TLCP secure channel communication method and system for intelligent password key

Abstract

The present invention discloses a TLCP secure channel communication method and system for an intelligent cryptographic key. The method includes: a client establishing a TLCP secure channel connection with a server based on a local national secret intelligent cryptographic key; the client conducting TLCP secure channel communication with the server based on the local national secret intelligent cryptographic key, including: when the client needs to send data, the client encrypts the data to be sent using the local national secret intelligent cryptographic key, and then sends the encrypted data to the server; when the client receives the encrypted data from the server, the client decrypts the received encrypted data using the local national secret intelligent cryptographic key to obtain the original data. The present invention aims to utilize the secure storage and encryption computing capabilities of the national secret intelligent cryptographic key to solve the security issues of TLCP transmission, improve the security performance of TLCP transmission, and provide users with a more secure and reliable data transmission solution.

Description

Technical Field

[0001] The present invention relates to the technical field of national secret intelligent password key encryption, and in particular to a TLCP secure channel communication method and system for an intelligent password key. Background Art

[0002] With the advancement of information technology, network security issues have become increasingly prominent. To ensure secure data transmission, a secure communication channel is necessary. The TLCP secure channel is a transport layer cryptographic protocol defined by the national standard "GB / T 38636-2020 Information Security Technology Transport Layer Cryptography Protocol (TLCP)." Based on national cryptographic algorithms, it establishes a secure data transmission channel with confidentiality and integrity for communication between two applications. However, in practice, directly using private key files stored in the computer file system or directly calculating sensitive data in memory significantly increases the risk of private key file leakage and sensitive data theft, severely reducing the security of TLCP transmission.

[0003] National secret smart cryptographic keys supporting the National Secret Algorithm can be used to store and protect sensitive information and access rights for individuals or organizations. They feature National Secret Algorithms SM2 / SM3 / SM4, as well as random number generation, ensuring that user keys and algorithm operations remain hidden from the physical device. Compared to traditional in-memory algorithms, they offer higher security and reliability. Therefore, how to address the security issues of TLCP transmission using the National Secret Smart Cryptographic Key has become a critical technical challenge that needs to be addressed. Summary of the Invention

[0004] Technical problem to be solved by the present invention: In response to the above-mentioned problems of the prior art, a TLCP secure channel communication method and system for an intelligent password key are provided. The present invention aims to utilize the secure storage and encryption computing capabilities of the national secret intelligent password key to solve the security problem of TLCP transmission, improve the security performance of TLCP transmission, and provide users with a more secure and reliable data transmission solution.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0006] A TLCP secure channel communication method for a smart password key comprises the following steps:

[0007] The client establishes a TLCP secure channel connection with the server based on the local national secret smart password key;

[0008] The client communicates with the server through a TLCP secure channel based on the local national secret smart password key, including: when the client needs to send data, the client will encrypt the data to be sent using the local national secret smart password key, and then send the encrypted data to the server; when the client receives the encrypted data from the server, the client will decrypt the received encrypted data using the local national secret smart password key to obtain the original data.

[0009] Optionally, the client establishing a TLCP secure channel connection with the server based on a local national secret smart password key includes:

[0010] The client connects to the local national secret smart password key and verifies the identity through the application interface;

[0011] The client generates a key pair stored in the local national secret smart password key through the local national secret smart password key, exports the public key and verifies the public key with the CA to generate the client's authentication certificate;

[0012] The client generates a client random number client_random, uses the client random number client_random to generate a hello request and sends it to the server, receives the hello request response from the server and extracts the server random number server_random from it;

[0013] The client receives the certificate verification message sent by the server, and verifies the server's authentication certificate (server_cert) contained in the certificate verification message with the CA organization. If the verification fails, the client exits. If the verification passes, the client extracts the server's encrypted public key (server_pub_key). If the client receives a certificate verification request sent by the server, the client generates a certificate verification message with the client's authentication certificate and sends it to the server for authentication.

