Method and system for handshake protocol based on SM2 algorithm and SM4 algorithm

Abstract

The present application provides a method and system for a handshake protocol based on the SM2 algorithm and the SM4 algorithm, and relates to the field of encrypted transmission. The method includes obtaining the first request information during a session; sending the first SM2 public key generated based on the SM2 algorithm and the first client random number ciphertext information to the server; decrypting the SM4 ciphertext information based on the first SM2 private key generated by the SM2 algorithm to obtain the SM4 target key; processing the second client random number ciphertext information and the first server random number ciphertext information; sending the second server random number target ciphertext information to the server; processing the first request information to receive the session return ciphertext information from the server and decrypt to determine the session return plaintext information. The present application completes the handshake encryption between the client and the server based on the national secret algorithm of the SM2 algorithm and the SM4 algorithm, and uses the SM2 algorithm and the SM4 algorithm to replace the RSA algorithm, the ECDHE algorithm and the DES algorithm that the SSL protocol relies on, and realizes the autonomous control of data security and information security.

Description

Technical Field

[0001] The present invention relates to the technical field of encrypted transmission, and in particular to a method and system for a handshake protocol based on an SM2 algorithm and an SM4 algorithm. Background Art

[0002] In data transmission, the first-level domain name of some platforms uses Hypertext Transfer Protocol (HTTP). The request body is transmitted in plain text on the network, and data security cannot be effectively guaranteed. It is easy to be eavesdropped and intercepted by middlemen. Since the data transmitted by HTTP is not encrypted, attackers can insert their own malicious content between the two ends of the communication, change the transmitted data, or conduct phishing attacks, thereby interfering with and destroying the communication and other security issues. With the development of cryptographic technology and computer technology, the Hypertext Transfer Protocol Secure (HTTPS) can be used to replace the traditional HTTP protocol. The HTTPS protocol is built into its browser. HTTPS is used to compress and decompress data and return the results sent back on the network. HTTPS uses Secure Sockets Layer (SSL) as a sublayer of the application layer to ensure the privacy of communication. HTTPS-like requests include a single HTTP request and a single HTTPS request.

[0003] However, some sites cannot use universal HTTPS due to limitations and security requirements. Some sites have extremely high security requirements, and their security may not meet the needs even if only one layer of protection is set up based on HTTPS. In related technologies, the current SSL protocol is usually implemented based on the RSA algorithm, ECDHE algorithm and DES algorithm. The HTTPS protocol uses certificates, which are issued by foreign root certification authorities and need to be renewed and maintained regularly. They are inconvenient to use and have great limitations. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a method and system for a handshake protocol based on the SM2 algorithm and the SM4 algorithm, which solves the problem of insufficient security of data transmission interaction in both HTTP plain text transmission and HTTPS using international encryption algorithms.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0006] In a first aspect, an embodiment of the present application provides a method for a handshake protocol based on an SM2 algorithm and an SM4 algorithm, which is used for a client, and the method includes: obtaining the first request information for the first time during a session; triggering a preset handshake procedure based on the first request information, and sending a first SM2 public key and a first client random number ciphertext information at a session level generated based on the SM2 algorithm to a server, so that the server can decrypt the first client random number ciphertext information through the first SM2 public key to obtain a second client random number; receiving the SM4 ciphertext information, the second SM2 public key and the target random number ciphertext information sent by the server; decrypting the SM4 ciphertext information based on the first SM2 private key generated by the SM2 algorithm to obtain an SM4 target key;

[0007] Based on the SM4 target key and the second SM2 public key, the target random number ciphertext information is processed to verify the data interaction process and generate the second server-side random number target ciphertext information; the second server-side random number target ciphertext information is sent to the server to perform tamper-proof verification to complete the handshake process between the client and the server, and determine the SM4 target key as a session-level symmetric encryption key; the first request information is processed through a preset target interaction strategy, and the generated session request data ciphertext information is sent to the server to receive the session return ciphertext information from the server and decrypt to determine the session return plaintext information.

[0008] According to the first aspect of the embodiment of the present application, the aforementioned triggering of a preset handshake procedure based on the first request information, sending a first SM2 public key and a first client random number ciphertext information of the session level generated based on the SM2 algorithm to the server, including: generating a first SM2 public-private key pair and a first client random number based on the SM2 algorithm, the first SM2 public-private key pair including a first SM2 public key and a first SM2 private key, and the first client random number is used for tamper prevention; encrypting the first client random number by the first SM2 private key to obtain the first client random number ciphertext information;

[0009] The first SM2 public key and the first client random number ciphertext information are sent to the server.

[0010] According to the first aspect of the embodiment of the present application, the target random number ciphertext information is processed based on the SM4 target key and the second SM2 public key to verify the data interaction process and generate the second server random number target ciphertext information, including: decrypting and splitting the target random number ciphertext information through the SM4 target key to obtain the third client random number and the second server random number; comparing the first client random number and the third client random number; when the first client random number and the third client random number are consistent, encrypting the second server random number through the SM4 target key to obtain the second server random number intermediate ciphertext information; encrypting the second server random number intermediate ciphertext information based on the second SM2 public key to obtain the second server random number target ciphertext information.

[0011] According to the first aspect of the embodiment of the present application, the aforementioned handshake protocol method based on the SM2 algorithm and the SM4 algorithm also includes: receiving a second request information that follows the first request information during the session; wherein the target interaction strategy has the same processing process for the first request information and the second request information.

[0012] According to the first aspect of the embodiment of the present application, the first request information is processed through a preset target interaction strategy, and the generated session request data ciphertext information is sent to the server to receive the session return ciphertext information from the server and decrypt to determine the session return plaintext information, including: encrypting the first request information based on a symmetric encryption key to obtain the session request data ciphertext information; sending the session request data ciphertext information to the server; receiving the session return ciphertext information sent by the server, and decrypting the session return ciphertext information through the symmetric encryption key to obtain the session return plaintext information.

