Message transmission system, communication system and message transmission method based on security hardware

Abstract

The invention discloses a message transmission system, a communication system and a message transmission method based on security hardware, the message transmission system comprises a service party and an agent party, the service party is deployed with service party security hardware equipment, and the agent party is deployed with agent party security hardware equipment; and in the process that the service party sends a message to the agent party, the message is encrypted and decrypted through the service party security hardware equipment and the agent party security hardware equipment respectively and then transmitted to the service end, so that the message is sent to the operator interface gateway through the service end. The message encryption is performed based on the security hardware, so that the encryption security and the encryption efficiency are improved, and the problems that the security and the efficiency of related technologies need to be further improved and the security requirement of current digital communication is difficult to meet are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of message transmission, and in particular to a message transmission system, a communication system, and a message transmission method. Background Art

[0002] With the rapid development and popularization of information technology, digital communication has become an indispensable part of modern society. People use digital communication tools such as email, social media, and mobile payment to communicate and exchange in their daily lives, and a large amount of personal, commercial, and confidential information is transmitted on the Internet. However, the security issues that come with it are also becoming increasingly serious, such as hacker attacks, phishing, malware, etc., which pose a huge threat to personal privacy and business secrets.

[0003] Traditional encryption technology mainly relies on software implementation, that is, the encryption algorithm and key management are executed by software programs in the computer system. However, software encryption methods are vulnerable to threats such as malware, hacker attacks and computer viruses, and have problems such as low security, vulnerability to attacks and low efficiency. Therefore, it is necessary to propose a more secure and reliable encryption method to protect sensitive information in communication. Summary of the invention

[0004] The main purpose of the present invention is to provide a message transmission system, a communication system and a message transmission method based on secure hardware to solve the problems existing in the related art.

[0005] In order to achieve the above-mentioned purpose, according to the first aspect of the present invention, a message transmission system is provided, characterized in that it includes: a service party and an agent party, the service party is deployed with a service party security hardware device, and the agent party is deployed with an agent party security hardware device; in the process of the service party sending a message to the agent party, the message is encrypted and decrypted by the service party security hardware device and the agent party security hardware device respectively, and then transmitted to the server side, so as to be sent to the operator interface gateway through the server side.

[0006] Optionally, in the process of the service party sending a message to the agent party, the message is encrypted and decrypted by the service party's secure hardware device and the agent's secure hardware device respectively and then transmitted to the server side, including: the service party encrypts the message to be sent and transmits it to the service party's secure hardware device through a pre-built encryption channel; the service party's secure hardware device decrypts the encrypted message data after obtaining it, and encrypts it after decryption to obtain the encrypted data to be sent; the encrypted data to be sent is sent to the agent's hardware encryption device and decrypted in the agent's hardware encryption device.

[0007] Optionally, the hardware encryption device of the proxy encrypts the decrypted data and transmits it to the server, so that the server decrypts it and sends it to the operator interface gateway.

[0008] Optionally, the encryption key and decryption key of the service-side security hardware device and the agent-side security hardware device remain consistent, and the encryption key and decryption key can be replaced periodically.

[0009] Optionally, the service provider encrypts and transmits the message to be sent to the service provider's secure hardware device through a pre-built encryption channel, including: the service provider encrypts and transmits the message to be sent to the service provider's secure hardware device using the public key of SM2 in the pre-built encryption channel.

[0010] Optionally, the service party's security hardware device performs decryption processing after obtaining the encrypted message data, and encrypts it after decryption to obtain the encrypted data to be sent, including: the service party's security hardware device uses the built-in SM2 private key to decrypt the data after obtaining the encrypted message data; and encrypts the decrypted data using the SM4 encryption algorithm to obtain the encrypted data to be sent.

[0011] Optionally, decryption in the hardware encryption device of the agent includes: decryption based on the SM4 decryption algorithm; the hardware encryption device of the agent encrypts the decrypted data and transmits it to the server, including: encrypting the decrypted data by the SM2 private key and transmitting it to the server.

[0012] According to a second aspect of the present invention, a communication system is provided, wherein the message transmission system described in any one of the implementations of the first aspect is deployed in the communication system.

