Secure communication method and system of MQTT protocol based on national cipher module

Abstract

The invention discloses a secure communication method and system of an MQTT protocol based on a national cryptographic module, a server and a client based on MQTT protocol communication are both configured with the national cryptographic module, and the secure communication method comprises the following steps: the server and the client generate an initial key pair based on the national cryptographic module, signature verification is carried out based on a national cryptographic algorithm and the initial key pair, so that security identity authentication between the server and the client is realized; negotiating an encryption key between the server and the client based on a national secret algorithm; the client sends a connection message of an MQTT protocol encrypted based on an encryption key and a national cryptographic algorithm to the server, and verification of a client user name and a password is carried out; the MQTT protocol communication based on the encryption key and the national cryptographic algorithm is carried out based on the verification result, SM2 algorithm signature and signature verification are fused in the MQTT protocol based on the national cryptographic hardware cryptographic module, the SM4 algorithm is adopted to symmetrically encrypt and decrypt data transmitted by the MQTT protocol, the MQTT protocol conforming to the national cryptographic algorithm is designed, and the confidentiality of the data is ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a secure communication method and system based on the MQTT protocol of a national secret password module. Background Art

[0002] MQTT (Message Queuing Telemetry Transport) is a lightweight messaging protocol designed specifically for efficient and reliable data transmission in resource-constrained network environments. The MQTT protocol is simple, low-overhead, and low-bandwidth, making it particularly suitable for communication between Internet of Things (IoT) devices, small devices, and mobile applications.

[0003] There are two implementations of the MQTT protocol's security mechanism: First, the MQTT protocol supports username / password authentication to ensure that only authorized devices can connect to the MQTT server, that is, each device is assigned a unique username and password, and verification is performed on the server to ensure that the server confirms the client's identity. Second, in order to ensure the security of such communications, especially when sensitive data or remote control instructions are involved, MQTT usually relies on Transport Layer Security (TLS) or its predecessor, Secure Sockets Layer (SSL) to provide encryption, authentication, and data integrity protection, and to achieve authentication and encrypted transmission of servers and clients.

[0004] However, the MQTT protocol uses a username / password authentication security mechanism, and its username / password is stored and transmitted in plain text on both the client and the server, so attackers can easily steal the username / password of the device. The MQTT protocol is used in combination with the TLS protocol, which can ensure the secure transmission of data and the identity authentication of both communicating parties. However, the cryptographic algorithms and digital certificates used in the TLS protocol are all international algorithms and international certificates, which do not meet the cryptographic compliance requirements.

[0005] The MQTT protocol works on top of the TCP / IP protocol family. Although MQTT itself only requires the underlying transport layer to provide an ordered and reliable bidirectional byte stream, it usually chooses to use TCP as its main transport layer protocol to ensure the reliability of the connection and the sequential transmission of data.

[0006] However, the TCP / IP protocol itself has not yet implemented the security function of the protocol. First, the TCP / IP protocol uses the IP address as the unique identifier of the network node, lacks a reliable authentication measure for the host or slave, and attackers can imitate the host or slave to send malicious commands. Although the MQTT protocol itself provides some basic security mechanisms such as username / password authentication for identity authentication, the username / password is stored and transmitted in plain text on both the client and the server, and attackers can easily steal the username / password of the device; second, the TCP / IP protocol does not encrypt the data in the packet and does not provide data integrity verification measures. Attackers can obtain key confidential information in communication transmission through eavesdropping.

[0007] In order to enhance the security of data transmission, the existing solution is to combine the MQTT protocol with the TLS (Transport Layer Security) protocol to form the MQTT over TLS solution. TLS provides three basic security goals for MQTT: confidentiality, integrity, and authentication. By encrypting information, unauthorized third parties are prevented from obtaining sensitive information; by using technologies such as message digests to confirm that the message has not been tampered with during transmission; and by using the certificate and key mechanism to confirm the identities of both parties in communication.

