Method and device for secure communication between client and server

Abstract

The invention provides a method and device for secure communication between a client and a server, and the method comprises the steps: the server generates a public key and a private key, and transmits the public key to the client; the client obtains hardware information of local equipment and generates a machine code character string; randomly generating random characters with set digits, and combining the machine code character string with the random characters to serve as encryption seeds; generating an encryption key according to the encryption seed; the client encrypts the encryption key through a public key and then sends the encryption key to a server, and the server decrypts the encryption key through a private key to obtain the encryption key; the client encrypts the request data according to the encryption key to obtain encrypted data, and signs the encrypted data; the client sends the signature and the encrypted data to the server; the server receives the signature, verifies the signature, decrypts the encrypted data by using the encryption key after the verification is passed, processes the data according to the request data, and sends return data; and the safety of data communication is greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of data communication technology, and in particular to a method and device for secure communication between a client and a server. Background Art

[0002] With the continuous improvement of information security requirements, secure communication between clients and servers has become an indispensable part of network systems. Existing secure communication solutions are mostly based on a combination of asymmetric and symmetric encryption for data encryption and verification, but there are still certain security risks in key generation, key exchange, and data verification. In particular, how to ensure that the transmitted keys and data are not tampered with and effectively verify the authenticity of the data source has become a problem that needs to be solved urgently. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a method and device for secure communication between a client and a server, which can greatly increase the difficulty of decryption and improve the security of data interaction.

[0004] In a first aspect, the present invention provides a method for secure communication between a client and a server, comprising the following steps:

[0005] Step 1: The server generates a public key and a private key, and then sends the public key to the client;

[0006] Step 2: The client obtains the hardware information of the local device and generates a machine code string; randomly generates a set number of random characters, combines the machine code string with the random characters as an encryption seed, and generates an encryption key according to the encryption seed;

[0007] Step 3: The client encrypts the encryption key using the public key and sends it to the server, and the server decrypts it using the private key to obtain the encryption key;

[0008] Step 4: The client encrypts the request data according to the encryption key to obtain encrypted data, and signs the encrypted data; the client sends the signature and encrypted data to the server;

[0009] Step 5: The server receives and verifies the signature. After verification, it uses the encryption key to decrypt the encrypted data, processes it according to the request data, and sends the return data.

[0010] In a second aspect, the present invention provides a device for secure communication between a client and a server, comprising the following modules:

[0011] Key pair module, the server generates a public key and a private key, and then sends the public key to the client;

[0012] The encryption key module, the client obtains the hardware information of the local device and generates a machine code string; randomly generates a set number of random characters, combines the machine code string with the random characters as an encryption seed, and generates an encryption key according to the encryption seed;

[0013] The sending key module encrypts the encryption key with the public key and sends it to the server, and the server decrypts it with the private key to obtain the encryption key;

[0014] In the request data module, the client encrypts the request data according to the encryption key to obtain the encrypted data, and signs the encrypted data; the client sends the signature and the encrypted data to the server;

[0015] In the return data module, the server receives and verifies the signature. After the verification, it uses the encryption key to decrypt the encrypted data, processes it according to the request data, and sends the return data.

[0016] One or more technical solutions provided by the present invention have at least the following technical effects or advantages:

[0017] 1. The key exchange of the present invention is highly secure: through the SM2 asymmetric encryption algorithm, the AES256 symmetric keys of the client and the server can be securely exchanged without being exposed, avoiding the risk of the key being stolen during transmission.

[0018] 2. The present invention prevents replay attacks: introduces a timestamp mechanism, attaches a current timestamp to each communication, verifies data through SM3 signature and checks the validity of the timestamp; any attempt to replay an expired data packet will be rejected, thereby effectively preventing replay attacks.

[0019] 3. Data integrity and source verification of the present invention: The transmission data, timestamp and AES256 key are signed and verified through the SM3 signature algorithm to ensure that the data has not been tampered with during the transmission process, and at the same time verify the authenticity of the source of the data to ensure the reliability of data transmission.

