Encryption communication method and server

Abstract

The invention provides an encrypted communication method and a server. The method is applied to a security management module of a server, and comprises the following steps: obtaining a target cipher suite comprising an asymmetric key algorithm, the target cipher suite being agreed by the server and a client; a digital certificate including a public key corresponding to the asymmetric key algorithm is sent to the client, so that the client encrypts a pre-master key based on the public key, and a ciphertext is obtained and sent to a server; sending a decryption instruction to the security chip, so that the security chip decrypts the ciphertext based on a private key corresponding to the asymmetric key algorithm in response to the decryption instruction to obtain a pre-master key; and sending the pre-master key to the protocol module, so that the protocol module generates a communication key for encrypted communication between the server and the client based on the pre-master key and the target cipher suite. And in combination with the security management module, butt joint of a communication protocol and a security chip is realized, and the security of communication is improved.

Description

Technical Field

[0001] The present application relates to the technical field of servers, and in particular to an encryption communication method and a server. Background Art

[0002] With the development of network security technology, how to ensure the confidentiality and integrity of network information transmission has become an important research topic. <gb t38636-2020>The transport layer cryptographic protocol specifies a protocol that uses a variety of cryptographic techniques to provide confidentiality and data integrity between two applications.

[0003] Currently, the TLCP protocol can be implemented through OpenSSL, an open source software library that provides a powerful, commercial-grade, comprehensive cryptographic library and various utilities for secure communication and data protection.

[0004] However, the TLCP protocol implemented by OpenSSL is a software solution. In scenarios with a higher security level, the software solution can easily lead to the exposure of private keys, resulting in lower security. Summary of the invention

[0005] The embodiment of the present application provides an encrypted communication method and server, which can realize the connection between the communication protocol and the security chip based on the communication protocol between the server 102 and the client 101, combined with the security management module, so that the security chip can decrypt the pre-master key sent by the client through a private key. Subsequently, the communication key used for communication can be obtained based on the pre-master key, thereby improving the security of communication.

[0006] In a first aspect, an embodiment of the present application provides an encrypted communication method, which is applied to a server, wherein the server includes a protocol module, a security management module, and a security chip, wherein the security chip stores a public key and a private key corresponding to an asymmetric key algorithm, and the method includes:

[0007] The protocol module determines that the server and the client agree to use a target cipher suite, the target cipher suite including an asymmetric key algorithm; the protocol module sends the target cipher suite to the security management module;

[0008] The security management module sends a digital certificate to the client, the digital certificate includes a public key corresponding to the asymmetric key algorithm, so that the client encrypts the pre-master key based on the public key, obtains the ciphertext and sends the ciphertext to the server;

[0009] The security management module sends a decryption instruction to the security chip, so that the security chip responds to the decryption instruction, decrypts the ciphertext based on the private key corresponding to the asymmetric key algorithm, obtains the pre-master key, and sends the pre-master key to the security management module;

[0010] The security management module obtains the pre-master key from the security chip and sends the pre-master key to the protocol module;

[0011] The protocol module generates a communication key based on the pre-master key and the target cipher suite. The communication key is used for encrypted communication between the server and the client.

[0012] In this solution, based on the communication protocol between the server 102 and the client 101, the security management module can be combined to realize the docking of the communication protocol and the security chip, so that the security chip can decrypt the pre-master key sent by the client through a private key. Subsequently, the communication key used for communication can be obtained based on the pre-master key, thereby improving the security of communication.

[0013] In a possible implementation, the method further includes:

[0014] The security management module sends a digital signature instruction to the security chip, so that the security chip responds to the digital signature instruction, digitally signs the exchange information based on the private key corresponding to the asymmetric key algorithm, obtains a digital signature result, and sends the digital signature result to the security management module; the exchange information is at least used to indicate the public key;

[0015] The security management module sends the digital signature result to the client, so that the client verifies the digital signature result. If the verification is successful, the pre-master key is encrypted based on the public key to obtain the ciphertext.

[0016] In this solution, the public key is verified through the digital signature result to ensure communication security.

[0017] In a possible implementation, a protocol module determines that a server and a client agree to use a target cipher suite, including: the protocol module receives a first message sent by the client, the first message is used to indicate the cipher suites that the client can support; the protocol module sends a second message to the client, the second message includes the target cipher suite determined from the key suite.

[0018] In a possible implementation, the first message includes a client random number; the second message includes a server random number; and the pre-master key is determined by the client based on at least the client random number and the server random number.

[0019] In a possible implementation, the protocol module is used to implement a transport layer encryption protocol, such as an Open Secure Sockets Layer (OpenSSL) protocol.

[0020] In a possible implementation, the asymmetric key algorithm is an elliptic curve public key cryptography algorithm.

[0021] In a possible implementation, before the security management module sends the digital certificate to the client, the following steps are included:

[0022] The security management module obtains the public key corresponding to the asymmetric key algorithm from the security chip.

[0023] In a possible implementation, before the security management module sends the digital certificate to the client, the following steps are included:

[0024] The security management module sends a certificate determination instruction to the security chip, so that the security chip responds to the certificate determination instruction, determines the digital certificate and sends it to the security management module.

[0025] In a second aspect, an embodiment of the present application provides an encrypted communication method, which is applied to a security management module of a server, the security management module is used to manage a security chip, and the security chip stores a public key and a private key corresponding to an asymmetric key algorithm, and the method includes:

[0026] Obtain a target cipher suite, which is agreed upon by the server and the client and includes an asymmetric key algorithm; send a digital certificate to the client, which includes a public key corresponding to the asymmetric key algorithm, so that the client encrypts the pre-master key based on the public key, obtains a ciphertext, and sends the ciphertext to the server;

[0027] Sending a decryption instruction to the security chip, so that the security chip responds to the decryption instruction, decrypts the ciphertext based on the private key corresponding to the asymmetric key algorithm, obtains the pre-master key, and sends the pre-master key to the security management module;

[0028] The pre-master key is sent to the protocol module, so that the protocol module generates a communication key based on the pre-master key and the target cipher suite, and the communication key is used for encrypted communication between the server and the client.

[0029] In this solution, based on the communication protocol between the server 102 and the client 101, the security management module can be combined to realize the docking of the communication protocol and the security chip, so that the security chip can decrypt the pre-master key sent by the client through a private key. Subsequently, the communication key used for communication can be obtained based on the pre-master key, thereby improving the security of communication.

[0030] In a possible implementation, the method further includes:

[0031] Sending a digital signature instruction to the security chip, so that the security chip responds to the digital signature instruction, digitally signs the exchange information based on the private key, obtains a digital signature result, and sends the digital signature result to the security management module; the exchange information is at least used to indicate the public key;

[0032] The digital signature result is sent to the client so that the client can verify the digital signature result. If the verification is successful, the pre-master key is encrypted based on the public key to obtain the ciphertext.

[0033] In a possible implementation, the protocol module is used to implement a transport layer encryption protocol; for example, it may be an Open Secure Sockets Layer (OpenSSL) protocol.

[0034] In a possible implementation, the asymmetric key algorithm is an elliptic curve public key cryptography algorithm.

[0035] In a possible implementation, before sending the digital certificate to the client, the following steps are included:

[0036] Get the public key corresponding to the asymmetric key algorithm from the security chip.

[0037] In a possible implementation, before sending the digital certificate to the client, the following steps are included:

[0038] A certificate determination instruction is sent to the security chip, so that the security chip responds to the certificate determination instruction, determines the digital certificate and sends it to the security management module.

