Message publishing method and device and storage medium

Abstract

The invention relates to a message publishing method and device and a storage medium. When a message is published, a message publishing end firstly obtains a to-be-published first message, signs the first message to obtain first signature information, and sends the first signature information to a corresponding publishing terminal controller, so that the first signature information is published after the publishing terminal controller successfully verifies the signature of the first signature information. And displaying a first message to be published in the first signature information. Through the mode, the publishing terminal controller only displays the message published by the message publishing end, data is prevented from being tampered in the transmission process, and therefore the safety and reliability of the message in the transmission process are ensured.

Description

Technical Field

[0001] The present application relates to the field of message publishing, and in particular to a message publishing method, device and storage medium. Background Art

[0002] The release terminal is an important device of the message release system. The message to be displayed by the message release system is displayed on the information board through the release terminal. However, the content information to be displayed by the release terminal is usually transmitted under the outdoor network, and network security means have not been widely introduced into the message release system. There is a general lack of effective technical protection means for the security of the content displayed by the message release system and the information release. In addition, due to the different models of existing hardware equipment, the interface mode, management mode, and information release mode are also different. In addition, the distribution of equipment terminals is relatively scattered, and they have been running on a single machine for a long time, resulting in hidden dangers such as weak supervision foundation and difficult security protection. At the same time, there is a hidden danger of malicious tampering in the process of information release in the message release system. The security of the released information cannot be technically guaranteed and can only be monitored manually afterwards, which has problems such as poor timeliness and high labor cost investment.

[0003] Therefore, how to improve the security and reliability of message publishing is a technical problem that those skilled in the art need to solve. Summary of the invention

[0004] The present application provides a message publishing method, device and storage medium to improve the security and reliability of message publishing.

[0005] In a first aspect, the present application provides a message publishing method, which is applied to a message publishing terminal, and the message publishing method includes:

[0006] Get the first message to be published;

[0007] Signing the first message to obtain first signature information;

[0008] The first signature information is sent to the corresponding publishing terminal controller, so that the publishing terminal controller displays the first message to be published in the first signature information after successfully verifying the first signature information.

[0009] In a third aspect, the present application provides an electronic device, including:

[0010] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the message publishing method described above in the present application through the computer program.

[0011] In a fourth aspect, the present application also provides a computer storage medium, which stores computer executable instructions, and the computer executable instructions are used to execute the steps of the above-mentioned message publishing method of the present application.

[0012] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: when publishing a message, the message publishing end first obtains the first message to be published, signs the first message to obtain the first signature information, and sends the first signature information to the corresponding publishing terminal controller, so that the publishing terminal controller can display the first message to be published in the first signature information after successfully verifying the first signature information. In this way, the publishing terminal controller only displays the message published by the message publishing end, avoiding data tampering during transmission, thereby ensuring the security and reliability of the message during transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0014] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0015] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0016] Figure 1 A schematic diagram of the structure of a message publishing system provided in an embodiment of the present application;

[0017] Figure 2 A schematic diagram of a message publishing method flow provided in an embodiment of the present application;

[0018] Figure 3 A schematic diagram of another message publishing method flow provided in an embodiment of the present application;

[0019] Figure 4 A schematic diagram of a process for a publishing terminal controller to access a secure and trusted integrated machine provided in an embodiment of the present application;

[0020] Figure 5 A schematic diagram of the process of initializing the publishing terminal controller and uploading audit information provided in an embodiment of the present application;

[0021] Figure 6 A schematic diagram of another message publishing method flow provided in an embodiment of the present application;

[0022] Figure 7 A user identity login flow chart provided for an embodiment of the present application;

[0023] Figure 8 An online message signature verification flow chart provided in an embodiment of the present application;

[0024] Fig. 9 A schematic diagram of another message publishing method flow provided in an embodiment of the present application;

[0025] Fig.10 A flowchart of on-site message signature verification provided in an embodiment of the present application;

[0026] Fig.11 A schematic diagram of a specific message publishing system structure provided in an embodiment of the present application;

[0027] Fig.12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0029] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0030] The embodiment of the invention discloses a message publishing method, a device and a storage medium to improve the security and reliability of message publishing.

[0031] See also Figure 1 , Figure 1A schematic diagram of the structure of a message publishing system provided for an embodiment of the present application; in this embodiment, the system includes a message publishing end and a message receiving end; the message publishing end includes a message publishing platform, a secure and trusted all-in-one machine, and a switch, and the message receiving end includes a publishing terminal controller and an on-site access terminal.

