A method and system for encryption and decryption based on a national secret hybrid algorithm

Abstract

The application provides a kind of encryption and decryption method and system based on national secret hybrid algorithm, first end carries out signing calculation to the data to be encrypted, obtains first message signature;Through symmetric encryption algorithm, symmetric encryption calculation is carried out to the data to be encrypted, and first ciphertext is obtained;Through asymmetric encryption algorithm, asymmetric encryption calculation is carried out to the first message signature, and second ciphertext is obtained;And initiate access request to second end, second end receives the request parameter sent by first end, carries out decryption calculation to second ciphertext through asymmetric encryption algorithm, and obtains first message signature;Through symmetric encryption algorithm, decryption calculation is carried out to first ciphertext, and the data to be encrypted is obtained;When first message signature is complete, process the data to be encrypted, obtain return data;And return data ciphertext is sent to first end, solve the problem that data transmission is vulnerable to attack and tampering, increase data security.

Description

Technical Field

[0001] This application relates to the field of cryptography, and in particular to an encryption and decryption method and system based on a hybrid Chinese national cryptographic algorithm. Background Technology

[0002] The basic process of data encryption is to process the original plaintext file or data according to a certain algorithm, making it an unreadable piece of code called ciphertext. The content can only be displayed after the corresponding key is entered. In this way, the purpose of protecting the data from being stolen or read by unauthorized persons is achieved. The reverse process is decryption, which is the process of converting the encoded information back into its original data.

[0003] Due to data security requirements, as an interface provider connecting to third-party systems, we need to ensure the confidentiality and integrity of data transmission. This necessitates defining a more secure and reliable interface encryption and decryption rule and implementation. In the field of cryptography, commonly used traditional international standard encryption algorithms are favored in many scenarios due to their long history and relatively mature algorithms. While Chinese national cryptographic algorithms (CNMA) are relatively new and have a smaller user base, they are more secure and reliable in network information transmission and storage. Existing technical solutions generally utilize traditional international standard encryption algorithms. Although this approach is secure and reliable, it cannot guarantee the security of its source code, leaving it vulnerable to deliberate external attacks, infiltration, and tampering. Summary of the Invention

[0004] This application provides an encryption and decryption method and system based on a hybrid national cryptographic algorithm to solve the problem that data is easily penetrated and tampered with by external malicious attacks in the prior art.

[0005] In a first aspect, embodiments of this application provide an encryption / decryption method based on a hybrid national cryptographic algorithm. This method is applied to a first end of an encryption / decryption system, which further includes a second end communicatively connected to the first end. The method then includes:

[0006] The first message signature is obtained by using a message digest algorithm to sign the data to be encrypted. The first message signature is used to verify the integrity of the data to be encrypted.

[0007] The first ciphertext is obtained by performing symmetric encryption calculations on the data to be encrypted using a symmetric encryption algorithm.

[0008] The first message signature is encrypted using an asymmetric encryption algorithm to obtain the second ciphertext.

[0009] Based on the preset splicing rules, the first ciphertext and the second ciphertext are spliced ​​together to obtain the third ciphertext;

[0010] The request parameters are obtained from the third ciphertext, and an access request is sent to the second end so that the request parameters can be sent to the second end.

[0011] In one possible design, after obtaining the first message signature by performing a signature calculation on the data to be encrypted using a message digest algorithm, the method further includes:

[0012] The signature of the first message is hashed to obtain a string;

[0013] The generator generates a first key and a second key based on the string. The first key is used to encrypt the data to be encrypted to obtain the first ciphertext; the second key is used to decrypt the first ciphertext.

[0014] In one possible design, a symmetric encryption algorithm is used to perform symmetric encryption calculations on the data to be encrypted, resulting in the first ciphertext, which includes:

[0015] The data to be encrypted is split into multiple data blocks of fixed size;

[0016] Each data block is encrypted using the first key to obtain the encryption result for each data block.

[0017] Based on the multiple encryption results, the first ciphertext is obtained.

[0018] In one possible design, the first message signature is subjected to asymmetric encryption computation using an asymmetric encryption algorithm to obtain the second ciphertext, which includes:

[0019] A private key and a corresponding public key are generated using an asymmetric encryption algorithm.

[0020] The second ciphertext is obtained by encrypting the first message signature using the private key.

[0021] In one possible design, the request parameters are obtained from the third ciphertext, including:

[0022] Encapsulate the second key, the public key, and the third ciphertext to obtain a ciphertext container;

[0023] The request parameters are obtained from the encrypted container.

[0024] Secondly, embodiments of this application provide an encryption / decryption method based on a hybrid national cryptographic algorithm. This method is applied to a second end of an encryption / decryption system, which also includes a first end communicatively connected to the second end. The method then includes:

[0025] Receive the request parameters sent by the first end, and decapsulate and restore the request parameters to obtain a ciphertext container; wherein, the ciphertext container includes a third ciphertext;

[0026] By using preset splicing rules, the third ciphertext is decomposed to obtain the first and second ciphertexts;

[0027] The first message signature is obtained by decrypting the second ciphertext using an asymmetric encryption algorithm.