[0039] In a third aspect, an embodiment of the present application provides a server, including a processor and a security chip; the security chip stores a public key and a private key corresponding to an asymmetric key algorithm, wherein:

[0040] The processor is used to determine a target cipher suite agreed upon by a server and a client, the target cipher suite including an asymmetric key algorithm;

[0041] The processor is used to send a digital certificate to the client, the digital certificate including a public key corresponding to the asymmetric key algorithm, so that the client encrypts the pre-master key based on the public key, obtains a ciphertext and sends the ciphertext to the server;

[0042] The processor is used to send a decryption instruction to the security chip;

[0043] The security chip is used to respond to the decryption instruction, decrypt the ciphertext based on the private key corresponding to the asymmetric key algorithm, obtain the pre-master key, send the pre-master key to the security management module, and send the pre-master key to the processor;

[0044] The processor generates a communication key based on the pre-master key and the target cipher suite, and the communication key is used for encrypted communication between the server and the client.

[0045] In one possible implementation, the processor is used to send a digital signature instruction to the security chip;

[0046] The security chip is used to respond to the digital signature instruction, digitally sign the exchange information based on the private key corresponding to the asymmetric key algorithm, obtain the digital signature result, and send the digital signature result to the security management module; the exchange information is at least used to indicate the public key;

[0047] The processor sends the digital signature result to the client, so that the client verifies the digital signature result. If the verification is successful, the pre-master key is encrypted based on the public key to obtain the ciphertext.

[0048] In this solution, the public key is verified through the digital signature result to ensure communication security.

[0049] In a possible implementation, the processor is configured to receive a first message sent by a client, where the first message is used to indicate a cipher suite that the client can support; and the protocol module sends a second message to the client, where the second message includes a target cipher suite determined from the cipher suite.

[0050] In a possible implementation, the first message includes a client random number; the second message includes a server random number; and the pre-master key is determined by the client based on at least the client random number and the server random number.

[0051] In a possible implementation, the protocol module is used to implement a transport layer encryption protocol, such as an Open Secure Sockets Layer (OpenSSL) protocol.

[0052] In a possible implementation, the asymmetric key algorithm is an elliptic curve public key cryptography algorithm.

[0053] In a possible implementation, before the processor sends the digital certificate to the client, the process includes:

[0054] The processor obtains a public key corresponding to the asymmetric key algorithm from the security chip.

[0055] In a possible implementation, before the processor sends the digital certificate to the client, the process includes:

[0056] The processor sends a certificate determination instruction to the security chip, so that the security chip responds to the certificate determination instruction, determines the digital certificate and sends it to the processor.

[0057] In a fourth aspect, an embodiment of the present application provides an encrypted communication device, which includes several modules, each of which is used to execute each step in the encrypted communication method provided in the first aspect of the embodiment of the present application, and the division of the modules is not limited here. For the specific functions performed by each module of the encrypted communication device and the beneficial effects achieved, please refer to the functions of each step of the encrypted communication method provided in the first aspect of the embodiment of the present application, which will not be repeated here.

[0058] For example, the encryption communication device includes a protocol module and a security management module, the security management module is used to manage a security chip, and the security chip stores a public key and a private key corresponding to an asymmetric key algorithm; wherein,

[0059] The protocol module is used to determine that the server and the client agree to use a target cipher suite, the target cipher suite including an asymmetric key algorithm; and send the target cipher suite to the security management module;

[0060] A security management module is used to send a digital certificate to a client, the digital certificate includes a public key corresponding to an asymmetric key algorithm, so that the client encrypts the pre-master key based on the public key, obtains a ciphertext and sends the ciphertext to the server;

[0061] The security management module is used to send a decryption instruction to the security chip, so that the security chip responds to the decryption instruction, decrypts the ciphertext based on the private key corresponding to the asymmetric key algorithm, obtains the pre-master key, and sends the pre-master key to the security management module;

[0062] A security management module, used to obtain a pre-master key from a security chip and send the pre-master key to a protocol module;

[0063] Protocol module, used to generate communication keys based on the pre-master secret key and the target cipher suite. The communication keys are used for encrypted communication between the server and the client.

[0064] In this solution, based on the communication protocol between the server 102 and the client 101, the security management module can be combined to realize the docking of the communication protocol and the security chip, so that the security chip can decrypt the pre-master key sent by the client through a private key. Subsequently, the communication key used for communication can be obtained based on the pre-master key, thereby improving the security of communication.

[0065] In a possible implementation, the security management module is used to send a digital signature instruction to the security chip, so that the security chip responds to the digital signature instruction, digitally signs the exchange information based on the private key corresponding to the asymmetric key algorithm, obtains a digital signature result, and sends the digital signature result to the security management module; the exchange information is at least used to indicate the public key;

[0066] The security management module is used to send the digital signature result to the client so that the client can verify the digital signature result. If the verification is successful, the pre-master key is encrypted based on the public key to obtain the ciphertext.

[0067] In this solution, the public key is verified through the digital signature result to ensure communication security.

[0068] In a possible implementation, the protocol module is used to receive a first message sent by a client, where the first message is used to indicate a cipher suite that the client can support; and send a second message to the client, where the second message includes a target cipher suite determined from the cipher suite.

[0069] In a possible implementation, the first message includes a client random number; the second message includes a server random number; and the pre-master key is determined by the client based on at least the client random number and the server random number.

[0070] In a possible implementation, the protocol module is used to implement a transport layer encryption protocol, such as an Open Secure Sockets Layer (OpenSSL) protocol.

[0071] In a possible implementation, the asymmetric key algorithm is an elliptic curve public key cryptography algorithm.

[0072] In a possible implementation, the security management module is used to obtain a public key corresponding to an asymmetric key algorithm from a security chip before sending a digital certificate to a client.

[0073] In a possible implementation, the security management module is used to send a certificate determination instruction to the security chip before sending the digital certificate to the client, so that the security chip responds to the certificate determination instruction, determines the digital certificate and sends it to the security management module.

[0074] In the fifth aspect, an embodiment of the present application provides an encryption communication device, comprising: at least one memory for storing programs; at least one processor for executing the programs stored in the memory, when the program stored in the memory is executed, the processor is used to execute the method provided in the first aspect and the method provided in the second aspect.

[0075] In a sixth aspect, an embodiment of the present application provides an encrypted communication device, characterized in that the device runs computer program instructions to execute the method provided in the first aspect, or execute the method provided in the second aspect. Exemplarily, the device can be a chip or a processor.

[0076] In one example, the device may include a processor, which may be coupled to a memory, read instructions in the memory and execute the method provided in the second aspect according to the instructions, or execute the method provided in the third aspect. The memory may be integrated in a chip or a processor, or may be independent of the chip or the processor.

[0077] In the seventh aspect, an embodiment of the present application provides a computer storage medium, in which instructions are stored. When the instructions are executed on a computer, the computer executes the method provided in the first aspect, or executes the method provided in the second aspect.

