Message processing method and device, equipment and medium

Abstract

The invention discloses a message processing method and device, equipment and a medium. The method is applied to message middleware and comprises the following steps: acquiring a service request of an application system participant; calling a secret key management interface provided by a hardware encryption and decryption module based on an application programming API interface, and generating a secret key and a secret key handle of an application system participant; broadcasting a public key and a public key handle in the secret key handle through a public key handle broadcasting interface; and calling an encryption and decryption interface provided by a hardware encryption and decryption module through an API interface according to the secret key, and processing the service request to obtain a target message. A standard calling interface is provided for an external application system in a uniform interface mode through native national cryptographic algorithm supporting capacity of message middleware, so that encryption and decryption processing of service requests of participants of the application system is achieved, a target message is obtained, the process of supporting application layer data encryption and decryption is achieved based on local hardware equipment, and the method is simple and convenient to implement. And the efficiency of algorithm calculation and data processing is improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and in particular to a message processing method, device, equipment and medium. Background Art

[0002] With the development of information technology, various industries have put forward higher requirements for the security construction of information systems. The localization of cryptography is not only a need to achieve independent innovation and security and reliability, but the application and construction of system national secret algorithms is mainly to enhance the security and controllability of national information systems.

[0003] When building an application system with message middleware as the basic component, in order to meet the national security requirements, the message middleware and the application system are usually treated as two independent entities. The application system transmits the message encrypted by the encryption device to the message middleware, and the message middleware calls the encryption device to decrypt the message, and then transmits the plain text to achieve the national security requirements of the encryption algorithm for the application system construction.

[0004] However, such solutions require the introduction of a national secret front-end or a national secret encryption machine, and in the process of using such encryption equipment, the application system and related basic components need to be adapted separately, which not only increases the cost of the application system, but also increases the difficulty of system construction. Summary of the invention

[0005] The present invention provides a message processing method, device, equipment and medium to realize rapid processing and security guarantee of business data through message middleware.

[0006] According to a first aspect of the present invention, a message processing method is provided, which is applied to a message middleware, and the method comprises:

[0007] Obtain business requests from application system participants;

[0008] Based on the API interface, the key management interface provided by the hardware encryption and decryption module is called to generate the key and key handle of the application system participant;

[0009] Broadcasting the public key and the public key handle in the secret key handle through the public key handle broadcast interface;

[0010] According to the secret key, the encryption and decryption interface provided by the hardware encryption and decryption module is called through the API interface to process the service request and obtain the target message.

[0011] According to a second aspect of the present invention, there is provided a message processing device, which is applied to a message middleware, and the device comprises:

[0012] A request acquisition unit, used to acquire business requests of application system participants;

[0013] A key generation unit, used to call the key management interface provided by the hardware encryption and decryption module based on the API interface to generate the key and key handle of the application system participant;

[0014] A handle broadcast unit, used to broadcast the public key and the public key handle in the secret key handle through a public key handle broadcast interface;

[0015] The message determination unit is used to call the encryption and decryption interface provided by the hardware encryption and decryption module through the API interface according to the secret key, process the service request, and obtain the target message.

[0016] According to a third aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0017] at least one processor; and

[0018] a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the message processing method described in any embodiment of the present invention.

[0020] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the message processing method described in any embodiment of the present invention when executed.

[0021] According to a fifth aspect of the present invention, an embodiment of the present invention further provides a computer program product, the computer program product comprising a computer program, and when the computer program is executed by a processor, the message processing method of any embodiment of the present invention is implemented.

[0022] The technical solution of the embodiment of the present invention is applied to the message middleware, which obtains the business request of the application system participant; calls the key management interface provided by the hardware encryption and decryption module based on the application programming API interface to generate the key and key handle of the application system participant; broadcasts the public key and public key handle in the key handle through the public key handle broadcast interface; calls the encryption and decryption interface provided by the hardware encryption and decryption module through the API interface according to the key, processes the business request, and obtains the target message. Through the native support of the national secret algorithm capability of the message middleware, a standard calling interface is provided for external application systems in the form of access in the form of a unified interface to implement encryption and decryption processing of the business request of the application system participant, obtain the target message, and is implemented based on local hardware devices in the process of supporting application layer data encryption and decryption, thereby improving the efficiency of algorithm calculation and data processing.