[0013] In a second aspect, an embodiment of the present application provides a method for a handshake protocol based on an SM2 algorithm and an SM4 algorithm, which is used for a server, and the method includes: receiving a first SM2 public key and a first client random number ciphertext information sent by a client; decrypting the first client random number ciphertext information by using the first SM2 public key to obtain a second client random number; obtaining a second SM2 public-private key pair from a key library, and generating a first server random number, the second SM2 public-private key pair including a second SM2 public key and a second SM2 private key; generating an SM4 target key based on the first SM2 public key, the second SM2 private key, the second client random number and the first server random number, encrypting the SM4 target key based on the first SM2 public key to obtain SM4 ciphertext information, combining the second client random number and the first server random number and encrypting them based on the SM4 target key to obtain to the target random number ciphertext information; send the SM4 ciphertext information, the second SM2 public key and the target random number ciphertext information to the client, so that the client can decrypt the SM4 ciphertext information based on the first SM2 private key generated by the SM2 algorithm to obtain the SM4 target key; and based on the SM4 target key and the second SM2 public key, process the target random number ciphertext information to verify the data interaction process and generate the second server-side random number target ciphertext information; receive the second server-side random number target ciphertext information sent by the client; decrypt the second server-side random number target ciphertext information based on the second SM2 private key and the SM4 target key to generate a third server-side random number and verify the data interaction process; receive the session request data ciphertext information sent by the client; decrypt the session request data ciphertext information, and send the generated session return ciphertext information to the client.

[0014] According to the second aspect of the embodiment of the present application, the aforementioned SM4 target key is generated based on the first SM2 public key, the second SM2 private key, the second client random number and the first server random number, the SM4 target key is encrypted based on the first SM2 public key to obtain SM4 ciphertext information, the second client random number and the first server random number are combined and encrypted based on the SM4 target key to obtain the target random number ciphertext information, including: based on the first SM2 public key, the second SM2 private key, the second client random number and the first server random number, the SM4 target key is negotiated through the SM2 algorithm; the SM4 target key is encrypted through the first SM2 public key and hexadecimal processing is performed to obtain SM4 ciphertext information; the second client random number and the first server random number are combined to obtain random number combination information; the random number combination information is encrypted through the SM4 target key to obtain the target random number ciphertext information.

[0015] According to the second aspect of the embodiment of the present application, the aforementioned decryption of the second server random number target ciphertext information based on the second SM2 private key and the SM4 target key to generate a third server random number and verify the data interaction process, including: decrypting the second server random number target ciphertext information by the second SM2 private key to obtain the third server random number intermediate ciphertext information; decrypting the third server random number intermediate ciphertext information by the SM4 target key to obtain the third server random number; comparing the third server random number with the first server random number; when the third server random number is consistent with the first server random number, determining that the handshake process between the client and the server is completed, and determining that the SM4 target key is a session-level symmetric encryption key.

[0016] According to the second aspect of the embodiment of the present application, the aforementioned decryption of the session request data ciphertext information and sending the generated session return ciphertext information to the client include: decrypting the session request data ciphertext information based on a symmetric encryption key to obtain first request information; generating session return data information based on the request content of the first request information; encrypting the session return data information by means of a symmetric encryption key to obtain session return ciphertext information; and sending the session return ciphertext information to the client.

[0017] In the third aspect, an embodiment of the present application provides a system of a handshake protocol based on the SM2 algorithm and the SM4 algorithm, which is used for a client, and the system includes: an acquisition module, a first sending module, a first receiving module, a first decryption module, a first processing module, a second sending module and a second processing module; wherein the acquisition module is used to obtain the first first request information during the session; the first sending module is used to trigger a preset handshake procedure based on the first request information, and send a first SM2 public key and a first client random number ciphertext information at the session level generated based on the SM2 algorithm to the server, so that the server can decrypt the first client random number ciphertext information through the first SM2 public key to obtain a second client random number; the first receiving module is used to receive the SM4 ciphertext information, the second SM2 public key and the target random number ciphertext information sent by the server. ; The first decryption module is used to decrypt the SM4 ciphertext information based on the first SM2 private key generated by the SM2 algorithm to obtain the SM4 target key; the first processing module is used to process the target random number ciphertext information based on the SM4 target key and the second SM2 public key to verify the data interaction process and generate the second server-side random number target ciphertext information; the second sending module is used to send the second server-side random number target ciphertext information to the server to perform anti-tampering verification to complete the handshake process between the client and the server, and determine that the SM4 target key is a session-level symmetric encryption key; the second processing module is used to process the first request information through a preset target interaction strategy, and send the generated session request data ciphertext information to the server to receive the session return ciphertext information from the server and decrypt to determine the session return plaintext information.

[0018] In a fourth aspect, an embodiment of the present application provides a system for a handshake protocol based on an SM2 algorithm and an SM4 algorithm, which is used on a server side, and the system includes: a second receiving module, a second decryption module, a generation module, a third processing module, a third sending module, a third receiving module, a third decryption module, a fourth receiving module, and a decryption sending module; wherein the second receiving module is used to receive a first SM2 public key and a first client random number ciphertext information sent by a client;

[0019] The second decryption module is used to decrypt the first client random number ciphertext information through the first SM2 public key to obtain the second client random number; the generation module is used to obtain the second SM2 public-private key pair from the key library and generate the first server random number, the second SM2 public-private key pair includes the second SM2 public key and the second SM2 private key; the third processing module is used to generate an SM4 target key based on the first SM2 public key, the second SM2 private key, the second client random number and the first server random number, encrypt the SM4 target key based on the first SM2 public key to obtain SM4 ciphertext information, combine the second client random number and the first server random number and encrypt them based on the SM4 target key to obtain the target random number ciphertext information; the third sending module is used to send the SM4 ciphertext information, the second SM2 public key and the target random number ciphertext to the client Information is used for the client to decrypt the SM4 ciphertext information based on the first SM2 private key generated by the SM2 algorithm to obtain the SM4 target key; and based on the SM4 target key and the second SM2 public key, the target random number ciphertext information is processed to verify the data interaction process and generate the second server random number target ciphertext information; the third receiving module is used to receive the second server random number target ciphertext information sent by the client; the third decryption module is used to decrypt the second server random number target ciphertext information based on the second SM2 private key and the SM4 target key to generate a third server random number and verify the data interaction process; the fourth receiving module is used to receive the session request data ciphertext information sent by the client; the decryption and sending module is used to decrypt the session request data ciphertext information, and send the generated session return ciphertext information to the client.

