TLCP secure channel communication method and system of national secret smart key

Abstract

The invention discloses a TLCP secure channel communication method and a TLCP secure channel communication system for a national cryptographic smart key. The method comprises the following steps: a client establishes TLCP secure channel connection with a server based on the local national cryptographic smart key; the client performs TLCP secure channel communication with the server based on a local state secret smart key, and the method comprises the following steps: when the client needs to send data, the client encrypts the data needing to be sent by using the local state secret smart key, and then sends the encrypted data to the server; and after the client side receives the encrypted data from the server side, the client side decrypts the received encrypted data by using the local national secret intelligent password key to obtain the original data. The invention aims to solve the security problem of TLCP transmission by using the security storage and encryption operational capability of the national secret smart key, improve the security performance of TLCP transmission, and provide a safer and more reliable data transmission solution for users.

Description

Technical Field

[0001] The present invention relates to the technical field of national secret intelligent password key encryption, and in particular to a TLCP secure channel communication method and system for a national secret intelligent password key. Background Art

[0002] With the development of information technology, network security issues have become increasingly prominent. In order to ensure the secure transmission of data, a secure communication channel needs to be established. The TLCP secure channel is a transport layer cryptographic protocol defined by the national standard "GB / T 38636-2020 Information Security Technology Transport Layer Cryptographic Protocol (TLCP)". Based on the national secret algorithm, it establishes a secure data transmission channel with confidentiality and integrity for communication between two applications. However, in actual applications, directly using private key files stored in the computer file system or directly calculating sensitive data in memory will greatly increase the risk of private key file leakage and sensitive data theft, thereby seriously reducing the security of TLCP transmission.

[0003] The National Secret Smart Key that supports the National Secret Algorithm can be used to store and protect sensitive information and access rights of individuals or organizations. It has the functions of the National Secret Algorithm SM2 / SM3 / SM4 / random number generation, which can ensure that the user key and the algorithm operation process do not appear outside the physical device of the password key. Compared with the traditional in-memory algorithm, it has the characteristics of high security and high reliability. Therefore, how to use the National Secret Smart Key to solve the security problem of TLCP transmission has become a key technical problem that needs to be solved urgently. Summary of the invention

[0004] Technical problem to be solved by the present invention: In view of the above-mentioned problems in the prior art, a TLCP secure channel communication method and system of a national secret smart password key are provided. The present invention aims to utilize the secure storage and encryption computing capabilities of the national secret smart password key to solve the security problem of TLCP transmission, improve the security performance of TLCP transmission, and provide users with a more secure and reliable data transmission solution.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: A TLCP secure channel communication method for a national secret intelligent password key comprises the following steps: The client establishes a TLCP secure channel connection with the server based on the local national secret smart password key; The client communicates with the server through a TLCP secure channel based on the local national secret smart password key, including: when the client needs to send data, the client will encrypt the data to be sent using the local national secret smart password key, and then send the encrypted data to the server; when the client receives the encrypted data from the server, the client will decrypt the received encrypted data using the local national secret smart password key to obtain the original data.

[0006] Optionally, the client establishing a TLCP secure channel connection with the server based on a local national secret smart password key includes: The client connects to the local national secret smart password key and verifies the identity through the application interface; The client generates a key pair stored in the national secret smart password key through the local national secret smart password key, exports the public key and verifies the public key with the CA to generate the client's identity authentication certificate; The client generates a client random number client_random, uses the client random number client_random to generate a hello request and sends it to the server, receives the hello request responded by the server and extracts the server random number server_random; The client receives the certificate verification message sent by the server, and verifies the server's authentication certificate server_cert contained in the certificate verification message through the CA organization. If the verification fails, the client ends and exits; if the verification passes, the client extracts the server's encrypted public key server_pub_key; if the client receives the certificate verification request sent by the server, the client generates a certificate verification message with the client's authentication certificate and sends it to the server for the server to authenticate the identity; The client uses the client random number client_random, the server random number server_random and the server authentication certificate server_cert to generate the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and generates the ciphertext message client_sec_msg from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key and sends it to the server through the client key exchange message for the server to decrypt the encrypted message sent by the client; The client generates the master key master_key from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and then sets the master key master_key as the session key for data encryption and decryption through the encryption algorithm interface specified in the local national secret smart password key.

