Encryption technology method based on digital signature in data exchange transmission

Abstract

The invention discloses an encryption technology method based on digital signature in data exchange transmission, and relates to the technical field of data encryption. The method comprises the following steps: a client performs digital signature on data to be encrypted by using a private key of the client; encrypting the to-be-encrypted data and the digital signature by using a randomly generated key to obtain ciphertext data; the server unlocks the digital envelope by using the public key of the client to obtain a random key and a sending identifier; decrypting the ciphertext data by using a random key to obtain original encrypted data and a digital signature; the digital signature of the encrypted data is verified with a public key of the client while retaining a copy. According to the invention, digital signature is carried out on the to-be-encrypted data by using the private key, the to-be-encrypted data and the digital signature are encrypted by using the randomly generated key to obtain the ciphertext data, and in the transmission process, the digital envelope and the server end unlock the ciphertext data by using the random key to obtain the original encrypted data and the digital signature, so that the security of data transmission is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of data encryption, and in particular relates to an encryption technology method based on digital signature in data exchange transmission. Background Art

[0002] The so-called digital signature is some data attached to the data unit, or a cryptographic transformation of the data unit. This data or transformation allows the recipient of the data unit to confirm the source and integrity of the data unit and protect the data from being forged by others (such as the recipient). It is a method of signing electronic messages, and a signed message can be transmitted in a communication network. Digital signatures can be obtained based on both public key cryptography and private key cryptography. Currently, digital signatures are mainly based on public key cryptography.

[0003] Digital signature technology is a typical application of asymmetric encryption algorithms. The encryption and decryption application process of digital signature is that the data source sender uses his own private key to encrypt the data checksum or other variables related to the data content to complete the legal "signature" of the data, and the data receiver uses the other party's public key to interpret the received "digital signature" and uses the interpretation result to verify the integrity of the data to confirm the legitimacy of the signature. Digital signature technology is an important technology for confirming identity in the virtual environment of the network system. In the application of digital signature, the sender's public key can be easily obtained, but his private key needs to be kept strictly confidential.

[0004] The following uses the encryption and decryption data interaction process of digital signatures in telecommunications applications as an example to explain the existing digital signature schemes in detail:

[0005] First, a public and private key pair is generated. The public key is sent to the server, and the private key is saved by the user.

[0006] The server uses the public key to directly encrypt the signature information; after receiving the encrypted signature information ciphertext, the user uses the private key to decrypt it and obtain the signature information.

[0007] However, there are many methods to crack the public and private key pairs, which makes the digital signature technology that only uses the public and private keys to protect the original signature information face a very serious security threat. Once the public and private key pairs are obtained by criminals, they can arbitrarily decrypt the original encrypted signature information of the user and obtain the user's transaction information, posing a threat to the user's private information and causing serious security risks.

[0008] Therefore, a technical problem that currently needs to be solved by those skilled in the art is: how to innovatively propose an encryption and decryption mechanism for digital signatures to protect user information security and improve the security of digital signature applications. Summary of the invention

[0009] The purpose of the present invention is to provide an encryption technology method based on digital signature in data exchange transmission, by using its own private key to digitally sign the encrypted data, encrypting the encrypted data and the digital signature with a randomly generated key to obtain ciphertext data, and sealing the digital envelope during transmission. The server uses a random key to decrypt the ciphertext data to obtain the original encrypted data and the digital signature, thereby solving the problem of insufficient security of existing digital signatures and potential security risks in user data transmission.

[0010] In order to solve the above technical problems, the present invention is achieved through the following technical solutions:

[0011] The present invention is an encryption technology method based on digital signature in data exchange transmission, comprising the following steps:

[0012] Step S1: The client performs identity authentication through ID, biometrics, and certificate verification, and logs into the system;

[0013] Step S2: The client uses its own private key SKa to digitally sign the encrypted data;

[0014] Step S3: Encrypt the encrypted data and digital signature using a randomly generated key to obtain ciphertext data;

[0015] Step S4: The open network uses the public key PKb of the server end, and uses the random key, the system time when sending or the sending number sequence number to obtain the digital envelope;

[0016] Step S5: After receiving the digital envelope and ciphertext data transmitted over the open network, the server performs identity authentication on the client;

[0017] Step S6: The server uses the client public key PKa to decrypt the digital envelope and obtain a random key and a sending identifier;

[0018] Step S7: Decrypt the ciphertext data with a random key to obtain the original encrypted data and digital signature;

[0019] Step S8: Verify the digital signature of the encrypted data using the client's public key, while retaining a copy.