[0028] The first ciphertext is decrypted using a symmetric encryption algorithm to obtain the data to be encrypted.

[0029] Verify the integrity of the first message signature; if the first message signature is complete, process the data to be encrypted and obtain the returned data;

[0030] The returned data is encrypted using a preset encryption algorithm to generate ciphertext, which is then sent to the first end.

[0031] In one possible design, the ciphertext container also includes a public key;

[0032] The first message signature is obtained by decrypting the second ciphertext using an asymmetric encryption algorithm, including:

[0033] The first message signature is obtained by decrypting the second ciphertext using an asymmetric encryption algorithm based on the public key.

[0034] In one possible design, the ciphertext container also includes a second key;

[0035] The first ciphertext is decrypted using a symmetric encryption algorithm to obtain the data to be encrypted, including:

[0036] Using a symmetric encryption algorithm, the first ciphertext is decrypted based on the second key to obtain the data to be encrypted.

[0037] In one possible design, the returned data is encrypted using a preset encryption algorithm to generate ciphertext, which is then sent to the first end, including:

[0038] The returned data is signed using a preset encryption algorithm to obtain a second message signature.

[0039] The returned data is encrypted using a second encryption algorithm to obtain the ciphertext of the returned data.

[0040] Respond to the access request and send the encrypted return data to the first end.

[0041] Thirdly, embodiments of this application provide an encryption / decryption system based on a hybrid national cryptographic algorithm, the system comprising: a first terminal and a second terminal.

[0042] The first end is used to implement an encryption / decryption method based on a national cryptographic hybrid algorithm, as described in any of the first aspects, and the second end is used to implement an encryption / decryption method based on a national cryptographic hybrid algorithm, as described in any of the second aspects.

[0043] Fourthly, embodiments of this application provide an encryption device based on a hybrid national cryptographic algorithm, the device comprising:

[0044] The signature calculation module is used to perform signature calculation on the data to be encrypted using a message digest algorithm to obtain a first message signature, wherein the first message signature is used to verify the integrity of the data to be encrypted;

[0045] The symmetric encryption calculation module is used to perform symmetric encryption calculations on the data to be encrypted using a symmetric encryption algorithm to obtain the first ciphertext.

[0046] The asymmetric encryption calculation module is used to perform asymmetric encryption calculation on the first message signature using an asymmetric encryption algorithm to obtain the second ciphertext.

[0047] The first splicing module is used to splice the first ciphertext and the second ciphertext to obtain the third ciphertext based on preset splicing rules;

[0048] The access module is used to obtain the request parameters based on the third ciphertext and initiate an access request to the second end so that the request parameters can be sent to the second end.

[0049] Fifthly, embodiments of this application provide a decryption device based on a hybrid national cryptographic algorithm, the decryption device comprising:

[0050] The receiving module is used to receive the request parameters sent by the first end, and decapsulate and restore the request parameters to obtain a ciphertext container; wherein, the ciphertext container includes a third ciphertext;

[0051] The second splicing module is used to decompose the third ciphertext according to preset splicing rules to obtain the first ciphertext and the second ciphertext.

[0052] The first decryption module is used to decrypt the second ciphertext using an asymmetric encryption algorithm to obtain the first message signature;

[0053] The second decryption calculation module is used to decrypt the first ciphertext using a symmetric encryption algorithm to obtain the data to be encrypted.

[0054] The verification module is used to verify the integrity of the first message signature; when the first message signature is complete, it processes the data to be encrypted and obtains the returned data.

[0055] The return module is used to encrypt the returned data using a preset encryption algorithm, generate ciphertext of the returned data, and send the ciphertext of the returned data to the first end.

[0056] Sixthly, embodiments of this application provide an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0057] The memory stores the instructions that the computer executes;

[0058] When the processor executes computer execution instructions stored in memory, it implements an encryption / decryption method based on a hybrid national cryptographic algorithm for either the first or second aspect.

[0059] In a seventh aspect, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions. When executed by a processor, the computer-executable instructions are used to implement an encryption / decryption method based on a hybrid national cryptographic algorithm, as described in the first or second aspect.

[0060] Eighthly, embodiments of this application provide a computer program product, including a computer program, which, when executed by a processor, is used to implement an encryption / decryption method based on a hybrid national cryptographic algorithm, as described in the first or second aspect.