[0008] However, when the existing MQTT protocol is used in combination with the TLS protocol, first of all, it is necessary to ensure that the TLS version and algorithm library used are currently considered safe. Secondly, if the TLS protocol is misconfigured, it may expose security risks or increase the vulnerability of the system. Finally, the current mainstream cryptographic algorithms and certificates of the TLS protocol are international cryptographic algorithms and international digital certificates. If used in important information systems or key Internet of Things, Internet of Vehicles and other equipment communications, it will not pass the requirements of cryptographic application and security assessment, and there will be non-compliant cryptographic applications. Summary of the invention

[0009] In order to overcome the shortcomings of the above technologies, the present invention provides a secure communication method and system of the MQTT protocol based on the national secret cryptographic module to realize the secure communication of the MQTT protocol. Based on the national secret hardware cryptographic module, the SM2 algorithm signature and verification are integrated into the MQTT protocol, and the SM2 public key is used to encrypt and store the username and password of each client. The SM4 algorithm is used to symmetrically encrypt and decrypt data transmitted by the MQTT protocol. The MQTT protocol that complies with the national secret is designed to realize the secure and compliant communication of the MQTT protocol between devices and ensure the confidentiality of the data.

[0010] The technical solution adopted by the present invention to overcome its technical problems is: the first aspect of the present invention proposes a secure communication method of the MQTT protocol based on the national secret password module, and the server and client communicating based on the MQTT protocol are both configured with the national secret password module, wherein the client is a subscriber or a publisher, and the secure communication method specifically includes: the server and the client generate an initial key pair based on the national secret password module, and perform signature verification based on the national secret algorithm and the initial key pair to achieve secure identity authentication between the server and the client; the server and the client negotiate an encryption key based on the national secret algorithm; the client sends a connection message of the MQTT protocol encrypted based on the encryption key and the national secret algorithm to the server to verify the client user name and password; based on the verification result, communication of the MQTT protocol based on the encryption key and the national secret algorithm is performed.

[0011] Furthermore, the server and the client generate an initial key pair based on the national secret cryptographic module, and perform signature verification based on the national secret algorithm and the initial key pair to achieve secure identity authentication between the server and the client, specifically including: the server and the client generate corresponding key pairs based on the national secret cryptographic module respectively, and share the public key in each other's key pair; the server Broker establishes a TCP connection with the client; the server generates a first random number based on the national secret cryptographic module, and sends it to the client; the client generates a second random number based on the national secret cryptographic module, and signs the first random number and the second random number based on the client private key, and sends the signature data to the server; after receiving the signature data, the server verifies the signature based on the client public key. If the verification succeeds, the server signs the second random number based on the server private key and sends the signature data to the client. If the verification fails, the connection with the corresponding client is closed; the client verifies the signature based on the server public key. If the verification succeeds, the client returns a confirmation message to the server to complete the identity authentication of the server. If the verification fails, the connection with the corresponding server is closed.

[0012] The identity is authenticated by signing and verifying the signature through the SM2 asymmetric key.

[0013] Furthermore, the server and the client negotiate an encryption key based on a national secret algorithm, specifically including: the server generates a symmetric key based on a national secret hardware cryptographic module, encrypts it based on the client public key to obtain an encrypted ciphertext, and signs the encrypted ciphertext based on the server private key to generate a signed message, and sends the encrypted ciphertext and the signed message to the client; the client verifies the signed message based on the server public key, and after the verification is passed, decrypts the encrypted ciphertext based on the client private key to obtain the symmetric key, and returns a confirmation message; both the server and the client use the symmetric key as the encryption key.

[0014] The SM4 symmetric key is obtained through negotiation through the SM2 asymmetric key and SM2 asymmetric encryption.

[0015] Furthermore, each device of the client is assigned a unique client username and password during initial deployment, and the client encrypts the client username and password using the server public key based on the national secret password module.

[0016] The username and password are encrypted using the SM2 asymmetric key.

[0017] Furthermore, the client sends a connection message of the MQTT protocol encrypted based on the encryption key and the national secret algorithm to the server to verify the client's username and password, specifically including: the client sends a connection message encrypted based on the national secret algorithm and the encryption key to the server, wherein the connection message at least includes the client's username and password encrypted based on the server's public key, the server decrypts the connection message based on the encryption key, and decrypts the client's username and password based on the server's private key; the server verifies the client's username and password, if the verification is successful, the server replies to the client with a reply message corresponding to the connection message, if the verification fails, the server closes the connection with the corresponding client.

[0018] Furthermore, the communication based on the MQTT protocol using the encryption key and the national secret algorithm at least includes the client's subscriber subscribing to a topic from the server, specifically including: the subscriber sending the topic information and load information in the subscription message encrypted based on the national secret algorithm and the encryption key to the server; the server decrypts the received topic information and load information based on the encryption key, and replies with a subscription reply message to the subscriber.

