Network security communication system and method based on national commercial cryptographic algorithm

Abstract

The invention discloses a network security communication system and method based on a national commercial cryptographic algorithm, and belongs to the field of information security communication, and the system comprises a management module which achieves the management of system data, and comprises the management of user login information and the obtaining of login information; data management of key maintenance is used for storing public key information of a user, the server is allowed to have the permission to modify and delete the public key information, and other clients have the reading permission; the encryption and decryption module is used for performing information encryption and signature, signature verification and decryption on the message and the file; the communication module is used for transmitting messages and files; and calling an encryption module to encrypt and sign the message and the file, and verifying and decrypting the signature. According to the network security communication system and method based on the national commercial cryptographic algorithm, the security communication system is designed and realized by adopting a domestic encryption algorithm SM2 / SM3, and the security, integrity and non-repudiation of transmission data are realized by combining an SM4 symmetric encryption algorithm.

Description

Technical Field

[0001] The present invention relates to the field of information security communication technology, and in particular to a network security communication system and method based on a national commercial cryptographic algorithm. Background Art

[0003] The core of information security protection is to encrypt data in real time by combining RSA encryption algorithm and random AES key encryption. Although the RSA private key is stored in the communication server of the system, it is very difficult to obtain the content in the system by conquering the key of AES algorithm. However, due to the huge traffic, operators or service providers usually only hide personal data in the packet data, and most of the communication is still transmitted in plain text, so there is a possibility of theft and tampering. Plain text display is very easy to cause the adverse consequences of intercepting and disseminating sensitive social information, administrative affairs information and financial information, which in turn causes very bad effects.

[0004] In response to the security issues existing in the above-mentioned communications, the present invention designs and implements a secure communication system based on a national secret algorithm. Summary of the invention

[0005] The purpose of the present invention is to provide a network security communication system and method based on a national commercial encryption algorithm to solve the problems mentioned in the above background technology.

[0006] To achieve the above object, the present invention provides a network security communication system and method based on a national commercial encryption algorithm, comprising:

[0007] Management module: manages system data, including user login information management, obtains login information, including port number, IP address, user name, login time, and logout time; key maintenance data management, used to store user public key information, allowing the server to have the authority to modify and delete it, and other clients to have read permissions, to ensure user keys are safe and reliable;

[0008] Encryption and decryption module: used to encrypt and sign messages and files, verify signatures, and decrypt;

[0009] Communication module: used for the transmission of messages and files; calls the encryption module to encrypt and sign messages and files, verify signatures and decrypt.

[0010] Preferably, it also includes a server and a client, the server is used to verify user login, logout, key hosting, generate, forward and complete identity authentication, store, send and receive information sent by users; the client is used for user login, display online user list, complete information sending and receiving, key negotiation and identity authentication, encrypt before sending information, and decrypt after receiving information.

[0011] Preferably, the SM4 algorithm is used to encrypt and decrypt communication data between the client and the server; the SM2 algorithm is used to digitally sign the information summary to ensure the security and non-repudiation of the transmitted information; and the SM3 algorithm is used to digitally sign the encrypted information to ensure the integrity of the information.

[0012] Preferably, the communication module calls the encryption and decryption module to encrypt and sign the information when sending a message, and transmits the information; calls the encryption and decryption module to verify the signature and decryption when receiving a message. After verification, the information is received and the communication process is completed; when transmitting a file, the communication module first calls the encryption and decryption module to encrypt and sign the file, and based on the Socket communication protocol, divides and labels the file, and after distributed transmission to the recipient, reassembles it, calls the encryption and decryption module to verify the signature and decryption, and the file is received after verification, and the file is safely and completely transmitted.

[0013] A method for a network security communication system based on a national commercial cryptographic algorithm, used for secure communication of a communication module, comprising:

[0014] The sender uses the SM3 algorithm to perform a hash operation on the message to generate a message digest;

[0015] Use the SM2 algorithm to digitally sign the message digest and generate a signature value;

[0016] Use SM4 algorithm to encrypt the message and generate ciphertext;

[0017] Send the message digest, signature value and ciphertext together to the recipient;

[0018] The receiver uses the SM2 algorithm to verify the signature value. After verification, the receiver uses the SM4 algorithm to decrypt the ciphertext to obtain the plaintext.

[0019] Use the SM3 algorithm to perform a hash operation on the plaintext to generate a message digest, which is compared with the message digest sent by the sender. If they are consistent, it means that the message has not been tampered with.

[0020] Therefore, the present invention adopts the above-mentioned network security communication system and method based on the national commercial encryption algorithm, adopts the security communication system designed and implemented by the domestic encryption algorithm SM2 / SM3, and combines the SM4 symmetric encryption algorithm to achieve the security, integrity and non-repudiation of transmitted data.

[0021] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 is an architectural diagram of an embodiment of the present invention;

[0023] Figure 2 The figure is a flow chart of a method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0024] Example

[0025] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] Reference Figure 1-Figure 2 The present invention discloses a network security communication system and method based on a national commercial encryption algorithm, including:

[0027] Management module: manages system data, including user login information management, obtains login information, including port number, IP address, user name, login time, and logout time; key maintenance data management, used to store user public key information, allowing the server to have the authority to modify and delete it, and other clients to have read permissions, to ensure user keys are safe and reliable;

[0028] Encryption and decryption module: used to encrypt and sign messages and files, verify signatures, and decrypt;

[0029] Communication module: used for the transmission of messages and files; calls the encryption module to encrypt and sign messages and files, and to verify signatures and decrypt them. When sending messages, the communication module calls the encryption and decryption module to encrypt and sign information and transmit it; when receiving messages, it calls the encryption and decryption module to verify signatures and decrypt. After verification, the information is received and the communication process is completed; when transmitting files, the communication module first calls the encryption and decryption module to encrypt and sign the files, and based on the Socket communication protocol, the files are segmented and numbered, and after distributed transmission to the recipient, they are reassembled and the encryption and decryption module is called to verify signatures and decrypt. After verification, the files are received and the file is safely and completely transmitted.