[0061] This application provides an encryption and decryption method and system based on a hybrid national cryptographic algorithm. The first end performs a message digest algorithm to sign the data to be encrypted, obtaining a first message signature, which is used to verify the integrity of the data to be encrypted. A symmetric encryption algorithm is then used to perform symmetric encryption calculations on the data to be encrypted, obtaining a first ciphertext. An asymmetric encryption algorithm is then used to perform asymmetric encryption calculations on the first message signature, obtaining a second ciphertext. Based on a preset concatenation rule, the first and second ciphertexts are concatenated to obtain a third ciphertext. Request parameters are obtained from the third ciphertext, and an access request is initiated to the second end to send the request parameters to the second end. The first end receives request parameters sent by the second end and decapsulates and restores the request parameters to obtain a ciphertext container. The ciphertext container includes a third ciphertext. The third ciphertext is decomposed according to preset concatenation rules to obtain a first ciphertext and a second ciphertext. The second ciphertext is decrypted using an asymmetric encryption algorithm to obtain a first message signature. The first ciphertext is then decrypted using a symmetric encryption algorithm to obtain the data to be encrypted. The integrity of the first message signature is verified. When the first message signature is complete, the data to be encrypted is processed to obtain return data. The return data is then encrypted using a preset encryption algorithm to generate ciphertext for the return data, which is then sent to the first end. This achieves the following technical effects: It enhances data security through a hybrid encryption method combining symmetric and asymmetric encryption. Using a symmetric encryption algorithm for the data to be encrypted requires less data capacity, processes data quickly, and reduces the performance requirements of the first-end device. The asymmetric encryption algorithm is more complex, making it easier to process message signatures with smaller data volumes, thus improving data and transmission security. The nested encryption method hides the private and public keys used for decryption, further enhancing data security. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0063] Figure 1 This is a schematic diagram of an encryption / decryption system based on a hybrid national cryptographic algorithm provided in an embodiment of this application;

[0064] Figure 2 A flowchart illustrating an encryption / decryption method based on a hybrid national cryptographic algorithm provided in this application embodiment. Figure 1 ;

[0065] Figure 3 A flowchart illustrating an encryption / decryption method based on a hybrid national cryptographic algorithm provided in this application embodiment. Figure 2 ;

[0066] Figure 4 A flowchart illustrating an encryption / decryption method based on a hybrid national cryptographic algorithm provided in this application embodiment. Figure 3 ;

[0067] Figure 5 A flowchart illustrating an encryption / decryption method based on a hybrid national cryptographic algorithm provided in this application embodiment. Figure 4 ;

[0068] Figure 6 An electronic device provided in an embodiment of this application.

[0069] Figure label:

[0070] 110 - First terminal; 120 - Second terminal; 130 - Base station;

[0071] 610 - Processor; 620 - Memory; 630 - Communication components; 640 - Bus. Detailed Implementation

[0072] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0073] In the embodiments of this application, the terms "first" and "second" are used to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that "first" and "second" do not necessarily imply difference. It should be noted that in the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner. In the embodiments of this application, "at least one" refers to one or more, and "more than one" refers to two or more.

[0074] It should be noted that the phrase "at...time" in the embodiments of this application can refer to the instant at which a certain situation occurs, or to a period of time after the occurrence of a certain situation; the embodiments of this application do not specifically limit this. Furthermore, the multiprotocol label switching message transmission method provided in the embodiments of this application is merely an example, and the multiprotocol label switching message transmission method may include more or less content.

[0075] To facilitate a clear description of the technical solutions in the embodiments of this application, some terms and technologies involved in the embodiments of this application will be briefly introduced below:

[0076] Symmetric encryption: The same key can be used for both encryption and decryption of information. This encryption method is called symmetric encryption, also known as single-key encryption.

[0077] Asymmetric encryption: Asymmetric encryption algorithms require two keys for encryption and decryption. One of these keys is a public key that can be freely distributed, and the other is a private key that can only be held by the person who created it.

[0078] Message digest algorithm: a function that compresses a message of arbitrary length to a fixed length.

[0079] To clearly understand the technical solution of this application, the solutions of the prior art will be described in detail first.

[0080] The National Cryptographic Algorithm System (NCAS) is a set of cryptographic algorithm standards formulated by the State Cryptography Administration. Its creation stems from a high level of attention and profound understanding of information security. In the process of network information transmission and storage, the confidentiality, integrity, and availability of data are crucial security requirements. While traditional international standard encryption algorithms are secure and reliable, the security of their source code cannot be guaranteed, leaving them vulnerable to infiltration or tampering by deliberate external attackers. To address this issue, a National Cryptographic Algorithm System with independent intellectual property rights was developed.

[0081] Figure 1 This is a schematic diagram of an encryption / decryption system based on a hybrid national cryptographic algorithm provided in this application embodiment. This application embodiment is mainly used in scenarios where a first end 110 and a second end 120 interact. The first end 110 initiates an access request and sends request parameters to the second end 120. The first end 110 and the second end 120 can be connected via a wired connection or transmit data through a base station 130. Data is easily penetrated or tampered with by external attackers during transmission. To avoid this, the request parameters are encrypted before the first end 110 sends them. A symmetric encryption algorithm is used to symmetrically encrypt the data to be encrypted, and an asymmetric encryption algorithm is used to asymmetricly encrypt the message signature of the data to be encrypted. The overall system employs a hybrid nested encryption method to improve the security of data and keys during transmission. Conversely, after the second end 120 receives the access request sent by the first end 110, the generated return data can also be encrypted using the same method to ensure the security of data transmission.