[0020] As a preferred technical solution, in step S1, the system login uses multiple identification factors such as hardware ID, biometrics, and certificate verification to perform multiple identity authentication. The user identity is bound to the hardware ID, and the server and client use digital certificates for two-way identity authentication. The user's behavior of accessing resources after logging in is controllable and managed accordingly according to the role. Only legitimate users can log in to the system, effectively protecting the user's rights and interests from any loss or damage.

[0021] As a preferred technical solution, in step S2, when the client generates its own key, randomly select large prime numbers p and q, where p and q are both greater than 3 and p≠q; calculate n=p×q×(p-1)×(q-1), m=p×q, and randomly select an integer r, where r satisfies p>2 r <q; calculated: Select the public key e, where 1<e<a(n), then gcd(e,a(n))=1, and calculate the private key d; where d×e≡1(moda(n));

[0022] The private key is (e,m) and the public key is (d,n).

[0023] As a preferred technical solution, in step S2, when the digital signature is generated, if the length of the plain text characters is large, a hash function needs to be selected to compress the plain text characters and obtain a digest ml before using the signature algorithm; wherein, the client uses the private key to execute the encryption algorithm on the generated information digest to obtain E(ml), which is attached to the data to be transmitted and transmitted to the server through the network; the server uses the public key of the client to decrypt the received signature E(ml) to obtain the information digest ml, and then executes the same HASH function operation on the sent data to obtain a new information digest ml2. The HASH function is a one-way function that is difficult to reverse solve. Different data usually generate different hash values ​​after the hash function operation. As long as the decrypted information digest ml and the newly generated information digest ml2 are compared, if they are consistent, it means that the data has not been tampered with and is authentic and reliable.

[0024] As a preferred technical solution, in step S3, the randomly generated key is encrypted to obtain ciphertext data, the ciphertext data is digitally signed to obtain signature information, and the ciphertext summary is encrypted into document ciphertext through a symmetric encryption algorithm; the message key of the symmetric encryption algorithm is randomly generated by hardware, the message key is encapsulated into a digital envelope using the recipient's public key, and the digital envelope, document ciphertext and signature information are packaged and compressed and transmitted to an open network.

[0025] As a preferred technical solution, in step S5, the server side calls the SM3 algorithm to calculate the hash value of the digital envelope, and calls the smart contract on the open network for concurrent query. If the digital envelope blockchain queries the corresponding hash value and the revocation blockchain does not query the corresponding data, the blockchain is considered to be trusted and returned to the client, and the digital envelope authentication passes the response; if the digital envelope blockchain queries the corresponding hash value and the revocation blockchain also queries the corresponding data, the digital envelope is considered to be trusted and has been revoked, and is returned to the client, and the digital envelope does not pass the response; if the digital envelope blockchain does not query the corresponding hash value and the revocation blockchain does not query the corresponding data, the digital envelope is considered to be untrusted and returned to the client, and the digital envelope authentication does not pass the response.

[0026] As a preferred technical solution, in step S6, after the receiving client logs in legally through hardware ID, biometrics, and certificate verification, the received document is decompressed, the decompressed digital envelope is restored to the message key by receiving the user's private key, the document ciphertext is decrypted into document plaintext using a symmetric encryption algorithm, the digital summary is extracted from the document plaintext, and the decompressed document signature information is restored to the document summary after the signature is verified; if the verification is the same as the extracted document summary, the recipient opens the document and sends a signed receipt at the same time, otherwise it is rejected.

[0027] As a preferred technical solution, the client defines the server's operating rights for the document. The document has attributes such as browsing rights, printing rights, usage time, and usage count. When the server receives the document, it can only operate with the rights defined by the user.

[0028] As a preferred technical solution, the document will track and record the operation records of the document in real time during the entire operation process, and the operation records will be reviewed in real time. After the real-time review is completed, it will be signed and stored, and log audit will be performed.

[0029] The present invention has the following beneficial effects:

[0030] The present invention uses its own private key to digitally sign the encrypted data, uses a randomly generated key to encrypt the encrypted data and the digital signature to obtain ciphertext data, and seals the digital envelope during transmission. The server uses a random key to decrypt the ciphertext data to obtain the original encrypted data and the digital signature, thereby improving the security of data transmission.