[0020] The present application provides a method and system for a handshake protocol based on the SM2 algorithm and the SM4 algorithm. Compared with the prior art, the present application has the following beneficial effects:

[0021] After the client obtains the first request information for the first time during the session, in order to generate a unique key corresponding to the session, the present application generates and sends the first SM2 public key and the first client random number ciphertext information to the server based on the SM2 algorithm; the server obtains the second client random number by decryption, obtains the second SM2 public-private key pair from the key library and generates the first server random number, obtains and sends the SM4 ciphertext information, the second SM2 public key and the target random number ciphertext information to the client through the SM2 algorithm and encryption processing, the client decrypts the SM4 ciphertext information based on the first SM2 private key generated by the SM2 algorithm to obtain the session-level SM4 target key, and processes the second client random number ciphertext information and the first server random number ciphertext information based on the SM4 target key and the second SM2 public key to verify the data interaction process, performs tamper-proof verification on the client and generates the second server random number target ciphertext information; then sends the second server random number target ciphertext information to the server, and performs tamper-proof verification on the server. This application completes the handshake encryption between the client and the server based on the national secret algorithm of SM2 algorithm and SM4 algorithm, and uses SM2 algorithm and SM4 algorithm to replace the RSA algorithm, ECDHE algorithm and DES algorithm that the SSL protocol relies on, thereby realizing the independent control of data security and information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 It is a flowchart of a method for a handshake protocol based on the SM2 algorithm and the SM4 algorithm provided in an embodiment of the present application;

[0024] Figure 2 It is a flowchart of another method of handshake protocol based on SM2 algorithm and SM4 algorithm provided in an embodiment of the present application;

[0025] Figure 3 This is a schematic diagram of a partial handshake encryption interaction between a client and a server provided in an embodiment of the present application;

[0026] Figure 4 It is a structural diagram of a system of a handshake protocol based on the SM2 algorithm and the SM4 algorithm provided in an embodiment of the present application;

[0027] Figure 5It is a structural diagram of another system of handshake protocol based on SM2 algorithm and SM4 algorithm provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention are clearly and completely described. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0030] The embodiments of the present application provide a method and system for a handshake protocol based on the SM2 algorithm and the SM4 algorithm, thereby solving the problem of insufficient security of data transmission interaction in both HTTP plain text transmission and HTTPS using international encryption algorithms, and achieving autonomous control of data security and information security.

[0031] The technical solution in the embodiment of the present application is to solve the above technical problems, and the overall idea is as follows:

[0032] In data transmission, the first-level domain names of some platforms use the HyperText Transfer Protocol (HTTP). The request body is transmitted in plain text on the network, and data security cannot be effectively guaranteed. It is easy to be eavesdropped and intercepted by middlemen. This may lead to the leakage of sensitive information, such as user login credentials and personal data, which are vulnerable to middleman attacks. Since the data transmitted by HTTP is not encrypted, attackers can insert their own malicious content between the two ends of the communication, change the transmitted data, or conduct phishing attacks, thereby interfering with and destroying the communication and other security issues.

[0033] With the development of cryptography and computer technology, Hypertext Transfer Protocol Secure (HTTPS) can be used to replace the traditional HTTP protocol. The HTTPS protocol is built into the browser. HTTPS is used to compress and decompress data and return the results transmitted over the network. HTTPS uses Secure Sockets Layer (SSL) as a sublayer of the application layer to ensure the privacy of communication.

[0034] However, some sites cannot use universal HTTPS due to limitations and security requirements. Some sites have extremely high security requirements, and their security may not meet the needs even if only one layer of protection is set up based on HTTPS. In related technologies, the current SSL protocol is usually implemented based on the RSA algorithm, ECDHE algorithm and DES algorithm. The HTTPS protocol uses certificates, which are issued by foreign root certification authorities and need to be renewed and maintained regularly. They are inconvenient to use and have great limitations.

[0035] At present, in order to ensure the autonomy and controllability of data security and information security, the national secret algorithm provides a set of domestic encryption standards, aiming to provide encryption services that meet security requirements for various information systems on specific platforms; based on this, in order to meet the confidentiality needs of specific platforms and ensure the autonomy and controllability of data security and information security, it is urgent to study how to use the national secret algorithm to replace the RSA algorithm, ECDHE algorithm and DES algorithm to meet specific encryption needs.

[0036] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0037] The following first introduces a method of a handshake protocol based on the SM2 algorithm and the SM4 algorithm provided in an embodiment of the present application.

[0038] The present invention provides a flowchart of a method for handshake protocol based on SM2 algorithm and SM4 algorithm, please refer to Figure 1 and Figure 3 The method is used for a client and may include the following steps S110-S170.

[0039] S110: Acquire the first request information during the session.

[0040] S120, triggering a preset handshake procedure based on the first request information, sending a session-level first SM2 public key and a first client random number ciphertext information generated based on the SM2 algorithm to the server, so that the server can decrypt the first client random number ciphertext information through the first SM2 public key to obtain a second client random number. It should be noted that each time the aforementioned S110 is triggered, the client will generate a new first SM2 public key based on the SM2 algorithm, and a first SM2 private key corresponding to the first SM2 public key.

[0041] S130, receiving the SM4 ciphertext information, the second SM2 public key and the target random number ciphertext information sent by the server.

[0042] S140. Decrypt the SM4 ciphertext information based on the first SM2 private key generated by the SM2 algorithm to obtain the SM4 target key.

[0043] S150. Based on the SM4 target key and the second SM2 public key, the target random number ciphertext information is processed to verify the data interaction process and generate the second server-side random number target ciphertext information.

[0044] S160, sending the second server random number target ciphertext information to the server to perform tamper-proof verification to complete the handshake process between the client and the server, and determining that the SM4 target key is a session-level symmetric encryption key.

[0045] S170: Process the first request information through a preset target interaction strategy, and send the generated session request data ciphertext information to the server, so as to receive the session return ciphertext information from the server and decrypt and determine the session return plaintext information.

[0046] The present application embodiment also provides a flowchart of another method of handshake protocol based on SM2 algorithm and SM4 algorithm, please refer to Figure 2 and Figure 3 The method is used on the server side and may include the following steps S210-S290.

[0047] S210. Receive the first SM2 public key and the first client random number ciphertext information sent by the client.

[0048] S220. Decrypt the first client random number ciphertext information using the first SM2 public key to obtain a second client random number.