[0082] Figure 2 A flowchart illustrating an encryption / decryption method based on a hybrid national cryptographic algorithm provided in this application embodiment. Figure 1 .like Figure 2 As shown, the encryption / decryption method based on a hybrid national cryptographic algorithm provided in this embodiment of the invention includes the following steps:

[0083] S201. The first message signature is obtained by performing a signature calculation on the data to be encrypted using a message digest algorithm.

[0084] Specifically, the data to be encrypted is processed using a message digest algorithm, which calls the corresponding function for calculation. This function is located in the cryptographic algorithm library. A fixed-length function value is generated from the data to be encrypted. The first message signature is used to verify the integrity of the data to be encrypted. The data to be encrypted can be either text data or binary data.

[0085] The data to be encrypted is input into a hash algorithm to generate a fixed-length hash value. This hash value is a digest of the data, representing the "fingerprint" of the data. The digest value is the message signature.

[0086] S202. Perform symmetric encryption calculations on the data to be encrypted using a symmetric encryption algorithm to obtain the first ciphertext.

[0087] Specifically, the encryption library is imported to generate a pair of fixed-length symmetric encryption keys. These keys must be kept secret and only the sender and receiver of the encrypted data know them. The length and complexity of the keys directly affect the security of the encryption. The grouped data to be encrypted is then encrypted using the keys and converted into a hexadecimal string. This hexadecimal string is the encrypted ciphertext. Finally, the hexadecimal string can be encoded for easy storage and transmission.

[0088] S203. Perform asymmetric encryption calculation on the first message signature using an asymmetric encryption algorithm to obtain the second ciphertext.

[0089] Specifically, first, an asymmetric encryption algorithm is used to generate a key pair, including a public key and a private key. The public key can be shared publicly, while the private key must be kept secret.

[0090] The encrypted data is processed using a message digest algorithm to generate a fixed-length digest value. The first message signature is then encrypted using a private key, which involves hashing the message signature and then encrypting the hash value to obtain the second ciphertext.

[0091] S204. Based on the preset splicing rules, splice the first ciphertext and the second ciphertext to obtain the third ciphertext.

[0092] Specifically, the first ciphertext is the ciphertext obtained by encrypting the data to be encrypted using a symmetric encryption algorithm, and the second ciphertext is the ciphertext obtained by encrypting the message signature using an asymmetric encryption algorithm.

[0093] In this embodiment, a byte array is used to calculate the number of bytes occupied by the first ciphertext and the number of bytes occupied by the second ciphertext.

[0094] A new byte array is created to assemble the first and second ciphertexts together, with their respective length information added in front of them to facilitate proper segmentation and processing during decryption. The new byte array is then transmitted as the third ciphertext.

[0095] S205. Obtain the request parameters based on the third ciphertext and send an access request to the second end.

[0096] Specifically, you first need to know the concatenation rules and encryption algorithm of the third ciphertext. If it's symmetric encryption, you need to obtain the symmetric key; if it's asymmetric encryption, you need the corresponding private or public key. For symmetric encryption, the key may be stored in a local configuration file, key management system, etc. Ensuring the secure storage and correct acquisition of the key is crucial for decryption.

[0097] The third ciphertext, the symmetric encryption key, and the asymmetric encryption public key are encapsulated together, and the encapsulated data is converted into a data transmission format between the first and second ends as a request parameter.

[0098] This invention discloses an encryption and decryption method based on a hybrid national cryptographic algorithm. The first end performs a message digest algorithm to sign the data to be encrypted, obtaining a first message signature, which is used to verify the integrity of the data to be encrypted. A symmetric encryption algorithm is then used to perform symmetric encryption on the data to be encrypted, obtaining a first ciphertext. An asymmetric encryption algorithm is then used to perform asymmetric encryption on the first message signature, obtaining a second ciphertext. Based on a preset concatenation rule, the first and second ciphertexts are concatenated to obtain a third ciphertext. Request parameters are obtained from the third ciphertext, and an access request is initiated to the second end to send the request parameters. This method achieves the following technical effects: It enhances data security through a hybrid encryption method combining symmetric and asymmetric encryption. The symmetric encryption algorithm for the data to be encrypted requires less data capacity, processes data quickly, and reduces the performance requirements of the first-end device. The asymmetric encryption algorithm, with its higher complexity, facilitates the processing of message signatures with smaller data volumes, thus improving data and transmission security.

[0099] Figure 3 A flowchart illustrating an encryption / decryption method based on a hybrid national cryptographic algorithm provided in this application embodiment. Figure 2 .like Figure 3 As shown, the encryption / decryption method based on a hybrid national cryptographic algorithm provided in this embodiment includes the following steps:

[0100] S301. Receive the request parameters sent by the first end, and decapsulate and restore the request parameters to obtain the ciphertext container.

[0101] Specifically, the ciphertext container includes a third ciphertext;

[0102] The request parameters are obtained by encapsulating the third ciphertext, the symmetric encryption key, and the asymmetric encryption public key according to the data transmission format of the first and second ends. After receiving the request parameters, the second end decapsulates them according to the format requirements to obtain a ciphertext container that stores the aforementioned third ciphertext.