[0031] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0033] Figure 1 The present invention is a flow chart of an encryption technology method based on digital signature in data exchange transmission. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0036] In order to make the purpose, technical solution and advantages of this application clearer, the following Figure 1 The implementation methods of the present application are described in further detail.

[0037] Before introducing the embodiments of the present application, a description of digital signatures is first given.

[0038] A digital signature (also known as a public key digital signature) is a string of numbers that can only be generated by the sender of the information and cannot be forged by others. This string of numbers is also an effective proof of the authenticity of the information sent by the sender. It is a method for authenticating digital information, similar to an ordinary physical signature written on paper, but implemented using public key encryption technology. A set of digital signatures usually defines two complementary operations, one for signing and the other for verification. Digital signatures are the application of asymmetric key encryption technology and digital summary technology.

[0039] Simply put, a digital signature is some data attached to a data unit, or a cryptographic transformation of a data unit. This data or transformation allows the recipient of the data unit to confirm the source and integrity of the data unit and protect the data from being forged by someone (such as the recipient). It is a method of signing an electronic message, and a signed message can be transmitted in a communication network. Digital signatures can be obtained based on both public key cryptography and private key cryptography, mainly digital signatures based on public key cryptography. It includes ordinary digital signatures and special digital signatures. Ordinary digital signature algorithms include RSA, ElGamal, Fiat-Shamir, Guillou-Quisquarter, Schnorr, Ong-Schnorr-Shamir digital signature algorithm, Des / DSA, elliptic curve digital signature algorithm and finite automaton digital signature algorithm.

[0040] The specific signing process is as follows:

[0041] When sending a message, the sender uses a hash function to generate a message digest from the message text, and then encrypts the digest with the sender's private key. The encrypted summary will be sent to the receiver together with the message as the digital signature of the message. The receiver first uses the same hash function as the sender to calculate the message digest from the original message received, and then uses the public key to decrypt the digital signature attached to the message. If the two digests are the same, the receiver can confirm that the message is from the sender.

[0042] Digital signatures have two functions: First, they can confirm that the message is indeed signed and sent by the sender, because no one can forge the sender's signature. Second, digital signatures can determine the integrity of the message. Because the characteristic of a digital signature is that it represents the characteristics of a file, if the file changes, the value of the digital summary will also change. Different files will get different digital summaries. A digital signature involves a hash function, the receiver's public key, and the sender's private key.

[0043] In order to make the purpose, technical solutions and advantages of this application more clear, the following Figure 1 It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0044] See also Figure 1 As shown, the present invention is an encryption technology method based on digital signature in data exchange transmission, including.

[0045] As a preferred technical solution, in step S1, the system login uses multiple identification factors such as hardware ID, biometrics, and certificate verification to perform multiple identity authentication. The user identity is bound to the hardware ID, and the server and client use digital certificates for two-way identity authentication. The user's behavior of accessing resources after logging in is controllable and managed accordingly according to the role. Only legitimate users can log in to the system, effectively protecting the user's rights and interests from any loss or damage.

[0046] As a preferred technical solution, in step S2, when the client generates its own key, randomly select large prime numbers p and q, where p and q are both greater than 3 and p≠q; calculate n=p×q×(p-1)×(q-1), m=p×q, and randomly select an integer r, where r satisfies p>2 r <q; calculated: Select the public key e, where 1<e<a(n), then gcd(e,a(n))=1, and calculate the private key d; where d×e≡1(moda(n));

[0047] The private key is (e,m) and the public key is (d,n).

[0048] A digital signature is a data summary generated by an irreversible algorithm and attached to the original data information. The receiver can verify the summary to confirm the integrity and identity of the data. Therefore, in step S2, when the digital signature is generated, when the length of the plain text characters is large, it is necessary to select a hash function to compress it and obtain the summary ml before using the signature algorithm; wherein, the client uses the private key to perform an encryption algorithm on the generated information summary to obtain E(ml) attached to the data to be transmitted, and transmits it to the server through the network; the server uses the client's public key to decrypt the received signature E(ml) to obtain the information summary ml, and then performs the same HASH function operation on the sent data to obtain a new information summary ml2. The HASH function is a one-way function that is difficult to reverse solve. Different data usually generate different hash values ​​after the hash function operation. As long as the decrypted information summary ml and the newly generated information summary ml2 are compared, if they are consistent, it means that the data has not been tampered with and is authentic and reliable.