[0019] Furthermore, the communication based on the MQTT protocol using the encryption key and the national secret algorithm includes at least the publishing end of the client publishing data, specifically including: the publishing end sending a publishing message to the server, and encrypting the subject information and load information in the publishing message based on the national secret algorithm and the encryption key; the server decrypts the received subject information and load information based on the encryption key, and replies with a reply message to the publishing message; the server sends a publishing message to the subscriber, and encrypts the subject information and load information in the publishing message based on the national secret algorithm and the encryption key; the subscriber decrypts the subject information and load information based on the encryption key, and replies with a reply message to the corresponding publishing message to the server.

[0020] Use SM4 symmetric key to encrypt data transmission.

[0021] Furthermore, the national secret algorithm adopts a combination of the SM2 asymmetric algorithm and the SM4 symmetric algorithm, wherein the SM2 asymmetric algorithm is used for signature verification and negotiation of the SM4 symmetric key, and the SM4 symmetric algorithm is used for data encryption transmission.

[0022] Furthermore, the initial key pair is an SM2 key pair.

[0023] Another aspect of the present invention proposes a secure communication system that runs the above-mentioned secure communication method of the MQTT protocol based on the national secret password module. The secure communication system includes at least a server and several clients that communicate based on the MQTT protocol. The server and the client are both configured with at least a national secret password module. The national secret password module includes at least an initial key unit, a signature and verification unit, an asymmetric encryption and decryption unit, a random number unit, a key unit and a symmetric encryption and decryption unit. The initial key unit is used to generate an initial asymmetric key for the device; the random number unit is used to generate a random number; the key unit is used to generate a symmetric key; the signature verification unit is used to perform signature verification based on a random number and an initial asymmetric key to achieve secure identity authentication of the server and the client; the asymmetric encryption and decryption unit is used to encrypt and decrypt the client's username and password based on the initial asymmetric key, and to negotiate an encryption key based on a symmetric key and an initial asymmetric key; the symmetric encryption and decryption unit is used to encrypt and decrypt messages transmitted by the MQTT protocol based on the encryption key.

[0024] The hardware national secret cryptographic module has a commercial secret product model certificate issued by the National Cryptography Administration, can meet the information security compliance requirements of the application system, can be used for secure management / storage of keys, and can provide hardware devices for cryptographic computing operations. This module is generally connected to the device in the form of an extension or external device.

[0025] The beneficial effects of the present invention are: 1. By configuring the hardware national secret password module, cryptographic algorithm operation, signature verification, key generation and random number generation are realized, thereby supporting the national secret algorithm MQTT protocol communication of the device and meeting the information security compliance requirements of the application system; 2. Through the digital signature, key negotiation, data encryption and other technologies of the national secret algorithm, the confidentiality, integrity and non-repudiation of communication and data transmission of the MQTT protocol can be achieved; 3. By using SM2 signature verification for identity authentication, and verifying the username and password based on the SM4 algorithm and SM4 symmetric key, the identities of both parties in communication are confirmed multiple times to ensure the transmission security of the MQTT protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A flowchart of a secure communication method of the MQTT protocol based on a national secret password module according to an embodiment of the present invention; Figure 2 A schematic diagram of a process for performing security identity authentication between a server and a client according to an embodiment of the present invention; Figure 3 A schematic diagram of a process for negotiating an encryption key between a server and a client based on a national encryption algorithm according to an embodiment of the present invention; Figure 4 The present invention is a flow chart of the MQTT protocol communication between the server and the client based on the encryption key and the national encryption algorithm. DETAILED DESCRIPTION

[0027] In order to facilitate those skilled in the art to better understand the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The following is only exemplary and does not limit the protection scope of the present invention.

[0028] like Figure 1 As shown, a flow chart of a secure communication method of the MQTT protocol based on a national secret password module described in this embodiment, the server and client communicating based on the MQTT protocol are both configured with a national secret password module, wherein the client is a subscriber or publisher.

[0029] Among them, the hardware national secret password module has a commercial secret product model certificate issued by the National Cryptography Bureau, can meet the information security compliance requirements of the application system, can be used for secure management / storage of keys, and can provide hardware devices for cryptographic calculation operations. The module is generally connected to the device in the form of an extension or external device. The secure communication method of the MQTT protocol based on the national secret password module described in this embodiment specifically includes the following steps.

[0030] S1, the server and the client generate an initial key pair based on the national secret cryptographic module, and perform signature verification based on the national secret algorithm and the initial key pair to achieve secure identity authentication between the server and the client.