[0049] S230, obtaining a second SM2 public-private key pair from the key library, and generating a first server random number, the second SM2 public-private key pair including a second SM2 public key and a second SM2 private key. It should be noted that the second SM2 public-private key pair can be set to automatically refresh for a longer period of time, and illustratively, the life cycle of the second SM2 public-private key pair can be set to half a year or one year.

[0050] S240. Generate an SM4 target key based on the first SM2 public key, the second SM2 private key, the second client random number and the first server random number, encrypt the SM4 target key based on the first SM2 public key to obtain SM4 ciphertext information, combine the second client random number and the first server random number and encrypt them based on the SM4 target key to obtain the target random number ciphertext information.

[0051] S250, sending SM4 ciphertext information, the second SM2 public key and the target random number ciphertext information to the client, so that the client can decrypt the SM4 ciphertext information based on the first SM2 private key generated by the SM2 algorithm to obtain the SM4 target key; and based on the SM4 target key and the second SM2 public key, process the target random number ciphertext information to verify the data interaction process and generate the second server-side random number target ciphertext information.

[0052] S260, receiving the second server random number target ciphertext information sent by the client.

[0053] S270. Decrypt the second server random number target ciphertext information based on the second SM2 private key and the SM4 target key to generate a third server random number and verify the data interaction process.

[0054] S280: Receive the encrypted session request data information sent by the client.

[0055] S290: Decrypt the session request data ciphertext information, and send the generated session return ciphertext information to the client.

[0056] It can be understood that after the client obtains the first request information, in order to generate a unique key corresponding to the session, the present application generates and sends the first SM2 public key and the first client random number ciphertext information to the server based on the SM2 algorithm; the server obtains the second client random number through decryption, obtains the second SM2 public-private key pair from the key library and generates the first server random number, and obtains and sends the SM4 ciphertext information, the second SM2 public key and the target random number ciphertext information to the client through the SM2 algorithm and encryption processing.

[0057] It should be noted that the client can decrypt the SM4 ciphertext information based on the first SM2 private key generated by the SM2 algorithm to obtain the session-level SM4 target key, and based on the SM4 target key and the second SM2 public key, process the second client random number ciphertext information and the first server random number ciphertext information to verify the data interaction process, perform anti-tampering verification on the client and generate the second server random number target ciphertext information.

[0058] It should be emphasized that all encrypted data interactions between the client and the server are transmitted in hexadecimal. After the client triggers the preset handshake procedure based on the first request information, the first SM2 public-private key pair at the session level is generated based on the SM2 algorithm. The first SM2 public-private key pair includes a first SM2 public key and a first SM2 private key.

[0059] Furthermore, the present application sends the second server random number target ciphertext information determined on the client to the server, decrypts the second server random number target ciphertext information to generate a third server random number, and performs anti-tampering verification on the server by verifying the value of the third server random number. When the third server random number passes the anti-tampering verification, data transmission interaction is performed between the client and the server based on the SM4 target key.

[0060] The above is a specific implementation method of the handshake protocol method based on the SM2 algorithm and the SM4 algorithm provided in the embodiment of the present application. The present application completes the handshake encryption between the client and the server based on the national secret algorithm of SM2 and SM4, and uses the SM2 algorithm and the SM4 algorithm to replace the RSA algorithm, ECDHE algorithm and DES algorithm that the SSL protocol depends on, thereby realizing autonomous control of data security and information security, and being able to meet the security encryption needs of specific platforms.

[0061] It should also be emphasized that the handshake protocol method based on the SM2 algorithm and the SM4 algorithm provided by this application is not simply for HTTPS requests. In the case that some sites cannot use general HTTPS due to limitations and security requirements, this application adopts a quasi-HTTPS handshake process, using the SM2 and SM4 national encryption algorithms, which can support the transmission security of the site based on HTTP, and the URL of the site still maintains HTTP; in addition, for some sites that use HTTPS and have extremely high security requirements, this application can add another layer of handshake process based on the national encryption algorithm on the basis of HTTPS to provide double protection. The steps of multiple handshakes to exchange keys and encrypted transmission based on the national encryption algorithm in this application can provide more secure transmission protection for the site. Based on this, this application can provide secure transmission support to sites that can only use HTTP, and can also provide additional double encrypted transmission protection for HTTPS sites.

[0062] In some embodiments, please refer to Figure 3 , the aforementioned triggering of a preset handshake procedure based on the first request information, sending a session-level first SM2 public key and a first client random number ciphertext information generated based on the SM2 algorithm to the server, that is, the aforementioned S120 may specifically include the following steps:

[0063] S121. Generate a first SM2 public-private key pair and a first client random number based on the SM2 algorithm, the first SM2 public-private key pair including a first SM2 public key and a first SM2 private key, and the first client random number is used for tamper prevention. It should be noted that the first SM2 public-private key pair and the first client random number can be updated in real time based on the session request.

[0064] S122. Encrypt the first client random number using the first SM2 private key to obtain ciphertext information of the first client random number.

[0065] S123. Send the first SM2 public key and the first client random number ciphertext information to the server.

[0066] In an embodiment of the present application, after the client obtains the first request information, a preset handshake program will be triggered, and the handshake program is implemented based on the SM2 algorithm and the SM4 algorithm; during the handshake process, the client first generates a first SM2 public key, a first SM2 private key and a first client random number based on the SM2 algorithm; the first client random number is encrypted by the first SM2 private key to obtain the first client random number ciphertext information.

[0067] It can be understood that the first client random number ciphertext information is encrypted by the first SM2 private key, and accordingly, the first client random number ciphertext information can be decrypted based on the first SM2 public key. Based on this, after the first SM2 public key and the first client random number ciphertext information are sent to the server, the first client random number ciphertext information can be decrypted on the server.

[0068] In some embodiments, the aforementioned generates an SM4 target key based on the first SM2 public key, the second SM2 private key, the second client random number and the first server random number, encrypts the SM4 target key based on the first SM2 public key to obtain SM4 ciphertext information, combines the second client random number and the first server random number and encrypts them based on the SM4 target key to obtain the target random number ciphertext information, that is, the aforementioned S240 may specifically include the following steps:

[0069] S241. Based on the first SM2 public key, the second SM2 private key, the second client random number and the first server random number, an SM4 target key is negotiated through the SM2 algorithm.