[0049] In step S3, the randomly generated key is used to encrypt the ciphertext data, the ciphertext data is digitally signed to obtain signature information, and the ciphertext summary is encrypted into document ciphertext through a symmetric encryption algorithm; the message key of the symmetric encryption algorithm is randomly generated by hardware, the message key is encapsulated into a digital envelope using the recipient's public key, and the digital envelope, document ciphertext and signature information are packaged and compressed and transmitted to an open network.

[0050] In step S4, the specific process of generating the digital envelope is as follows:

[0051] Generate a key pair: Generate a public key and a private key using a public key encryption algorithm such as RSA. For example, use the KeyPairGenerator class in Java to generate an RSA key pair.

[0052] Encrypt content: Encrypt sensitive information using a public key. This usually involves using a symmetric encryption algorithm such as AES to generate a random symmetric key, and then encrypting the information with that symmetric key. For example, AES encryption is implemented using the Cipher class in Java.

[0053] Envelope: Envelope the encrypted message with the symmetric key encrypted with the recipient's public key into a digital envelope. This can be done by serializing the encrypted message and the symmetric key and then sending it to the recipient.

[0054] Decryption information: After receiving the digital envelope, the recipient first uses his private key to decrypt the digital envelope and obtain the symmetric key. Then, the symmetric key is used to decrypt the encrypted information to obtain the original information.

[0055] In step S5, the server side calls the SM3 algorithm to calculate the hash value of the digital envelope, and calls the smart contract on the open network for concurrent query. If the digital envelope blockchain queries the corresponding hash value and the revocation blockchain does not query the corresponding data, the blockchain is considered to be trusted and returned to the client, and the digital envelope authentication passes the response; if the digital envelope blockchain queries the corresponding hash value and the revocation blockchain also queries the corresponding data, the digital envelope is considered to be trusted and has been revoked, and is returned to the client, and the digital envelope does not pass the response; if the digital envelope blockchain does not query the corresponding hash value and the revocation blockchain does not query the corresponding data, the digital envelope is considered to be untrusted and returned to the client, and the digital envelope authentication does not pass the response.

[0056] In step S6, after the receiving client has logged in legally through hardware ID, biometrics, and certificate verification, the received document is decompressed, the decompressed digital envelope is restored to the message key through the receiving user's private key, the document ciphertext is decrypted into document plaintext using a symmetric encryption algorithm, the digital summary is extracted from the document plaintext, and the decompressed document signature information is restored to the document summary after the signature is verified; if the verification is the same as the extracted document summary, the recipient opens the document and sends a signed receipt at the same time, otherwise it is rejected.

[0057] The client defines the server's operating authority for the document. The document has attributes such as browsing authority, printing authority, usage time, and number of times used. When the server receives the document, it can only have the authority defined by the operating user. The document will be tracked and recorded in real time during the entire operation process. The operation record will be reviewed in real time. After the real-time review is completed, it will be signed and stored, and log audit will be performed. This ensures the validity and timeliness of the information and lays the foundation for future work. In the process of document production, handwritten signatures, two-dimensional barcode stamping, and electronic signatures can be performed. In addition to digital signatures, electronic signatures also use digital watermark technology to ensure the legality and traceability of the seals of electronic documents and printed paper documents.

[0058] It is worth noting that in the above system embodiment, the various units included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0059] In addition, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiments can be completed by instructing related hardware through a program, and the corresponding program can be stored in a computer-readable storage medium.

[0060] The preferred embodiments of the present invention disclosed above are only used to help illustrate the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. An encryption technology method based on digital signature in data exchange transmission, characterized in that: The steps include: Step S1: The client performs identity authentication through ID, biometrics, and certificate verification, and logs into the system; Step S2: The client uses its own private key SKa to digitally sign the encrypted data; Step S3: Encrypt the encrypted data and digital signature using a randomly generated key to obtain ciphertext data; Step S4: The open network uses the public key PKb of the server end, and uses the random key, the system time when sending or the sending number sequence number to obtain the digital envelope; Step S5: After receiving the digital envelope and ciphertext data transmitted over the open network, the server performs identity authentication on the client; Step S6: The server uses the client public key PKa to decrypt the digital envelope and obtain a random key and a sending identifier; Step S7: Decrypt the ciphertext data with a random key to obtain the original encrypted data and digital signature; Step S8: Verify the digital signature of the encrypted data using the client's public key, while retaining a copy.