[0031] The process diagram of secure identity authentication between the server and the client is as follows Figure 2 As shown, the specific steps include the following steps.

[0032] S11, the server and the client respectively generate corresponding initial asymmetric key pairs based on the national secret cryptographic module, and share the public keys in each other's key pairs.

[0033] The server and client have generated the initial SM2 key pair of the device through the national secret password module, and the server Broker and the client share the initial SM2 public key with each other through installation and configuration before communication.

[0034] S12, the server Broker establishes a TCP connection with the client.

[0035] S13, the server Broker generates a first random number R1 through a hardware national secret password module and sends it to the client.

[0036] S14, the client generates a second random number R2 through the hardware national secret password module, and uses the client's initial SM2 private key to sign the first random number R1 and the second random number R2, and sends the signed data to the server.

[0037] S15, after receiving the signature data, the server Broker uses the client public key to verify the signature and completes the client's identity authentication; if the signature verification fails, the connection with the corresponding client is closed; if the signature verification passes, the server Broker uses the server SM2 private key to sign the client's second random number R2 and sends the signature data to the client.

[0038] S16, after receiving the signature data, the client uses the server public key to verify the signature data, thereby completing the identity authentication of the server. If the signature verification fails, the connection with the corresponding server is closed. If the signature verification passes, a confirmation message is returned.

[0039] S2: The server and the client negotiate the encryption key based on the national encryption algorithm.

[0040] The process diagram of the negotiation of encryption keys between the server and the client based on the national secret algorithm is as follows Figure 3 As shown, the specific steps include the following steps.

[0041] S21, the server Broker generates a 16-byte symmetric key K through the national secret password module, and uses the client SM2 public key to encrypt it into a ciphertext C, and uses the server Broker SM2 private key to sign the ciphertext C to generate a signed message Sc, and sends the encrypted ciphertext C and the signed message Sc to the client; S22, the client receives the encrypted ciphertext C and the signed message Sc, and uses the client's SM2 public key to verify the signed message Sc. After the verification is successful, the client uses its own SM2 private key to decrypt C, obtain K, and return a confirmation message.

[0042] S23, the server Broker and the client use the symmetric key K as the encryption key for encrypted data transmission between the two parties.

[0043] S3: The client sends a connection message of the MQTT protocol encrypted based on the encryption key and the national encryption algorithm to the server to verify the client username and password.

[0044] like Figure 4As shown in the figure, it is a flow chart of the data transmission process between the server and the client, in which each device of the client is assigned a unique client username and password during initial deployment. The client username and password are encrypted and stored using the server Broker's SM2 public key through the hardware national secret password module, and are used for the server to verify the client during MQTT communication. The client sends a connection message of the MQTT protocol encrypted based on the encryption key and the national secret algorithm to the server to verify the client username and password, which mainly includes the following process.

[0045] S31, the client sends a connection message, namely, a CONNECT message, of the MQTT protocol encrypted based on the national secret algorithm and the encryption key to the server, wherein the connection message includes at least the client's user name and password encrypted based on the server's public key.

[0046] The payload message Payload in the CONNECT message includes at least the client user name and password encrypted using the SM2 public key.

[0047] The national encryption algorithm used to encrypt messages during data transmission adopts the SM4 algorithm.

[0048] S32, the server decrypts the CONNECT message based on the encryption key, and decrypts the client username and password in the payload message Payload based on the server SM2 private key.

[0049] S33, the server verifies the user name and password of the client. If the user name and password of the client are verified, the server sends a reply message corresponding to the CONNECT message, that is, a CONNACK message, to the client, and performs data transmission in the subsequent step S4.

[0050] It should be noted that the reply CONNACK message only has a message header, does not include a payload, and does not need to be encrypted. For example, the reply CONNACK message indicates that the connection is successful, identifies the message length supported for communication, and supports functions.

[0051] If the client username and password verification fails, the connection with the corresponding client is closed.

[0052] S4, based on the verification results, communication is carried out using the MQTT protocol based on encryption keys and national secret algorithms.

[0053] In one embodiment of the present invention, the encrypted communication process of the MQTT protocol and the commonly used transmission methods of PUBLISH, PUBACK, SUBSCRIBE, and SUBACK messages are taken as examples to illustrate the communication between the server and the client using the MQTT protocol based on encryption keys and national encryption algorithms.