[0007] Optionally, the client generating the client random number client_random means that the client generates the client random number client_random by using a local national secret smart password key.

[0008] Optionally, generating the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the pre-master key pre_master_key through the SM3 algorithm interface in the local national secret smart password key; generating the ciphertext information client_sec_msg through the encryption algorithm interface specified in the local national secret smart password key refers to generating the ciphertext information client_sec_msg through the SM2 algorithm interface in the local national secret smart password key; generating the master key master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the master key master_key through the SM3 algorithm interface in the local national secret smart password key, and setting the master key master_key as a session key through the encryption algorithm interface specified in the local national secret smart password key refers to setting the master key master_key as a session key through the SM4 algorithm interface in the local national secret smart password key; The client communicates with the server through a TLCP secure channel based on the local national secret smart password key, including: when the client needs to send data, the client encrypts the data to be sent using the SM4 algorithm interface in the local national secret smart password key based on the session key, and then sends the encrypted data to the server; when the client receives the encrypted data from the server, the client decrypts the received encrypted data using the SM4 algorithm interface in the local national secret smart password key based on the session key and the ciphertext information client_sec_msg in the server key exchange message to obtain the original data.

[0009] Optionally, it also includes: The server establishes a TLCP secure channel connection with the client based on the local national secret smart password key; The server communicates with the client through a TLCP secure channel based on the local national secret smart password key, including: when the server needs to send data, the server will encrypt the data to be sent using the local national secret smart password key, and then send the encrypted data to the client; when the server receives the encrypted data from the client, the server will decrypt the received encrypted data using the local national secret smart password key to obtain the original data.

[0010] Optionally, the server establishes a TLCP secure channel connection with the client based on the local national secret smart password key, including: The server connects to the local national secret smart password key and verifies the identity through the application interface; The server generates a key pair stored in the national secret smart password key through the local national secret smart password key, exports the public key and verifies the public key with the CA organization to generate the server's identity authentication certificate; After receiving the hello request from the client, the server extracts the client random number client_random from the hello request, generates the server random number server_random, uses the server random number server_random to generate a response hello request and sends the response request and certificate verification message to the client; If the server needs to verify the client's authentication certificate, it sends a certificate verification request to the client, waits for the certificate verification message sent by the client, and verifies the server's authentication certificate server_cert contained in the certificate verification message through the CA organization. If the verification fails, it ends and exits; otherwise, jump to the next step; The server uses the client random number client_random, the server random number server_random and the server authentication certificate server_cert to generate the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and generates the ciphertext message client_sec_msg from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key and sends it to the client through the server key exchange message for the client to decrypt the encrypted message sent by the server; The server generates the master key master_key from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and then sets the master key master_key as the session key for data encryption and decryption through the encryption algorithm interface specified in the local national secret smart password key.

[0011] Optionally, generating the server random number server_random means that the server generates the server random number server_random by using a local national secret smart password key; The generating of the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the pre-master key pre_master_key through the SM3 algorithm interface in the local national secret smart password key; generating the ciphertext information client_sec_msg through the encryption algorithm interface specified in the local national secret smart password key refers to generating the ciphertext information client_sec_msg through the SM2 algorithm interface in the local national secret smart password key; generating the master key master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the master key master_key through the SM3 algorithm interface in the local national secret smart password key, and setting the master key master_key as a session key through the encryption algorithm interface specified in the local national secret smart password key refers to setting the master key master_key as a session key through the SM4 algorithm interface in the local national secret smart password key; The server communicates with the client through a TLCP secure channel based on the local national secret smart password key, including: when the server needs to send data, the server encrypts the data to be sent using the SM4 algorithm interface in the local national secret smart password key based on the session key, and then sends the encrypted data to the client; when the server receives the encrypted data from the client, the server decrypts the received encrypted data using the SM4 algorithm interface in the local national secret smart password key based on the session key and the ciphertext information client_sec_msg in the client key exchange message to obtain the original data.