[0070] S242. Encrypt the SM4 target key using the first SM2 public key and perform hexadecimal processing to obtain SM4 ciphertext information.

[0071] S243. Combine the second client random number and the first server random number to obtain random number combination information.

[0072] S244. Encrypt the random number combination information using the SM4 target key to obtain the target random number ciphertext information.

[0073] It can be understood that after receiving the first SM2 public key and the first client random number ciphertext information sent by the client, the server first obtains the second client random number by decryption; and obtains the second SM2 public key and the second SM2 private key from the key library to generate the first server random number.

[0074] In an embodiment of the present application, after obtaining the first SM2 public key, the second SM2 private key, the second client random number and the first server random number, the first SM2 public key, the second SM2 private key, the second client random number and the first server random number can be used as parameters based on the SM2 algorithm to negotiate an SM4 target key; after obtaining the SM4 target key, in order to perform further interactive verification between the server and the client based on the SM4 target key, the present application encrypts the SM4 target key through the first SM2 public key to obtain SM4 ciphertext information.

[0075] It can be understood that the SM4 ciphertext information is encrypted by the first SM2 public key, and accordingly, the SM4 ciphertext information can be decrypted by the first SM2 private key of the client. In addition, to avoid plain text transmission, the present application combines the second client random number and the first server random number to obtain random number combination information, and encrypts it by the SM4 target key.

[0076] It should be noted that after the client decrypts the SM4 ciphertext information to obtain the SM4 target key, the SM4 target key can be used to decrypt and split the encrypted target random number ciphertext information.

[0077] In some embodiments, the target random number ciphertext information is processed based on the SM4 target key and the second SM2 public key to verify the data interaction process and generate the second server random number target ciphertext information, that is, the aforementioned S150 may specifically include the following steps:

[0078] S151. Decrypt and split the target random number ciphertext information using the SM4 target key to obtain a third client random number and a second server random number.

[0079] S152: Compare the first client random number and the third client random number.

[0080] S153. When the random number of the first client is consistent with the random number of the third client, the random number of the second server is encrypted by using the SM4 target key to obtain the intermediate ciphertext information of the random number of the second server.

[0081] S154. Encrypt the second server random number intermediate ciphertext information based on the second SM2 public key to obtain the second server random number target ciphertext information.

[0082] In some embodiments, the aforementioned decryption of the second server random number target ciphertext information based on the second SM2 private key and the SM4 target key to generate a third server random number and verify the data interaction process, that is, the aforementioned S270 may specifically include the following steps:

[0083] S271. Decrypt the random number target ciphertext information of the second server using the second SM2 private key to obtain the random number intermediate ciphertext information of the third server.

[0084] S272. Decrypt the intermediate ciphertext information of the third server random number using the SM4 target key to obtain the third server random number.

[0085] S273. Compare the third server random number with the first server random number.

[0086] S274. When the third server random number is consistent with the first server random number, determine that the handshake process between the client and the server is completed, and determine that the SM4 target key is a session-level symmetric encryption key.

[0087] It is understandable that, if the data interaction process has not been maliciously tampered with, the third client random number should be consistent with the first client random number initially generated by the client; based on this, by comparing the first client random number and the third client random number, the security of the information interaction between the client and the server can be determined.

[0088] Furthermore, after security verification is performed based on the client, in order to ensure the accuracy of the verification, the present application encrypts the second server random number intermediate ciphertext information based on the second SM2 public key, obtains and sends the second server random number target ciphertext information to the server. It can be understood that the server stores the second SM2 private key and the SM4 target key. The second server random number target ciphertext information is decrypted twice in a row by the second SM2 private key and the SM4 target key to obtain the third server random number. In the ideal case where the data interaction process has not been maliciously tampered with, the third server random number and the first server random number should be consistent. Based on this, the security of the information interaction between the client and the server can be further determined by comparing the third server random number and the first server random number. When the third server random number is consistent with the first server random number, it can be determined that the handshake process between the client and the server has been completed, and the aforementioned negotiated SM4 target key is used as the session-level symmetric encryption key for encryption.

[0089] In some embodiments, the aforementioned handshake protocol method based on SM2 algorithm and SM4 algorithm further includes: receiving second request information following the first request information during the session; wherein the target interaction strategy processes the first request information and the second request information in the same manner.

[0090] In some embodiments, the first request information is processed by a preset target interaction strategy, and the generated session request data ciphertext information is sent to the server, so as to receive the session return ciphertext information from the server and decrypt and determine the session return plaintext information, that is, the aforementioned S170 may specifically include the following steps:

[0091] S171. Encrypt the first request information based on the symmetric encryption key to obtain ciphertext information of session request data.

[0092] S172. Send the encrypted session request data to the server.

[0093] S173. Receive the session return ciphertext information sent by the server, and decrypt the session return ciphertext information using the symmetric encryption key to obtain the session return plaintext information.

[0094] In some embodiments, the aforementioned decrypting of the session request data ciphertext information and sending the generated session return ciphertext information to the client, that is, the aforementioned S290 may specifically include the following steps:

[0095] S291. Decrypt the ciphertext information of the session request data based on the symmetric encryption key to obtain first request information.

[0096] S292: Generate session return data information based on the request content of the first request information.

[0097] S293. Encrypt the session return data information using a symmetric encryption key to obtain session return ciphertext information.

[0098] S294. Send the session return ciphertext information to the client.

[0099] In the embodiment of the present application, it can be understood that after determining that the SM4 key is a session-level symmetric encryption key, the symmetric encryption key is used to encrypt and decrypt information interactions between the client and the server. To avoid plain text transmission, the present application encrypts the first request information based on the aforementioned symmetric encryption key, obtains and sends the session request data ciphertext information to the server.

[0100] After the server receives the ciphertext information of the session request data, since the server also stores the aforementioned symmetric encryption key, the server decrypts the ciphertext information of the session request data using the symmetric encryption key to obtain the first request information; then, the server generates corresponding session return data information according to the plaintext data information in the first request information, encrypts it based on the aforementioned symmetric encryption key, and sends the session return ciphertext information to the client; after the client decrypts the session return ciphertext information using the symmetric encryption key, it obtains the session return plaintext information to complete the information interaction.