[0013] According to the third aspect of the present invention, a message transmission method is provided, including: when a service party sends a message to an agent party, the message is encrypted and decrypted by the service party's security hardware device and the agent's security hardware device respectively, and then transmitted to the server side, so as to be sent to the operator interface gateway through the server side.

[0014] Optionally, the encryption and decryption performed by the service-side security hardware device and the agent-side security hardware device and then transmitted to the server includes: the service party encrypts the message to be sent and transmits it to the service-side security hardware device through a pre-built encryption channel; the service-side security hardware device performs decryption processing after obtaining the encrypted message data, and encrypts it after decryption to obtain the encrypted data to be sent; the encrypted data to be sent is sent to the agent's hardware encryption device and decrypted in the agent's hardware encryption device.

[0015] This embodiment provides a message transmission system, a communication system, and a message transmission method, wherein the message transmission system includes: a service party and an agent party, wherein the service party is deployed with a service party security hardware device, and the agent party is deployed with an agent party security hardware device; when the service party sends a message to the agent party, the message is encrypted and decrypted by the service party security hardware device and the agent party security hardware device respectively and then transmitted to the service end, so as to be sent to the operator interface gateway through the service end. Encrypting messages based on secure hardware improves the security and efficiency of encryption, and solves the problem that the security and efficiency of related technologies need to be further improved, and it is difficult to meet the security requirements of current digital communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A secure hardware-based message transmission system is provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0019] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so as to describe the embodiments of the present invention described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0020] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0021] Regarding the transmission of SMS content, SMS will contain a lot of personal sensitive information. The SMS transmission stage includes the service provider, agent, operator and final recipient. The service provider provides the final recipient with SMS sending and receiving services, and sends the SMS content information required by the final recipient; the agent is the service provider of the service provider's SMS sending and receiving services, that is, the service provider transfers the SMS flow to the operator through the agent to send and receive SMS numbers and SMS content; the final recipient is the final SMS recipient individual.

[0022] The above SMS data transfer process involves three forwarding stages of SMS content, mobile phone numbers and other information, namely, service provider → agent, agent → operator, operator → final recipient. There are risks such as data leakage during the SMS data transfer process. The transmission process uses unsafe encryption algorithms (such as MD5, DES), and uses software to call encryption keys, or the encryption and decryption keys are built into the code.

[0023] According to an embodiment of the present invention, a message transmission system is provided, such as Figure 1 As shown, it includes the following: a service party and an agent party, the service party is deployed with a service party security hardware device, and the agent party is deployed with an agent party security hardware device; in the process of the service party sending a message to the agent party, the message is encrypted and decrypted by the service party security hardware device and the agent party security hardware device respectively, and then transmitted to the server side, so as to be sent to the operator interface gateway through the server side.

[0024] In this embodiment, in order to ensure the secure transmission from the service provider to the agent, and to reduce the potential security risks caused by unencrypted, software calling encryption and decryption keys, and using unsafe algorithms, the method uses a secure hardware module to encrypt the message. Compared with the software encryption method, it greatly prevents the risk of encryption and decryption key leakage, and effectively improves the security and efficiency of message encryption.

[0025] The architecture of the security hardware device in this embodiment includes the underlying hardware devices, including but not limited to CPU, memory, hard disk, network card, computing engine; operating system, which can be Linux operating system; functional components can include computing module, management module, other modules; and service interface. The management module is a module built into the security hardware device that specifically manages the key life cycle, and can be set to automatically update regularly according to a time period.

[0026] For applications that need to call secure hardware devices, the server to which the application belongs should be deployed in the same area as the secure hardware device, which can ensure that the secure hardware device can only be accessed by specific applications in the intranet, thereby improving the security of the secure hardware device. For example, when accessing the intranet, the service interface can be used to obtain detailed information about the current master key from the management module of the secure hardware device, such as the current master version identifier of the master key, the next key update time, etc., and the plaintext key information will not be obtained through the interface.