[0023] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 is a flowchart of a message processing method provided according to Embodiment 1 of the present invention;

[0026] Figure 2 is a flowchart of a message processing method provided according to Embodiment 2 of the present invention;

[0027] Figure 3 This is an example flow chart of a message processing method provided according to Embodiment 2 of the present invention;

[0028] Figure 4 is a structural diagram of a message processing device provided according to Embodiment 3 of the present invention;

[0029] Figure 5 It is a schematic diagram of the structure of an electronic device implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] Embodiment 1

[0033] Figure 1 A flowchart of a message processing method is provided for the first embodiment of the present invention. This embodiment is applicable to the situation that ... the method can be executed by a message processing device, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device. Figure 1 As shown, the method is applied to message middleware, including:

[0034] S110: Obtain business requests from application system participants.

[0035] In this embodiment, the application system refers to a software system that implements specific business functions and processes. Application system participants include message producers and message consumers of the application system. A business request can be understood as a request for a service, operation or resource in a business process or system.

[0036] Specifically, the message middleware can provide a transmission channel to the application system in the form of a unified interface, and the message middleware can obtain business requests sent by application system participants through the unified interface.

[0037] S120 , calling the key management interface provided by the hardware encryption and decryption module based on the API interface to generate the key and key handle of the application system participant.

[0038] In this embodiment, the Application Programming Interface (API) can be understood as a protocol or tool set that allows different software components to interact and exchange data. The hardware encryption and decryption module can be understood as a module that provides encryption, decryption, signing and other functions in hardware. The key management interface can be understood as an interface for managing keys, such as an interface for generating and deleting keys.

[0039] Among them, the encryption and decryption interface includes the symmetric encryption algorithm SM1 encryption and decryption function interface, the symmetric encryption algorithm SM4 encryption and decryption function interface, the asymmetric encryption algorithm SM2 encryption and decryption function interface, the hash algorithm calling interface, the data signature generation interface and the signature verification interface.

[0040] Specifically, the message middleware can call the key management interface provided by the hardware encryption and decryption module based on the API interface, and implement the key generation, storage and binding process of the application system participants by calling the interface function.

[0041] S130. Broadcast the public key and public key handle in the secret key handle through the public key handle broadcast interface.

[0042] In this embodiment, the public key can be understood as the public part of a key pair used to encrypt data and verify digital signatures. The public key handle can be understood as a reference or identifier used to identify and operate a public key in an encryption algorithm.

[0043] Specifically, the message middleware can query the public key and public key handle of the application system participants based on the public key handle interface and broadcast them. After the message middleware application system participants complete the secret key storage, the message middleware provides the public key handle information to the application system participants through the public key handle broadcast interface to ensure that the message producer uses the correct handle to implement message encryption. For example, the message producer can use its own private key to encrypt data and send it to multiple message recipients, or use the public key of the message recipient to encrypt data, ensuring that only the message recipient can correctly decrypt the data according to its private key.

[0044] S140. According to the secret key, the encryption and decryption interface provided by the hardware encryption and decryption module is called through the API interface to process the service request and obtain the target message.

[0045] In this embodiment, the encryption and decryption interface can be understood as an interface for encryption, decryption, signing, etc. The target message can be understood as a message that has been encrypted, signed, or decrypted.

[0046] Specifically, the message middleware can call the encryption and decryption interface provided by the hardware encryption and decryption module through the API interface, process the business data in the business request through the interface function corresponding to the encryption and decryption interface, and obtain the target message.