2. According to claim 1, a method for encryption technology based on digital signature in data exchange transmission is characterized in that: In step S1, the system login uses multiple identification factors such as hardware ID, biometrics, and certificate verification to perform multiple identity authentication. The user identity is bound to the hardware ID, and the server and client use digital certificates for two-way identity authentication. The user's behavior of accessing resources after logging in is controllable and managed accordingly according to the role.

3. According to claim 1, the encryption technology method based on digital signature in data exchange transmission is characterized in that: In step S2, when the client generates its own key, large prime numbers p and q are randomly selected, where p and q are both greater than 3 and p≠q; n=p×q×(p-1)×(q-1), m=p×q are calculated, and an integer r is randomly selected, where r satisfies p>2 r <q; calculated: Select the public key e, where 1<e<a(n), then gcd(e,a(n))=1, and calculate the private key d; where d×e≡1(moda(n)); The private key is (e,m) and the public key is (d,n).

4. The encryption technology method based on digital signature in data exchange transmission according to claim 1 is characterized in that: In the step S2, when the digital signature is generated, if the length of the plain text characters is large, a hash function needs to be selected to compress it and obtain the digest ml before using the signature algorithm; wherein, the client uses the private key to execute the encryption algorithm on the generated information digest to obtain E(ml), which is attached to the data to be transmitted and transmitted to the server through the network; the server uses the public key of the client to decrypt the received signature E(ml) to obtain the information digest ml, and then executes the same HASH function operation on the sent data to obtain a new information digest ml2.

5. The encryption technology method based on digital signature in data exchange transmission according to claim 1 is characterized in that: In step S3, the randomly generated key is used to encrypt the ciphertext data, the ciphertext data is digitally signed to obtain signature information, and the ciphertext summary is encrypted into document ciphertext through a symmetric encryption algorithm; the message key of the symmetric encryption algorithm is randomly generated by hardware, the message key is encapsulated into a digital envelope using the recipient's public key, and the digital envelope, document ciphertext and signature information are packaged and compressed and transmitted to an open network.

6. The encryption technology method based on digital signature in data exchange transmission according to claim 1 is characterized in that: In step S5, the server side calls the SM3 algorithm to calculate the hash value of the digital envelope, and calls the smart contract on the open network for concurrent query. If the digital envelope blockchain queries the corresponding hash value and the revocation blockchain does not query the corresponding data, the blockchain is considered to be trusted and returned to the client, and the digital envelope authentication passes the response; if the digital envelope blockchain queries the corresponding hash value and the revocation blockchain also queries the corresponding data, the digital envelope is considered to be trusted and has been revoked, and is returned to the client, and the digital envelope does not pass the response; if the digital envelope blockchain does not query the corresponding hash value and the revocation blockchain does not query the corresponding data, the digital envelope is considered to be untrusted and returned to the client, and the digital envelope authentication does not pass the response.

7. The encryption technology method based on digital signature in data exchange transmission according to claim 1 is characterized in that: In step S6, after the receiving client has logged in legally through hardware ID, biometrics, and certificate verification, the received document is decompressed, the decompressed digital envelope is restored to the message key by receiving the user's private key, the document ciphertext is decrypted into document plaintext using a symmetric encryption algorithm, the digital summary is extracted from the document plaintext, and the decompressed document signature information is restored to the document summary after the signature is verified; if the verification is the same as the extracted document summary, the recipient opens the document and sends a signed receipt at the same time, otherwise it is rejected.

8. The encryption technology method based on digital signature in data exchange transmission according to claim 7 is characterized in that: The client defines the server's operating authority for the document. The document has attributes such as browsing authority, printing authority, usage time, and number of uses. When the server receives the document, it can only have the authority defined by the operating user.

9. The encryption technology method based on digital signature in data exchange transmission according to claim 7 is characterized in that: The document will be tracked in real time during the entire operation process to record the document's operation records, and the operation records will be reviewed in real time. After the real-time review is completed, it will be signed and stored, and a log audit will be performed.

Images