[0027] As an optional implementation method of this embodiment, in the process of the service party sending a message to the agent party, the message is encrypted and decrypted by the service party's secure hardware device and the agent's secure hardware device respectively and then transmitted to the server side, including: the service party encrypts the message to be sent and transmits it to the service party's secure hardware device through a pre-built encryption channel; the service party's secure hardware device decrypts the encrypted message data after obtaining it, and encrypts it after decryption to obtain the encrypted data to be sent; the encrypted data to be sent is sent to the agent's hardware encryption device, and decrypted in the agent's hardware encryption device.

[0028] As an optional implementation method of this embodiment, the service party encrypts and transmits the message to be sent to the service party's secure hardware device through a pre-built encryption channel, including: the service party encrypts and transmits the message to be sent to the service party's secure hardware device using the public key of SM2 in the pre-built encryption channel.

[0029] As an optional implementation method of this embodiment, the service party's security hardware device performs decryption processing after obtaining the encrypted message data, and encrypts it after decryption to obtain the encrypted data to be sent, including: the service party's security hardware device uses the built-in SM2 private key to decrypt the data after obtaining the encrypted message data; and encrypts the decrypted data through the SM4 encryption algorithm to obtain the encrypted data to be sent.

[0030] In the above optional implementation, on the service side, when the message is transmitted to the secure hardware module, the SMS message sent by the service side to the agent side, the message to be encrypted is transmitted to the secure hardware module in an encrypted manner to ensure that the message will not be stolen or tampered with during the transmission process. The secure channel uses the SM2 elliptic curve public key cryptography algorithm to ensure the security of communication, and uses the SM2 public key encryption to send the encrypted message to the secure hardware module. It is recommended that the server and the secure hardware module are in the same area to further encrypt the message sending rate.

[0031] Encrypting and processing messages in the security hardware module: The security hardware module receives the message to be encrypted, decrypts the data using the built-in SM2 private key to obtain the original data, and subsequently encrypts the message using the built-in SM4 encryption algorithm to generate an encrypted message.

[0032] For example, two encryption methods can be used: Keyword encryption: A built-in keyword rule library is required to match the keyword content of the sent SMS content, and only the matched content is encrypted. Advantage: convenient for subsequent processing and maintenance. Full encryption: The sent content is fully encrypted. Advantage: short encryption time.

[0033] Furthermore, after encryption is completed, if it needs to be called by an application on the intranet server, the encrypted data can be returned to the application through the service interface. If storage is required, the database can be stored for data retention and the encrypted data can be sent to the agent.

[0034] As an optional implementation of this embodiment, the hardware encryption device of the proxy encrypts the decrypted data and transmits it to the server, so that the server decrypts it and sends it to the operator interface gateway.

[0035] As an optional implementation method of this embodiment, decryption in the hardware encryption device of the agent includes: decryption based on the SM4 decryption algorithm; the hardware encryption device of the agent encrypts the decrypted data and transmits it to the server, including: encrypting the decrypted data by the SM2 private key and transmitting it to the server.

[0036] In the above optional implementation, the agent obtains the encrypted message, and can decrypt the encrypted message through the secure hardware module. The decryption process is opposite to that of the service party. The encrypted message is sent to the secure hardware module, which decrypts it using the SM4 national secret algorithm. The SM2 private key is then used to encrypt the data and transmit it to the server. The server can decrypt it using the SM2 public key. For the operator information, it is sent to each operator interface gateway.

[0037] As an optional implementation of this embodiment, the encryption key and decryption key of the service-side security hardware device and the agent-side security hardware device remain consistent, and the encryption key and decryption key can be replaced periodically.

[0038] In this optional implementation, whether it is a service-side or agent-side secure hardware device, the encryption and decryption keys therein are maintained by functional components in the secure hardware, such as a management module, and the encryption and decryption keys therein can be set to be automatically updated regularly based on a time period, such as every month.

[0039] Furthermore, the encryption and decryption keys of the service provider and the agent are kept consistent. To achieve consistency, the key synchronization can be achieved through the cluster function of the security hardware device. Under the cluster function cluster configuration, set the IP and port of other security devices that need to be synchronized, and synchronize the keys through the dedicated line. Manual synchronization can also be achieved through a USB key

[0040] In the above implementation, in order to complete the message encryption from the service provider to the agent, the service provider and the agent need to have hardware encryption modules in the network environment, and the encryption and decryption keys must be consistent. The key management system can be used to regularly replace the keys of the hardware encryption modules. The above method ensures the secure transmission of the message content from the service provider to the agent.

