization pass messages to the first business application party and the second business application party respectively, so that the first business application party or the second business application party can send a second call request for metadata to the metadata service center.

[0027] Specifically, the first intermediate parameter and the second intermediate parameter in the present invention are in a publicly available state. It should be noted that the first intermediate parameter and the second intermediate parameter in the present invention are calculated based on the pre-configured first encryption parameter, the second encryption parameter and the corresponding random number modulus. The present invention defines the first encryption parameter as P, the second encryption parameter as G, the first random number as A, and the second random number as B. The first intermediate parameter is m1, and the second intermediate parameter is m2. The first encryption parameter P is a large prime number, and the second encryption parameter G is a number related to the first encryption parameter P. The first service application party calculates the first intermediate parameter m1 based on the first encryption parameter P and the second encryption parameter G; the second service application party calculates the second intermediate parameter m2 based on the first encryption parameter P and the second encryption parameter G.

[0028] The calculation method of the first intermediate parameter m1 is: the first intermediate parameter m1 is calculated according to the first encryption parameter P, the second encryption parameter G and the first random number A according to the following formula: m1=G^A mod P, the above formula indicates that the second encryption parameter G is raised to the power of the first random number A and then the modulus calculation of the first encryption parameter P is performed, and the first intermediate parameter m1 is sent to the second service application party. The calculation method of the second intermediate parameter m2 includes: the second intermediate parameter is calculated according to the first encryption parameter P, the second encryption parameter G and the second random number B according to the following formula: m2=G^B modP, the above formula indicates that the second encryption parameter G is raised to the power of the first random number B and then the modulus calculation of the first encryption parameter P is performed, and the first intermediate parameter m2 is sent to the first service application party.

[0029] Furthermore, when the second service application party obtains the first intermediate parameter m1=G^A mod P, it further obtains the second random number B generated by itself and the first intermediate parameter m1 to perform the following calculation: F1=m1^B mod P=(G^A mod P)^B mod P=(G^A*B) mod P; obtains the first shared key F1, and sends the first shared key F1 to the metadata service center. When the first service application party obtains the second intermediate parameter m2=G^B mod P, it further obtains the first random number A generated by itself and the second intermediate parameter m2 to perform the following calculation: F2=m2^A modP=(G^B mod P)^A mod P=(G^B*A) mod P; obtains the second shared key F2, and sends the second shared key F2 to the metadata service center. It should be noted that the present invention obtains the first shared key and the second shared key based on the modulus calculation of the power function. Therefore, the first shared key F1=m1^B mod P=(G^A mod P)^B mod P=(G^A*B) mod P=(G^B*A) mod P=F2, so as long as the two random numbers A and B in the first shared key and the second shared key are the same, the values ​​of the first shared key F1 and the second shared key F2 are the same. If the values ​​of the first shared key F1 and the second shared key F2 are different, the metadata service center issues a verification authorization failure message.

[0030] It should be noted that, in another preferred embodiment of the present invention, in order to improve the information security of the metadata service center and the corresponding business application party, the present invention further establishes an encrypted communication technology between the metadata service center and the corresponding business application party, and the specific method of the encrypted communication service includes the following steps: when the first business application party or the second business application party obtains the authorization verification success message returned by the metadata service center, the first business application party or the second business application party sends a second request message to the metadata service center, and the first business application party or the second business application party generates a key pair, wherein the second request message includes the first public key of the key pair, the metadata service center obtains the first public key of the second request message, and encrypts the requested business metadata resource according to the first public key and returns it to the first business application party or the second business application party, and the first business application party or the second business application party decrypts the requested business metadata resource according to the private key of its own key pair.

[0031] The embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. The embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part, and / or installed from a removable medium. When the computer program is executed by the central processing unit (CPU), the above-mentioned functions defined in the method of the present application are executed. It should be noted that the above-mentioned computer-readable medium of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, a system, device or device of an electrical, magnetic, optical, electromagnetic, infrared segment, or semiconductor, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more wire segments, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, electrical wire, optical cable, RF, etc., or any suitable combination of the foregoing.