[0020] 4. High security of AES256 key generation of the present invention: A unique AES256 key is generated by combining the hardware information of the client device with 128-bit random characters, and combined with the SHA256 hash algorithm to ensure that the generated symmetric key is unpredictable and unique, further enhancing the security of communication.

[0021] 5. The present invention supports device binding: Since the generation of AES256 keys depends on the client hardware information, the device binding function can be realized. Even if the key is intercepted, it is difficult for the other party to accurately obtain the client hardware information and cannot decrypt the communication content, thereby enhancing the security of communication.

[0022] 6. Efficient encryption and decryption of the present invention: AES256 symmetric encryption algorithm is used for data transmission, with high encryption and decryption efficiency, which is suitable for application scenarios requiring large-scale data transmission.

[0023] 7. The lightweight signature mechanism of the present invention: The SM3 signature algorithm is computationally efficient and can provide powerful data integrity protection and anti-tampering capabilities, ensuring that the signature verification process is lightweight and fast without affecting the efficiency of communication.

[0024] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The present invention will be further described below in conjunction with embodiments with reference to the accompanying drawings.

[0026] Figure 1 is a flow chart of the method in Embodiment 1 of the present invention;

[0027] Figure 2 It is a schematic diagram of the structure of the device in the second embodiment of the present invention. DETAILED DESCRIPTION

[0028] The embodiments of the present application solve the technical problem of insecure data transmission in the prior art by providing a method and device for secure communication between a client and a server.

[0029] The technical solution in the embodiment of the present application has the following general idea:

[0030] 1. The server generates SM2 public key and private key:

[0031] The server generates a random SM2 asymmetric key pair during initialization, including an SM2 public key and a private key. The server sends the generated SM2 public key to the client through a secure channel.

[0032] 2. The client generates an AES256 symmetric encryption key through the following steps:

[0033] 1. **Get hardware information**: The client extracts unique identification information from the device hardware, including hardware feature information such as the number of CPU cores, memory size (in GB), hard disk capacity (in GB), and the MAC address of the network card.

[0034] 2. **Generate machine code**: Combine the acquired hardware information in sequence to generate a unique machine code string.

[0035] 3. **Generate random characters**: The client generates 128-bit random characters.

[0036] 4. **Combining machine code and random characters**: Combine the machine code with 128 bits of random characters as a seed to generate the AES256 key.

[0037] 5. **Use hash to generate key**: Hash the above combined seed through the SHA256 hash function to generate a 256-bit AES symmetric encryption key.

[0038] The python sample code is as follows:

[0039] importhashlib

[0040] import os

[0041] importpsutil

[0042] import uuid

[0043] #Get the number of CPU cores

[0044] defget_cpu_cores():

[0045] return str(psutil.cpu_count(logical=False))

[0046] #Get the memory size (in GB)

[0047] defget_memory_size():

[0048] return str(round(psutil.virtual_memory().total / (1024**3),2))#Convert to GB

[0049] #Get the hard disk capacity (in GB)

[0050] defget_disk_size():

[0051] disk_usage=psutil.disk_usage(' / ')

[0052] return str(round(disk_usage.total / (1024**3),2))#Convert to GB

[0053] #Get the MAC address of the network card

[0054] defget_mac_address():

[0055] mac = uuid.getnode()

[0056] return':'.join(('%012X'%mac)[i:i+2]for iin range(0,12,2))

[0057] #Generate machine code

[0058] defgenerate_machine_code():

[0059] cpu_cores = get_cpu_cores()

[0060] memory_size=get_memory_size()

[0061] disk_size = get_disk_size()

[0062]

[0063] 3. The client encrypts the AES256 key and sends it to the server:

[0064] The client uses the SM2 public key received from the server to encrypt the generated AES256 key to obtain the encrypted AES256 key. The client sends the encrypted AES256 key to the server.

[0065] 4. Server decrypts the AES256 key:

[0066] After receiving the encrypted AES256 key sent by the client, the server uses its locally stored SM2 private key to decrypt the key and obtain the AES256 key generated by the client.

[0067] 5. The client and server communicate using AES256:

[0068] After the client and server obtain the same AES256 key through the above steps, they start using the AES256 symmetric encryption algorithm for data communication.