[0054] The process of the client's subscriber subscribing to a topic from the server includes the following steps: S411, the subscriber sends the subject information and load information in the subscription SUBSCRIBE message encrypted based on the SM4 national encryption algorithm and encryption key to the server.

[0055] The subscriber uses the encryption key K to encrypt the topic information (Topic) and load information (payload) transmitted in the protocol to generate the ciphertext E, E=SM4_enc(Topic||payload).

[0056] S412, the server decrypts the received topic information and load information based on the encryption key K, and replies with a subscription reply message to the subscriber.

[0057] The server decrypts the received ciphertext E according to the encryption key K (Topic||payload)=SM4_dec(E) to obtain the message topic (Topic) and payload (payload) sent by the client.

[0058] The process of publishing data on the publishing end includes the following steps: S421, the publisher sends the subject information and load information in the PUBLISH message encrypted based on the SM4 national encryption algorithm and encryption key to the server.

[0059] S422, the server decrypts the received topic information and load information based on the encryption key K, and replies with a corresponding PUBACK message to the publisher.

[0060] S423, the server sends the subject information and load information in the PUBLISH message encrypted based on the SM4 national encryption algorithm and encryption key to the subscriber.

[0061] S424, the subscriber decrypts the topic information and the load information based on the encryption key and replies with a corresponding PUBACK message to the server.

[0062] Another embodiment of the present invention also proposes a secure communication system for running the secure communication method based on the above-mentioned MQTT protocol based on the national secret cryptographic module, wherein the secure communication system includes at least a server and several clients communicating based on the MQTT protocol, and both the server and the client are configured with at least a national secret cryptographic module.

[0063] The national secret password module at least includes an initial key unit, a signature and verification unit, an asymmetric encryption and decryption unit, a random number unit, a key unit and a symmetric encryption and decryption unit. The initial key unit is used to generate the initial asymmetric key of the device; the random number unit is used to generate random numbers; the key unit is used to generate symmetric keys; the signature verification unit is used to perform signature verification based on random numbers and initial asymmetric keys to achieve secure identity authentication of the server and client; the asymmetric encryption and decryption unit is used to encrypt and decrypt the client's username and password based on the initial asymmetric key, and to negotiate encryption keys based on symmetric keys and initial asymmetric keys; the symmetric encryption and decryption unit is used to encrypt and decrypt messages transmitted by the MQTT protocol based on the encryption key.

[0064] The present invention proposes a secure communication method and system for the MQTT protocol based on a national secret cryptographic module. The method and system support multiple functions of generating an initial public-private key pair based on the national secret cryptographic module, asymmetric encryption and decryption, generating random numbers, generating symmetric keys, and symmetric encryption and decryption. First, the SM2 signature verification technology is used to implement a secure identity authentication mechanism between the server Broker and the client. Then, the SM2 asymmetric encryption technology is used to securely negotiate an SM4 symmetric key for encrypting transmitted data between the server Broker and the client. Finally, the negotiated SM4 symmetric key is used to encrypt the transmitted data, thereby implementing MQTT protocol communication based on the national secret algorithm and ensuring the confidentiality of the data.

[0065] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0066] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The system and system embodiment described above are only illustrative, and some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0067] Professionals can appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

Claims

1. A secure communication method based on the MQTT protocol of the national secret password module, characterized in that: The server and client based on MQTT protocol communication are both equipped with national secret password modules, where the client is the subscriber or publisher. The secure communication method specifically includes: The server and client generate an initial key pair based on the national secret password module, and perform signature verification based on the national secret algorithm and the initial key pair to achieve secure identity authentication between the server and the client; The server and client negotiate encryption keys based on the national secret algorithm; The client sends a connection message of the MQTT protocol encrypted based on the encryption key and the national encryption algorithm to the server to verify the client username and password; Based on the verification results, communication is carried out using the MQTT protocol based on encryption keys and national secret algorithms.

2. According to claim 1, a secure communication method based on the MQTT protocol of the national secret password module is characterized in that: The server and the client generate an initial key pair based on the national secret password module, and perform signature verification based on the national secret algorithm and the initial key pair to achieve secure identity authentication between the server and the client, specifically including: The server and the client generate corresponding key pairs based on the national secret password module respectively, and share the public key in each other's key pair; The server establishes a TCP connection with the client; The server generates a first random number based on the national secret code module and sends it to the client; The client generates a second random number based on the national secret password module, signs the first random number and the second random number based on the client private key, and sends the signature data to the server; After receiving the signed data, the server verifies the signature based on the client public key. If the verification is successful, the server signs the second random number based on the server private key and sends the signature data to the client. If the verification fails, the connection with the corresponding client is closed; The client verifies the signature based on the server public key. If the verification succeeds, the client returns a confirmation message to the server to complete the server's identity authentication. If the verification fails, the client closes the connection with the corresponding server.