[0014] The client uses the client random number client_random, the server random number server_random, and the server authentication certificate server_cert to generate the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key. The client generates the ciphertext message client_sec_msg from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key and sends it to the server through the client key exchange message for the server to decrypt the encrypted message sent by the client.

[0015] The client generates the master key master_key from the pre-master key through the encryption algorithm interface specified in the local national secret smart password key, and then sets the master key master_key as the session key through the encryption algorithm interface specified in the local national secret smart password key for data encryption and decryption.

[0016] Optionally, the client generating the client random number client_random means that the client generates the client random number client_random through a local national secret smart password key.

[0017] Optionally, generating the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the pre-master key pre_master_key through the SM3 algorithm interface in the local national secret smart password key; generating the ciphertext information client_sec_msg through the encryption algorithm interface specified in the local national secret smart password key refers to generating the ciphertext information client_sec_msg through the SM2 algorithm interface in the local national secret smart password key; generating the master key master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the master key master_key through the SM3 algorithm interface in the local national secret smart password key, and setting the master key master_key as a session key through the encryption algorithm interface specified in the local national secret smart password key refers to setting the master key master_key as a session key through the SM4 algorithm interface in the local national secret smart password key;

[0018] The client communicates with the server through a TLCP secure channel based on the local national secret smart password key, including: when the client needs to send data, the client encrypts the data to be sent using the SM4 algorithm interface in the local national secret smart password key based on the session key, and then sends the encrypted data to the server; when the client receives the encrypted data from the server, the client decrypts the received encrypted data using the SM4 algorithm interface in the local national secret smart password key based on the session key and the ciphertext information client_sec_msg in the server key exchange message to obtain the original data.

[0019] Optionally, it also includes:

[0020] The server establishes a TLCP secure channel connection with the client based on the local national secret smart password key;

[0021] The server communicates with the client through a TLCP secure channel based on the local national secret smart password key, including: when the server needs to send data, the server will encrypt the data to be sent using the local national secret smart password key, and then send the encrypted data to the client; when the server receives the encrypted data from the client, the server will decrypt the received encrypted data using the local national secret smart password key to obtain the original data.

[0022] Optionally, the server establishing a TLCP secure channel connection with the client based on the local national secret smart password key includes:

[0023] The server connects to the local national secret smart password key and verifies the identity through the application interface;

[0024] The server generates a key pair stored in the local national secret smart password key through the local national secret smart password key, exports the public key and verifies the public key with the CA to generate the server's authentication certificate;

[0025] After receiving the client's hello request, the server extracts the client random number client_random from the hello request, generates the server random number server_random, uses the server random number server_random to generate a response hello request and sends the response request and certificate verification message to the client;

[0026] If the server needs to verify the client's authentication certificate, it sends a certificate verification request to the client, waits for the certificate verification message sent by the client, and verifies the server's authentication certificate contained in the certificate verification message through the CA organization. If the verification fails, the process ends and exits; otherwise, jump to the next step.

[0027] The server uses the client random number client_random, the server random number server_random, and the server authentication certificate server_cert to generate the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key. The server generates the ciphertext message client_sec_msg from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key and sends it to the client through the server key exchange message for the client to decrypt the encrypted message sent by the server.

[0028] The server generates the master key master_key from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and then sets the master key master_key as the session key through the encryption algorithm interface specified in the local national secret smart password key for data encryption and decryption.

[0029] Optionally, generating the server random number server_random refers to the server generating the server random number server_random by using a local national secret smart password key;

[0030] The generating of the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the pre-master key pre_master_key through the SM3 algorithm interface in the local national secret smart password key; generating the ciphertext information client_sec_msg through the encryption algorithm interface specified in the local national secret smart password key refers to generating the ciphertext information client_sec_msg through the SM2 algorithm interface in the local national secret smart password key; generating the master key master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the master key master_key through the SM3 algorithm interface in the local national secret smart password key, and setting the master key master_key as a session key through the encryption algorithm interface specified in the local national secret smart password key refers to setting the master key master_key as a session key through the SM4 algorithm interface in the local national secret smart password key;

[0031] The server communicates with the client through a TLCP secure channel based on the local national secret smart password key, including: when the server needs to send data, the server encrypts the data to be sent using the SM4 algorithm interface in the local national secret smart password key based on the session key, and then sends the encrypted data to the client; when the server receives the encrypted data from the client, the server decrypts the received encrypted data using the SM4 algorithm interface in the local national secret smart password key based on the session key and the ciphertext information client_sec_msg in the client key exchange message to obtain the original data.