[0069] 6. Data verification and signature:

[0070] In order to ensure that the data has not been tampered with during transmission, the present invention designs a signature algorithm based on SM3 to verify the data. The specific steps are as follows:

[0071] 1. **Signature data construction**: The client or server constructs signature data every time it transmits data, which includes the following: the ciphertext data to be transmitted, the timestamp (Unix timestamp since January 1, 1970), and the currently used AES256 key.

[0072] 2. **SM3 Signature**: After combining the data of the above three parts, a signature is generated through the SM3 hash algorithm.

[0073] 3. **Send Signature**: Send the signature together with the ciphertext data and timestamp to the other party.

[0074] 4. **Verify the signature**: After receiving the ciphertext, timestamp and signature, the recipient uses the same SM3 algorithm to hash the received ciphertext, timestamp and AES256 key and compares them with the signature to verify the integrity of the data and the authenticity of its source.

[0075] Embodiment 1

[0076] like Figure 2 As shown, this embodiment provides a method for secure communication between a client and a server, comprising the following steps:

[0077] Step 1: The server generates a public key and a private key, and then sends the public key to the client;

[0078] Step 2: The client obtains the hardware information of the local device and generates a machine code string; randomly generates a set number of random characters, combines the machine code string with the random characters as an encryption seed, and generates an encryption key according to the encryption seed;

[0079] Step 3: The client encrypts the encryption key using the public key and sends it to the server, and the server decrypts it using the private key to obtain the encryption key;

[0080] Step 4: The client encrypts the request data according to the encryption key to obtain encrypted data, and signs the encrypted data; the client sends the signature and encrypted data to the server;

[0081] Step 5: The server receives and verifies the signature. After verification, it uses the encryption key to decrypt the encrypted data, processes it according to the request data, and sends the return data.

[0082] In this embodiment, preferably, step 1 is specifically as follows: when the server is initialized, it generates a pair of random SM2 asymmetric key pairs, including a public key and a private key, and then sends the public key to the client and stores the private key in the server.

[0083] In this embodiment, preferably, the step 2 is specifically as follows: the client extracts unique identification information from the hardware of the local device, including the number of CPU cores, memory, hard disk capacity and MAC address of the network card, and the memory and hard disk capacity are both in GB; the obtained unique identification information is combined in a set order to generate a unique machine code string; then a 128-bit random character is generated; the machine code string is combined with the 128-bit random character as an encryption seed; the encryption seed is hashed by the SHA256 hash function to generate a 256-bit AES symmetric encryption key.

[0084] In this embodiment, preferably, step 4 is specifically as follows: the client encrypts the request data according to the encryption key to obtain encrypted data, and after combining the encrypted data, timestamp and encryption key, signs it through the SM3 hash algorithm; the client sends the signature and encrypted data to the server.

[0085] In this embodiment, preferably, step 5 is specifically as follows: the server receives and verifies the signature, decrypts the encrypted data with the encryption key after the verification, processes the request data to obtain return data, encrypts the return data with the encryption key, and then signs the encrypted return data, timestamp and encryption key through the SM3 hash algorithm, and sends the encrypted return data and signature to the client.

[0086] Based on the same inventive concept, the present application also provides a device corresponding to the method in Example 1, see Example 2 for details.

[0087] Embodiment 2

[0088] like Figure 2 As shown, in this embodiment, a device for secure communication between a client and a server is provided, including the following modules:

[0089] Key pair module, the server generates a public key and a private key, and then sends the public key to the client;

[0090] The encryption key module, the client obtains the hardware information of the local device and generates a machine code string; randomly generates a set number of random characters, combines the machine code string with the random characters as an encryption seed, and generates an encryption key according to the encryption seed;

[0091] The sending key module encrypts the encryption key with the public key and sends it to the server, and the server decrypts it with the private key to obtain the encryption key;

[0092] In the request data module, the client encrypts the request data according to the encryption key to obtain the encrypted data, and signs the encrypted data; the client sends the signature and the encrypted data to the server;

[0093] In the return data module, the server receives and verifies the signature. After the verification, it uses the encryption key to decrypt the encrypted data, processes it according to the request data, and sends the return data.