[0103] S302. Using preset splicing rules, decompose the third ciphertext to obtain the first and second ciphertexts.

[0104] Specifically, the first ciphertext is the ciphertext obtained by encrypting the data to be encrypted using a symmetric encryption algorithm, and the second ciphertext is the ciphertext obtained by encrypting the message signature using an asymmetric encryption algorithm.

[0105] In this embodiment of the application, the new byte array is parsed, and during decryption, the number of bytes occupied by the first ciphertext and the number of bytes occupied by the second ciphertext are identified based on their respective length information, and the first ciphertext and the second ciphertext are segmented.

[0106] S303. The second ciphertext is decrypted using an asymmetric encryption algorithm to obtain the first message signature.

[0107] Specifically, the asymmetric encryption algorithm generates a key pair, including a public key and a private key. The private key is used at the first end to encrypt the first message signature, and the public key is transmitted to the second end along with the ciphertext. The second end uses the public key to decrypt the encrypted hash value to obtain the hash value, and then uses the hash value to perform reverse calculation to obtain the first message signature.

[0108] S304. The first ciphertext is decrypted using a symmetric encryption algorithm to obtain the data to be encrypted.

[0109] Specifically, the symmetric encryption algorithm generates a pair of identical 128-bit symmetric keys. One key is used at the first end to perform encryption calculations on the data to be encrypted, while the other key is transmitted to the second end to decrypt the first ciphertext to obtain the data to be encrypted.

[0110] S305. Verify the integrity of the first message signature; if the first message signature is complete, process the data to be encrypted and obtain the returned data.

[0111] Specifically, the first message signature is used to verify the integrity of the data to be encrypted;

[0112] The hash value obtained from decryption is reverse-calculated using a hash function to obtain a fixed-length digest value. A fixed-length digest value is also generated during the encryption process at the first end. The two digest values ​​are compared to see if they are the same. If they are the same, it means that the message signature has not been tampered with during transmission, and the data to be encrypted has also not been tampered with. The transmitted data is complete.

[0113] The second end's request method for reading the data to be encrypted, and the timestamp, etc., are returned based on the first end's access request.

[0114] S306. The returned data is encrypted using a preset encryption algorithm to generate ciphertext of the returned data, and the ciphertext of the returned data is sent to the first end.

[0115] Specifically, the returned data is encrypted using the same hybrid encryption method as the first end in steps S101-S105 to obtain the returned data ciphertext, and the returned data ciphertext is sent to the first end to complete the first end access process.

[0116] This invention discloses an encryption / decryption method based on a hybrid national cryptographic algorithm. The method involves a second end receiving request parameters from a first end and decapsulating and restoring the request parameters to obtain a ciphertext container. The ciphertext container includes a third ciphertext. The third ciphertext is decomposed according to a preset concatenation rule to obtain a first ciphertext and a second ciphertext. The second ciphertext is decrypted using an asymmetric encryption algorithm to obtain a first message signature. The first ciphertext is then decrypted using a symmetric encryption algorithm to obtain data to be encrypted. The integrity of the first message signature is verified. When the first message signature is complete, the data to be encrypted is processed to obtain returned data. The returned data is then encrypted using a preset encryption algorithm to generate ciphertext, which is sent to the first end. This method achieves the following technical effects: It enhances data security through nested encryption, encrypting the data while simultaneously encrypting the decryption key, thus solving the problem of data loss during data transmission leading to data decryption failure.

[0117] Figure 4 A flowchart illustrating an encryption / decryption method based on a hybrid national cryptographic algorithm provided in this application embodiment. Figure 3 .like Figure 4 As shown, the encryption / decryption method based on a hybrid national cryptographic algorithm provided in this embodiment includes the following steps:

[0118] S401. Hash the first message signature to obtain a string.

[0119] Specifically, hashing message signatures to obtain strings is typically done to ensure data integrity and verify the source of the message;

[0120] The first message signature is processed using a hash algorithm to generate a hash value. The hash algorithm usually generates binary data. In order to facilitate storage and transmission, the hash value needs to be converted into a string form in this embodiment of the application.

[0121] S402. Using a generator, generate the first key and the second key based on the string.

[0122] Specifically, the first key is used to encrypt the data to be encrypted, resulting in the first ciphertext; the second key is used to decrypt the first ciphertext, resulting in the data to be encrypted.

[0123] The generator randomly generates a byte sequence, which is used to increase the randomness of the key. The string is iteratively generated to produce a first key and a second key. The first key and the second key can be the same for symmetric encryption algorithms, or they can be different for asymmetric encryption algorithms.

[0124] S403. Divide the data to be encrypted into multiple data blocks of fixed size.

[0125] Specifically, the length of the data to be encrypted must be a multiple of 512 bits. If the length of the data does not meet the requirement, it needs to be padded. First, add a 1 to the end of the data, then add several 0s until the total length of the data, including the 1 and 0s, equals 448 modulo 512. Finally, append the 64-bit representation of the data length to the end of the data. The padded data is then grouped into 512-bit blocks. Each block is then expanded using a message expansion function and iteratively compressed into multiple fixed-size data blocks using a compression function.