[0032] In addition, the present invention also provides a TLCP security channel communication system for a smart password key, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the TLCP security channel communication method for the smart password key.

[0033] In addition, the present invention also provides a computer-readable storage medium, which stores a computer program or instruction. The computer program or instruction is programmed or configured to execute the TLCP secure channel communication method of the smart password key through a processor.

[0034] In addition, the present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the TLCP secure channel communication method of the smart password key through a processor.

[0035] Compared with the prior art, the present invention mainly has the following advantages:

[0036] 1. This invention combines the National Secret Intelligent Password Key with the TLCP protocol to effectively ensure confidentiality, integrity, and identity authentication during data transmission, thereby greatly improving the security of data transmission. Sensitive data and keys during the secure connection establishment process are independently stored in the intelligent password key. Even if an attacker successfully attacks the computer system or performs a memory scan, they cannot obtain the key data in the intelligent password key without knowing the password key.

[0037] 2. This invention uses a national secret smart password key for key management. Only authenticated users can use it, which effectively prevents key leakage, ensures key security and improves the convenience of key management. Users do not need to remember complex passwords, they only need to keep the smart password key safe;

[0038] 3. The national secret intelligent password key used in the present invention is a special password hardware with efficient encryption computing capabilities. It can improve the efficiency of encryption computing while ensuring security, thereby improving the efficiency of data transmission.

[0039] 4. The encryption algorithm adopted by the national secret smart password key used in the present invention is a national secret algorithm independently developed by my country, which improves the autonomous controllability of the system. It is not only suitable for Internet data transmission, but can also be applied to various scenarios and industries such as the Internet of Things, cloud computing, big data, CA center, online banking, e-government, e-commerce, etc., and has broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 Schematic diagram of the basic process of the method of the embodiment of the present invention.

[0041] Figure 2 Schematic diagram of the hierarchical structure of the client and server in an embodiment of the present invention.

[0042] Figure 3 This is a diagram of the interaction between the TLCP connection process and the National Secret Intelligent Password Key in an embodiment of the present invention. DETAILED DESCRIPTION

[0043] like Figure 1 As shown, the TLCP secure channel communication method of the smart password key of this embodiment includes the following steps:

[0044] S1. The client establishes a TLCP secure channel connection with the server based on the local National Cryptography Smart Password Key. The National Cryptography Smart Password Key is easy to use and complies with the unified interface of the "GM / T 0016-2012 Smart Password Key Cryptography Application Interface Specification." All National Cryptography Smart Password Keys that comply with the "GM / T 0016-2012 Smart Password Key Cryptography Application Interface Specification" can be used as the National Cryptography Smart Password Key for the method of this embodiment.

[0045] S2, the client communicates with the server through a TLCP secure channel based on the local national secret smart password key, including: when the client needs to send data, the client will encrypt the data to be sent using the local national secret smart password key, and then send the encrypted data to the server; when the client receives the encrypted data from the server, the client will decrypt the received encrypted data using the local national secret smart password key to obtain the original data.