[0094] In this embodiment, preferably, the key pair module is specifically as follows: when the server is initialized, it generates a pair of random SM2 asymmetric key pairs, including a public key and a private key, and then sends the public key to the client and stores the private key in the server.

[0095] In this embodiment, preferably, the encryption key module is specifically as follows: the client extracts unique identification information from the hardware of the local device, including the number of CPU cores, memory, hard disk capacity and MAC address of the network card, and the memory and hard disk capacity are both in GB; the obtained unique identification information is combined in a set order to generate a unique machine code string; then a 128-bit random character is generated; the machine code string is combined with the 128-bit random character as an encryption seed; the encryption seed is hashed by the SHA256 hash function to generate a 256-bit AES symmetric encryption key.

[0096] In this embodiment, preferably, the request data module is specifically as follows: the client encrypts the request data according to the encryption key to obtain encrypted data, and after combining the encrypted data, timestamp and encryption key, signs it through the SM3 hash algorithm; the client sends the signature and encrypted data to the server.

[0097] In this embodiment, preferably, the return data module is specifically as follows: the server receives and verifies the signature, decrypts the encrypted data with an encryption key after the verification, processes the request data to obtain return data, encrypts the return data with an encryption key, and then signs the encrypted return data, timestamp and encryption key through the SM3 hash algorithm, and sends the encrypted return data and signature to the client.

[0098] Since the device introduced in the second embodiment of the present invention is a device used to implement the method of the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the device, so it is not repeated here. All devices used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0099] The technical solution provided in the embodiments of the present application has at least the following technical effects or advantages:

[0100] 1. The key exchange of the embodiment of the present application is highly secure: through the SM2 asymmetric encryption algorithm, the AES256 symmetric keys of the client and the server can be securely exchanged without being exposed, avoiding the risk of the key being stolen during transmission.

[0101] 2. The embodiment of the present application prevents replay attacks by introducing a timestamp mechanism, with each communication accompanied by a current timestamp, and checking the validity of the timestamp while verifying the data through the SM3 signature; any attempt to replay an expired data packet will be rejected, thereby effectively preventing replay attacks.

[0102] 3. Data integrity and source verification of the embodiment of the present application: The transmitted data, timestamp and AES256 key are signed and verified through the SM3 signature algorithm to ensure that the data has not been tampered with during the transmission process, and at the same time verify the authenticity of the source of the data to ensure the reliability of data transmission.

[0103] 4. High security of AES256 key generation in the embodiment of the present application: A unique AES256 key is generated by combining the hardware information of the client device with 128-bit random characters, and combined with the SHA256 hash algorithm to ensure that the generated symmetric key is unpredictable and unique, further enhancing the security of communication.

[0104] 5. The embodiment of the present application supports device binding: Since the generation of AES256 keys depends on the client hardware information, the device binding function can be realized. Even if the key is intercepted, it is difficult for the other party to accurately obtain the client hardware information and cannot decrypt the communication content, thereby enhancing the security of the communication.

[0105] 6. Efficient encryption and decryption in the embodiment of the present application: AES256 symmetric encryption algorithm is used for data transmission, with high encryption and decryption efficiency, which is suitable for application scenarios that require large-scale data transmission.

[0106] 7. Lightweight signature mechanism of the embodiment of the present application: The SM3 signature algorithm is computationally efficient and can provide powerful data integrity protection and anti-tampering capabilities, ensuring that the signature verification process is lightweight and fast without affecting the efficiency of communication.

[0107] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0108] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0109] Although the specific implementation modes of the present invention are described above, those skilled in the art should understand that the specific implementation modes described are only illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for secure communication between a client and a server, characterized in that: The steps include: Step 1: The server generates a public key and a private key, and then sends the public key to the client; Step 2: The client obtains the hardware information of the local device and generates a machine code string; randomly generates a set number of random characters, combines the machine code string with the random characters as an encryption seed, and generates an encryption key according to the encryption seed; Step 3: The client encrypts the encryption key using the public key and sends it to the server, and the server decrypts it using the private key to obtain the encryption key; Step 4: The client encrypts the request data according to the encryption key to obtain encrypted data, and signs the encrypted data; the client sends the signature and encrypted data to the server; Step 5: The server receives and verifies the signature. After verification, it uses the encryption key to decrypt the encrypted data, processes it according to the request data, and sends the return data.