[0032] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0033] Those skilled in the art should understand that the embodiments of the present invention described above and shown in the accompanying drawings are only examples and do not limit the present invention. The objectives of the present invention have been fully and effectively achieved. The functional and structural principles of the present invention have been demonstrated and explained in the embodiments. Without departing from the principles, the implementation methods of the present invention may be deformed or modified in any way.

Claims

1. An encrypted communication method for metadata business services, characterized in that: The method comprises: The first service application sends a service metadata call request to the second service application, the second service application generates a second random number according to the service metadata call request, and the second service application generates a second intermediate parameter according to the second random number; The first service application party generates a first random number by itself, wherein the first service application party generates a first intermediate parameter according to the first random number; The first service application party sends the first intermediate parameter to the second service application party, and the second service application party sends the second intermediate parameter to the first service application party; The first service application party and the second service application party calculate a shared key according to the second intermediate parameter and the first intermediate parameter respectively, and determine the service metadata call authorization according to the shared key; The first service application party and the second service application party simultaneously obtain a first encryption parameter P and a second encryption parameter G, wherein the first encryption parameter P is a large prime number, and the second encryption parameter G is a number related to the first encryption parameter P, the first service application party calculates the first intermediate parameter according to the first encryption parameter P and the second encryption parameter G; the second service application party calculates the second intermediate parameter according to the first encryption parameter P and the second encryption parameter G; After the metadata service center obtains the first shared key F1 and the second shared key F2 respectively, the metadata service center verifies whether the first shared key F1 and the second shared key F2 are equal. If the first shared key F1 and the second shared key F2 are equal, the metadata service center authorizes the first business application party and the second business application party to call the business metadata of both parties respectively, and returns an authorization verification success message; otherwise, it returns an authorization verification failure message to the first business application party and the second business application party respectively; After the first business application party or the second business application party obtains the authorization verification success message returned by the metadata service center, the first business application party or the second business application party sends a second request message to the metadata service center, and the first business application party or the second business application party generates a key pair, wherein the second request message includes the first public key of the key pair, the metadata service center obtains the first public key of the second request message, and encrypts the requested business metadata resource according to the first public key and returns it to the first business application party or the second business application party, and the first business application party or the second business application party decrypts the requested business metadata resource according to the private key of its own key pair.

2. The encryption communication method for metadata business service according to claim 1, characterized in that: The calculation method of the first intermediate parameter m1 includes: defining the first random number generated by the first service application party as A, and calculating the first intermediate parameter according to the first encryption parameter P and the second encryption parameter G according to the following formula: m1=G^A mod P, the above formula represents the modulus calculation of the first encryption parameter P after raising the second encryption parameter G to the power of the first random number A, and sending the first intermediate parameter m1 to the second service application party.

3. The encryption communication method for metadata business service according to claim 2, characterized in that: The calculation method of the second intermediate parameter m2 includes: defining the second random number generated by the second service application party as B, and calculating the second intermediate parameter according to the first encryption parameter P and the second encryption parameter G according to the following formula: m2=G^B mod P, the above formula represents the modulus calculation of the first encryption parameter P after raising the second encryption parameter G to the power of the first random number B, and sending the first intermediate parameter m2 to the first service application party.

4. The encryption communication method for metadata business service according to claim 3, characterized in that: After the second service application obtains the first intermediate parameter m1=G^A mod P, it further obtains the second random number B generated by itself and the first intermediate parameter m1 to perform the following calculation: F1=m1^B mod P=(G^A mod P)^B mod P=(G^A*B) mod P; A first shared key F1 is obtained, and the first shared key is sent to the metadata service center.

5. The encryption communication method for metadata business service according to claim 4, characterized in that: After the first business application party obtains the second intermediate parameter m2=G^B mod P, it further obtains the first random number A generated by itself and the second intermediate parameter m2 to perform the following calculation: F2=m2^A mod P=(G^B mod P)^A mod P=(G^B*A) mod P; obtains the second shared key F2, and sends the second shared key F2 to the metadata service center.

6. An encrypted communication system for metadata business services, characterized in that: The system executes an encrypted communication method for metadata business services as described in any one of claims 1-5.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the encryption communication method for a metadata business service as described in any one of claims 1 to 5.

Images