[0012] In addition, the present invention also provides a TLCP secure channel communication system for a national secret smart password key, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the TLCP secure channel communication method for the national secret smart password key.

[0013] In addition, the present invention also provides a computer-readable storage medium, which stores a computer program or instruction, and the computer program or instruction is programmed or configured to execute the TLCP secure channel communication method of the national secret smart password key through a processor.

[0014] In addition, the present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the TLCP secure channel communication method of the national secret smart password key through a processor.

[0015] Compared with the prior art, the present invention mainly has the following advantages: 1. The present invention combines the national secret smart password key and the TLCP protocol, which can effectively ensure the confidentiality, integrity and identity authentication of data during transmission, thereby greatly improving the security of data transmission. Sensitive data and keys in the process of establishing a secure connection are independently stored in the smart password key. Even if an attacker can successfully attack the computer system or perform a memory scan, he cannot obtain the key data in the smart password key without knowing the password of the password key; 2. The present invention uses the national secret smart password key for key management, which can only be used by users who have passed identity authentication. This effectively prevents the leakage of keys, ensures the security of keys and improves the convenience of key management. Users do not need to remember complex passwords, but only need to keep the smart password key safe; 3. The national secret intelligent password key used in the present invention is a special password hardware with efficient encryption computing capabilities. It can improve the efficiency of encryption computing while ensuring security, thereby improving the efficiency of data transmission.

[0016] 4. The encryption algorithm adopted by the national secret smart password key used in the present invention is a national secret algorithm independently developed by my country, which improves the autonomy and controllability of the system. It is not only suitable for Internet data transmission, but also can be applied to the Internet of Things, cloud computing, big data, CA center, online banking, e-government, e-commerce and other scenarios and industries, and has broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 Schematic diagram of the basic flow of the method of the embodiment of the present invention.

[0018] Figure 2 Schematic diagram of the hierarchical structure of the client and server in an embodiment of the present invention.

[0019] Figure 3 This is a diagram of the interaction between the TLCP connection process and the national secret smart password key in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] like Figure 1 As shown, the TLCP secure channel communication method of the national secret smart password key of this embodiment includes the following steps: S1, the client establishes a TLCP secure channel connection with the server based on the local national secret smart password key; the national secret smart password key is easy to use and complies with the unified interface of the "GM / T 0016-2012 Smart Password Key Password Application Interface Specification". All national secret smart password keys that comply with the "GM / T 0016-2012 Smart Password Key Password Application Interface Specification" can be used as the national secret smart password key used in the method of this embodiment; S2, the client communicates with the server through a TLCP secure channel based on the local national secret smart password key, including: when the client needs to send data, the client will encrypt the data to be sent using the local national secret smart password key, and then send the encrypted data to the server; when the client receives the encrypted data from the server, the client will decrypt the received encrypted data using the local national secret smart password key to obtain the original data.

[0021] The national secret smart password key is easy to use and complies with the unified interface of the "GM / T 0016-2012 Smart Password Key Password Application Interface Specification". All national secret smart password keys that comply with the "GM / T 0016-2012 Smart Password Key Password Application Interface Specification" can be used as the hardware device relied on by the present invention. In this embodiment, the client and the server both have their own local national secret smart password keys. Figure 2 This is a schematic diagram of the hierarchical structure of the client and server in this embodiment, wherein the upper side of the dotted line is the software part, and the national secret smart password key under the dotted line is the hardware part. When the application software performs TLCP, it will access the local national secret smart password key API through the TLCP connection layer, thereby using the local national secret smart password key to implement encryption and decryption of TLCP secure channel data, and the whole process is transparent to the application software.