[0126] S404. Use the first key to perform encryption calculations on each data block to obtain the encryption result of each data block.

[0127] Specifically, one can optionally encrypt each of the divided data blocks one by one using a key to obtain the encryption result of each data block.

[0128] S405. Based on multiple encryption results, the first ciphertext is obtained.

[0129] Specifically, the encryption result of each data block is not complete. Encrypting the entire data to be encrypted would be computationally expensive due to the large amount of data. Therefore, the multiple encryption results are arranged and combined according to the segmentation order to form the first ciphertext.

[0130] S406. Generate a private key and a corresponding public key using an asymmetric encryption algorithm.

[0131] Specifically, the private key is used to encrypt the message signature to obtain the second ciphertext; the public key is used to decrypt the second ciphertext to obtain the message signature.

[0132] Import the asymmetric encryption package. The generated private key is stored in the secure hardware device or encrypted file at the first end to prevent the private key from being leaked. The generated public key is stored publicly and transmitted to the second end along with the ciphertext.

[0133] S407. The second ciphertext is obtained by encrypting the first message signature based on the private key.

[0134] Specifically, the first message signature is encrypted using the private key, which means hashing the message signature and then encrypting the hash value to obtain the second ciphertext.

[0135] S408: Encapsulate the second key, public key, and third ciphertext to obtain a ciphertext container.

[0136] Specifically, the first and second ciphertexts are obtained through an encryption algorithm. During the encryption process, the encryption algorithm also generates a private key and a public key, which need to be transmitted to the second end along with the ciphertexts. A new ciphertext container is created, and the third ciphertext obtained by assembling the second private key and the public key is encapsulated to obtain the ciphertext container.

[0137] S409. Obtain the request parameters based on the encrypted container.

[0138] Specifically, the request parameters are constructed by converting the third-party ciphertext in the ciphertext container into JSON, XML, or other formats required by the second end, so that the second end can accurately identify the request parameters. A JSON object is an unordered collection of key-value pairs. JSON is a lightweight data interchange format that can be used by various programming languages. An XML document is composed of elements, which consist of a start tag, an end tag, and the content between the tags. XML is a markup language used for storing and transmitting data.

[0139] Using the HTTP first-end library, an access request is initiated to the second end, and the constructed request parameters are sent to the second end. HTTP is an application layer protocol used for distributed, collaborative, and hypermedia information systems. It is the foundation of data communication on the World Wide Web, used to transfer data between the first and second ends.

[0140] This application provides an encryption and decryption method based on a hybrid national cryptographic algorithm. After obtaining a first message signature by performing a message digest algorithm on the data to be encrypted, the message is processed to obtain a key for a symmetric encryption algorithm. The data to be encrypted is then encrypted using the symmetric encryption algorithm based on the key. The message signature is pre-processed before symmetric encryption, which increases the algorithm program and improves security.

[0141] Figure 5 A flowchart illustrating an encryption / decryption method based on a hybrid national cryptographic algorithm provided in this application embodiment. Figure 4 .like Figure 5 As shown, the encryption / decryption method based on a hybrid national cryptographic algorithm provided in this embodiment includes the following steps:

[0142] S501. Using an asymmetric encryption algorithm and based on the public key, the second ciphertext is decrypted to obtain the first message signature.

[0143] Specifically, the second end uses the public key to decrypt the encrypted hash value to obtain the hash value, and then uses the hash value to perform reverse calculation to obtain the first message signature.

[0144] S502. Using a symmetric encryption algorithm and based on the second key, the first ciphertext is decrypted to obtain the data to be encrypted.

[0145] Specifically, the second end receives the second key and decrypts the first ciphertext using a symmetric encryption algorithm to obtain the data to be encrypted.

[0146] S503. The returned data is signed using a preset encryption algorithm to obtain a second message signature.

[0147] Specifically, the returned data is processed using a message digest algorithm, and the corresponding function is called for calculation. This function is located in a cryptographic algorithm library. A fixed-length function value is generated from the returned data, and a second message signature is used to verify the integrity of the returned data.

[0148] S504. The returned data is encrypted using the second encryption algorithm to obtain the ciphertext of the returned data.

[0149] Specifically, the encryption library is imported to generate a pair of 128-bit symmetric encryption algorithm symmetric keys. The returned data after being grouped is encrypted using the key and converted into a hexadecimal string. This hexadecimal string is the encrypted ciphertext. Finally, the hexadecimal string can be encoded for easy storage and transmission.

[0150] S505: Respond to the access request and send the returned encrypted data to the first end.

[0151] Specifically, the second end identifies the data to be encrypted, obtains the data requested by the first end, processes it, generates return data, responds to the first end's access request, and sends the return data back to the first end.

[0152] This application provides an encryption and decryption method based on a hybrid national cryptographic algorithm. By using a nested decryption method, the message signature and key are first decrypted, and then the first ciphertext is decrypted based on the key. This increases the complexity of data encryption. Even if the data is tampered with, the encrypted data will not be incomplete, and only the integrity of the external key and message signature will be affected.