[0101] In some embodiments, the present application also provides a system 300 for a handshake protocol based on the SM2 algorithm and the SM4 algorithm, such as Figure 4 As shown, the system 300 is used for a client and may include the following modules:

[0102] The acquisition module 310 is used to acquire the first request information during the session.

[0103] The first sending module 320 is used to trigger a preset handshake procedure based on the first request information, and send the first SM2 public key and the first client random number ciphertext information of the session level generated based on the SM2 algorithm to the server, so that the server can decrypt the first client random number ciphertext information through the first SM2 public key to obtain the second client random number.

[0104] The first receiving module 330 is used to receive the SM4 ciphertext information, the second SM2 public key and the target random number ciphertext information sent by the server.

[0105] The first decryption module 340 is used to decrypt the SM4 ciphertext information based on the first SM2 private key generated by the SM2 algorithm to obtain the SM4 target key.

[0106] The first processing module 350 is used to process the target random number ciphertext information based on the SM4 target key and the second SM2 public key to verify the data interaction process and generate the second server-side random number target ciphertext information.

[0107] The second sending module 360 ​​is used to send the second server random number target ciphertext information to the server to perform anti-tampering verification to complete the handshake process between the client and the server, and determine that the SM4 target key is a session-level symmetric encryption key.

[0108] The second processing module 370 is used to process the first request information through a preset target interaction strategy, send the generated session request data ciphertext information to the server, receive the session return ciphertext information from the server and decrypt to determine the session return plaintext information.

[0109] According to an embodiment of the present application, any multiple modules among the acquisition module 310, the first sending module 320, the first receiving module 330, the first decryption module 340, the first processing module 350, the second sending module 360 ​​and the second processing module 370 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module.

[0110] In some embodiments, the first sending module 320 may be specifically used for:

[0111] Generate a first SM2 public-private key pair and a first client random number based on the SM2 algorithm, the first SM2 public-private key pair including a first SM2 public key and a first SM2 private key, and the first client random number is used for tamper prevention;

[0112] Encrypt the first client random number by using the first SM2 private key to obtain the first client random number ciphertext information;

[0113] The first SM2 public key and the first client random number ciphertext information are sent to the server.

[0114] In some embodiments, the first processing module 350 may be specifically used for:

[0115] Decrypt and split the target random number ciphertext information through the SM4 target key to obtain the third client random number and the second server random number;

[0116] Comparing the first client random number with the third client random number;

[0117] When the random number of the first client is consistent with the random number of the third client, the random number of the second server is encrypted by the SM4 target key to obtain the intermediate ciphertext information of the random number of the second server;

[0118] The second server random number intermediate ciphertext information is encrypted based on the second SM2 public key to obtain the second server random number target ciphertext information.

[0119] In some embodiments, the second processing module 370 may be specifically used for:

[0120] Encrypt the first request information based on the symmetric encryption key to obtain session request data ciphertext information;

[0121] Send the encrypted session request data to the server;

[0122] Receive the session return ciphertext information sent by the server, and decrypt the session return ciphertext information using the symmetric encryption key to obtain the session return plaintext information.

[0123] Figure 4 Each module in the system shown has the functions of implementing S110-S170 in the aforementioned method of handshake protocol based on SM2 algorithm and SM4 algorithm, and can achieve its corresponding technical effects, which will not be repeated here for the sake of concise description.

[0124] In some embodiments, the present application also provides a system 400 for a handshake protocol based on the SM2 algorithm and the SM4 algorithm, such as Figure 5 As shown, the system 400 is used at the server side and may include the following modules:

[0125] The second receiving module 410 is used to receive the first SM2 public key and the first client random number ciphertext information sent by the client.

[0126] The second decryption module 420 is used to decrypt the first client random number ciphertext information by using the first SM2 public key to obtain a second client random number.

[0127] The generation module 430 is used to obtain the second SM2 public-private key pair from the key library and generate a first server random number. The second SM2 public-private key pair includes a second SM2 public key and a second SM2 private key.

[0128] The third processing module 440 is used to generate an SM4 target key based on the first SM2 public key, the second SM2 private key, the second client random number and the first server random number, encrypt the SM4 target key based on the first SM2 public key to obtain SM4 ciphertext information, combine the second client random number and the first server random number and encrypt them based on the SM4 target key to obtain the target random number ciphertext information.

[0129] The third sending module 450 is used to send SM4 ciphertext information, the second SM2 public key and the target random number ciphertext information to the client, so that the client can decrypt the SM4 ciphertext information based on the first SM2 private key generated by the SM2 algorithm to obtain the SM4 target key; and based on the SM4 target key and the second SM2 public key, process the target random number ciphertext information to verify the data interaction process and generate the second server-side random number target ciphertext information.

[0130] The third receiving module 460 is used to receive the second server random number target ciphertext information sent by the client.

[0131] The third decryption module 470 is used to decrypt the second server random number target ciphertext information based on the second SM2 private key and the SM4 target key to generate a third server random number and verify the data interaction process.

[0132] The fourth receiving module 480 is used to receive the encrypted session request data information sent by the client.

[0133] The decryption and sending module 490 is used to decrypt the session request data ciphertext information and send the generated session return ciphertext information to the client.

[0134] According to an embodiment of the present application, any multiple modules among the second receiving module 410, the second decryption module 420, the generating module 430, the third processing module 440, the third sending module 450, the third receiving module 460, the third decryption module 470, the fourth receiving module 480 and the decryption sending module 490 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module.

[0135] In some embodiments, the third processing module 440 may be specifically used for:

[0136] Based on the first SM2 public key, the second SM2 private key, the second client random number and the first server random number, an SM4 target key is negotiated through the SM2 algorithm;

[0137] The SM4 target key is encrypted by the first SM2 public key and processed in hexadecimal to obtain SM4 ciphertext information;

[0138] Combining the second client random number with the first server random number to obtain random number combination information;

[0139] The random number combination information is encrypted using the SM4 target key to obtain the target random number ciphertext information.

[0140] In some embodiments, the third decryption module 470 may be specifically used for:

[0141] Decrypt the random number target ciphertext information of the second server by using the second SM2 private key to obtain the random number intermediate ciphertext information of the third server;

[0142] Decrypt the random number intermediate ciphertext information of the third server by using the SM4 target key to obtain the random number of the third server;

[0143] Compare the third server random number with the first server random number;

[0144] When the third server random number is consistent with the first server random number, it is determined that the handshake process between the client and the server is completed, and the SM4 target key is determined to be a session-level symmetric encryption key.