[0032] Among them, the message publishing platform is based on the identity authentication scheme of UKEY (USB Key, network key), which provides strong identity authentication capabilities for login personnel to prevent unauthorized personnel from logging into the platform and illegally publishing messages. The secure and trusted all-in-one machine is based on the signature verification method of the trusted authentication mechanism of Trusted Computing 3.0 to ensure the integrity and consistency of information during transmission. At the same time, it realizes the functions of security management and control of the publishing terminal controller, trusted policy configuration and issuance, and trusted audit of the receiving publishing terminal controller, as well as authorization and management of the secure access of the on-site access terminal. The secure and trusted all-in-one machine sends data to the publishing terminal controller through the switch.

[0033] The terminal controller is based on the trusted root of trusted computing 3.0 technology as the core and source of trust. Using the trusted measurement mechanism, the terminal controller is securely started with trusted measurement, static trusted measurement, and dynamic trusted measurement. Combined with the trusted strategy, the active security defense system of the terminal controller is built, and the audit information is reported to the secure and trusted integrated machine to ensure the security and trustworthiness of the terminal controller. The audit information is an audit log, which is used to record the operation process, operation results and other data of the terminal controller. The on-site access terminal signs the message based on the trusted authentication mechanism, and the terminal controller verifies the signature of the obtained message. After the signature verification is successful, the integrity and security of the data in each link of publishing, circulation and receiving are ensured.

[0034] See also Figure 2 , Figure 2 A message publishing method flow chart provided in an embodiment of the present application is applied to a message publishing end, and the method specifically comprises the following steps:

[0035] S101, obtaining a first message to be published;

[0036] In this embodiment, after the user logs in to the message publishing platform, he needs to publish a message through the message publishing platform. In this embodiment, in order to distinguish the message published by the user through the message publishing platform from the message published through the presence access terminal, the message published through the message publishing platform is defined as the first message, and the message published through the presence access terminal is defined as the second message.

[0037] S102, signing the first message to obtain first signature information;

[0038] In this embodiment, in order to ensure the security and reliability of the message during transmission, it is necessary to sign the first message through a signature mechanism. In addition, this embodiment does not specifically limit the signing process of the first message, and those skilled in the art can select a suitable algorithm to execute according to actual needs. For example, the national secret algorithm SM2 (asymmetric encryption algorithm), SM3 (hash algorithm), etc. can be selected to perform the signing and verification process. Among them, the process of signing the first message to obtain the first signature information in this embodiment can be: the message publisher uses a summary algorithm to generate an information summary for the first message, signs the information summary through the private key of the message publisher, and sends the first message and the signed information summary as the first signature information to the publishing terminal controller.

[0039] S103: Send the first signature information to the corresponding publishing terminal controller, so that the publishing terminal controller displays the first message to be published in the first signature information after successfully verifying the first signature information.

[0040] It should be noted that after the first message is signed and the first signature information is obtained, the first signature information needs to be sent to the corresponding publishing terminal controller. After the publishing terminal controller receives the first signature information, it needs to verify the signature of the first signature information. If the signature verification is successful, it means that the first message published through the message publishing platform has not been tampered with during the transmission process. At this time, the first message to be published in the first signature information can be displayed; if the signature verification fails, the corresponding operation can be performed according to the pre-established strategy, such as: the first signature information can be ignored and the first message can be refused to be displayed; the first signature information can also be temporarily stored, and the notification of the first signature information can be resent to the message publishing platform. Through the re-verification operation, it is decided whether to display the first information. If the signature verification still fails after re-verification, the first signature information is ignored, otherwise the first message is displayed.

[0041] Accordingly, this embodiment does not specifically limit the signature verification process of the first message, and those skilled in the art can select a suitable algorithm to execute according to actual needs. Among them, the signature verification process of the first signature information in this embodiment can be: after the publishing terminal controller receives the first signature information, it uses the same digest algorithm to generate a new information digest for the received first message itself; uses the public key of the message publishing end to verify the signed information digest, obtains the information digest sent by the message publishing end, and compares whether the newly generated information digest is the same as the information digest sent by the message publishing end. If they are the same, it indicates that the signature verification is successful, otherwise, it indicates that the signature verification fails.