2. A method for secure communication between a client and a server according to claim 1, characterized in that: The step 1 is specifically as follows: when the server is initialized, it generates a pair of random SM2 asymmetric key pairs, including a public key and a private key, and then sends the public key to the client and stores the private key in the server.

3. A method for secure communication between a client and a server according to claim 1, characterized in that: The step 2 is specifically as follows: the client extracts unique identification information from the hardware of the local device, including the number of CPU cores, memory, hard disk capacity and MAC address of the network card, and the memory and hard disk capacity are both in GB; the obtained unique identification information is combined in a set order to generate a unique machine code string; then a 128-bit random character is generated; the machine code string is combined with the 128-bit random character as an encryption seed; the encryption seed is hashed by the SHA256 hash function to generate a 256-bit AES symmetric encryption key.

4. A method for secure communication between a client and a server according to claim 1, characterized in that: The specific steps of step 4 are as follows: the client encrypts the request data according to the encryption key to obtain the encrypted data, and after combining the encrypted data, timestamp and encryption key, signs the data through the SM3 hash algorithm; the client sends the signature and encrypted data to the server.

5. A method for secure communication between a client and a server according to claim 1, characterized in that: The specific step 5 is as follows: the server receives and verifies the signature, decrypts the encrypted data with the encryption key after the verification, processes the request data to obtain the return data, encrypts the return data with the encryption key, and then signs the encrypted return data, timestamp and encryption key through the SM3 hash algorithm, and sends the encrypted return data and signature to the client.

6. A device for secure communication between a client and a server, characterized in that: Includes the following modules: Key pair module, the server generates a public key and a private key, and then sends the public key to the client; The encryption key module, the client obtains the hardware information of the local device and generates a machine code string; randomly generates a set number of random characters, combines the machine code string with the random characters as an encryption seed, and generates an encryption key according to the encryption seed; The sending key module encrypts the encryption key with the public key and sends it to the server, and the server decrypts it with the private key to obtain the encryption key; In the request data module, the client encrypts the request data according to the encryption key to obtain the encrypted data, and signs the encrypted data; the client sends the signature and the encrypted data to the server; In the return data module, the server receives and verifies the signature. After the verification, it uses the encryption key to decrypt the encrypted data, processes it according to the request data, and sends the return data.

7. The device for secure communication between a client and a server according to claim 6, characterized in that: The key pair module is specifically as follows: when the server is initialized, it generates a pair of random SM2 asymmetric key pairs, including a public key and a private key, and then sends the public key to the client and stores the private key in the server.

8. The device for secure communication between a client and a server according to claim 6, characterized in that: The encryption key module is specifically as follows: the client extracts unique identification information from the hardware of the local device, including the number of CPU cores, memory, hard disk capacity and MAC address of the network card, and the memory and hard disk capacity are both in GB; the obtained unique identification information is combined in a set order to generate a unique machine code string; then a 128-bit random character is generated; the machine code string is combined with the 128-bit random character as an encryption seed; the encryption seed is hashed through the SHA256 hash function to generate a 256-bit AES symmetric encryption key.

9. The device for secure communication between a client and a server according to claim 6, characterized in that: The request data module is specifically as follows: the client encrypts the request data according to the encryption key to obtain encrypted data, and after combining the encrypted data, timestamp and encryption key, signs it through the SM3 hash algorithm; the client sends the signature and encrypted data to the server.

10. The device for secure communication between a client and a server according to claim 6, characterized in that: The return data module is specifically as follows: the server receives and verifies the signature, decrypts the encrypted data with the encryption key after the verification, processes the request data to obtain the return data, encrypts the return data with the encryption key, and then signs the encrypted return data, timestamp and encryption key through the SM3 hash algorithm, and sends the encrypted return data and signature to the client.

Images