[0145] In some embodiments, the aforementioned decryption and sending module 490 may be specifically used for:

[0146] Decrypting the ciphertext information of the session request data based on the symmetric encryption key to obtain the first request information;

[0147] Generate session return data information based on the request content of the first request information;

[0148] Encrypt the session return data information using a symmetric encryption key to obtain the session return ciphertext information;

[0149] Send the session return ciphertext information to the client.

[0150] Figure 5 Each module in the system shown has the functions of implementing S210-S290 in the aforementioned method of handshake protocol based on SM2 algorithm and SM4 algorithm, and can achieve its corresponding technical effects, which will not be repeated here for the sake of concise description.

[0151] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0152] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0153] In summary, compared with the prior art, this application has the following beneficial effects:

[0154] 1. The handshake protocol method based on the SM2 algorithm and the SM4 algorithm provided by this application is not simply for HTTPS requests. In the case that some sites cannot use the general HTTPS due to limitations and security requirements, this application adopts a quasi-HTTPS handshake process, using the SM2 and SM4 national encryption algorithms, which can support the transmission security of the site based on HTTP; for some sites that use HTTPS and have extremely high security requirements, this application can add another layer of handshake process based on the national encryption algorithm on the basis of HTTPS to provide double protection. This application can provide secure transmission support for sites that can only use HTTP, and can also provide additional double encryption transmission protection for HTTPS sites.

[0155] 2. This application introduces the national secret algorithm, which replaces the traditional RSA algorithm, ECDHE algorithm and DES algorithm that the SSL protocol relies on. The national secret algorithm based on SM2 algorithm and SM4 completes the handshake encryption between the client and the server, realizes the autonomous control of data security and information security, and has higher security and the ability to resist quantum computing attacks.

[0156] 3. The first SM2 public-private key pair and the first client random number can be updated in real time based on the session request to ensure that each session has a unique key, thereby reducing the risk of the key being cracked. This application implements session-level keys and flexible encryption usage scenarios. It not only considers traditional key exchange methods, but also introduces an innovative key management mechanism at the session level. Each session has a unique key, which improves the security of the system.

[0157] 4. This application adopts SM2 algorithm, SM4 algorithm and key management mechanism to ensure the security of data during transmission and storage. Considering the generation, distribution, storage and update links, all ciphertext data interactions between the client and the server are transmitted in hexadecimal to ensure the security of the entire system; this series of measures not only meets the mandatory testing and certification requirements for commercial encryption, but also meets the higher standards of password security and encryption algorithm security for specific platforms.

[0158] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method of handshake protocol based on SM2 algorithm and SM4 algorithm, characterized in that: For a client, the method comprises: Get the first request information during the session; triggering a preset handshake procedure based on the first request information, and sending a first SM2 public key at a session level generated based on the SM2 algorithm and a first client random number ciphertext information to the server, so that the server decrypts the first client random number ciphertext information by using the first SM2 public key to obtain a second client random number; Receive the SM4 ciphertext information, the second SM2 public key and the target random number ciphertext information sent by the server; Decrypt the SM4 ciphertext information based on the first SM2 private key generated by the SM2 algorithm to obtain the SM4 target key; Based on the SM4 target key and the second SM2 public key, the target random number ciphertext information is processed to verify the data interaction process and generate the second server random number target ciphertext information; Sending the second server random number target ciphertext information to the server to perform tamper-proof verification to complete the handshake process between the client and the server, and determining that the SM4 target key is a session-level symmetric encryption key; Processing the first request information through a preset target interaction strategy, sending the generated session request data ciphertext information to the server, so as to receive the session return ciphertext information from the server and decrypt and determine the session return plaintext information; The processing of the target random number ciphertext information based on the SM4 target key and the second SM2 public key to verify the data interaction process and generate the second server random number target ciphertext information includes: Decrypt and split the target random number ciphertext information by using the SM4 target key to obtain a third client random number and a second server random number; Comparing the first client random number with the third client random number; When the first client random number is consistent with the third client random number, encrypt the second server random number by using the SM4 target key to obtain the second server random number intermediate ciphertext information; The second server random number intermediate ciphertext information is encrypted based on the second SM2 public key to obtain the second server random number target ciphertext information.

2. The method of handshake protocol based on SM2 algorithm and SM4 algorithm as claimed in claim 1, characterized in that: The triggering of a preset handshake procedure based on the first request information, sending a first SM2 public key and a first client random number ciphertext information of a session level generated based on the SM2 algorithm to the server, includes: Generate a first SM2 public-private key pair and a first client random number based on the SM2 algorithm, wherein the first SM2 public-private key pair includes a first SM2 public key and a first SM2 private key, and the first client random number is used for tamper prevention; Encrypt the first client random number by using the first SM2 private key to obtain the first client random number ciphertext information; The first SM2 public key and the first client random number ciphertext information are sent to the server.

3. The method of handshake protocol based on SM2 algorithm and SM4 algorithm as claimed in claim 1, characterized in that: Also includes: receiving a second request message subsequent to the first request message during a conversation; wherein the target interaction strategy processes the first request message and the second request message in the same manner; The step of processing the first request information by using a preset target interaction strategy, sending the generated session request data ciphertext information to the server, receiving the session return ciphertext information from the server and decrypting and determining the session return plaintext information, includes: Encrypting the first request information based on the symmetric encryption key to obtain session request data ciphertext information; Sending the encrypted session request data to the server; The session return ciphertext information sent by the service end is received, and the session return ciphertext information is decrypted by using the symmetric encryption key to obtain the session return plaintext information.