[0042] From the above, it can be seen that when publishing a message, the message publishing end first obtains the first message to be published, signs the first message to obtain the first signature information, and sends the first signature information to the corresponding publishing terminal controller, so that the publishing terminal controller can display the first message to be published in the first signature information after successfully verifying the first signature information. In this way, the publishing terminal controller only displays the message published by the message publishing end, avoiding data tampering during transmission, thereby ensuring the security and reliability of the message during transmission.

[0043] See also Figure 3 , Figure 3 A flow chart of another message publishing method provided in an embodiment of the present application is provided. The message publishing method is applied to a message publishing terminal. The method specifically comprises the following steps:

[0044] S201, obtaining a first message to be published;

[0045] S202, signing the first message to obtain first signature information;

[0046] S203, sending the first signature information to the corresponding publishing terminal controller, so that the publishing terminal controller displays the first message to be published in the first signature information after successfully verifying the first signature information;

[0047] S204, generating a trusted control strategy; sending the trusted control strategy to the publishing terminal controller, so that the publishing terminal controller performs trusted control according to the trusted control strategy;

[0048] S205, receiving the audit information uploaded by the publishing terminal controller; the audit information includes dynamic measurement results and static measurement results;

[0049] S206, judging whether the publishing terminal controller is abnormal according to the audit information;

[0050] If yes, execute S207; if no, execute S208;

[0051] S207, denying access to the issuing terminal controller;

[0052] S208: Allow the publishing terminal controller to access.

[0053] The message publishing end in this solution can not only sign the message, but also issue a trusted policy to the publishing terminal controller, and determine the trusted status of the publishing terminal controller according to the audit information uploaded by the publishing terminal controller. It should be noted that in this embodiment, only the process S201-S208 is used to illustrate this embodiment, but the execution order of each step is not limited, such as: S204-S208 can be executed first to issue a trusted policy and a trusted status determination to the publishing terminal controller, and then S201-S203 can be executed to sign the message, or S204 can be executed first to issue a trusted policy to the publishing terminal controller, and then S201-S203 can be executed to sign the message, and then S205-S208 can be executed to determine the trusted status, which is not specifically limited here.

[0054] Specifically, the secure and trusted integrated machine in the message publishing end can issue a trusted control policy to the publishing terminal controller. Based on the trusted control policy, the publishing terminal controller can have startup measurement, dynamic measurement, static measurement, malicious code prevention, trusted auditing, and trusted control functions. For example: After the publishing terminal controller obtains the dynamic measurement result, if the dynamic measurement result is determined to be abnormal according to the trusted control policy, the corresponding operation will be blocked. In this way, the security of the publishing terminal controller itself can be ensured.

[0055] Furthermore, the publishing terminal controller in the present application can also collect audit information; the audit information includes dynamic measurement results and static measurement results; and send the audit information to the secure and trusted integrated machine, which can determine the trusted state of the publishing terminal control based on the audit information. If the trusted state of the publishing terminal control is in a normal state, it means that the publishing terminal control is a trusted terminal, and the publishing terminal control access is allowed at this time. If the trusted state of the publishing terminal control is in an abnormal state, it means that the publishing terminal control is an untrusted terminal, and the publishing terminal control access is denied at this time. Among them, since the publishing terminal controller is local, it can also determine its own trusted state based on its own measurement results and other data. Therefore, the audit information sent by the publishing terminal controller to the secure and trusted integrated machine can also include the trusted state determined by the publishing terminal controller itself. The secure and trusted integrated machine can use this trusted state as a reference to determine whether the terminal is abnormal.

[0056] It should be noted that the denial of access to the publishing terminal controller and the permission of access to the publishing terminal controller in this embodiment refers to the denial / permission of the publishing terminal controller to connect to the message publishing end, specifically to connect to the message publishing platform in the message publishing end. If the publishing terminal controller and the message publishing platform are in a connected state, the message publishing platform can send messages to the publishing terminal controller through the secure and trusted all-in-one machine. If the publishing terminal controller and the message publishing platform are in a disconnected state, the message publishing platform cannot send messages to the publishing terminal controller through the secure and trusted all-in-one machine.