[0046] The National Secret Smart Password Key is easy to use and complies with the unified interface of the "GM / T 0016-2012 Smart Password Key Password Application Interface Specification". All National Secret Smart Password Keys that comply with the "GM / T 0016-2012 Smart Password Key Password Application Interface Specification" can be used as the hardware device relied on by the present invention. In this embodiment, both the client and the server have their own local National Secret Smart Password Key. Figure 2 The figure is a schematic diagram of the hierarchical structure of the client and server in this embodiment, where the upper side of the dotted line is the software part, and the national secret smart password key below the dotted line is the hardware part. When the application software performs TLCP, it will access the local national secret smart password key API through the TLCP connection layer, thereby using the local national secret smart password key to realize the encryption and decryption of the TLCP secure channel data, and the entire process is transparent to the application software.

[0047] See also Figure 3 In this embodiment, step S1, i.e., the client establishing a TLCP secure channel connection with the server based on the local national secret smart password key, includes:

[0048] S1.1. The client connects to the local National Secret Smart Key and verifies its identity through the application interface. This step is the verification phase of the National Secret Smart Key. After connecting to the National Secret Smart Key, the client verifies its identity through the application interface, enabling normal use of the National Secret Smart Key's national secret algorithm calculations and key storage access functions. The specific method of identity verification through the application interface is determined by the National Secret Smart Key and is not limited to the specific interface verification method in this embodiment. The server also needs to perform this step to access the local National Secret Smart Key.

[0049] S1.2, the client generates a key pair stored in the national secret smart password key through the local national secret smart password key, exports the public key and verifies the public key with the CA to generate the client's authentication certificate; this step is the preliminary preparation stage. The TLCP connection process requires two-way verification of the server or client identity. Before the connection is established, it is necessary to generate the SM2 key pair stored in the smart password key through the application interface of the national secret smart password key. And export the corresponding public key through the application interface of the national secret smart password key, and verify it with the CA to become a certificate, which are the client's authentication certificate and the server's authentication certificate respectively. The private key is stored in the smart password key and cannot be accessed by the outside world;

[0050] S1.3. The client generates a client random number, client_random, and uses it to generate a hello request and send it to the server. The client receives the hello request in response and extracts the server random number, server_random, from it. The hello request (hello message) contains the protocol version, session identifier, cipher suite, and a random number generated by the smart password key interface. The client sends a hello message, and the server responds to the hello message, enabling the exchange of random numbers between the client and the server. The random numbers in the hello messages between the server and the client are generated by the random number generation interface of the smart password key. The random number generated by the server is server_random, and the random number generated by the client is client_random.

[0051] S1.4, the client receives the certificate verification message sent by the server, and verifies the server's authentication certificate contained in the certificate verification message with the CA organization. If the verification fails, the client exits; if the verification passes, the client extracts the server's encryption public key server_pub_key; if the client receives the certificate verification request sent by the server, the client generates a certificate verification message with the client's authentication certificate and sends it to the server for authentication;

[0052] S1.5. The client uses the client random number client_random, the server random number server_random, and the server authentication certificate server_cert to generate the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart key. The client generates the ciphertext message client_sec_msg from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart key and sends it to the server through the client key exchange message for the server to decrypt the encrypted message sent by the client.

[0053] S1.6, the client generates the master key master_key from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and then sets the master key master_key as the session key through the encryption algorithm interface specified in the local national secret smart password key for data encryption and decryption.

[0054] The client generating the client random number client_random in step S1.3 can be generated using software or hardware, depending on actual needs. The hardware can be either a local National Security Intelligent Cryptographic Key or other hardware with random number generation capabilities. As an optional implementation, the client generating the client random number client_random in step S1.3 of this embodiment refers to the client generating the client random number client_random using a local National Security Intelligent Cryptographic Key.

[0055] In step S1.5 of this embodiment, generating the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the pre-master key pre_master_key through the SM3 algorithm interface in the local national secret smart password key; generating the ciphertext message client_sec_msg through the encryption algorithm interface specified in the local national secret smart password key refers to generating the ciphertext message client_sec_msg through the SM2 algorithm interface in the local national secret smart password key. In step S1.6 of this embodiment, generating the master key master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the master key master_key through the SM3 algorithm interface in the local national secret smart password key; setting the master key master_key as a session key through the encryption algorithm interface specified in the local national secret smart password key refers to setting the master key master_key as a session key through the SM4 algorithm interface in the local national secret smart password key. The client generates the password specification change message content through the national secret signature algorithm SM2 and SM3 interfaces of the smart password key, and generates the SM4 symmetric encryption communication key for symmetric encryption communication. This communication key is generated and saved in the smart password key.