4. A method of handshake protocol based on SM2 algorithm and SM4 algorithm, characterized in that: For the server, the method includes: Receive the first SM2 public key and the first client random number ciphertext information sent by the client; Decrypt the first client random number ciphertext information by using the first SM2 public key to obtain a second client random number; Obtain a second SM2 public-private key pair from the key library, and generate a first server random number, wherein the second SM2 public-private key pair includes a second SM2 public key and a second SM2 private key; Generate an SM4 target key based on the first SM2 public key, the second SM2 private key, the second client random number and the first server random number, encrypt the SM4 target key based on the first SM2 public key to obtain SM4 ciphertext information, combine the second client random number and the first server random number and encrypt them based on the SM4 target key to obtain target random number ciphertext information; Send the SM4 ciphertext information, the second SM2 public key and the target random number ciphertext information to the client, so that the client can decrypt the SM4 ciphertext information based on the first SM2 private key generated by the SM2 algorithm to obtain the SM4 target key; and process the target random number ciphertext information based on the SM4 target key and the second SM2 public key to verify the data interaction process and generate the second server random number target ciphertext information; Receive the second server random number target ciphertext information sent by the client; Decrypting the second server random number target ciphertext information based on the second SM2 private key and the SM4 target key to generate a third server random number and verify the data interaction process; Receive the encrypted session request data information sent by the client; The session request data ciphertext information is decrypted, and the generated session return ciphertext information is sent to the client.

5. The method of handshake protocol based on SM2 algorithm and SM4 algorithm as claimed in claim 4, characterized in that: The method of generating an SM4 target key based on the first SM2 public key, the second SM2 private key, the second client random number, and the first server random number, encrypting the SM4 target key based on the first SM2 public key to obtain SM4 ciphertext information, combining the second client random number and the first server random number and encrypting them based on the SM4 target key to obtain target random number ciphertext information includes: Based on the first SM2 public key, the second SM2 private key, the second client random number and the first server random number, negotiate an SM4 target key through the SM2 algorithm; The SM4 target key is encrypted by the first SM2 public key and processed in hexadecimal to obtain SM4 ciphertext information; Combining the second client random number and the first server random number to obtain random number combination information; The random number combination information is encrypted using the SM4 target key to obtain the target random number ciphertext information.

6. The method of handshake protocol based on SM2 algorithm and SM4 algorithm as claimed in claim 4, characterized in that: The decrypting the second server random number target ciphertext information based on the second SM2 private key and the SM4 target key to generate a third server random number and verify the data interaction process includes: Decrypt the second server random number target ciphertext information by using the second SM2 private key to obtain the third server random number intermediate ciphertext information; Decrypt the random number intermediate ciphertext information of the third server by using the SM4 target key to obtain a third server random number; Comparing the third server random number with the first server random number; When the third server random number is consistent with the first server random number, it is determined that the handshake process between the client and the server is completed, and the SM4 target key is determined to be a session-level symmetric encryption key.

7. The method of handshake protocol based on SM2 algorithm and SM4 algorithm as claimed in claim 6, characterized in that: The decrypting the session request data ciphertext information and sending the generated session return ciphertext information to the client includes: Decrypting the ciphertext information of the session request data based on the symmetric encryption key to obtain first request information; Generate session return data information based on the request content of the first request information; Encrypt the session return data information by using the symmetric encryption key to obtain session return ciphertext information; The session return ciphertext information is sent to the client.

8. A system of handshake protocol based on SM2 algorithm and SM4 algorithm, characterized in that: For a client, the system comprises: An acquisition module, used to acquire the first request information during the session; A first sending module, used to trigger a preset handshake procedure based on the first request information, and send a first SM2 public key and a first client random number ciphertext information of a session level generated based on the SM2 algorithm to the server, so that the server decrypts the first client random number ciphertext information by the first SM2 public key to obtain a second client random number; The first receiving module is used to receive the SM4 ciphertext information, the second SM2 public key and the target random number ciphertext information sent by the server; A first decryption module, used to decrypt the SM4 ciphertext information based on a first SM2 private key generated by an SM2 algorithm to obtain an SM4 target key; A first processing module, configured to process the target random number ciphertext information based on the SM4 target key and the second SM2 public key to verify the data interaction process and generate the second server random number target ciphertext information; A second sending module, used to send the second server random number target ciphertext information to the server to perform tamper-proof verification to complete the handshake process between the client and the server, and determine that the SM4 target key is a session-level symmetric encryption key; A second processing module is used to process the first request information through a preset target interaction strategy, send the generated session request data ciphertext information to the server, receive the session return ciphertext information from the server and decrypt to determine the session return plaintext information; The processing of the target random number ciphertext information based on the SM4 target key and the second SM2 public key to verify the data interaction process and generate the second server random number target ciphertext information includes: Decrypt and split the target random number ciphertext information by using the SM4 target key to obtain a third client random number and a second server random number; Comparing the first client random number with the third client random number; When the first client random number is consistent with the third client random number, encrypt the second server random number by using the SM4 target key to obtain the second server random number intermediate ciphertext information; The second server random number intermediate ciphertext information is encrypted based on the second SM2 public key to obtain the second server random number target ciphertext information.

9. A system of handshake protocol based on SM2 algorithm and SM4 algorithm, characterized in that: For the server, the system includes: A second receiving module is used to receive the first SM2 public key and the first client random number ciphertext information sent by the client; A second decryption module, configured to decrypt the first client random number ciphertext information by using the first SM2 public key to obtain a second client random number; A generation module, used to obtain a second SM2 public-private key pair from a key library and generate a first server random number, wherein the second SM2 public-private key pair includes a second SM2 public key and a second SM2 private key; A third processing module is used to generate an SM4 target key based on the first SM2 public key, the second SM2 private key, the second client random number and the first server random number, encrypt the SM4 target key based on the first SM2 public key to obtain SM4 ciphertext information, combine the second client random number and the first server random number and encrypt them based on the SM4 target key to obtain target random number ciphertext information; A third sending module is used to send the SM4 ciphertext information, the second SM2 public key and the target random number ciphertext information to the client, so that the client can decrypt the SM4 ciphertext information based on the first SM2 private key generated by the SM2 algorithm to obtain the SM4 target key; and based on the SM4 target key and the second SM2 public key, process the target random number ciphertext information to verify the data interaction process and generate the second server random number target ciphertext information; The third receiving module is used to receive the second server random number target ciphertext information sent by the client; A third decryption module, used to decrypt the second server random number target ciphertext information based on the second SM2 private key and the SM4 target key to generate a third server random number and verify the data interaction process; The fourth receiving module is used to receive the encrypted session request data information sent by the client; The decryption and sending module is used to decrypt the session request data ciphertext information and send the generated session return ciphertext information to the client.

Images