[0057] See also Figure 4 , Figure 4 A schematic diagram of a process for a terminal controller to access a secure and trusted integrated machine provided in an embodiment of the present application; Figure 4 It can be seen that the publishing terminal controller includes a trusted component module and a publishing terminal business application, and the secure and trusted integrated machine includes a trusted configuration management module and a network control module; the trusted component module sends the audit information including the trusted status to the trusted configuration management module, and the trusted configuration management module determines whether to allow the publishing terminal controller to access based on the audit information, and generates corresponding control instructions and sends them to the network control module. The network control module generates a control strategy based on the IP (Internet Protocol) or MAC (Media Access Control) address of the publishing terminal controller and the control instructions, and authorizes or blocks the publishing terminal business application of the publishing terminal controller from accessing the message publishing platform based on the control strategy.

[0058] In summary, it can be seen that the present application can enhance the security of the publishing terminal controller itself by issuing a trusted policy to the publishing terminal controller, prevent the running of unknown and tampered programs, ensure that the publishing terminal controller is protected by a trusted mechanism from startup to operation, and have complete audit information to achieve the terminal's own security immunity; in addition, the present application can also determine the trusted status of the publishing terminal controller based on the audit information uploaded by the publishing terminal controller, and authorize and block the access of the publishing terminal controller to the message publishing platform based on the trusted status. In this way, only authorized publishing terminal controllers can be allowed to access the publishing platform network for information publishing, preventing unauthorized publishing terminal controllers from accessing the publishing platform network through IP addresses or MACs.

[0059] Based on the above embodiment, in this embodiment, the process of receiving the audit information uploaded by the publishing terminal controller specifically includes the following steps:

[0060] Receive the audit information uploaded by the publishing terminal controller, the audit signature value corresponding to the audit information, and the initialization information; verify the initialization information; if the verification is successful, verify the audit information according to the audit signature value; if the verification is successful, determine whether the publishing terminal controller is abnormal based on the audit information.

[0061] Specifically, when this application receives audit information uploaded by the publishing terminal controller, in order to ensure the security of the audit information, the publishing terminal controller can be initialized in advance and the initialization information can be generated during the initialization process. When uploading the audit information, the audit information needs to be signed, and the audit information, audit signature value and initialization information are uploaded together. The secure and trusted all-in-one machine needs to perform signature verification operations on both the initialization information and the audit information. Only after all the signatures are verified successfully can it be determined that the correct audit information has been received, ensuring the security and reliability of information transmission. See Figure 5 , Figure 5 This is a schematic diagram of the initialization process of the publishing terminal controller and the audit information upload process provided by the embodiment of the present application. Figure 5 It can be seen that the execution entities of this process include: the issuing terminal controller, the trusted configuration management module of the secure and trusted integrated machine, and the trusted certificate issuance module. The process specifically includes the following steps:

[0062] 1. Factory stage: release the pre-made public key A of the terminal controller and the pre-made private key A of the trusted configuration management module;

[0063] 2. Installation phase: The trusted configuration management module generates the road section information; the trusted certificate issuance module generates the trusted root signature verification public key B and signature verification private key B;

[0064] 3. Initialization phase:

[0065] 3.1. The publishing terminal controller initiates an initialization request. After receiving the initialization request, the trusted configuration management module calls the trusted certificate issuance module to export the public key interface and obtains the signature verification public key B of the trusted root public key; the trusted configuration management module uses the preset private key A to sign the signature verification public key B of the trusted root public key and the road section information to obtain the signature value A; the signature verification public key B of the trusted root public key, the road section information, and the signature value A are sent to the publishing terminal controller;

[0066] 3.2. The issuing terminal controller uses the preset public key A to verify the signature value of the trusted root's signature public key B and the road section information; if the signature verification is successful, the trusted root is called to generate the SM2 key pair public key C and private key C;

[0067] 3.3. The issuing terminal controller sends the trusted root public key C to the trusted configuration management module. The trusted configuration management module calls the signature interface provided by the trusted certificate issuance module, uses the signature verification public key B to sign the trusted root public key C and the road section information to generate a signature value B, and sends the signature value B to the issuing terminal controller;

[0068] 3.4. The publishing terminal controller receives the signature value B and uses the signature verification public key B of the trusted root public key, the road section information, and the signature value B of the trusted root public key for signature verification; if the signature verification is successful, the initialization is completed, and the generated initialization information includes: signature value B, road section information and public key C.