[0047] The technical solution of the embodiment of the present invention is applied to the message middleware, which obtains the business request of the application system participant; calls the key management interface provided by the hardware encryption and decryption module based on the application programming API interface to generate the key and key handle of the application system participant; broadcasts the public key and public key handle in the key handle through the public key handle broadcast interface; calls the encryption and decryption interface provided by the hardware encryption and decryption module through the API interface according to the key, processes the business request, and obtains the target message. Through the native support of the national secret algorithm capability of the message middleware, a standard calling interface is provided for external application systems in the form of access in the form of a unified interface to implement encryption and decryption processing of the business request of the application system participant, obtain the target message, and is implemented based on local hardware devices in the process of supporting application layer data encryption and decryption, thereby improving the efficiency of algorithm calculation and data processing.

[0048] As a first optional embodiment of the first embodiment, before obtaining the service request of the application system participant, the method further includes:

[0049] Receive the identity authentication information of the application system participants, determine the permission attributes of the application system participants, and control the loading of the backend configuration file based on the permission attributes.

[0050] In this embodiment, the identity authentication information can be understood as information related to identity authentication, such as an account password, etc. The permission attribute can be understood as a permission used to distinguish the account. The backend configuration file can be understood as a configuration file used to control access to authorized resources.

[0051] Specifically, the message middleware can receive the identity authentication information of the application system participants, such as through the account password to achieve identity authentication, the password is encrypted and stored by calling the SM4 algorithm of the hardware encryption and decryption module. After the identity authentication is completed, the message middleware can identify the message middleware resource permissions that the account can access (such as message topics and message queues and other resources), obtain the permission attributes, and control the loading of the message middleware backend configuration file through the permission attributes to ensure that the application system participants can only access authorized resources when accessing the message middleware.

[0052] Embodiment 2

[0053] Figure 2 This is a flow chart of a message processing method provided in Embodiment 2 of the present invention. This embodiment is a further optimization of the above embodiment. Figure 2 As shown, the method includes:

[0054] S201. Obtain business requests from application system participants.

[0055] S202: Based on the API interface, the key management interface provided by the hardware encryption and decryption module is called, the key generation interface function is called, the key is generated and the key handle is returned.

[0056] In this embodiment, the key generation interface function can be understood as a function used to complete the key generation function. Among them, the key generation interface function includes a symmetric key generation interface and an asymmetric key generation interface;

[0057] Specifically, the message middleware can call the key management interface provided by the hardware encryption and decryption module based on the API interface, call the key generation interface function according to the key generation requirements in the business request, generate the key and return the key handle.

[0058] S203: Bind the key handle to the application system participant.

[0059] Specifically, the message middleware can bind the key handle to the account of the application system participant.

[0060] S204, calling the storage interface function corresponding to the key generation interface function, storing the key and returning the key handle.

[0061] In this embodiment, the storage interface function can be understood as an interface function for completing the key storage function.

[0062] Specifically, the message middleware implements the key storage and binding process of the participants through a unified interface. The keys of all participants are stored in the hardware encryption module, and the cryptographic algorithm calling process is implemented through the key handle to meet the key lifecycle security.

[0063] For example, when storing the secret key of the application system participant, the message middleware can first call the SM3 algorithm to complete the hash, and then call the SM4 algorithm to use the symmetric key handle to call the hardware module for encryption, and then store it in the application system database after encryption.

[0064] Exemplarily, the functions provided by the key management interface of the hardware encryption and decryption module are demonstrated by taking a specific example, as shown in Table 1 below.

[0065] Table 1 Example of key management interface list

[0066]

[0067] As shown in Table 1, it includes a symmetric key generation interface and a corresponding symmetric password storage interface, which are used to generate a symmetric key and return a symmetric key handle; it also includes an asymmetric key generation interface and a corresponding asymmetric password storage interface, as well as a key deletion interface, and the functions corresponding to the interface can be implemented by calling the interface function.

[0068] S205. Broadcast the public key and public key handle in the secret key handle through the public key handle broadcast interface.