[0030] It also includes a server and a client. The server is used to verify user login, logout, key hosting, generate, forward and complete identity authentication, store, and send and receive information sent by users; the client is used for user login, display online user lists, complete information sending and receiving, key negotiation and identity authentication, encrypt before sending information, and decrypt after receiving information.

[0031] The SM4 algorithm is used to encrypt and decrypt communication data between the client and the server; the SM2 algorithm is used to digitally sign the information summary to ensure the security and non-repudiation of the transmitted information; the SM3 algorithm is used to digitally sign the encrypted information to ensure the integrity of the information. Both SM2 and SM3 are domestic encryption algorithms. SM2 is an asymmetric encryption algorithm based on the public key cryptographic algorithm standard of elliptic curve cryptography. Its key length is 192-256 bits, and its security strength is higher than the 2048 bits of the international algorithm RSA. The encryption and decryption speed is faster than RSA, and the key generation speed is more than 100 times faster than the RSA algorithm. SM3 is a hash algorithm used to replace international algorithms such as MD5 / SHA-1 / SHA-2. It is suitable for digital signatures and verification, the generation and verification of message authentication codes, and the generation of random numbers. It can be used for data integrity verification and message digests.

[0032] A method for a network security communication system based on a national commercial cryptographic algorithm, used for secure communication of a communication module, comprising:

[0033] The sender uses the SM3 algorithm to perform a hash operation on the message to generate a message digest;

[0034] Use the SM2 algorithm to digitally sign the message digest and generate a signature value;

[0035] Use SM4 algorithm to encrypt the message and generate ciphertext;

[0036] Send the message digest, signature value and ciphertext together to the recipient;

[0037] The receiver uses the SM2 algorithm to verify the signature value. After verification, the receiver uses the SM4 algorithm to decrypt the ciphertext to obtain the plaintext.

[0038] Use the SM3 algorithm to perform a hash operation on the plaintext to generate a message digest, which is compared with the message digest sent by the sender. If they are consistent, it means that the message has not been tampered with.

[0039] Therefore, the present invention adopts the above-mentioned network security communication system and method based on the national commercial encryption algorithm, adopts the security communication system designed and implemented by the domestic encryption algorithm SM2 / SM3, and combines the SM4 symmetric encryption algorithm to achieve the security, integrity and non-repudiation of transmitted data.

[0040] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.

Claims

1. A network security communication system based on a national commercial encryption algorithm, characterized in that: include: Management module: manages system data, including user login information management, and obtains login information, including port number, IP address, user name, login time and logout time; Key maintenance data management is used to store the user's public key information. The server is allowed to modify and delete it, and other clients have read permissions. Encryption and decryption module: used to encrypt and sign messages and files, verify signatures, and decrypt; Communication module: used for the transmission of messages and files; calls the encryption module to encrypt and sign messages and files, verify signatures and decrypt.

2. A network security communication system based on a national commercial encryption algorithm according to claim 1, characterized in that: It also includes a server and a client. The server is used to verify user login, logout, key hosting, generate, forward and complete identity authentication, store, and send and receive information sent by users; the client is used for user login, display online user lists, complete information sending and receiving, key negotiation and identity authentication, encrypt before sending information, and decrypt after receiving information.

3. A network security communication system based on a national commercial encryption algorithm according to claim 2, characterized in that: The SM4 algorithm is used to encrypt and decrypt communication data between the client and the server; the SM2 algorithm is used to digitally sign the information summary; and the SM3 algorithm is used to digitally sign the encrypted information.

4. A network security communication system based on a national commercial encryption algorithm according to claim 3, characterized in that: When sending a message, the communication module calls the encryption and decryption module to encrypt and sign the information and transmit the information; when receiving a message, the encryption and decryption module is called to verify the signature and decrypt. After verification, the information is received and the communication process is completed; when transmitting a file, the communication module first calls the encryption and decryption module to encrypt and sign the file, and based on the Socket communication protocol, the file is divided and numbered, and after distributed transmission to the recipient, it is reassembled and the encryption and decryption module is called to verify the signature and decrypt. After verification, the file is received, and the file is safely and completely transmitted.

5. A method for utilizing a network security communication system based on a national commercial encryption algorithm as described in any one of claims 1 to 4 for secure communication of a communication module, characterized in that: include: The sender uses the SM3 algorithm to perform a hash operation on the message to generate a message digest; Use the SM2 algorithm to digitally sign the message digest and generate a signature value; Use SM4 algorithm to encrypt the message and generate ciphertext; Send the message digest, signature value and ciphertext together to the recipient; The receiver uses the SM2 algorithm to verify the signature value. After verification, the receiver uses the SM4 algorithm to decrypt the ciphertext to obtain the plaintext. Use the SM3 algorithm to perform a hash operation on the plaintext to generate a message digest, which is compared with the message digest sent by the sender. If they are consistent, it means that the message has not been tampered with.

Images