[0069] 4. Audit information upload stage:

[0070] 4.1. The publishing terminal controller uses the trusted root private key C to sign the trusted audit information to generate a signature value C; and sends the trusted root public key C, the trusted root public key signature value B, the audit information, and the trusted audit signature value C to the trusted configuration management module;

[0071] 4.3. The trusted configuration management module calls the signature verification interface of the trusted certificate issuance module, and uses public key B to verify the signature value B against public key C and road section information; if the verification is successful, the trusted configuration management module uses the trusted root public key C to verify the trusted audit and signature value C; if the verification is successful, the trusted status of the publishing terminal controller is determined based on the audit information, and the trusted audit upload result is returned to the publishing terminal controller.

[0072] 5. Cancellation phase: The terminal controller or trusted configuration management module sends a cancellation request, and the terminal controller deletes the trusted root public key verification key B, road section information, trusted public key signature value B, trusted root public key C and private key C.

[0073] In summary, this application can ensure that the publishing terminal controller uploads the audit information correctly to the safe and trusted integrated machine through the above process, and the safe and trusted integrated machine can accurately determine the trusted status of the publishing terminal controller through the audit information.

[0074] See also Figure 6 , Figure 6 A flow chart of another message publishing method provided in an embodiment of the present application is provided. The message publishing method is applied to a message publishing terminal. The method specifically comprises the following steps:

[0075] S301, receiving login information input by a user through a first UKEY; the login information includes a PIN code, a user name and a password;

[0076] S302, verifying the login information; if the verification is successful, determining whether the first UKEY is valid according to the UKEY revocation list; if the first UKEY is valid, allowing the user to publish a message;

[0077] S303, obtaining the first message to be published;

[0078] S304, adding a road section identifier and an anti-replay identifier to the first message to generate a reorganized message;

[0079] S305: Sign the reassembled message to generate first signature information.

[0080] S306: Send the first signature information to the corresponding publishing terminal controller, so that the publishing terminal controller displays the first message to be published in the first signature information after successfully verifying the first signature information.

[0081] In this embodiment, in order to improve the security of the system, a strong identity authentication capability is provided for the message publishing platform to avoid the security risks of the "user name / password" single-factor authentication method, and to ensure that only users who have passed the strong identity authentication can log in to the platform to publish information. Specifically, in this application, the message publishing platform login personnel need to insert the UKEY when logging in to the information publishing platform, and the message publishing platform login personnel enter the user name, password and PIN code; after the message publishing platform verifies that the PIN code, user name and password are correct, it verifies the UKEY in the platform security identity authentication module of the secure and trusted all-in-one machine, determines whether the UKEY has been revoked, and allows or blocks the user login according to the verification results, and retains the audit information according to the verification results.

[0082] See also Figure 7 , Figure 7 The user identity login flow chart provided for the embodiment of the present application shows that the login personnel first need to apply for UKEY from the platform security identity authentication module. After the application is successful, the login personnel use UKEY to log in to the message publishing platform; the message publishing platform calls the UKEY online authentication interface to verify the UKEY, and the platform security identity authentication module verifies the UKEY based on the revocation list, and returns the verification result and records the audit. It should be noted that the platform security identity authentication in this solution can maintain and manage UKEY, wherein the platform security identity authentication module supports administrators and ordinary users to view UKEY information, administrators to send UKEY, administrators to cancel UKEY, administrators to reset UKEY, administrators and ordinary users to unlock UKEY, administrators and ordinary users to modify the PIN code of UKEY, administrators to delete UKEY and other functions.

[0083] Furthermore, this application not only needs to sign the message to be published, but also needs to add a section identifier and an anti-replay identifier to the message to be sent. Figure 8 , Figure 8 The online message signature verification flow chart provided in the embodiment of the present application is as follows: Figure 8It can be seen that the process specifically includes the following steps: the message publishing platform publishes the message; the online message signing module in the secure and trusted integrated machine obtains the message, and the publishing terminal business application of the publishing terminal controller receives the message at the same time; the online message signing module parses the message, uses the national secret algorithm to sign the message, area / section identification, and anti-replay identification, and generates signature information; the online message signing module sends the signature information to the message verification module of the publishing terminal controller, the message verification module verifies the message, generates audit information and uploads it to the trusted configuration management module of the secure and trusted integrated machine; the message verification module returns the verification result to the publishing terminal business application, and the publishing terminal business application performs corresponding processing according to the verification result. If the verification is successful, the message will be displayed. If the verification fails, the corresponding operation will be performed according to the pre-established strategy.