[0069] S206. When being a message producer, obtain the first target handle information broadcasted by the public key handle broadcast interface; the first target handle information comes from the target consumer of the service data received in the service request.

[0070] In this embodiment, the first target handle information can be understood as the public key and public key handle of the recipient of the business data. The target consumer is the recipient of the business data, which can be one or more. The business data can be understood as the data to be transmitted.

[0071] Specifically, when the application system participant is a message producer, the business request corresponds to transmitting business data to the target consumer through the message middleware, and the message middleware can obtain the first target handle information of the target consumer through the public key handle broadcast interface.

[0072] S207: Call the encryption and decryption interface provided by the hardware encryption and decryption module based on the API interface to determine the encryption and decryption functional interface function corresponding to the service request.

[0073] In this embodiment, the encryption / decryption function interface function can be understood as a function for implementing encryption, decryption or signing functions.

[0074] Specifically, the message middleware can call the encryption and decryption interface provided by the hardware encryption and decryption module based on the API interface, and determine the encryption and decryption function interface function to be called through the service request.

[0075] Table 2 Example of encryption and decryption interface list

[0076]

[0077]

[0078] As shown in the above table, there are six types of encryption and decryption interfaces, namely, symmetric encryption algorithm SM1 encryption and decryption function interface, symmetric encryption algorithm SM4 encryption and decryption function interface, asymmetric encryption algorithm SM2 encryption and decryption function interface, hash algorithm calling interface, data signature generation interface and signature verification interface. The corresponding functions are implemented by calling the interface functions.

[0079] S208. Process the business data in the business request according to the first target handle information and the secret key through the encryption and decryption function interface function, obtain the target message and write it.

[0080] Specifically, the message middleware can encrypt the business data in the business request according to the public key in the first target handle information and the private key in the secret key through the encryption and decryption function interface function, obtain the target message and write it into the corresponding message pool, so as to pass it to the target consumer to obtain the target message.

[0081] Exemplarily, when sending to a target consumer, the business data can be encrypted using the public key in the first target handle information combined with the encryption and decryption function interface function to ensure that only the correct target consumer can parse the data. When there are multiple target consumers, the private key of the message producer can be used for encryption and / or signing to ensure that multiple target consumers can decrypt and verify the message based on the public key of the message producer.

[0082] S209. When it is a message consumer, obtain the second target handle information broadcast by the public key handle broadcast interface; the second target handle information comes from the target producer of the business data in the business request.

[0083] In this embodiment, the second target handle information can be understood as the handle information of the target producer that sends the service data. The target producer can be understood as the message producer that sends the service data.

[0084] Specifically, when the application system participant is a message consumer, the message middleware can obtain the second target handle information broadcast by the target producer through the public key handle broadcast interface; the second target handle information comes from the target producer of the business data in the business request.

[0085] S210: Call the encryption and decryption interface provided by the hardware encryption and decryption module based on the API interface to determine the encryption and decryption functional interface function corresponding to the service request.

[0086] Specifically, the message middleware can call the encryption and decryption interface provided by the hardware encryption and decryption module based on the API interface, determine the encryption and decryption functional interface function corresponding to the business request, and complete the decryption and / or unsigning of the business data.

[0087] S211. Process the business data in the business request according to the second target handle information and the secret key through the encryption and decryption function interface function to obtain the target message.

[0088] Specifically, the message middleware can decrypt and / or unsign the business data in the business request according to the public key and the secret key in the second target handle information through the encryption and decryption function interface function to obtain the target message.