3. According to claim 1, a secure communication method based on the MQTT protocol of the national secret password module is characterized in that: The server and the client negotiate an encryption key based on the national secret algorithm, specifically including: The server generates a symmetric key based on the national secret hardware cryptographic module, encrypts it based on the client public key to obtain an encrypted ciphertext, and signs the encrypted ciphertext based on the server private key to generate a signed message, and sends the encrypted ciphertext and signed message to the client; The client verifies the signed message based on the server public key, and after verification, decrypts the encrypted ciphertext based on the client private key to obtain the symmetric key, and returns a confirmation message; Both the server and the client use the symmetric key as the encryption key.

4. According to claim 1, a secure communication method based on the MQTT protocol of the national secret password module is characterized in that: Each device of the client is assigned a unique client username and password during initial deployment, and the client encrypts the client username and password using the server public key based on the national secret password module.

5. A secure communication method based on the MQTT protocol of the national secret password module according to claim 4, characterized in that: The client sends a connection message of the MQTT protocol encrypted based on the encryption key and the national encryption algorithm to the server to verify the client username and password, specifically including: The client sends a connection message encrypted with the national secret algorithm and encryption key to the server, wherein the connection message includes at least the client's user name and password encrypted with the server's public key. The server decrypts the connection message based on the encryption key, and decrypts the client's username and password based on the server's private key; The server verifies the client's username and password. If the verification is successful, the server replies to the client with a reply message corresponding to the connection message. If the verification fails, the server closes the connection with the corresponding client.

6. The secure communication method according to claim 1, characterized in that: The communication based on the MQTT protocol with encryption keys and national encryption algorithms at least includes the client's subscriber subscribing to a topic from the server, specifically including: The subscriber sends the subject information and load information in the subscription message encrypted based on the national encryption algorithm and encryption key to the server; The server decrypts the received topic information and payload information based on the encryption key, and replies with a subscription reply message to the subscriber.

7. The secure communication method according to claim 1, characterized in that: The communication based on the MQTT protocol with encryption keys and national encryption algorithms at least includes the publishing end of the client publishing data, specifically including: The publisher sends a publishing message to the server, and encrypts the subject information and payload information in the publishing message based on the national encryption algorithm and encryption key; The server decrypts the received topic information and payload information based on the encryption key, and replies with a reply message to the published message; The server sends a publishing message to the subscriber and encrypts the subject information and load information in the publishing message based on the national encryption algorithm and encryption key. The subscriber decrypts the topic information and payload information based on the encryption key and replies to the server with a reply message corresponding to the published message.

8. A secure communication method based on the MQTT protocol of the national secret password module according to any one of claims 1 to 7, characterized in that: The national secret algorithm adopts a combination of the SM2 asymmetric algorithm and the SM4 symmetric algorithm, wherein the SM2 asymmetric algorithm is used for signature verification and negotiation of the SM4 symmetric key, and the SM4 symmetric algorithm is used for data encryption transmission.

9. A secure communication method based on the MQTT protocol of the national secret password module according to any one of claims 1 to 7, characterized in that: The initial key pair is the SM2 key pair.

10. A secure communication system for running the secure communication method of the MQTT protocol based on the national secret password module according to any one of claims 1 to 9, characterized in that: The secure communication system at least includes a server and several clients communicating based on the MQTT protocol. The server and the client are both equipped with at least a national secret password module. The national secret code module at least includes an initial key unit, a signature and verification unit, an asymmetric encryption and decryption unit, a random number unit, a key unit and a symmetric encryption and decryption unit. The initial key unit is used to generate an initial asymmetric key for the device; The random number unit is used to generate random numbers; The key unit is used to generate a symmetric key; The signature verification unit is used to perform signature verification based on a random number and an initial asymmetric key to achieve secure identity authentication of the server and the client; The asymmetric encryption and decryption unit is used to encrypt and decrypt the user name and password of the client based on the initial asymmetric key, and to negotiate an encryption key based on the symmetric key and the initial asymmetric key; The symmetric encryption and decryption unit is used to encrypt and decrypt messages transmitted by the MQTT protocol based on an encryption key.

Images