[0078] In an eighth aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method provided in the first aspect, or execute the method provided in the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1a is a system architecture diagram of a communication system provided in an embodiment of the present application;

[0080] Figure 1b is a schematic diagram of the structure of the processor 111 provided in an embodiment of the present application;

[0081] Figure 2 It is a structural schematic diagram of a client provided in an embodiment of the present application;

[0082] Figure 3 It is a communication schematic diagram of an encrypted communication method provided in an embodiment of the present application;

[0083] Figure 4 is a flow chart of step 303;

[0084] Figure 5 It is a communication schematic diagram of another encrypted communication method provided in an embodiment of the present application;

[0085] Figure 6 This is a communication schematic diagram of another encrypted communication method provided in an embodiment of the present application;

[0086] Figure 7 It is a communication schematic diagram of another encrypted communication method provided in an embodiment of the present application;

[0087] Figure 8 It is a structural diagram of an encryption communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0088] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0089] In the description of the embodiments of the present application, words such as "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0090] In the description of the embodiments of the present application, the term "and / or" is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, B exists alone, and A and B exist at the same time. In addition, unless otherwise specified, the term "multiple" means two or more. For example, multiple systems refers to two or more systems, and multiple terminals refers to two or more terminals.

[0091] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "include", "comprise", "have" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0092] Below, some terms in this embodiment are explained. It should be noted that these explanations are for the convenience of understanding by those skilled in the art and do not constitute a limitation on the scope of protection claimed in this application.

[0093] Transport Layer Control Protocol (TLCP): is a fictitious protocol name, so there is no standard definition. If TLCP refers to a custom protocol used within a specific project or system, you need to refer to the relevant documentation of that project or system for the specific definition. Since TLCP is not a recognized standard protocol, it is impossible to provide a precise definition.

[0094] Open Secure Sockets Layer (OpenSSL): is an open source software library that provides a powerful, commercial-grade, comprehensive encryption library and various utilities to achieve secure communications and data protection. OpenSSL contains a rich set of encryption algorithms, hash functions, and various digital certificate processing tools, allowing developers to implement data encryption, digital signatures, digital certificate management and other functions in their applications.

[0095] EVP (Enveloped Public Key): is a high-level encryption interface used in OpenSSL to provide symmetric encryption, asymmetric encryption, and hash functions. The EVP library provides an abstract encryption framework that allows switching between different algorithm implementations without changing the application code.

[0096] TPM2-TSS-ENGINE: is an open source cryptographic engine. TPM is an international standard that provides hardware-level security features such as secure key generation and storage, encryption and decryption operations, digital signatures, and platform integrity checks. This engine enables developers to use TPM to perform cryptographic operations and manage keys in scenarios that require a high level of security, rather than relying entirely on software solutions. It supports a variety of TPM-based operations, including but not limited to key generation, data encryption and decryption, generation and verification of digital signatures, etc. Due to its hardware reinforcement capabilities for secure operations, TPM2-TSS-Engine is particularly valuable in security-sensitive applications in areas such as financial services, cloud computing, and the Internet of Things.

[0097] Elliptic curve cryptography (ECC): SM2 algorithm for short, is my country's public key cryptography algorithm standard (first publicly released in December 2010, became China's commercial cryptography standard in 2012, and became China's national cryptography standard in 2016). SM2 algorithm is an asymmetric encryption algorithm, which is a public key cryptography algorithm standard based on elliptic curve cryptography. Its secret key length is 256 bits, including digital signatures, key exchange and public key encryption. SM2 uses a 256-bit ECC, which has higher security strength than RSA 2048 bits and faster computing speed than RSA.

[0098] Cipher suite: A set of parameters used in the Transport Layer Security (TLS) / Secure Sockets Layer (SSL) protocol to describe the encryption method for communication between the client and the server. The selection of cipher suites is crucial to ensuring communication security. Different combinations of cipher suites provide different levels of security protection. When selecting a cipher suite, factors such as security, performance, and compatibility with existing systems need to be considered.

[0099] Pre-Master Secret: In the SSL / TLS protocol, the pre-master secret is one of the key elements to establish a secure connection. It plays an important role in the process of generating a shared key between the client and the server.

[0100] Digital signature: also known as public key digital signature, is a digital string that can only be generated by the sender of the information and cannot be forged by others. This digital string is also an effective proof of the authenticity of the information sent by the sender. It is a method for authenticating digital information, similar to an ordinary physical digital signature written on paper, but it is implemented using technology in the field of public key encryption.

[0101] The communication system to which the encrypted communication method provided in the embodiment of the present application may be applied is introduced. Figure 1a The present invention provides an example of an architecture of a communication system. The present invention provides an encryption communication method that can be applied to Figure 1a As shown in the system architecture diagram. Figure 1a As shown, the communication system includes a client 101 and a server 102 .

[0102] Among them, the client 101 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and portable wearable devices. Exemplary embodiments of the terminal devices involved in this solution include, but are not limited to, electronic devices equipped with iOS, Android, Windows, Harmony OS, or other operating systems. The embodiments of this application do not specifically limit the type of electronic devices.

[0103] The server 102 can be used to provide cloud services, which can be a server or a hyperterminal that can establish a communication connection with other devices and provide computing functions and / or storage functions for other devices. The server involved in this solution can be a hardware server or can be embedded in a virtualized environment. For example, the server involved in this solution can be a virtual machine executed on a hardware server including one or more other virtual machines.

[0104] The client 101 communicates with the server 102 via a network. The network may be a wired network and / or a wireless network. It is understood that the network may use any known network communication protocol to achieve different communications, and the network communication protocol may be various wired and / or wireless communication protocols.

[0105] Among them, server 102 can be a single-node server, such as a rack server; it can also be a computing node in a multi-node server. The multi-node server can be a blade server, a high-density server or a whole cabinet server (an independent product formed by integrating the original architecture that separates the rack and the machine, such as the server node).

[0106] For example, Figure 1a As shown, the server 102 may include a power supply 121 and a mainboard 110 , wherein the power supply 121 is electrically connected to the mainboard 110 and is used to supply power to devices connected to the mainboard 110 .

[0107] In some possible embodiments, the devices connected to the mainboard 110 may include a processor 111 , a memory 112 , a security chip 113 , a baseboard management controller (BMC) 114 , a PCIE slot 115 , a network card 122 , a disk 123 , and a fan 124 .

[0108] The processor 111 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The processor 111 may also be a controller with computing capabilities. For example, in the embodiment of the present application, Figure 1b As shown, the processor 111 can run the protocol module 1111 and the security management module 1112, wherein the protocol module 1111 is used to control the network protocol between the server 102 and the client 101; the security management module 1112 is used to achieve the connection between the protocol module 1111 and the security chip 113, and control the security chip 113 to perform actions. Exemplarily, the protocol module 1111 can be an OPENSSL protocol stack, and the security management module 1112 can be deployed in TPM2TSS-ENGINE, thereby reducing the impact on the protocol module 1111, and further reducing the cost of developing the security management module 1112. The deployment of the security management module 1112 in the TPM2TSS-ENGINE is only an example and does not constitute a specific limitation. In some possible cases, the security management module 1112 can also be deployed in the protocol module 1111.

[0109] Among them, the memory 112 can be inserted into a memory slot to connect to the motherboard 110. The memory 112 can be a random access memory (RAM). By way of example but not limitation, many forms of RAM are available. Exemplarily, the memory 112 includes at least two types of memories, for example, the memory can be either a random access memory (RAM) or a read-only memory (ROM). For example, the RAM can include a dynamic random access memory (DRAM) or a storage class memory (SCM) and other memories.

[0110] Among them, the security chip 113 is also called an encryption coprocessor and an encryption chip, which is an application-specific integrated circuit (ASIC) chip specifically used for data and identity security. The security chip 113 can safely store one or more keys and use these keys in data encryption. In the embodiment of the present application, the processor 111 runs the security management module 1112 to control the security chip 113 to perform operations such as decryption and digital signature.