[0153] This application provides an encryption device based on a hybrid national cryptographic algorithm, the device comprising:

[0154] The first signature calculation module is used to perform signature calculation on the data to be encrypted using a message digest algorithm to obtain a first message signature, wherein the first message signature is used to verify the integrity of the data to be encrypted.

[0155] The symmetric encryption calculation module is used to perform symmetric encryption calculations on the data to be encrypted using a symmetric encryption algorithm to obtain the first ciphertext.

[0156] The asymmetric encryption calculation module is used to perform asymmetric encryption calculation on the first message signature using an asymmetric encryption algorithm to obtain the second ciphertext.

[0157] The first splicing module is used to splice the first ciphertext and the second ciphertext to obtain the third ciphertext based on preset splicing rules;

[0158] The access module is used to obtain the request parameters based on the third ciphertext and initiate an access request to the second end so that the request parameters can be sent to the second end.

[0159] In one possible design, after the signature calculation module, it includes:

[0160] The hash module is used to hash the first message signature to obtain a string;

[0161] The generator module is used to generate a first key and a second key from a string. The first key is used to encrypt the data to be encrypted to obtain the first ciphertext; the second key is used to decrypt the first ciphertext.

[0162] In one possible design, the symmetric encryption computation module includes:

[0163] The splitting module is used to split the data to be encrypted into multiple data blocks of a fixed size;

[0164] The first calculation module is used to perform encryption calculations on each data block using the first key to obtain the encryption result of each data block.

[0165] The first generation module is used to obtain the first ciphertext based on multiple encryption results.

[0166] In one possible design, the asymmetric cryptographic computation module includes:

[0167] The algorithm module is used to generate a private key and a corresponding public key using an asymmetric encryption algorithm.

[0168] The second calculation module is used to perform encryption calculations on the first message signature based on the private key to obtain the second ciphertext.

[0169] In one possible design, the access module includes:

[0170] The encapsulation module is used to encapsulate the second key, the public key, and the third ciphertext to obtain a ciphertext container;

[0171] The second generation module is used to obtain the request parameters based on the encrypted container.

[0172] This application provides a decryption device based on a hybrid national cryptographic algorithm, the decryption device comprising:

[0173] The receiving module is used to receive the request parameters sent by the first end, and decapsulate and restore the request parameters to obtain a ciphertext container; wherein, the ciphertext container includes a third ciphertext;

[0174] The second splicing module is used to decompose the third ciphertext according to preset splicing rules to obtain the first ciphertext and the second ciphertext.

[0175] The first decryption module is used to decrypt the second ciphertext using an asymmetric encryption algorithm to obtain the first message signature;

[0176] The second decryption calculation module is used to decrypt the first ciphertext using a symmetric encryption algorithm to obtain the data to be encrypted.

[0177] The verification module is used to verify the integrity of the first message signature; when the first message signature is complete, it processes the data to be encrypted and obtains the returned data.

[0178] The return module is used to encrypt the returned data using a preset encryption algorithm, generate ciphertext of the returned data, and send the ciphertext of the returned data to the first end.

[0179] In one possible design, the ciphertext container also includes a public key;

[0180] The first decryption module includes:

[0181] The third decryption module is used to perform decryption calculations on the second ciphertext using an asymmetric encryption algorithm based on the public key, in order to obtain the first message signature.

[0182] In one possible design, the ciphertext container also includes a second key;

[0183] The second decryption calculation module includes:

[0184] The fourth decryption module is used to perform decryption calculations on the first ciphertext using a symmetric encryption algorithm and based on the second key, to obtain the data to be encrypted.

[0185] In one possible design, the return module includes:

[0186] The second signature calculation module is used to perform signature calculation on the returned data using a preset encryption algorithm to obtain the second message signature;

[0187] The encryption calculation module is used to perform encryption calculations on the returned data using a second encryption algorithm to obtain the ciphertext of the returned data.

[0188] The response module is used to respond to access requests and send encrypted return data to the first end.

[0189] This application also provides an encryption / decryption system based on a hybrid national cryptographic algorithm, wherein both the first and second ends are used to implement an encryption / decryption method based on a hybrid national cryptographic algorithm as described above; for details, please refer to the above description. Figure 1 The details of this embodiment will not be elaborated here.

[0190] Figure 6 An electronic device provided in this application includes at least one processor 610 and a memory 620. The electronic device also includes a communication component 630. The processor 610, memory 620, and communication component 630 are connected via a bus 640.

[0191] In the specific implementation process, at least one processor 610 executes computer execution instructions stored in memory 620, so that at least one processor 610 is used to implement the encryption and decryption method based on the national cryptographic hybrid algorithm of the above embodiment.

[0192] The specific implementation process of processor 610 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0193] In the above embodiments, it should be understood that the processor 610 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0194] The memory 620 may include high-speed RAM memory, and may also include non-volatile memory NVM, such as at least one disk storage.

[0195] Bus 640 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Bus 640 can be divided into address bus, data bus, control bus, etc. For ease of illustration, the bus 640 in the accompanying drawings of this application is not limited to only one bus or one type of bus.