[0089] The technical solution of the embodiment of the present invention is to use the hardware encryption and decryption module as a part of the message middleware, provide a business processing channel for the application system in the form of a unified interface, receive the business request of the application system through the message middleware, call the key management interface of the hardware encryption and decryption module based on the API interface, call the key generation interface function in hardware form, generate the key and key handle corresponding to the application system participant, bind and store them with the application system participant, realize the generation of the key in the form of hardware processing, and meet the security of the key life cycle. The public key and public key handle of the participant are broadcasted through the public key handle broadcast interface, so that the participant can receive the target handle information of other application system participants associated with the business data transmission, and call the encryption and decryption interface provided by the hardware encryption and decryption module through the API interface based on the target handle information and its own secret key, so as to realize the encryption and decryption and encryption and decryption functions of the business data through the corresponding encryption and decryption function interface function, and at the same time meet the national security requirements of the message middleware and application system construction, compared with hardware devices such as encryption machines or national SSl gateways called through the network, it improves the computing speed and data processing efficiency, meets the national security requirements at the application and data security levels, does not need to repeatedly introduce other hardware encryption devices, and reduces the system construction cost.

[0090] The data security protection method for application systems is implemented based on the API interface of the message middleware hardware encryption and decryption module. By building a unified API calling interface to simultaneously meet the message reading and writing capabilities and the national secret algorithm calling capabilities, it provides application layer data security protection for the application system.

[0091] In order to facilitate the understanding of this solution, a specific example is used to demonstrate: Figure 3 This is an example flow chart of a message processing method provided in Embodiment 2 of the present invention, such as Figure 3 As shown, an application system A is included as a message producer, an application system B is included as a message consumer and the message middleware in the present invention. Taking a message sending and receiving as an example, the steps may be:

[0092] S301, application system A (message producer) performs identity login authentication;

[0093] S302, application system B (message consumer) performs identity login authentication;

[0094] S303, the message middleware performs identity authentication and authorization based on the identity authentication information of the application system participants;

[0095] S304: The key management interface provided by the hardware encryption and decryption module of the message middleware calls the key generation interface function to generate and store the key, and bind the key handle to the participant;

[0096] S305, application system A (message producer) queries the first handle information of the target consumer based on the public key handle broadcast interface;

[0097] S306, the message middleware broadcasts the public key handle information of the participant through the public key handle broadcast interface;

[0098] S307, application system B (message consumer) queries the second handle information of the target producer based on the public key handle broadcast interface;

[0099] S308, application system A (message producer) generates an encryption service request and calls the hardware encryption and decryption module based on the API interface;

[0100] S309, the message middleware calls the hardware encryption and decryption module based on the API interface, encrypts and / or signs the business data through the encryption and decryption function interface function through the secret key and the first handle information, obtains the target data, and writes it into the message pool;

[0101] S310, application system B (message consumer) generates a decryption service request based on the encrypted data;

[0102] S311, application system B (message consumer) calls the hardware encryption and decryption module based on the decryption service request and API interface;

[0103] S312. The message middleware calls the hardware encryption and decryption module based on the API interface, and decrypts and / or unsigns the business data through the encryption and decryption function interface function using the secret key and the second handle information.

[0104] Embodiment 3

[0105] Figure 4 This is a schematic diagram of the structure of a message processing device provided by Embodiment 3 of the present invention. Figure 4 As shown, the device is applied to message middleware, and the device includes:

[0106] A request acquisition unit 41 is used to acquire a business request of an application system participant;

[0107] The key generation unit 42 is used to call the key management interface provided by the hardware encryption and decryption module based on the API interface to generate the key and key handle of the application system participant;

[0108] A handle broadcast unit 43, used to broadcast the public key and the public key handle in the secret key handle through a public key handle broadcast interface;

[0109] The message determination unit 44 is used to call the encryption and decryption interface provided by the hardware encryption and decryption module through the API interface according to the secret key, process the service request, and obtain the target message.

[0110] The technical solution of the embodiment of the present invention is applied to the message middleware, which obtains the business request of the application system participant; calls the key management interface provided by the hardware encryption and decryption module based on the application programming API interface to generate the key and key handle of the application system participant; broadcasts the public key and public key handle in the key handle through the public key handle broadcast interface; calls the encryption and decryption interface provided by the hardware encryption and decryption module through the API interface according to the key, processes the business request, and obtains the target message. Through the native support of the national secret algorithm capability of the message middleware, a standard calling interface is provided for external application systems in the form of access in the form of a unified interface to implement encryption and decryption processing of the business request of the application system participant, obtain the target message, and is implemented based on local hardware devices in the process of supporting application layer data encryption and decryption, thereby improving the efficiency of algorithm calculation and data processing.