[0111] Among them, the PCIE slot 115 is suitable for expanding at least one of a GPU card, a network card, a video capture card, an HBA (Host Bus Adapter) card, a RAID (redundant arrays of independent disks) card, and an SSD, and can also support the expansion of various adapter cards.

[0112] The network card 122 is used to communicate with the management device 201 .

[0113] The disk 123 may be a mechanical hard disk HDD or a solid state disk SSD. It should be understood that the disk 123 is only an example of a non-volatile memory and does not constitute a specific limitation. In actual applications, a non-volatile memory may be selected in combination with actual conditions.

[0114] It should be noted that Figure 1a This is only an example of the server 102 and does not constitute a specific limitation. In practical applications, the server 102 may include: Figure 1a More or fewer devices.

[0115] Figure 2 It is a structural diagram of a client 101 provided in an embodiment of the present application.

[0116] like Figure 2 As shown, the client 101 includes a processor 1011 , a memory 1012 , and a network interface 1013 .

[0117] The processor 1011 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0118] The memory 1012 may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories. Among them, the nonvolatile memory may be a read-only memory (ROM), a programmable ROM (PROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0119] For example, a computer program may be stored in the memory 1012, and when the processor 1011 executes the computer program, the steps performed by the client 101 in the steps of the following encryption communication method embodiment are implemented. Alternatively, when the processor 1011 executes the computer program, the functions of each module in the above-mentioned device embodiment are implemented. For example, the computer program may be divided into one or more modules / units, and the one or more modules / units may be a series of computer program instruction segments that can perform specific functions. The one or more modules / units are stored in the memory 1012 and executed by the processor 1011 to complete the present application.

[0120] The network interface 1013 is used to send and receive data, for example, to send data processed by the processor 1011 to the server 102 , or to receive data sent by the server 102 .

[0121] Of course, to simplify, Figure 2 Only some of the components of the client 101 related to the present application are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application conditions, the client 101 may also include any other appropriate components. In addition, the client 101 may be a computing device such as a desktop computer, a notebook, a palm computer, and a cloud server. Those skilled in the art will understand that Figure 2 This is only an example of the client 101 and does not constitute a limitation on the client 101. The client 101 may include more or fewer components than shown in the figure, or may combine certain components, or may have different components. For example, the electronic device may also include an input device, an output device, a network access device, a bus, etc. By way of example, the input device may be a microphone array, and may also include, for example, a keyboard, a mouse, etc. By way of example, the output device may output various information to the outside, and may include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, etc.

[0122] In order to solve the technical problems raised by the background technology, an embodiment of the present application proposes an encrypted communication method.

[0123] The method realizes the connection between the protocol module 1111 and the security chip 113 by adding a security management module 1112, thereby realizing the decryption of the ciphertext sent by the client based on hardware, thereby improving the security of communication. Here is only a brief description of the method, and the details of the method are described below.

[0124] Next, in combination with the communication system provided above, an encrypted communication method provided in an embodiment of the present application is introduced in detail.

[0125] Figure 3 1 is a flow chart of the encryption communication method provided in the embodiment of the present application. This embodiment can be applied to the server 102, and the server 102 may include a protocol module 1111, a security management module 1112 and a security chip 113. Figure 3 As shown, the encryption communication method provided in the embodiment of the present application includes at least the following steps:

[0126] Step 301 : The security management module 1112 sends a key pair generation instruction to the security chip 113 .

[0127] In one implementation, the security management module 1112 may instruct the security chip in advance to generate multiple key pairs based on multiple cryptographic suites, including generating a key pair generation instruction based on an asymmetric key algorithm, and the key pair generation instruction may include an asymmetric key algorithm.

[0128] Step 302: In response to the key pair generation instruction, the security chip 113 determines and stores a key pair corresponding to the asymmetric key algorithm, where the key pair includes a private key and a public key.

[0129] It should be noted that asymmetric key algorithms, also known as public key cryptographic algorithms, use two completely different but completely matching pairs of keys (key pairs): public key and private key. Data encrypted with a public key can only be decrypted using the private key that matches the public key; data encrypted with a private key can only be decrypted using the public key that matches the private key. As the name suggests, a public key is a key that can be provided to many people and is public. In contrast, a private key is unique to a specific individual and is kept confidential.

[0130] In the embodiment of the present application, the security chip 113 generates a key pair corresponding to the asymmetric key algorithm based on the asymmetric key algorithm: a private key and a public key; the private key is only stored in the security chip 113, and the security chip 113 is private to the private key. The processor 111 of the server 102 can obtain the public key, but cannot obtain the private key, thereby improving the security of the private key.

[0131] When the asymmetric key algorithm is SM2, the key pair is determined by selecting an elliptic curve and a base point G. Then, a private key (d) is randomly generated and a public key (Q = d*G, G is the base point) is calculated. The elliptic curve is determined by: for the elliptic curve equation: 2 =x 3 +ax+bmod p, confirm a, b, p to confirm the curve.

[0132] It should be noted that the key pair corresponding to the asymmetric encryption algorithm: a public key and a private key is configured in advance in the security chip 113 to ensure the stability of the encryption and decryption process.

[0133] Step 303: The protocol module 1111 determines that the server 101 and the client 102 agree to use a target cipher suite, which includes an asymmetric key algorithm.

[0134] For example, Figure 4 As shown, in the embodiment of the present application, step 303 may specifically include the following steps:

[0135] Step 3031: The client 101 sends a first message to the server 102, where the first message is at least used to indicate the cipher suites that the client 101 can support.

[0136] In some possible implementations, the first message may be a client hello message, which may include the following content: an available version number, a current time, a client random number, a list of supported cipher suites, a list of available compression methods, and the like.

[0137] The user can set the list of available cipher suites through the client 101 to meet the needs of improving communication security or being compatible with specific encryption requirements. In specific implementation, this can be achieved through the setCiphers method of QSslSocket, allowing developers to dynamically adjust the cipher suites used according to different communication requirements and security policies, thereby enhancing the security of data transmission.

[0138] A cipher suite is a set of parameters used in the TLS / SSL protocol to describe the encryption method for communication between the client and the server. A cipher suite includes a key exchange algorithm, an encryption algorithm, a digital signature algorithm, an integrity check algorithm, and a protocol version.

[0139] Among them, the key exchange algorithm is used to determine how the client 101 and the server 102 authenticate each other during the handshake process.

[0140] Encryption algorithm: used to encrypt data for transmission. Common encryption algorithms include AES_128, AES_256, AES_128_CBC, AES_256_CBC, AES_128_GCM, AES_256_GCM, and ChaCha20-Poly1305. These algorithms ensure the confidentiality of data and prevent data from being intercepted by unauthorized third parties during transmission.

[0141] Digital signature algorithm: used for digital signature of digital certificates issued by digital certificate authorities (CA), including RSA and DSS. These algorithms ensure the authenticity and validity of digital certificates and prevent security threats such as man-in-the-middle attacks.

[0142] Integrity verification algorithm: used to verify the integrity of the message. Common algorithms include SHA, SHA256, and SHA384. These algorithms ensure that the message has not been tampered with during transmission, thus ensuring the integrity of the information.

[0143] Protocol version: used to specify the security protocol version used, such as TLS1.2, TLS1.3, etc.

[0144] Step 3032: The protocol module 1111 sends a second message to the client 101, where the second message is used to indicate a target cipher suite determined from the key suite, where the target cipher suite includes an asymmetric key algorithm.

[0145] Exemplarily, when the first message is a client hello message, the second message may be a server hello message, which may include the following content: an available version number, current time, a server random number, a used cipher suite (target key suite), a list of available compression methods, etc.