[0041] Compared with the traditional software encryption method, this embodiment has the following advantages: Strong security: The present invention performs message encryption based on secure hardware, which is more secure and reliable than the traditional software encryption method, and effectively prevents the risk of message being cracked or tampered. Efficient encryption speed: The secure hardware accelerates the encryption process, improves the encryption speed, and reduces the impact of the encryption process on system performance. Flexible deployment method: The present invention can be flexibly deployed in various communication systems and is suitable for a variety of application scenarios, such as cloud computing, the Internet of Things, etc.

[0042] The embodiment of the present invention further provides a communication system, in which the message transmission system of the above embodiment is deployed in the communication system, and can be flexibly deployed in various communication systems and is applicable to various application scenarios, such as cloud computing, the Internet of Things, etc.

[0043] Furthermore, the information transmission system includes: a service party and an agent party, wherein the service party is deployed with a service party security hardware device, and the agent party is deployed with an agent party security hardware device; in the process of the service party sending a message to the agent party, the message is encrypted and decrypted by the service party security hardware device and the agent party security hardware device respectively and then transmitted to the server side, so as to be sent to the operator interface gateway through the server side.

[0044] Furthermore, in the process of the service party sending a message to the agent party, the message is encrypted and decrypted by the service party's security hardware device and the agent's security hardware device respectively and then transmitted to the server side, including: the service party encrypts the message to be sent and transmits it to the service party's security hardware device through a pre-built encryption channel; the service party's security hardware device decrypts the encrypted message data after obtaining it, and encrypts it after decryption to obtain the encrypted data to be sent; the encrypted data to be sent is sent to the agent's hardware encryption device and decrypted in the agent's hardware encryption device.

[0045] Furthermore, the hardware encryption device of the agent encrypts the decrypted data and transmits it to the server, so that the server decrypts it and sends it to the operator interface gateway.

[0046] Furthermore, the encryption key and decryption key of the service party's secure hardware device and the agent party's secure hardware device remain consistent, and the encryption key and decryption key can be replaced regularly.

[0047] Furthermore, the service provider encrypts and transmits the message to be sent to the service provider's secure hardware device through a pre-built encryption channel, including: the service provider encrypts and transmits the message to be sent to the service provider's secure hardware device using the public key of SM2 in the pre-built encryption channel.

[0048] Furthermore, the service party's security hardware device performs decryption processing after obtaining the encrypted message data, and encrypts it after decryption to obtain the encrypted data to be sent, including: the service party's security hardware device uses the built-in SM2 private key to decrypt the data after obtaining the encrypted message data; and encrypts the decrypted data through the SM4 encryption algorithm to obtain the encrypted data to be sent.

[0049] Furthermore, decryption in the hardware encryption device of the agent includes: decryption based on the SM4 decryption algorithm; the hardware encryption device of the agent encrypts the decrypted data and transmits it to the server, including: encrypting the decrypted data by the SM2 private key and transmitting it to the server.

[0050] An embodiment of the present invention also provides a message transmission method, characterized in that the method includes encrypting and decrypting the message to be sent through the service party's security hardware device and the agent party's security hardware device and then transmitting it to the server: the service party encrypts the message to be sent and transmits it to the service party's security hardware device through a pre-built encryption channel; the service party's security hardware device decrypts the message data after obtaining it, and encrypts it after decryption to obtain the encrypted data to be sent; the encrypted data to be sent is sent to the agent's hardware encryption device and decrypted in the agent's hardware encryption device.

[0051] As an optional implementation of this embodiment, the hardware encryption device of the proxy encrypts the decrypted data and transmits it to the server, so that the server decrypts it and sends it to the operator interface gateway.

[0052] As an optional implementation of this embodiment, the encryption key and decryption key of the service-side security hardware device and the agent-side security hardware device remain consistent, and the encryption key and decryption key can be replaced periodically.

[0053] As an optional implementation method of this embodiment, the service party encrypts and transmits the message to be sent to the service party's secure hardware device through a pre-built encryption channel, including: the service party encrypts and transmits the message to be sent to the service party's secure hardware device using the public key of SM2 in the pre-built encryption channel.