[0111] Furthermore, the key generation unit 42 is specifically used for:

[0112] Based on the API interface, call the key management interface provided by the hardware encryption and decryption module, call the key generation interface function, generate the key and return the key handle;

[0113] The key generation interface function includes a symmetric key generation interface and an asymmetric key generation interface;

[0114] Binding the key handle to the application system participant;

[0115] The storage interface function corresponding to the key generation interface function is called to store the key and return the key handle.

[0116] The application system participants include the message producers of the application system and the message consumers of the application system.

[0117] Furthermore, the message determination unit 44 includes: a first determination subunit and a second determination subunit.

[0118] The first determining subunit is specifically configured to:

[0119] When being the message producer, obtaining the first target handle information broadcasted by the public key handle broadcast interface; the first target handle information comes from the target consumer receiving the service data in the service request;

[0120] Calling the encryption and decryption interface provided by the hardware encryption and decryption module based on the API interface to determine the encryption and decryption functional interface function corresponding to the service request;

[0121] According to the first target handle information and the secret key, the business data in the business request is processed through the encryption and decryption function interface function to obtain the target message and write it.

[0122] The second determining subunit is specifically used for:

[0123] When being the message consumer, obtaining the second target handle information broadcasted by the public key handle broadcast interface; the second target handle information comes from the target producer of the service data in the service request;

[0124] Calling the encryption and decryption interface provided by the hardware encryption and decryption module based on the API interface to determine the encryption and decryption functional interface function corresponding to the service request;

[0125] The business data in the business request is processed according to the second target handle information and the secret key through the encryption and decryption function interface function to obtain a target message.

[0126] Among them, the encryption and decryption interface includes a symmetric encryption algorithm SM1 encryption and decryption function interface, a symmetric encryption algorithm SM4 encryption and decryption function interface, an asymmetric encryption algorithm SM2 encryption and decryption function interface, a hash algorithm calling interface, a data signature generation interface and a signature verification interface.

[0127] Optionally, the device further includes: a permission configuration unit.

[0128] The permission configuration unit is specifically used to: receive identity authentication information of an application system participant, determine the permission attribute of the application system participant, and control the loading of a backend configuration file based on the permission attribute.

[0129] The message processing device provided by the embodiment of the present invention can execute the message processing method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0130] Embodiment 4

[0131] Figure 5A schematic diagram of the structure of an electronic device 50 that can be used to implement an embodiment of the present invention is shown. The electronic device is a message middleware provided as any embodiment of the present invention, and is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0132] like Figure 5 As shown, the electronic device 50 includes at least one processor 51, and a memory connected to the at least one processor 51 in communication, such as a read-only memory (ROM) 52, a random access memory (RAM) 53, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 51 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 52 or the computer program loaded from the storage unit 58 to the random access memory (RAM) 53. In the RAM 53, various programs and data required for the operation of the electronic device 50 can also be stored. The processor 51, the ROM 52, and the RAM 53 are connected to each other via a bus 54. An input / output (I / O) interface 55 is also connected to the bus 54.

[0133] A number of components in the electronic device 50 are connected to the I / O interface 55, including: an input unit 56, such as a keyboard, a mouse, etc.; an output unit 57, such as various types of displays, speakers, etc.; a storage unit 58, such as a disk, an optical disk, etc.; and a communication unit 59, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 59 allows the electronic device 50 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0134] The processor 51 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 51 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 51 executes the various methods and processes described above, such as a message processing method.

[0135] In some embodiments, the message processing method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 58. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 50 via the ROM 52 and / or the communication unit 59. When the computer program is loaded into the RAM 53 and executed by the processor 51, one or more steps of the message processing method described above may be performed. Alternatively, in other embodiments, the processor 51 may be configured to perform the message processing method in any other appropriate manner (e.g., by means of firmware).