[0022] See also Figure 3 In this embodiment, step S1, i.e. the client establishing a TLCP secure channel connection with the server based on the local national secret smart password key, includes: S1.1, the client connects to the local national secret smart password key and verifies the identity through the application interface; this step is the verification stage of the national secret smart password key. After connecting to the national secret smart password key, the client verifies the identity through the application interface, so that the national secret algorithm operation and key storage access function of the national secret smart password key can be used normally. The specific method of identity verification by the application interface is determined by the national secret smart password key, and this embodiment is not limited to the specific interface identity verification method. The server also needs this step to access the local national secret smart password key; S1.2, the client generates a key pair stored in the national secret smart password key through the local national secret smart password key, exports the public key and verifies the public key through the CA organization to generate the client's identity authentication certificate; this step is the preliminary preparation stage. The TLCP connection process requires two-way verification of the server or client identity. Before the connection is established, it is necessary to generate the SM2 key pair stored in the smart password key through the application interface of the national secret smart password key. And export the corresponding public key through the application interface of the national secret smart password key, and verify it through the CA organization to become a certificate, which are the client's identity authentication certificate and the server's identity authentication certificate respectively. The private key is stored in the smart password key and cannot be accessed by the outside world; S1.3, the client generates a client random number client_random, uses the client random number client_random to generate a hello request and sends it to the server, receives the hello request responded by the server and extracts the server random number server_random in it; the message content of the hello request (hello message) includes the protocol version, session identifier, cipher suite, and the random number generated by the smart password key interface. The client sends a hello message, and the server responds to the hello message, so that the client and the server can exchange random numbers with each other; the random numbers in the hello messages between the server and the client are generated by the random number generation interface of the smart password key. The random number generated by the server is server_random, and the random number generated by the client is client_random; S1.4, the client receives the certificate verification message sent by the server, and verifies the server's authentication certificate server_cert contained in the certificate verification message through the CA organization. If the verification fails, the client ends and exits; if the verification passes, the client extracts the server's encrypted public key server_pub_key; if the client receives the certificate verification request sent by the server, the client generates a certificate verification message with the client's authentication certificate and sends it to the server for the server to authenticate the identity; S1.5, the client uses the client random number client_random, the server random number server_random and the server authentication certificate server_cert to generate the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, generates the ciphertext information client_sec_msg from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key and sends it to the server through the client key exchange message for the server to decrypt the encrypted message sent by the client; S1.6, the client generates the master key master_key from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and then sets the master key master_key as the session key for data encryption and decryption through the encryption algorithm interface specified in the local national secret smart password key.

[0023] The client generating the client random number client_random in step S1.3 can be generated by software or hardware according to actual needs, wherein the hardware can be either a local national secret smart password key or other hardware with a random number generation function. As an optional implementation, the client generating the client random number client_random in step S1.3 of this embodiment means that the client generates the client random number client_random by using a local national secret smart password key.

[0024] In step S1.5 of this embodiment, generating the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the pre-master key pre_master_key through the SM3 algorithm interface in the local national secret smart password key; generating the ciphertext information client_sec_msg through the encryption algorithm interface specified in the local national secret smart password key refers to generating the ciphertext information client_sec_msg through the SM2 algorithm interface in the local national secret smart password key. In step S1.6 of this embodiment, generating the master key master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the master key master_key through the SM3 algorithm interface in the local national secret smart password key, and setting the master key master_key as a session key through the encryption algorithm interface specified in the local national secret smart password key refers to setting the master key master_key as a session key through the SM4 algorithm interface in the local national secret smart password key. The client generates the password specification change message content through the national secret signature algorithm SM2 and SM3 interfaces of the smart password key, and generates the SM4 symmetric encryption communication key for symmetric encryption communication. This communication key is generated and saved in the smart password key.