[0056] In this embodiment, in step S2, the client conducts TLCP secure channel communication with the server based on the local National Secret Smart Key. The steps include: when the client needs to send data, the client encrypts the data to be sent using the SM4 algorithm interface in the local National Secret Smart Key based on the session key, and then sends the encrypted data to the server. After receiving the encrypted data from the server, the client decrypts the received encrypted data using the SM4 algorithm interface in the local National Secret Smart Key based on the session key and the ciphertext client_sec_msg in the server's key exchange message to obtain the original data. These steps constitute the client's TLCP secure channel communication phase. The client transmits the data to be communicated through the application interface of the National Secret Smart Key, and obtains data symmetrically encrypted and decrypted using the National Secret SM4 algorithm, thereby conducting secure data communication.

[0057] This embodiment also includes:

[0058] S3: The server establishes a TLCP secure channel connection with the client based on the local national secret smart password key;

[0059] S4, the server communicates with the client through a TLCP secure channel based on the local national secret smart password key, including: when the server needs to send data, the server will encrypt the data to be sent using the local national secret smart password key, and then send the encrypted data to the client; when the server receives the encrypted data from the client, the server will decrypt the received encrypted data using the local national secret smart password key to obtain the original data.

[0060] See also Figure 3 In this embodiment, step S3, i.e., the server establishing a TLCP secure channel connection with the client based on the local national secret smart password key, includes:

[0061] S3.1, the server connects to the local national secret smart password key and verifies the identity through the application interface;

[0062] S3.2, the server generates a key pair stored in the local national secret smart password key through the local national secret smart password key, derives the public key and verifies the public key with the CA to generate the server's authentication certificate;

[0063] S3.3, after receiving the client's hello request, the server extracts the client random number client_random from the hello request, generates the server random number server_random, uses the server random number server_random to generate a response hello request, and sends the response request and certificate verification message to the client;

[0064] S3.4: If the server needs to verify the client's authentication certificate, it sends a certificate verification request to the client, waits for the certificate verification message sent by the client, and verifies the server's authentication certificate (server_cert) contained in the certificate verification message through the CA. If the verification fails, the process ends and exits; otherwise, jump to the next step.

[0065] S3.5. The server uses the client random number client_random, the server random number server_random, and the server authentication certificate server_cert to generate a pre-master key pre_master_key using the encryption algorithm interface specified in the local national secret smart key. The server generates a ciphertext message client_sec_msg from the pre-master key pre_master_key using the encryption algorithm interface specified in the local national secret smart key and sends it to the client through a server key exchange message for the client to decrypt the encrypted message sent by the server.

[0066] S3.6, the server generates the master key master_key from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and then sets the master key master_key as the session key through the encryption algorithm interface specified in the local national secret smart password key for data encryption and decryption.

[0067] Similar to the client, the server-side random number server_random generated in step S3.3 can be generated using software or hardware, depending on actual needs. The hardware can be either a local National Security Intelligent Cryptographic Key or other hardware with random number generation capabilities. As an optional implementation, in this embodiment, generating the server-side random number server_random in step S3.3 refers to the server generating the server-side random number server_random using a local National Security Intelligent Cryptographic Key.

[0068] In step S3.5 of this embodiment, generating the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the pre-master key pre_master_key through the SM3 algorithm interface in the local national secret smart password key; generating the ciphertext message client_sec_msg through the encryption algorithm interface specified in the local national secret smart password key refers to generating the ciphertext message client_sec_msg through the SM2 algorithm interface in the local national secret smart password key. In step S3.6 of this embodiment, generating the master key master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the master key master_key through the SM3 algorithm interface in the local national secret smart password key; setting the master key master_key as a session key through the encryption algorithm interface specified in the local national secret smart password key refers to setting the master key master_key as a session key through the SM4 algorithm interface in the local national secret smart password key. Similar to the client, the server generates the password specification change message content through the national secret signature algorithm SM2 and SM3 interface of the smart password key, and generates the SM4 symmetric encryption communication key for symmetric encryption communication. This communication key is generated and saved in the smart password key.