[0084] In summary, this application ensures that the information board only displays the information published by the message publishing platform by adding a road section identifier and an anti-replay identifier to the message to be sent, and then signing and sending it to the publishing terminal controller, thereby preventing data from being tampered with, replayed, and published across regions / road sections during transmission, and ensuring the integrity and consistency protection of the message publishing platform during the message transmission process.

[0085] See also Fig. 9 , Fig. 9 A flow chart of another message publishing method provided in an embodiment of the present application is provided. The message publishing method is applied to a publishing terminal controller. The message publishing method includes:

[0086] S401, receiving first signature information sent by a message publisher; the first signature information is information generated after the message publisher signs a first message to be published;

[0087] S402, verifying the first signature information;

[0088] S403: If the signature verification is successful, the first message to be published in the first signature information is displayed.

[0089] It should be noted that the message publishing method described in this embodiment is different from the message publishing method described in the previous embodiment only in the execution subject, so the specific execution process of this embodiment can refer to the content described in any of the above method embodiments.

[0090] Based on any of the above embodiments, in this embodiment, the message publishing method further includes:

[0091] Receive the second signature information sent by the presence access terminal; wherein the second signature information is information generated after the presence access terminal signs the second message to be published according to the second UKEY; verify the second signature information; if the verification is successful, display the second message to be published in the second signature information.

[0092] It should be noted that if the network fails, users cannot send messages to the publishing terminal controller through the message publishing platform. At this time, maintenance personnel can access the publishing terminal controller on site through network cables or other means to perform maintenance. Specifically, the on-site message publisher needs to apply for UKEY from the platform security identity authentication module of the secure and trusted all-in-one machine for on-site message publishing; the on-site message publisher carries UKEY and the on-site access terminal to the publishing terminal controller site, connects the on-site access terminal to the publishing terminal controller, and then publishes the message. See Fig.10 , Fig.10 The on-site message signature verification flow chart provided in the embodiment of the present application; through Fig.10 It can be seen that the process includes the following steps: the on-site message publishing application of the on-site access terminal publishes the message, the on-site message signature module calls UKEY to generate signature information, and sends the signature information to the message verification module of the publishing terminal controller, and returns the signature status; the on-site message publishing application sends the message to the publishing terminal business application; the publishing terminal business application receives the message and initiates a verification request to the message verification module; the message verification module verifies the message and generates audit information; the message verification module returns the verification result to the publishing terminal business application; the publishing terminal business application performs corresponding processing based on the verification result.

[0093] In summary, through the above process, the present application can allow only authorized on-site access terminals to access the publishing terminal controller to publish information when a network failure requires on-site access controller maintenance, thereby ensuring the security of message sending.

[0094] See also Fig.11 , Fig.11 A specific message publishing system structure diagram provided for the embodiment of the present application; this solution adds a user identity authentication login module to the original message publishing platform to realize the secure login of platform users and ensure the legitimacy of the identities of platform users. The secure and trusted all-in-one machine mainly includes a platform security identity authentication module, a trusted certificate issuance module, a trusted configuration management module, an online message signing module and a network control module. The publishing terminal controller includes a trusted component module, a message verification module and a publishing terminal business application. The on-site access terminal mainly includes an on-site message signing module and an on-site message publishing application.

[0095] Among them, the message publishing platform includes a user identity authentication login module. When users log in to the message publishing platform, they need to use UKEY to log in. The user identity authentication login module calls the UKEY online authentication interface of the secure and trusted integrated machine for authentication and generates audit information. The platform security identity authentication module of the secure and trusted integrated machine has the following functions: support the maintenance and management of UKEY, including the functions of issuing, canceling, resetting, unlocking, and modifying PIN codes; support the management of on-site access UKEY, including message signing key generation and disabling (based on SN (Serial Number, product serial number)), and synchronize the cancellation list to the message verification module when the publishing terminal controller is online; support the management of platform user identity authentication login UKEY: user information import and disabling (based on SN); provide a platform user identity authentication online authentication interface, and record audit information based on the authentication results.