[0025] In this embodiment, in step S2, the client performs TLCP secure channel communication with the server based on the local national secret smart password key, including: when the client needs to send data, the client uses the SM4 algorithm interface in the local national secret smart password key to encrypt the data to be sent based on the session key, and then sends the encrypted data to the server; when the client receives the encrypted data from the server, the client uses the SM4 algorithm interface in the local national secret smart password key to decrypt the received encrypted data based on the session key and the ciphertext information client_sec_msg in the server key exchange message to obtain the original data. The above steps are the TLCP secure channel communication stage of the client, and the client transmits the data to be communicated through the application interface of the national secret smart password key, and obtains the data symmetrically encrypted and decrypted by the national secret SM4 algorithm, thereby performing secure data communication.

[0026] This embodiment also includes: S3, the server establishes a TLCP secure channel connection with the client based on the local national secret smart password key; S4, the server communicates with the client through a TLCP secure channel based on the local national secret smart password key, including: when the server needs to send data, the server will encrypt the data to be sent using the local national secret smart password key, and then send the encrypted data to the client; when the server receives the encrypted data from the client, the server will decrypt the received encrypted data using the local national secret smart password key to obtain the original data.

[0027] See also Figure 3 In this embodiment, step S3, i.e. the server establishing a TLCP secure channel connection with the client based on the local national secret smart password key, includes: S3.1, the server connects to the local national secret smart password key and verifies the identity through the application interface; S3.2, the server generates a key pair stored in the national secret smart password key through the local national secret smart password key, exports the public key and verifies the public key with the CA organization to generate the server's identity authentication certificate; S3.3, after receiving the hello request from the client, the server extracts the client random number client_random from the hello request, generates the server random number server_random, uses the server random number server_random to generate a response hello request and sends the response request and the certificate verification message to the client; S3.4, if the server needs to verify the client's identity authentication certificate, it sends a certificate verification request to the client, waits for the certificate verification message sent by the client, and verifies the server's identity authentication certificate server_cert contained in the certificate verification message through the CA organization. If the verification fails, it ends and exits; otherwise, jump to the next step; S3.5, the server uses the client random number client_random, the server random number server_random and the server authentication certificate server_cert to generate the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, generates the ciphertext information client_sec_msg from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and sends it to the client through the server key exchange message for the client to decrypt the encrypted message sent by the server; S3.6, the server generates the master key master_key from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and then sets the master key master_key as the session key through the encryption algorithm interface specified in the local national secret smart password key for data encryption and decryption.

[0028] Similar to the client, the server random number server_random generated in step S3.3 can be generated by software or hardware according to actual needs, wherein the hardware can be either a local national secret smart password key or other hardware with a random number generation function. As an optional implementation, the server random number server_random generated in step S3.3 of this embodiment means that the server generates the server random number server_random through the local national secret smart password key.

[0029] In step S3.5 of this embodiment, generating the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the pre-master key pre_master_key through the SM3 algorithm interface in the local national secret smart password key; generating the ciphertext information client_sec_msg through the encryption algorithm interface specified in the local national secret smart password key refers to generating the ciphertext information client_sec_msg through the SM2 algorithm interface in the local national secret smart password key. In step S3.6 of this embodiment, generating the master key master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the master key master_key through the SM3 algorithm interface in the local national secret smart password key, and setting the master key master_key as a session key through the encryption algorithm interface specified in the local national secret smart password key refers to setting the master key master_key as a session key through the SM4 algorithm interface in the local national secret smart password key. Similar to the client, the server generates the password specification change message content through the national secret signature algorithm SM2 and SM3 interface of the smart password key, and generates the SM4 symmetric encryption communication key for symmetric encryption communication. This communication key is generated and saved in the smart password key.