[0069] In this embodiment, in step S4, the server-side TLCP secure channel communication with the client based on the local National Secret Smart Key includes: when the server needs to send data, the server encrypts the data to be sent using the SM4 algorithm interface in the local National Secret Smart Key based on the session key, and then sends the encrypted data to the client; when the server receives the encrypted data from the client, the server decrypts the encrypted data using the SM4 algorithm interface in the local National Secret Smart Key based on the session key and the ciphertext client_sec_msg in the client key exchange message to obtain the original data. These steps constitute the server-side TLCP secure channel communication phase. The server transmits the data to be communicated through the application interface of the National Secret Smart Key, and obtains data symmetrically encrypted and decrypted using the National Secret SM4 algorithm, thereby conducting secure data communication.

[0070] See also Figure 3In this embodiment, the interaction process between the client and server is as follows: The client and server each generate an SM2 key pair stored in the smart key through the smart key's application interface, and then export the corresponding public key through the smart key's application interface. This is then verified as a certificate by a CA. The private key is stored in the smart key. During the TLCP connection process, the client first sends a hello message to the server. The hello message content is defined by the national standard TLCP protocol (including the session protocol version, random number, session identifier, cipher suite, and compression algorithm). The random number in the hello messages between the server and client is generated using the random number generation interface of the smart key. The random number generated by the server is server_random, and the random number generated by the client is client_random. After sending the hello message, the server then sends a certificate verification message (defined by the national standard TLCP protocol). The certificate is the server's identity authentication certificate server_cert, which has been verified by the CA and contains the server's SM2 public key server_key. The server signs the client_random, server_random, certificate length, and server_cert using the Smart Key's SM2 algorithm interface. The signature is sent via the server's Key Exchange message (defined by the national TLCP protocol). If the server needs to verify the client's identity, it sends a Certificate Request message (defined by the national TLCP protocol). After receiving the server's authentication certificate and verifying the certificate chain, the client extracts the server's public key, server_pub_key. If the client receives the server's Certificate Request message, it sends the client's CA-verified authentication certificate, client_cert, which contains the client's SM2 public key, client_key, and a client certificate message (defined by the national TLCP protocol). The client uses the client_random, server_random, server certificate length, and server_cert parameters to generate a pre-master key (pre_master_key) using the Smart Key's SM3 algorithm. The client then encrypts the pre-master key using the server_pub_key using the Smart Key's SM2 algorithm to create the ciphertext client_sec_msg, which is then sent via a client key exchange message (defined by the national TLCP protocol). The client then uses the pre-master key using the Smart Key's SM3 algorithm to generate the master key (master_key). The client then uses the master key (SM4 algorithm) to set the session key.Subsequent messages are transmitted using the smart key's SM4 algorithm interface. Upon receiving the ciphertext message from the server, the server decrypts it using the SM4 algorithm interface. When sending a message, the server converts the plaintext message into ciphertext using the SM4 algorithm interface before sending it. After receiving the key exchange message from the client, the server decrypts the client_sec_msg using the SM2 algorithm interface (the private key is stored in the smart key) to obtain the pre-master key (pre-master_key). The server then uses the SM3 algorithm interface to obtain the master key (master_key). After obtaining the master key, the server sets it as the session key using the SM4 algorithm interface. Subsequent messages are transmitted using the SM4 algorithm interface. Upon receiving the ciphertext message from the client, the server decrypts it using the SM4 algorithm interface. When sending a message, the server converts the plaintext message into ciphertext using the SM4 algorithm interface before sending it.