[0146] It should be noted that when the server 102 and the client 101 establish communication, the client 101 and the server 102 will negotiate based on the cipher suites supported by both parties, and select a cipher suite supported by both parties to perform data encryption and decryption. Specifically, the server 102 sends a second message to the client 101 to determine the cipher suite supported by both parties. This process ensures that only encryption methods recognized by both parties will be used, thereby ensuring the security of communication. It should be noted that once the cipher suite is selected, it will be used to protect data during the communication process. In some possible implementations, SSL / TLS protocol versions and cipher suites, such as TLSv1.3, can be used to avoid using known insecure or outdated encryption methods, further improving the security of communications.

[0147] Step 304 : The protocol module 1111 sends the target cipher suite to the security management module 1112 .

[0148] Step 305: The security management module 1112 determines a digital certificate, where the digital certificate includes a public key corresponding to an asymmetric key algorithm in the target cryptographic suite.

[0149] A digital certificate contains a public key, owner identity information, a digital signature, and a validity period. It is mainly used to clearly identify the identity of a transaction entity and ensure the authenticity of the transaction entity's identity, thereby ensuring the security of network applications. A digital certificate is used to verify the identity of the owner of a public key during communication. The existence of a digital certificate can clearly identify the identity of a transaction entity and has authentication, ensuring the authenticity of the transaction entity's identity. This authentication is one of the important guarantees for the security of network applications.

[0150] In the embodiment of the present application, the security management module 1112 requests a digital certificate from a third party based on the public key corresponding to the non-object encryption algorithm. The third party digitally signs the public key to confirm that the public key comes from the subject claiming to send the public key: server 102. The digital certificate is determined based on the public key of server 102 and the digital signature of the public key of server 102, and the digital certificate is sent to the security management module 1112; wherein the third party can be a CA (digital certificate authority) service agency or a dedicated server. It is worth noting that the above public key can be obtained by the security management module 1112 from the security chip 113, or the public key may have been stored in other places in advance, and the embodiment of the present application does not specifically limit this.

[0151] Specifically, the process of obtaining a digital certificate through an asymmetric key algorithm can be:

[0152] (1) The security management module 1112 sends a request to the CA, where the request includes at least the name of the server 102 and the public key of the server 102 (the public key corresponding to the asymmetric key algorithm);

[0153] (2) The CA uses its private key to digitally sign the public key of the server 102 (the public key corresponding to the asymmetric key algorithm) to obtain a digital certificate; the CA returns the digital certificate to the security management module 1112.

[0154] It should be noted that the above method is only an example. In some possible implementation methods, the security management module 1112 can send a public key to the client 101. Since the disclosure of the public key does not affect the confidentiality of the communication, the security management module 1112 can publish its public key in a public database for other users to access, or send it to the client 101 by ordinary email or the like.

[0155] It is worth noting that if the security chip 113 does not expose the public key to the outside, the security management module 1112 can send a certificate determination instruction to the security chip 113, and the security chip 113 responds to the certificate determination instruction, determines the digital certificate, and sends the digital certificate to the security management module 1112. If the security chip 113 exposes the public key to the outside, the security management module 1112 can directly determine the certificate. Of course, the security management module 1112 can also control the security chip 113 to determine the digital certificate. The specific design can be combined with the actual situation, and the embodiment of the present application does not make specific limitations on this.

[0156] Step 306 : The security management module 1112 sends a digital certificate to the client 101 .

[0157] Step 307: The client 101 encrypts the pre-master key based on the public key corresponding to the asymmetric key algorithm to obtain a ciphertext.

[0158] In the specific implementation, after the client 101 passes the authentication of the digital certificate, it encrypts the pre-master key based on the public key corresponding to the asymmetric key algorithm to obtain the ciphertext. Specifically, the client 101 will request the public key from a third party such as CA, and the digital authentication process can be: the client 101 verifies the digital signature with the public key of CA, and if the digital signature is proved to be valid, it means that the identity of the server 102 is legal.

[0159] Step 308 : The client 101 sends the ciphertext to the server 102 .

[0160] Step 309 : The security management module 1112 sends a decryption instruction to the security chip 113 .

[0161] The decryption instruction may include the ciphertext and the public key corresponding to the asymmetric key algorithm.

[0162] Step 310 : In response to the decryption instruction, the security chip 113 decrypts the ciphertext based on the private key corresponding to the asymmetric key algorithm to obtain the pre-master key.

[0163] It should be noted that the public key corresponding to the asymmetric key algorithm and the private key corresponding to the asymmetric key algorithm are a key pair, and the ciphertext encrypted by the public key corresponding to the asymmetric key algorithm can be decrypted by the private key corresponding to the asymmetric key algorithm.

[0164] In a specific implementation, after the server 102 receives the ciphertext, the processor 111 of the server 102 can send a decryption instruction to the security chip 113. The security chip 113 responds to the decryption instruction and decrypts the ciphertext based on the private key corresponding to the public key it holds to restore the pre-master key.

[0165] Step 311 : The security chip 113 sends the pre-master key to the security management module 113 .

[0166] Step 312 : The security management module 113 sends the pre-master key to the protocol module 1111 .

[0167] Step 313 : The protocol module 1111 determines a communication key based on the pre-master key and the target cipher suite, and the communication key is used for encrypted communication between the server 102 and the client 101 .

[0168] In actual applications, the target cryptographic suite includes an encryption algorithm (used for encrypting data for transmission), and the protocol module 1111 determines the communication key based on the pre-master key and the encryption algorithm in the target cryptographic suite, such as a symmetric encryption algorithm.

[0169] It should be noted that the client 101 and the server 102 have agreed on a target cipher suite, and the client 101 will also determine the communication key based on the pre-master key and the encryption algorithm in the target cipher suite. Subsequently, when data needs to be transmitted to the server 102, the communication key is used to encrypt the data, the ciphertext is obtained and sent to the server 102, and the server 102 can decrypt the ciphertext based on the communication key.

[0170] In this solution, based on the transport layer communication protocol between the server 102 and the client 101, the communication protocol and the security chip are connected in combination with the security management module, so that the security chip decrypts the pre-master key sent by the client through a private key. Subsequently, the communication key used for communication can be obtained based on the pre-master key, thereby improving the security of communication.

[0171] In some possible embodiments, the client 101 includes a client, and the server 102 includes a service end.

[0172] Among them, the client can be understood as an application for implementing a business. Usually a client is used to implement a business, such as a cloud desktop or a cloud conference. The embodiments of the present application are not intended to limit the business implemented by the client, which can be determined in combination with actual needs. In actual applications, the client is installed on the client 101, and the user runs the client through the client 101, so that the client provides services to the user and meets business needs. Of course, in some possible cases, the client 101 is installed with a browser, and the user can access the client through the browser.

[0173] Among them, the server can be understood as an application that provides services to the client. The services that the server can provide need to be combined with the services that the client connected to the server needs to implement. The embodiments of the present application are not intended to limit the services provided by the server, which can be determined in combination with actual needs. In actual applications, the server is installed on the server 102, and the server 102 can run the server to provide services to the client to meet different business needs.