[0030] In this embodiment, in step S4, the server performs TLCP secure channel communication with the client based on the local national secret smart password key, including: when the server needs to send data, the server uses the SM4 algorithm interface in the local national secret smart password key to encrypt the data to be sent based on the session key, and then sends the encrypted data to the client; when the server receives the encrypted data from the client, the server uses the SM4 algorithm interface in the local national secret smart password key to decrypt the received encrypted data based on the session key and the ciphertext information client_sec_msg in the client key exchange message to obtain the original data. The above steps are the TLCP secure channel communication stage of the server. The server transmits the data to be communicated through the application interface of the national secret smart password key, obtains the data symmetrically encrypted and decrypted by the national secret SM4 algorithm, and thus performs secure data communication.

[0031] See also Figure 3In this embodiment, the interaction process between the client and the server is as follows: the client and the server generate the SM2 key pair stored in the smart password key through the application interface of the smart password key respectively, and export the corresponding public key through the application interface of the smart password key, and verify it as a certificate through the CA organization. The private key is stored in the smart password key. During the TLCP connection process, the client first sends a hello message to the server. The content of the hello message is defined by the national standard TLCP protocol (including session protocol version, random number, session identifier, cipher suite and compression algorithm), where the random number in the hello message between the server and the client is generated through the random number generation interface of the smart password key. The random number generated by the server is server_random, and the random number generated by the client is client_random. After the server sends the hello message, it then sends a certificate verification message (defined by the national standard TLCP protocol). The certificate is the server identity authentication certificate server_cert, which has been verified by the CA. The certificate contains the server SM2 public key server_key. The server signs the client_random, server_random, certificate length, and server_cert through the SM2 algorithm interface of the smart password key, and the signature information will be sent through the server key exchange message (defined by the national standard TLCP protocol). If the server needs to verify the identity of the client, it will send a certificate request message (defined by the national standard TLCP protocol). After the client receives the server's identity authentication certificate, it extracts the server's encrypted public key server_pub_key after the certificate passes the certificate chain verification. If the server's certificate request message is received, the client's identity authentication certificate client_cert will be sent, which has passed CA verification. The certificate contains the client's SM2 public key client_key, and the client certificate message (defined by the national standard TLCP protocol) will be sent. The client generates the pre-master key pre_master_key by calling the SM3 algorithm interface of the smart key through client_random, server_random, the length of the server certificate, and server_cert, and encrypts the pre-master key pre_master_key into the ciphertext information client_sec_msg with server_pub_key through the SM2 algorithm interface of the smart key, and sends it as a client key exchange message (defined by the national standard TLCP protocol). The client generates the master key master_key from pre_master_key through the SM3 algorithm interface of the smart key, and then sets the master_key as the session key through the SM4 algorithm interface of the smart key.Subsequent messages are all sent through the SM4 algorithm interface of the smart password key: after receiving the ciphertext message from the server, it is decrypted through the SM4 algorithm interface of the smart password key; when a message needs to be sent, the plaintext message is converted into a ciphertext message through the SM4 algorithm interface of the smart password key before sending. After receiving the key exchange message from the client, the server decrypts the client_sec_msg through the SM2 algorithm interface of the smart key (the private key exists in the smart password key), obtains the pre-master key pre_master_key, and then obtains the master key master_key through the SM3 algorithm interface of the smart password key. After obtaining the master_key, the server sets the master_key as the session key through the SM4 algorithm interface of the smart password key. Subsequent messages are all sent through the SM4 algorithm interface of the smart password key: after receiving the ciphertext message from the client, it is decrypted through the SM4 algorithm interface of the smart password key; when a message needs to be sent, the plaintext message is converted into a ciphertext message through the SM4 algorithm interface of the smart password key before sending.