[0196] The above description of the functions implemented by electronic devices and main control devices has introduced the solutions provided by the embodiments of the present invention. It is understood that, in order to implement the above functions, the electronic device or main control device includes hardware structures and / or software modules corresponding to the execution of each function. By combining the units and algorithm steps of the various examples described in the embodiments of the present invention, the embodiments of the present invention can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the technical solutions of the embodiments of the present invention.

[0197] This application also provides a computer-readable storage medium storing computer-executable instructions. When executed by a processor, these instructions are used to implement the encryption / decryption method based on a hybrid national cryptographic algorithm described in the above embodiments. In the specific implementation of the aforementioned multiprotocol tag exchange (MPTA) message transmission method, each module can be implemented as a processor.

[0198] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0199] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an application-specific integrated circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in an electronic device or a host device.

[0200] This application also provides a computer program product, including a computer program, which, when executed by a processor, is used to implement the encryption and decryption method based on the national cryptographic hybrid algorithm described above.

[0201] The computer program is stored in a readable storage medium, and at least one processor can read the computer program from the readable storage medium and execute the computer program to perform the scheme provided in any of the above embodiments.

[0202] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disk, or optical disk.

[0203] The technical solutions of this application have been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it is readily understood by those skilled in the art that the scope of protection of this application is obviously not limited to these specific embodiments. The above embodiments are only used to illustrate the technical solutions of this application and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for encryption and decryption based on a national secret hybrid algorithm, characterized in that, The method is applied to a first end in a cipher system, the cipher system further comprising a second end in communication connection with the first end, and the method comprises: performing signing calculation on the to-be-encrypted data by a message digest algorithm to obtain a first message signature, wherein the first message signature is used to verify the integrity of the to-be-encrypted data; performing hash processing on the first message signature to obtain a string; generating a first secret key and a second secret key from the string by a generator; performing symmetric encryption calculation on the to-be-encrypted data by a symmetric encryption algorithm and using the first secret key to obtain first ciphertext; the second secret key is used to decrypt the first ciphertext; generating a private key and a public key corresponding to the private key by an asymmetric encryption algorithm; performing encryption calculation on the first message signature based on the private key to obtain second ciphertext; combining the first ciphertext and the second ciphertext and information used to identify the lengths of the first ciphertext and the second ciphertext to obtain third ciphertext; packaging the second secret key, the public key and the third ciphertext to obtain ciphertext container; obtaining request parameters according to the ciphertext container, and initiating an access request to the second end to facilitate sending the request parameters to the second end.

2. The method of claim 1, wherein, The method comprises: splitting the to-be-encrypted data into a plurality of data blocks of a fixed size; performing encryption calculation on each data block by the first secret key to obtain an encryption result of each data block; obtaining the first ciphertext according to a plurality of encryption results.

3. A method for encryption and decryption based on a national secret hybrid algorithm, characterized in that, The method is applied to a second end in a cipher system, the cipher system further comprising a first end in communication connection with the second end, and the method comprises: receiving request parameters sent by the first end and restoring the request parameters by unpackaging to obtain ciphertext container; wherein the ciphertext container comprises a second secret key, a public key and third ciphertext; decomposing the third ciphertext according to length information contained in the third ciphertext to obtain first ciphertext and second ciphertext; performing decryption calculation on the second ciphertext according to the public key by an asymmetric encryption algorithm to obtain a first message signature; performing decryption calculation on the first ciphertext according to the second secret key by a symmetric encryption algorithm to obtain to-be-encrypted data; verifying the integrity of the first message signature; when the first message signature is complete, processing the to-be-encrypted data to obtain return data; performing encryption calculation on the return data by a preset encryption algorithm to generate return data ciphertext, and sending the return data ciphertext to the first end; The first ciphertext and the second secret key are generated by the first end, and the specific generation process is: a first message signature is obtained by signing and calculating the data to be encrypted through a message digest algorithm, the first message signature is used to verify the integrity of the data to be encrypted; a string is obtained by performing hash processing on the first message signature; the first secret key and the second secret key are generated by a generator according to the string; and the first ciphertext is obtained by performing symmetric encryption calculation on the data to be encrypted through a symmetric encryption algorithm and by using the first secret key.

4. The method of claim 3, wherein, The encryption calculation on the return data through the preset encryption algorithm, the generation of return data ciphertext, and the sending of the return data ciphertext to the first end include: The signing calculation on the return data through the preset encryption algorithm, the generation of a second message signature, and the encryption calculation on the return data through a second encryption algorithm, the generation of return data ciphertext, and the sending of the return data ciphertext to the first end. The system includes a first end and a second end. The first end is used to implement the encryption and decryption method based on the hybrid national encryption algorithm according to any one of claims 1 to 2, and the second end is used to implement the encryption and decryption method based on the hybrid national encryption algorithm according to any one of claims 3 to 4.

5. A system for encryption and decryption based on a national secret hybrid algorithm, characterized in that, ​ ​

Images