[0174] In some possible cases of this embodiment, the first message includes the client random number; the second message includes the server random number; the pre-master key is determined by the client 101 based on the client random number and the server random number. The generation and use process of the pre-master key is as follows:

[0175] The pre-master key is generated based on the client random number, the server random number and the pre-master key. Among them, the pre-master key is random, and this pre-master key is usually a random byte sequence of fixed length. The client 101 uses the public key corresponding to the asymmetric key algorithm in the target key suite (obtained through a digital certificate) to encrypt the pre-master key, and the encrypted pre-master key is transmitted to the server 102. Since only the security chip 113 of the server 102 has the private key corresponding to the asymmetric key algorithm in the target key suite, only the security chip 113 can decrypt the pre-master key, thereby ensuring the security of the transmission.

[0176] Subsequently, after receiving the encrypted pre-master key, the security chip 113 of the server 102 uses its own private key to decrypt the pre-master key to obtain the pre-master key.

[0177] Subsequently, the client 101 and the server 102 use the same pre-master key to generate a communication key based on the encryption algorithm in the target key suite through a series of defined pseudo-random functions (PRFs) and other information (such as client random numbers and server random numbers). The communication key is the final key shared between the client 101 and the server 102 and is used to encrypt communication data.

[0178] It is worth noting that the protocol module 1111 provides an encryption interface, which is at least used to provide an asymmetric key algorithm. When the protocol module 1111 is an OPENSSL protocol stack, the encryption interface can be an EVP interface. The security management module 1112 provides a hardware algorithm adapted to the asymmetric key algorithm provided by the encryption interface. The hardware algorithm is used to call the security chip 113 to implement the asymmetric key algorithm, thereby supporting an asymmetric encryption algorithm based on the encryption interface. The security management module 1112 can be an interface that is adapted to the hardware algorithm of the asymmetric key algorithm provided by the encryption interface.

[0179] It should be noted that in order to verify the identity of the sender of the information and ensure that the information has not been tampered with during the transmission process, the embodiment of the present application requires that the server 102 digitally signs the exchanged information between the client 101 and the server 102 (at least used to indicate the client random number, the server random number and the public key) and sends it to the client 101. Specifically, the digital signature involves using the private key of the server 102 to digitally sign the information itself. The client 101 uses the public key of the server 102 to verify the digital signature. If the verification is successful, it means that the information is indeed from the claimed sender and the information has not been modified during the transmission process. This mechanism not only verifies the identity of the sender, but also ensures the integrity of the information.

[0180] Figure 5 A flow chart of another encrypted communication method provided in an embodiment of the present application is shown.

[0181] As shown Figure 5 in, based on steps 301 to 310 shown Figure 3 in, in the embodiments of the present application, at least the following steps are further included:

[0182] Step 501, the security management module 1112 sends a digital signature instruction to the security chip 113.

[0183] Step 502, the security chip 113 responds to the digital signature instruction, digitally signs the exchange information based on the private key corresponding to the asymmetric key algorithm, and obtains a digital signature result.

[0184] In the embodiments of the present application, the digital signature instruction includes the exchange information. The security chip 113 digitally signs the exchange information based on the private key corresponding to the asymmetric key algorithm, and obtains a digital signature result. The digital signature result includes the exchange information and the digital signature of the exchange information. Exemplarily, the exchange information is used to indicate the client random number, the server random number, and the public key.

[0185] When the asymmetric key algorithm is SM2, assume that M is the message to be digitally signed (such as the exchange information), the digital signature is (r, s), the user key pair is (d, Q), and the base point is G. The implementation process of the digital signature is as follows:

[0186] a. Generate a random number k (1 < k < n - 1, where n is the order of the elliptic curve).

[0187] b. Calculate the elliptic curve point (x1, y1) = k * G.

[0188] c. Calculate r = x1 mod n. If r is 0, re - select k.

[0189] d. Calculate s = ((hash(M) + r * d) * k^(-1)) mod n. If s is 0, re - select k.

[0190] e. The digital signature is (r, s).

[0191] Step 503, the security chip 113 sends the digital signature result to the security management module 1112.

[0192] Step 504, the security management module 1112 sends the digital signature result to the client 101.

[0193] Step 505, the client 101 determines whether the verification of the digital signature result is successful. If so, execute step 306.

[0194] When the asymmetric key algorithm is SM2, the public key Q, digital signature (r, s), and message M of the SM2 algorithm are used for digital signature verification. The specific process is: a. Calculate t = (r + s) mod n. If t is 0, the digital signature is invalid; b. Calculate the elliptic curve point (x1, y1) = (s^-1*t)*G+(s^-1*r)*Q; c. Verify whether r is equal to x1 mod n. If they are equal, the digital signature is valid.

[0195] Figure 6 What is shown is only a basic embodiment of the method of the embodiment of the present application. By performing certain optimization and expansion on this basis, other preferred embodiments of the method can be obtained.

[0196] In one embodiment, based on the above-mentioned embodiments, this embodiment provides a more specific description and a certain degree of optimization for the encryption communication method. In this embodiment, the processor 111 and the security chip 113 of the server 102 are used as an example to illustrate the scheme, which at least includes the following steps:

[0197] Step 601: The processor 111 sends a key pair generation instruction to the security chip 113.

[0198] For example, the processor 111 may execute the security management module 113 to send a key pair generation instruction to the security chip 113 .

[0199] Step 602: In response to the key pair generation instruction, the security chip 113 determines and stores a key pair corresponding to the asymmetric key algorithm, where the key pair includes a private key and a public key.

[0200] Please refer to the description of step 302 for details, which will not be repeated here.

[0201] Step 603: The client 101 sends a first message to the processor 111, where the first message is at least used to indicate the cipher suites and client random numbers that the client 101 can support.

[0202] For details, please refer to the description of step 3031 above and will not be repeated here.

[0203] Step 604: The processor 111 selects a target cipher suite from the cipher suites supported by the client 101 based on the first message, where the target cipher suite includes an asymmetric key algorithm.

[0204] For example, the processor 111 may execute the protocol module 1111 to select a target cryptographic suite from supported cryptographic suites based on the first message, where the target cryptographic suite includes an asymmetric key algorithm.

[0205] For details, please refer to the description of step 3032 above and will not be repeated here.

[0206] Step 605: The processor 111 sends a second message to the client 101, where the second message is used to indicate a target cipher suite and a server random number.

[0207] For example, the processor 111 may run the protocol module 1111 to send a second message to the client 101 , where the second message is used to indicate a target cipher suite selected from available cipher suites and a server random number.

[0208] Step 606 : The processor 111 sends a certificate confirmation instruction to the security chip 113 .

[0209] For example, the processor 111 may execute the security management module 1112 to send a certificate confirmation instruction to the client 101 .

[0210] Step 607: The security chip 113 determines a digital certificate in response to the certificate determination instruction, where the digital certificate includes a public key corresponding to the asymmetric key algorithm.

[0211] For details, please refer to the above description of step 305, which will not be repeated here.

[0212] Step 608 : The processor 111 sends the digital certificate to the client 101 .

[0213] Step 609 , the processor 111 sends a digital signature instruction to the security chip 113 , where the digital signature instruction is used to instruct to digitally sign the exchange information, where the exchange information is used to indicate the client random number, the server random number, and the public key corresponding to the asymmetric key algorithm.

[0214] For example, the processor 111 may execute the security management module 1112 to send a digital signature instruction to the client 101 .

[0215] Step 610: In response to the digital signature instruction, the security chip 113 digitally signs the exchanged information based on the private key corresponding to the asymmetric key algorithm to obtain a digital signature result.

[0216] The detailed process of digital signature is described in step 502 and will not be repeated here.

[0217] Step 611 : The security chip 113 sends the digital signature result to the processor 111 .

[0218] Step 612 : The processor 111 sends the digital signature result to the client 101 .