[0032] In summary, the method of this embodiment utilizes the secure storage and encryption computing capabilities of the national secret smart password key to solve the security problem of TLCP transmission. By effectively combining the national secret smart password key with the TLCP protocol, it not only improves the security of the TLCP security channel, but also improves the convenience of password management. Moreover, by storing sensitive data and key files in the calculation process in the national secret smart password key, even if the attacker can successfully attack the computer system or perform a memory scan, without knowing the password key password, the key data in the smart password key cannot be obtained, which greatly improves the security of data transmission. The method of this embodiment can achieve a higher level of secure communication, ensure the security of private key files and sensitive data in the encryption and decryption process, thereby providing users with a more secure and reliable data transmission solution, which can be widely used in various scenarios and industries such as the Internet of Things, cloud computing, big data, CA center, online banking, e-government, e-commerce, etc., to achieve functions such as user identity authentication, data encryption protection, and information integrity protection.

[0033] In addition, this embodiment also provides a TLCP secure channel communication system for a national secret smart password key, including a microprocessor and a memory connected to each other, and the microprocessor is programmed or configured to execute the TLCP secure channel communication method for the national secret smart password key.

[0034] In addition, this embodiment also provides a computer-readable storage medium, which stores a computer program or instruction, and the computer program or instruction is programmed or configured to execute the TLCP secure channel communication method of the national secret smart password key through a processor.

[0035] In addition, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the TLCP secure channel communication method of the national secret smart password key through a processor.

[0036] Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application can take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0037] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A TLCP secure channel communication method for a national secret intelligent password key, characterized in that: The steps include: The client establishes a TLCP secure channel connection with the server based on the local national secret smart password key; The client communicates with the server through a TLCP secure channel based on the local national secret smart password key, including: when the client needs to send data, the client will encrypt the data to be sent using the local national secret smart password key, and then send the encrypted data to the server; when the client receives the encrypted data from the server, the client will decrypt the received encrypted data using the local national secret smart password key to obtain the original data.

2. The TLCP secure channel communication method of the national secret intelligent password key according to claim 1 is characterized in that: The client establishes a TLCP secure channel connection with the server based on the local national secret smart password key, including: The client connects to the local national secret smart password key and verifies the identity through the application interface; The client generates a key pair stored in the national secret smart password key through the local national secret smart password key, exports the public key and verifies the public key with the CA to generate the client's identity authentication certificate; The client generates a client random number client_random, uses the client random number client_random to generate a hello request and sends it to the server, receives the hello request responded by the server and extracts the server random number server_random; The client receives the certificate verification message sent by the server, and verifies the server's authentication certificate server_cert contained in the certificate verification message through the CA organization. If the verification fails, the client ends and exits; if the verification passes, the client extracts the server's encrypted public key server_pub_key; if the client receives the certificate verification request sent by the server, the client generates a certificate verification message with the client's authentication certificate and sends it to the server for the server to authenticate the identity; The client uses the client random number client_random, the server random number server_random and the server authentication certificate server_cert to generate the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and generates the ciphertext message client_sec_msg from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key and sends it to the server through the client key exchange message for the server to decrypt the encrypted message sent by the client; The client generates the master key master_key from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and then sets the master key master_key as the session key for data encryption and decryption through the encryption algorithm interface specified in the local national secret smart password key.

3. The TLCP secure channel communication method of the national secret intelligent password key according to claim 2 is characterized in that: The client generates a client random number client_random, which means that the client generates a client random number client_random through a local national secret smart password key.

4. The TLCP secure channel communication method of the national secret intelligent password key according to claim 2 is characterized in that: The generating of the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the pre-master key pre_master_key through the SM3 algorithm interface in the local national secret smart password key; generating the ciphertext information client_sec_msg through the encryption algorithm interface specified in the local national secret smart password key refers to generating the ciphertext information client_sec_msg through the SM2 algorithm interface in the local national secret smart password key; generating the master key master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the master key master_key through the SM3 algorithm interface in the local national secret smart password key, and setting the master key master_key as a session key through the encryption algorithm interface specified in the local national secret smart password key refers to setting the master key master_key as a session key through the SM4 algorithm interface in the local national secret smart password key; The client communicates with the server through a TLCP secure channel based on the local national secret smart password key, including: when the client needs to send data, the client encrypts the data to be sent using the SM4 algorithm interface in the local national secret smart password key based on the session key, and then sends the encrypted data to the server; when the client receives the encrypted data from the server, the client decrypts the received encrypted data using the SM4 algorithm interface in the local national secret smart password key based on the session key and the ciphertext information client_sec_msg in the server key exchange message to obtain the original data.