[0096] The trusted certificate issuance module has the following functions: support key generation based on the national secret SM2 (asymmetric encryption algorithm); support the national secret SM3 (hash algorithm) digest algorithm; provide key pair export function; provide public key export function; provide signature function; provide signature verification function. The trusted configuration management module has the following functions: support benchmark collection and benchmark distribution of the terminal controller application ZIP package, which is the benchmark value used when the terminal controller is measured; support trusted management and trusted audit viewing of the terminal controller; support the addition, modification, deletion and other operations of trusted control policies, and can be distributed to the terminal controller; support terminal trusted status determination based on trusted audit; support sending authorization and blocking policies to the network control module. The online message signature module has the following functions: support the acquisition of messages from the message publishing platform; support multiple message protocol parsing, modular expansion (to deal with different message publishing platforms and different message protocols); support signing messages, area / section identification, anti-replay identification, and generating signature information; support sending signature information to the corresponding terminal controller message verification module. The network control module has the following functions: support isolation policy management based on IP or MAC.

[0097] Among them, the publishing terminal business application of the publishing terminal controller has the following functions: calling the message verification module to verify the published message. The trusted component module has the following functions: supporting the activation of policies, trusted auditing, and trusted control functions; supporting the collection of key results of dynamic and static measurements as audit information, and sending them to the trusted configuration management module. The message verification module has the following functions: supporting the reception of signature information sent by the online message signature module and the on-site message signature module; supporting the verification of messages from the online message signature module and the on-site message signature module, providing a message verification interface, and retaining the audit.

[0098] The on-site message publishing application of the on-site access terminal is used to call the message signing interface provided by the on-site message signing module to sign the published message. The on-site message signing module has the following functions: supports UKEY operation under Windows; supports the use of UKEY to sign messages published by the on-site message publishing application, and provides an on-site message signing interface; supports sending signature information to the message verification module controlled by the publishing terminal. See Table 1, which is a functional description table of each component in the message publishing system in an embodiment of the present invention.

[0099] Table 1

[0100]

[0101]

[0102]

[0103]

[0104] In an embodiment, a message publishing device is provided, which is applied to a message publishing end, and the device specifically includes:

[0105] An acquisition module, used for acquiring a first message to be published;

[0106] A signing module, used to sign the first message to obtain first signature information;

[0107] The first sending module is used to send the first signature information to the corresponding publishing terminal controller, so that the publishing terminal controller displays the first message to be published in the first signature information after successfully verifying the first signature information.

[0108] In another embodiment of the present application, the device further comprises:

[0109] A policy generation module, used to generate a trusted control policy;

[0110] The second sending module is used to send the trusted control policy to the publishing terminal controller, so that the publishing terminal controller performs trusted control according to the trusted control policy.

[0111] In another embodiment of the present application, the device further comprises:

[0112] A first receiving module is used to receive the audit information uploaded by the publishing terminal controller; the audit information includes dynamic measurement results and static measurement results;

[0113] The first judgment module is used to judge whether the publishing terminal controller is abnormal according to the audit information; if so, denying access to the publishing terminal controller.

[0114] In another embodiment of the present application, the first receiving module includes:

[0115] A receiving unit, configured to receive the audit information uploaded by the publishing terminal controller, the audit signature value corresponding to the audit information, and initialization information;

[0116] The first signature verification unit is used to verify the signature of the initialization information; if the signature verification is successful, the second signature verification unit is triggered;

[0117] The second signature verification unit is used to verify the audit information according to the audit signature value; if the signature verification is successful, the first judgment module is triggered.

[0118] In another embodiment of the present application, the device further comprises:

[0119] A second receiving module is used to receive login information input by the user through the first UKEY; the login information includes a PIN code, a user name and a password;

[0120] A verification module, used to verify the login information; if the verification is successful, the second judgment module is triggered;

[0121] The second judgment module is used to judge whether the first UKEY is valid according to the UKEY revocation list; if the first UKEY is valid, the user is allowed to publish a message.

[0122] In another embodiment of the present application, the signature module includes:

[0123] A reassembly unit, used for adding a section identifier and an anti-replay identifier to the first message to generate a reassembly message;

[0124] The signature unit is used to sign the reorganized message to generate first signature information.

[0125] In an embodiment, a message publishing device is provided, which is applied to a publishing terminal controller, and the device specifically includes:

[0126] A third receiving module is used to receive first signature information sent by a message publisher; the first signature information is information generated by the message publisher after signing the first message to be published;

[0127] A first signature verification module, used to verify the first signature information; if the signature verification is successful, the display module is triggered;

[0128] The first display module is used to display the first message to be published in the first signature information.