[0219] For example, the processor 111 may run the security management module 1112 to send a digital signature result to the client 101 .

[0220] For example, the processor 111 can run the protocol module 1111 and the security management module 1112 , the security management module 1112 obtains the digital signature result from the security chip 113 and sends it to the protocol module 1111 , and the protocol module 1111 sends the digital signature result to the client 101 .

[0221] Step 613: The client 101 determines whether the digital signature result is successfully verified. If so, execute step 614.

[0222] For details, please refer to the description of step 505, which will not be repeated here.

[0223] Step 614: The client 101 determines the pre-master key based on the client random number and the server random number, and encrypts the pre-master key based on the public key corresponding to the asymmetric key algorithm to obtain a ciphertext.

[0224] Step 615 : The client 101 sends the ciphertext to the processor 111 .

[0225] Step 616 : The processor 111 sends a decryption instruction to the security chip 113 .

[0226] For example, the processor 111 may run the security management module 1112 to send a decryption instruction to the client 101 .

[0227] Step 617 : In response to the decryption instruction, the security chip 113 decrypts the ciphertext based on the private key corresponding to the asymmetric key algorithm to obtain the pre-master key.

[0228] Step 618 : The security chip 113 sends the pre-master key to the processor 111 .

[0229] Step 619 : The processor 111 determines a communication key based on the pre-master key and the target cipher suite, where the communication key is used for encrypted communication between the server 102 and the client 101 .

[0230] For example, the processor 111 may run the protocol module 1111 to determine a communication key based on the pre-master key and the target cipher suite, and the communication key is used for encrypted communication between the server 102 and the client 101. For details, see step 313, which will not be described in detail.

[0231] In this solution, based on the transport layer communication protocol between the server 102 and the client 101, the communication protocol and the security chip are connected in combination with the security management module, so that the security chip decrypts the pre-master key sent by the client through a private key. Subsequently, the communication key used for communication can be obtained based on the pre-master key, thereby improving the security of communication.

[0232] A specific example is provided below in combination with the above embodiments. In the following example, the client 101 includes a client, the server 102 includes a server, the protocol module 1111 in the server 102 is an OPENSSL protocol stack, the security management module 1112 is deployed in TPM2TSS-ENGINE, the security management module 1112 is an interface adapted to the SM2 algorithm based on the EVP interface, and the security chip 113 pre-generates and stores a key pair (public key and private key) based on the SM2 algorithm. The solution is described by taking the client, server, OPENSSL protocol stack, security management module 1112 and security chip 113 as examples. Figure 7 A flowchart of a specific example of an encrypted communication method provided for the implementation of this application. Figure 7 The specific contents include:

[0233] 1. The client sends a ClientHello message to the server. The ClientHello message includes a client random number and a list of supported cipher suites.

[0234] For example, the ClientHello message may include: an available version number, current time, client random number, a list of supported cipher suites, and a list of available compression methods. The client random number is a random number generated by the client and used to generate a pre-master key.

[0235] 2. The OPENSSL protocol stack selects the cipher suite to be used from the list of supported cipher suites, and the cipher suite used includes an asymmetric key algorithm.

[0236] 3. The OPENSSL protocol stack sends a ServerHello message to the client. The ClientHello message includes the server random number and the cipher suite used.

[0237] After receiving the client hello message, the server returns a server hello message to the client. The server hello message may include: the version number used, the current time, the server random number, the cipher suite used, and the compression method used. It should be noted that the version number used, the cipher suite used, and the compression method used are the answers to step 1. The server random number is a random number generated by the server and is used to generate a symmetric key.

[0238] 4. The security management module 1112 reads the SM2 certificate and sends it to the OPENSSL protocol stack; for example, the security management module 1112 directly reads the SM2 certificate or the security management module 1112 sends a certificate determination instruction to the security chip 113. The security chip 113 determines the SM2 certificate in response to the certificate determination instruction and sends it to the security management module 1112.

[0239] 5. The OPENSSL protocol stack sends a Certificate message to the client, which contains the SM2 certificate;

[0240] 6. The client verifies the legality of the identities of both parties based on the SM2 certificate. If so, proceed to step 13.

[0241] 7. The OPENSSL protocol stack prepares key exchange parameters, which include the client random number, the server random number, and the public key corresponding to the asymmetric key algorithm.

[0242] 8. The OPENSSL protocol stack sends key exchange parameters to the security management module 1112.

[0243] 9. The security management module 1112 sends a digital signature instruction to the security chip 113.

[0244] 10. The security chip 113 performs SM2 signature on the key exchange parameters to obtain an SM2 signature result.

[0245] 11. The security chip 113 sends the SM2 signature result to the OPENSSL protocol stack through the security management module 1112.

[0246] 12. The OPENSSL protocol stack sends a ServerKeyExchange message to the client. The ServerKeyExchange message includes key exchange parameters and SM2 signature results.

[0247] 13. The client verifies the SM2 signature result. If the verification succeeds, the key exchange parameters and the server are credible.

[0248] 14. The client determines the pre-master key based on the client random number and the server random number, and encrypts the pre-master key based on the public key to obtain the ciphertext.

[0249] 15. The client sends a ClientKeyExchange message to the security management module 1112 through the OPENSSL protocol stack, and the ClientKeyExchange message includes a ciphertext.

[0250] 16. The security management module 1112 sends a decryption instruction to the security chip 113.

[0251] 17. The security chip 113 decrypts the ciphertext to obtain the pre-master key.

[0252] 18. The security chip 113 sends the pre-master key to the security management module 1112.

[0253] 19. The security management module 1112 sends the pre-master key to the OPENSSL protocol stack.

[0254] 20.The OPENSSL protocol stack generates communication keys based on the pre-master secret key and the encryption algorithm in the used cipher suite.

[0255] 21. The client generates a communication key based on the pre-master secret key and the encryption algorithm in the cipher suite used.

[0256] 22. The server and client use the communication key for encrypted communication.

[0257] Based on the same concept as the embodiment of the method of the present application, the embodiment of the present application also provides an encrypted communication device. The encrypted communication device includes several modules, each of which is used to execute each step in the encrypted communication method provided in the embodiment of the present application, and the division of the modules is not limited here. The technicians in the relevant field can clearly understand that in practical applications, the various steps in the encrypted communication method provided in the embodiment of the present application can be assigned to different modules as needed, that is, the internal structure of the device is divided into different modules to complete all or part of the functions described above. Each module in the embodiment can be integrated in a processing unit, or each unit can exist physically alone, or two or more modules can be integrated in one unit, and the above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of each module are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present application. The specific working process of the module in the above-mentioned device can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0258] For example, the encryption communication device is used to execute the encryption communication method provided in the embodiment of the present application. Figure 8 Schematic diagram of the structure of the encryption communication device provided in the embodiment of the present application. Figure 8 As shown, the encryption communication device provided in the embodiment of the present application includes:

[0259] The protocol module 1111 is used to determine that the server and the client agree to use a target cipher suite, the target cipher suite including an asymmetric key algorithm; and send the target cipher suite to the security management module;

[0260] The security management module 1112 is used to send a digital certificate to the client, where the digital certificate includes a public key corresponding to an asymmetric key algorithm, so that the client encrypts the pre-master key based on the public key, obtains a ciphertext, and sends the ciphertext to the server;

[0261] The security management module 1112 is used to send a decryption instruction to the security chip, so that the security chip responds to the decryption instruction, decrypts the ciphertext based on the private key corresponding to the asymmetric key algorithm, obtains the pre-master key, and sends the pre-master key to the security management module;

[0262] The security management module 1112 is used to obtain the pre-master key from the security chip and send the pre-master key to the protocol module 1111;

[0263] The protocol module 1111 is used to generate a communication key based on the pre-master key and the target cipher suite, and the communication key is used for encrypted communication between the server and the client.