[0071] In summary, the method of this embodiment utilizes the secure storage and encryption computing capabilities of the National Secret Smart Password Key to solve the security issues of TLCP transmission. By effectively combining the National Secret Smart Password Key with the TLCP protocol, it not only improves the security of the TLCP secure channel, but also improves the convenience of password management. Moreover, by storing sensitive data and key files in the calculation process in the National Secret Smart Password Key, even if an attacker can successfully attack the computer system or perform a memory scan, without knowing the password of the password key, the key data in the smart password key cannot be obtained, which greatly improves the security of data transmission. The method of this embodiment can achieve a higher level of secure communication, ensure the security of private key files and sensitive data in the encryption and decryption process, thereby providing users with a more secure and reliable data transmission solution, which can be widely used in various scenarios and industries such as the Internet of Things, cloud computing, big data, CA centers, online banking, e-government, e-commerce, etc., to achieve functions such as user identity authentication, data encryption protection, and information integrity protection.

[0072] In addition, this embodiment also provides a TLCP security channel communication system for a smart password key, including a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the TLCP security channel communication method for the smart password key.

[0073] In addition, this embodiment also provides a computer-readable storage medium, which stores a computer program or instruction. The computer program or instruction is programmed or configured to execute the TLCP secure channel communication method of the smart password key through a processor.

[0074] In addition, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the TLCP secure channel communication method of the smart password key through a processor.

[0075] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the functions described in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including the instruction device, which implements the function specified in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0076] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiment. All technical solutions based on the concept of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A TLCP secure channel communication method for a smart password key, characterized in that: The steps include: The client establishes a TLCP secure channel connection with the server based on the local national secret smart password key; The client communicates with the server through a TLCP secure channel based on the local national secret smart password key. This includes: when the client needs to send data, it encrypts the data to be sent using the local national secret smart password key and then sends the encrypted data to the server. When the client receives the encrypted data from the server, it decrypts the encrypted data using the local national secret smart password key to obtain the original data. The client establishes a TLCP secure channel connection with the server based on the local national secret smart password key, including: The client connects to the local national secret smart password key and verifies the identity through the application interface; The client generates a key pair stored in the local national secret smart password key through the local national secret smart password key, exports the public key and verifies the public key with the CA to generate the client's authentication certificate; The client generates a client random number client_random, uses the client random number client_random to generate a hello request and sends it to the server, receives the hello request response from the server and extracts the server random number server_random from it; The client receives the certificate verification message sent by the server, and verifies the server's authentication certificate (server_cert) contained in the certificate verification message through the CA organization. If the verification fails, the client ends and exits. If the verification passes, the client extracts the server's encrypted public key (server_pub_key). If the client receives a certificate verification request sent by the server, the client generates a certificate verification message with the client's authentication certificate and sends it to the server for authentication. The client uses the client random number client_random, the server random number server_random, and the server authentication certificate server_cert to generate the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key. The client generates the ciphertext message client_sec_msg from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key and sends it to the server through the client key exchange message for the server to decrypt the encrypted message sent by the client. The client generates the master key master_key from the pre-master key through the encryption algorithm interface specified in the local national secret smart password key, and then sets the master key master_key as the session key through the encryption algorithm interface specified in the local national secret smart password key for data encryption and decryption.

2. The TLCP secure channel communication method for a smart password key according to claim 1, characterized in that: The client generates a client random number client_random, which means that the client generates the client random number client_random through a local national secret smart password key.