5. The TLCP secure channel communication method of the national secret intelligent password key according to claim 1 is characterized in that: Also includes: The server establishes a TLCP secure channel connection with the client based on the local national secret smart password key; The server communicates with the client through a TLCP secure channel based on the local national secret smart password key, including: when the server needs to send data, the server will encrypt the data to be sent using the local national secret smart password key, and then send the encrypted data to the client; when the server receives the encrypted data from the client, the server will decrypt the received encrypted data using the local national secret smart password key to obtain the original data.

6. The TLCP secure channel communication method of the national secret intelligent password key according to claim 5 is characterized in that: The server establishes a TLCP secure channel connection with the client based on the local national secret smart password key, including: The server connects to the local national secret smart password key and verifies the identity through the application interface; The server generates a key pair stored in the national secret smart password key through the local national secret smart password key, exports the public key and verifies the public key with the CA organization to generate the server's identity authentication certificate; After receiving the hello request from the client, the server extracts the client random number client_random from the hello request, generates the server random number server_random, uses the server random number server_random to generate a response hello request and sends the response request and certificate verification message to the client; If the server needs to verify the client's authentication certificate, it sends a certificate verification request to the client, waits for the certificate verification message sent by the client, and verifies the server's authentication certificate server_cert contained in the certificate verification message through the CA organization. If the verification fails, it ends and exits; otherwise, jump to the next step; The server uses the client random number client_random, the server random number server_random and the server authentication certificate server_cert to generate the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and generates the ciphertext message client_sec_msg from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key and sends it to the client through the server key exchange message for the client to decrypt the encrypted message sent by the server; The server generates the master key master_key from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and then sets the master key master_key as the session key for data encryption and decryption through the encryption algorithm interface specified in the local national secret smart password key.

7. The TLCP secure channel communication method of the national secret intelligent password key according to claim 6 is characterized in that: Generating the server random number server_random means that the server generates the server random number server_random through the local national secret smart password key; The generating of the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the pre-master key pre_master_key through the SM3 algorithm interface in the local national secret smart password key; generating the ciphertext information client_sec_msg through the encryption algorithm interface specified in the local national secret smart password key refers to generating the ciphertext information client_sec_msg through the SM2 algorithm interface in the local national secret smart password key; generating the master key master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the master key master_key through the SM3 algorithm interface in the local national secret smart password key, and setting the master key master_key as a session key through the encryption algorithm interface specified in the local national secret smart password key refers to setting the master key master_key as a session key through the SM4 algorithm interface in the local national secret smart password key; The server performs TLCP secure channel communication with the client based on the local national secret smart password key, including: when the server needs to send data, the server encrypts the data to be sent using the SM4 algorithm interface in the local national secret smart password key based on the session key, and then sends the encrypted data to the client; When the server receives the encrypted data from the client, the server uses the SM4 algorithm interface in the local national secret smart password key to decrypt the received encrypted data based on the session key and the ciphertext information client_sec_msg in the client key exchange message to obtain the original data.

8. A TLCP secure channel communication system of a national secret intelligent password key, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the TLCP secure channel communication method of the national secret smart password key as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the TLCP secure channel communication method of the national secret smart password key described in any one of claims 1 to 7 through a processor.

10. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the TLCP secure channel communication method of the national secret smart password key described in any one of claims 1 to 7 through a processor.

Images