[0264] Based on the same concept as the method embodiment of the present application, the present application embodiment also provides a computing device. The structure of the computing device can be found in Figure 1a Server 102 in.

[0265] In a specific application, the computing device may include a processor 111 and a memory, and the memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a hard disk 123. The volatile memory may be a memory 112. Specifically, the memory of the computing device, such as the hard disk 123 and the memory 112, may store a computer program. When the computing device is running, the processor 111 may read the computer program stored in the memory, such as reading the computer program stored in the hard disk 123 to the memory 112, and read the computer program from the memory 112, to implement the steps in the above-mentioned encryption communication method, such as Figure 3 , Figure 4 , Figure 5 , Figure 6 Steps in .

[0266] Exemplarily, the computer program may be divided into one or more modules / units, which may be a series of computer program instruction segments capable of completing specific functions, and the one or more modules / units are stored in a memory such as a hard disk 123 and executed by the processor 111 to complete the present application. For example, the computer program may be divided into a protocol module 1111 and a security management module 1112, and the specific functions of each module are described above.

[0267] In addition to the above methods, devices and electronic devices, the embodiments of the present application may also provide a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the encryption communication method of various embodiments of the present application described in the "Method" section of this specification. Wherein, the computer program product can be written in any combination of one or more programming languages ​​to perform computer program codes for performing the operations of the embodiments of the present application, and the programming languages ​​include object-oriented programming languages, such as Java, C++, etc., and also include conventional procedural programming languages, such as "C" language or similar programming languages. Wherein, the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer program code can be executed completely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device, partially on the remote computing device, or completely on the remote computing device or server.

[0268] In addition, the embodiment of the present application may also provide a computer-readable storage medium on which computer program instructions are stored, and the computer program instructions, when executed by the processor, cause the processor to execute the steps in the encryption communication method according to various embodiments of the present disclosure described in the "Method" section of the present specification. The computer-readable storage medium may adopt any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may include, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0269] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0270] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0271] The basic principles of the present application are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present application are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, rather than limitation, and the above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0272] The block diagrams of the devices, apparatuses, equipment, and systems involved in the present disclosure are intended to be illustrative examples only and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems may be connected, arranged, and configured in any manner. Words such as "include," "comprise," "have," and the like are open words, meaning "including but not limited to," and may be used interchangeably therewith. The words "or," "and," and "as used herein refer to the words "and / or," and may be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as," as used herein, refers to the phrase "such as, but not limited to," and may be used interchangeably therewith.

[0273] It should also be noted that in the apparatus, device and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0274] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

[0275] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.< / gb>

Claims

1. An encrypted communication method, characterized in that: Applied to a server, the server includes a protocol module, a security management module and a security chip, the security chip stores a public key and a private key corresponding to an asymmetric key algorithm, and the method includes: The protocol module determines that the server and the client agree to use a target cipher suite, wherein the target cipher suite includes the asymmetric key algorithm; the protocol module sends the target cipher suite to the security management module; The security management module sends a digital certificate to the client, wherein the digital certificate includes the public key corresponding to the asymmetric key algorithm, so that the client encrypts the pre-master key based on the public key, obtains a ciphertext and sends the ciphertext to the server; The security management module sends a decryption instruction to the security chip, so that the security chip responds to the decryption instruction, decrypts the ciphertext based on the private key corresponding to the asymmetric key algorithm, obtains the pre-master key, and sends the pre-master key to the security management module; The security management module sends the pre-master key to the protocol module; The protocol module generates a communication key based on the pre-master key and the target cipher suite, wherein the communication key is used for encrypted communication between the server and the client.

2. The method according to claim 1, characterized in that The method further comprises: The security management module sends a digital signature instruction to the security chip, so that the security chip responds to the digital signature instruction, digitally signs the exchange information based on the private key corresponding to the asymmetric key algorithm, obtains a digital signature result, and sends the digital signature result to the security management module; the exchange information is at least used to indicate the public key; The security management module sends the digital signature result to the client, so that the client verifies the digital signature result. If the verification is successful, the client encrypts the pre-master key based on the public key to obtain a ciphertext.

3. The method according to claim 1 or 2, characterized in that: The protocol module determines that the server and the client agree to use a target cipher suite, including: The protocol module receives a first message sent by a client, where the first message is used to indicate a cipher suite that the client can support; The protocol module sends a second message to the client, where the second message includes a target cipher suite determined from the key suite.

4. The method according to claim 3, characterized in that The first message includes a client random number; the second message includes a server random number; The pre-master key is determined by the client based on at least the client random number and the server random number.

5. The method according to any one of claims 1 to 4, characterized in that: The protocol module is used to implement the transport layer encryption protocol.

6. The method according to any one of claims 1 to 5, characterized in that: The asymmetric key algorithm is an elliptic curve public key cryptography algorithm.

7. An encrypted communication method, characterized in that: A security management module applied to a server, the security management module being used to manage a security chip, the security chip storing a public key and a private key corresponding to the asymmetric key algorithm, the method comprising: Acquire a target cipher suite, the target cipher suite being agreed upon by the server and the client, and including the asymmetric key algorithm; send a digital certificate to the client, the digital certificate including the public key corresponding to the asymmetric key algorithm, so that the client encrypts a pre-master key based on the public key, obtains a ciphertext, and sends the ciphertext to the server; Sending a decryption instruction to the security chip, so that the security chip responds to the decryption instruction, decrypts the ciphertext based on the private key corresponding to the asymmetric key algorithm, obtains the pre-master key, and sends the pre-master key to the security management module; The pre-master key is sent to the protocol module, so that the protocol module generates a communication key based on the pre-master key and the target cipher suite, wherein the communication key is used for encrypted communication between the server and the client.

8. The method according to claim 7, characterized in that The method further comprises: Sending a digital signature instruction to the security chip, so that the security chip responds to the digital signature instruction, digitally signs the exchange information based on the private key, obtains a digital signature result, and sends the digital signature result to the security management module; the exchange information is at least used to indicate the public key; The digital signature result is sent to the client, so that the client verifies the digital signature result. If the verification is successful, the pre-master key is encrypted based on the public key to obtain a ciphertext.

9. The method according to any one of claims 7 or 8, characterized in that: The protocol module is used to implement the transport layer encryption protocol; The asymmetric key algorithm is an elliptic curve public key cryptography algorithm.

10. A server, characterized in that: It includes a processor and a security chip; the security chip stores the public key and private key corresponding to the asymmetric key algorithm, wherein: The processor is used to determine a target cipher suite agreed upon by the server and the client, wherein the target cipher suite includes the asymmetric key algorithm; The processor is used to send a digital certificate to the client, where the digital certificate includes the public key corresponding to the asymmetric key algorithm, so that the client encrypts the pre-master key based on the public key to obtain a ciphertext and sends the ciphertext to the server; The processor is used to send a decryption instruction to the security chip; The security chip is used to respond to the decryption instruction, decrypt the ciphertext based on the private key corresponding to the asymmetric key algorithm, obtain the pre-master key, send the pre-master key to the security management module, and send the pre-master key to the processor; The processor generates a communication key based on the pre-master key and the target cipher suite, wherein the communication key is used for encrypted communication between the server and the client.

Images