[0129] In another embodiment of the present application, the device further comprises:

[0130] A fourth receiving module is configured to receive second signature information sent by the presence access terminal; wherein the second signature information is information generated by the presence access terminal after signing the second message to be published according to the second UKEY;

[0131] A second signature verification module is used to verify the second signature information; if the verification is successful, the second display module is triggered;

[0132] The second display module is used to display the second message to be published in the second signature information.

[0133] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0134] See also Fig.12 , Fig.12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, the electronic device specifically includes:

[0135] A processor 11, a memory 12, and a computer program stored in the memory 12 and executable on the processor 11. The processor 11 executes the steps of the message publishing method described in any of the above method embodiments through the computer program.

[0136] Among them, the processor 11 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 11 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 11 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 11 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 11 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0137] The memory 12 may include one or more computer-readable storage media, which may be non-transitory. The memory 12 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 12 is at least used to store the following computer program 121, wherein, after the computer program is loaded and executed by the processor 11, it can implement the relevant steps in the message publishing method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 22 may also include an operating system 122 and data 123, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 122 may include Windows, Unix, Linux, etc.

[0138] In some embodiments, the electronic device may further include a display screen 13 , an input / output interface 14 , a communication interface 15 , a sensor 16 , a power source 17 , and a communication bus 18 .

[0139] certainly, Fig.12 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application. In actual applications, the electronic device may include Fig.12 More or fewer components than shown, or combinations of certain components.

[0140] In another exemplary embodiment, a computer storage medium is also provided, and when the program instructions are executed by a processor, the steps of the message publishing method described in any of the above method embodiments are implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0141] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0142] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0143] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A message publishing method, characterized in that: The message publishing method is applied to a message publishing terminal, and the message publishing method includes: Get the first message to be published; Signing the first message to obtain first signature information; The first signature information is sent to the corresponding publishing terminal controller, so that the publishing terminal controller displays the first message to be published in the first signature information after successfully verifying the first signature information.

2. The message publishing method according to claim 1, characterized in that: The message publishing method also includes: Generate credible control strategies; The trusted control policy is sent to the publishing terminal controller, so that the publishing terminal controller performs trusted control according to the trusted control policy.

3. The message publishing method according to claim 1, characterized in that: The message publishing method also includes: Receiving audit information uploaded by the publishing terminal controller; the audit information includes dynamic measurement results and static measurement results; Determining whether the publishing terminal controller is abnormal according to the audit information; If so, the terminal controller is denied access.

4. The message publishing method according to claim 3, characterized in that: The receiving of the audit information uploaded by the publishing terminal controller includes: Receiving the audit information uploaded by the publishing terminal controller, the audit signature value corresponding to the audit information, and initialization information; Verifying the signature of the initialization information; If the signature verification is successful, the audit information is verified according to the audit signature value; If the signature verification is successful, continue to execute the step of determining whether the issuing terminal controller is abnormal based on the audit information.

5. The message publishing method according to any one of claims 1 to 4, characterized in that: Before obtaining the first message to be published, the method further includes: Receiving login information input by the user through the first UKEY; the login information includes a PIN code, a user name and a password; Verifying the login information; If the verification is successful, determining whether the first UKEY is valid according to the UKEY revocation list; If the first UKEY is valid, the user is allowed to publish messages.

6. The message publishing method according to any one of claims 1 to 4, characterized in that: The signing of the first message to obtain first signature information includes: adding a road section identifier and an anti-replay identifier to the first message to generate a reassembled message; The reassembled message is signed to generate first signature information.

7. A message publishing method, characterized in that: The message publishing method is applied to a publishing terminal controller, and the message publishing method includes: Receive first signature information sent by a message publisher; the first signature information is information generated by the message publisher after signing the first message to be published; Verifying the first signature information; If the signature verification is successful, the first message to be published in the first signature information is displayed.

8. The message publishing method according to claim 7, characterized in that: The message publishing method also includes: receiving second signature information sent by the presence access terminal; wherein the second signature information is information generated by the presence access terminal after signing the second message to be published according to the second UKEY; Verifying the second signature information; If the signature verification is successful, the second message to be published in the second signature information is displayed.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the message publishing method described in any one of claims 1 to 6 of the present application, or the steps of the message publishing method described in claim 7 or 8 through the computer program.

10. A computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the message publishing method described in any one of claims 1 to 6 of the present application, or the steps of the message publishing method described in claim 7 or 8.

Images