3. The TLCP secure channel communication method for a smart password key according to claim 1, characterized in that: The generating of the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the pre-master key pre_master_key through the SM3 algorithm interface in the local national secret smart password key; generating the ciphertext information client_sec_msg through the encryption algorithm interface specified in the local national secret smart password key refers to generating the ciphertext information client_sec_msg through the SM2 algorithm interface in the local national secret smart password key; generating the master key master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the master key master_key through the SM3 algorithm interface in the local national secret smart password key, and setting the master key master_key as a session key through the encryption algorithm interface specified in the local national secret smart password key refers to setting the master key master_key as a session key through the SM4 algorithm interface in the local national secret smart password key; The client communicates with the server through a TLCP secure channel based on the local national secret smart password key, including: when the client needs to send data, the client encrypts the data to be sent using the SM4 algorithm interface in the local national secret smart password key based on the session key, and then sends the encrypted data to the server; when the client receives the encrypted data from the server, the client decrypts the received encrypted data using the SM4 algorithm interface in the local national secret smart password key based on the session key and the ciphertext information client_sec_msg in the server key exchange message to obtain the original data.

4. The TLCP secure channel communication method for a smart password key according to claim 1, characterized in that: Also includes: The server establishes a TLCP secure channel connection with the client based on the local national secret smart password key; The server communicates with the client through a TLCP secure channel based on the local national secret smart password key, including: when the server needs to send data, the server will encrypt the data to be sent using the local national secret smart password key, and then send the encrypted data to the client; when the server receives the encrypted data from the client, the server will decrypt the received encrypted data using the local national secret smart password key to obtain the original data.

5. The TLCP secure channel communication method for a smart password key according to claim 4, characterized in that: The server establishes a TLCP secure channel connection with the client based on the local national secret smart password key, including: The server connects to the local national secret smart password key and verifies the identity through the application interface; The server generates a key pair stored in the local national secret smart password key through the local national secret smart password key, exports the public key and verifies the public key with the CA to generate the server's authentication certificate; After receiving the client's hello request, the server extracts the client random number client_random from the hello request, generates the server random number server_random, uses the server random number server_random to generate a response hello request and sends the response request and certificate verification message to the client; If the server needs to verify the client's authentication certificate, it sends a certificate verification request to the client, waits for the certificate verification message sent by the client, and verifies the server's authentication certificate contained in the certificate verification message through the CA organization. If the verification fails, the process ends and exits; otherwise, jump to the next step. The server uses the client random number client_random, the server random number server_random, and the server authentication certificate server_cert to generate the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key. The server generates the ciphertext message client_sec_msg from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key and sends it to the client through the server key exchange message for the client to decrypt the encrypted message sent by the server. The server generates the master key master_key from the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key, and then sets the master key master_key as the session key through the encryption algorithm interface specified in the local national secret smart password key for data encryption and decryption.

6. The TLCP secure channel communication method for a smart password key according to claim 5, characterized in that: Generating the server random number server_random means that the server generates the server random number server_random through the local national secret smart password key; The generating of the pre-master key pre_master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the pre-master key pre_master_key through the SM3 algorithm interface in the local national secret smart password key; generating the ciphertext information client_sec_msg through the encryption algorithm interface specified in the local national secret smart password key refers to generating the ciphertext information client_sec_msg through the SM2 algorithm interface in the local national secret smart password key; generating the master key master_key through the encryption algorithm interface specified in the local national secret smart password key refers to generating the master key master_key through the SM3 algorithm interface in the local national secret smart password key, and setting the master key master_key as a session key through the encryption algorithm interface specified in the local national secret smart password key refers to setting the master key master_key as a session key through the SM4 algorithm interface in the local national secret smart password key; The server communicates with the client via a TLCP secure channel based on the local national secret smart password key. When the server needs to send data, the server encrypts the data to be sent using the SM4 algorithm interface in the local national secret smart password key based on the session key, and then sends the encrypted data to the client. When the server receives the encrypted data from the client, the server uses the SM4 algorithm interface in the local national secret smart password key to decrypt the received encrypted data based on the session key and the ciphertext information client_sec_msg in the client key exchange message to obtain the original data.

7. A TLCP secure channel communication system for an intelligent password key, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the TLCP secure channel communication method of the smart password key according to any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the TLCP secure channel communication method of the smart password key according to any one of claims 1 to 6 through a processor.

9. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the TLCP secure channel communication method of the smart password key according to any one of claims 1 to 6 through a processor.

Images