[0054] As an optional implementation method of this embodiment, the service party's security hardware device performs decryption processing after obtaining the encrypted message data, and encrypts it after decryption to obtain the encrypted data to be sent, including: the service party's security hardware device uses the built-in SM2 private key to decrypt the data after obtaining the encrypted message data; and encrypts the decrypted data through the SM4 encryption algorithm to obtain the encrypted data to be sent.

[0055] As an optional implementation method of this embodiment, decryption in the hardware encryption device of the agent includes: decryption based on the SM4 decryption algorithm; the hardware encryption device of the agent encrypts the decrypted data and transmits it to the server, including: encrypting the decrypted data by the SM2 private key and transmitting it to the server.

[0056] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A message transmission system based on secure hardware, characterized in that: include: The service provider and the agent, wherein the service provider is equipped with a service provider security hardware device and the agent is equipped with an agent security hardware device; When the service provider sends a message to the agent, the message is encrypted and decrypted by the service provider's security hardware device and the agent's security hardware device respectively and then transmitted to the service end, so as to be sent to the operator interface gateway through the service end.

2. The secure hardware-based message transmission system according to claim 1, characterized in that: In the process of the service party sending a message to the agent party, the message is encrypted and decrypted by the service party's security hardware device and the agent's security hardware device respectively and then transmitted to the service end, including: The service provider encrypts and transmits the message to be sent to the service provider's secure hardware device through a pre-built encryption channel; The service provider's secure hardware device performs decryption processing after obtaining the encrypted message data, and encrypts it after decryption to obtain the encrypted data to be sent; The encrypted data to be sent is sent to the hardware encryption device of the agent and decrypted in the hardware encryption device of the agent.

3. The secure hardware-based message transmission system according to claim 2, characterized in that: The hardware encryption device of the agent encrypts the decrypted data and transmits it to the server, so that the server decrypts it and sends it to the operator interface gateway.

4. The secure hardware-based message transmission system according to claim 1, characterized in that: The encryption key and decryption key of the service party's secure hardware device and the agent party's secure hardware device remain consistent, and the encryption key and decryption key can be replaced regularly.

5. The secure hardware-based message transmission system according to claim 2, characterized in that: The service provider encrypts and transmits the message to be sent to the service provider's secure hardware device through a pre-built encryption channel, including: The service provider encrypts the message to be sent using the public key of SM2 in a pre-built encryption channel and transmits it to the service provider's secure hardware device.

6. The secure hardware-based message transmission system according to claim 5, characterized in that: The service-side security hardware device performs decryption processing after obtaining the encrypted message data, and encrypts the encrypted data to be sent after decryption, including: After obtaining the encrypted message data, the service provider's secure hardware device uses the built-in SM2 private key to decrypt the data; The decrypted data is encrypted using the SM4 encryption algorithm to obtain the encrypted data to be sent.

7. The secure hardware-based message transmission system according to claim 3, characterized in that: Decrypting in the hardware encryption device of the agent includes: decrypting based on the SM4 decryption algorithm; The hardware encryption device of the agent encrypts the decrypted data and transmits it to the server, including: encrypting the decrypted data by using the SM2 private key and transmitting it to the server.

8. A communication system, characterized in that: The message transmission system described in any one of claims 1 to 7 is deployed in a communication system.

9. A message transmission method, characterized in that: include: When the service provider sends a message to the agent, the message is encrypted and decrypted by the service provider's security hardware device and the agent's security hardware device respectively, and then transmitted to the server, and then sent to the operator interface gateway through the server.

10. The message transmission method according to claim 9, characterized in that: The encryption and decryption performed by the service provider's security hardware device and the agent's security hardware device before transmission to the server include: The service provider encrypts and transmits the message to be sent to the service provider's secure hardware device through a pre-built encryption channel; The service provider's secure hardware device performs decryption processing after obtaining the encrypted message data, and encrypts it after decryption to obtain the encrypted data to be sent; The encrypted data to be sent is sent to the hardware encryption device of the agent and decrypted in the hardware encryption device of the agent.

Images