[0136] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0137] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0138] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0139] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0140] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0141] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0142] In one embodiment, the embodiment of the present invention further includes a computer program product, the computer program product includes a computer program, and the computer program implements the message processing method of any embodiment of the present invention when executed by a processor.

[0143] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0144] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0145] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A message processing method, characterized in that: Applied to message middleware, the method includes: Obtain business requests from application system participants; Based on the application programming API interface, the key management interface provided by the hardware encryption and decryption module is called to generate the key and key handle of the application system participant; Broadcasting the public key and the public key handle in the secret key handle through the public key handle broadcast interface; According to the secret key, the encryption and decryption interface provided by the hardware encryption and decryption module is called through the API interface to process the service request and obtain the target message.

2. The method according to claim 1, characterized in that The API-based interface calls the key management interface provided by the hardware encryption and decryption module to generate the key and key handle of the application system participant, including: Based on the API interface, call the key management interface provided by the hardware encryption and decryption module, call the key generation interface function, generate the key and return the key handle; The key generation interface function includes a symmetric key generation interface and an asymmetric key generation interface; Binding the key handle to the application system participant; The storage interface function corresponding to the key generation interface function is called to store the key and return the key handle.

3. The method according to claim 1, characterized in that The application system participants include the message producers of the application system and the message consumers of the application system.

4. The method according to claim 3, characterized in that When the message producer is the message producer, correspondingly, the encryption and decryption interface provided by the hardware encryption and decryption module is called through the API interface according to the secret key to process the service request and obtain the target message, including: Acquire the first target handle information broadcasted by the public key handle broadcast interface; the first target handle information comes from the target consumer who receives the service data in the service request; Calling the encryption and decryption interface provided by the hardware encryption and decryption module based on the API interface to determine the encryption and decryption functional interface function corresponding to the service request; According to the first target handle information and the secret key, the business data in the business request is processed through the encryption and decryption function interface function to obtain the target message and write it.

5. The method according to claim 3, characterized in that: When the message consumer is the message consumer, correspondingly, the encryption and decryption interface provided by the hardware encryption and decryption module is called through the API interface according to the secret key to process the service request and obtain the target message, including: Acquire the second target handle information broadcasted by the public key handle broadcast interface; the second target handle information comes from the target producer of the service data in the service request; Calling the encryption and decryption interface provided by the hardware encryption and decryption module based on the API interface to determine the encryption and decryption functional interface function corresponding to the service request; The business data in the business request is processed according to the second target handle information and the secret key through the encryption and decryption function interface function to obtain a target message.

6. The method according to claim 1, characterized in that The encryption and decryption interface includes a symmetric encryption algorithm SM1 encryption and decryption function interface, a symmetric encryption algorithm SM4 encryption and decryption function interface, an asymmetric encryption algorithm SM2 encryption and decryption function interface, a hash algorithm calling interface, a data signature generation interface and a signature verification interface.

7. The method according to claim 1, characterized in that Before obtaining the business request of the application system participant, the method further includes: Receive identity authentication information of an application system participant, determine the permission attribute of the application system participant, and control the loading of a backend configuration file based on the permission attribute.

8. A message processing device, characterized in that: Applied to message middleware, the device comprises: A request acquisition unit, used to acquire business requests of application system participants; A key generation unit, used to call the key management interface provided by the hardware encryption and decryption module based on the API interface to generate the key and key handle of the application system participant; A handle broadcast unit, used to broadcast the public key and the public key handle in the secret key handle through a public key handle broadcast interface; The message determination unit is used to call the encryption and decryption interface provided by the hardware encryption and decryption module through the API interface according to the secret key, process the service request, and obtain the target message.

9. An electronic device, characterized in that: The electronic device, as a message middleware according to any one of claims 1 to 7, comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the message processing method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the message processing method according to any one of claims 1 to 7 when executed.

Images