A bidding document encryption and decryption method

Abstract

The present invention provides a bidding document encryption and decryption method, and relates to the technical field of bidding and tendering. The bidding document encryption and decryption method is used to perform encryption and decryption of bidding documents in an electronic bidding and tendering system by using a mobile application APP and a digital certificate CA, including the steps of scanning a first encrypted two-dimensional code, generating an initial encryption key, encrypting and packaging an electronic bidding document, scanning a second encrypted two-dimensional code, generating an initial decryption key, decrypting the electronic and restoring the electronic bidding document. The present invention uses a mobile application APP and a corresponding digital certificate CA to perform encryption and decryption of the electronic bidding document by combining multiple encryption technologies, and the key is not easy to be cracked, so the security is improved; at the same time, the mobile application APP and the corresponding digital certificate CA are both held by the user, and the initial encryption key and the corresponding initial decryption key are dynamically generated, which are not completely controlled by the platform of the electronic bidding and tendering system, and the risk of early decryption is low.

Description

Technical Field

[0001] The present invention relates to the technical field of bidding and tendering, and in particular to a bidding document encryption and decryption method. Background Art

[0002] With the rapid advancement of information technology, electronic processes have been widely adopted, such as in the field of electronic bidding. The "Electronic Bidding Method" stipulates that all bidding documents must be encrypted when submitted and need to be decrypted online when the bid is opened. Therefore, the encryption and decryption technology of bidding documents is a key link to ensure information security in the electronic bidding process.

[0003] However, the existing encryption and decryption technologies still have the following defects:

[0004] (1) Reliance on a single encryption method: Most electronic bidding systems rely on a single encryption method (such as using only the platform's server certificate for encryption and decryption). A single encryption method is easy to crack, and the centralized decryption process lacks necessary supervision, resulting in security loopholes and limiting the flexibility and security of the system.

[0005] (2) Lack of dynamic key management: In existing technologies, key generation and management often lack dynamism. Once the key is leaked, the security of the entire electronic bidding system will be threatened.

[0006] (3) Centralized risk of the decryption process: The decryption process is usually controlled by the platform. This centralized processing method carries the risk of unauthorized access or early decryption. Summary of the invention

[0007] The present invention solves the problems existing in the existing encryption and decryption technologies and provides a bidding document encryption and decryption method. The present invention uses a mobile application APP and a corresponding digital certificate CA to perform encryption and decryption on the electronic bidding document by combining multiple encryption technologies, so that the key is not easy to be cracked and the security is improved; at the same time, the mobile application APP and the corresponding digital certificate CA are both held by the user, and the initial encryption key and the corresponding initial decryption key are dynamically generated, which is not completely controlled by the platform of the electronic bidding system, and the risk of early decryption is low.

[0008] The technical solution adopted by the present invention is:

[0009] A bidding document encryption and decryption method is used to encrypt and decrypt electronic bidding documents in an electronic bidding system using a mobile application APP and a digital certificate CA, comprising the following steps:

[0010] Step S1, after receiving the encryption request from the user, the electronic bidding system generates a first encrypted QR code; the mobile application APP is used to scan the first encrypted QR code, and the CA authentication server of the electronic bidding system performs encryption authorization authentication on the first digital certificate CA bound to the mobile application APP; wherein the message content of the first encrypted QR code includes the unique first coding ID assigned by the CA authentication server when the first digital certificate CA is bound to the mobile application;

[0011] Step S2, after the encryption authentication is passed, an initial encryption key is generated through a physical unclonable function PUF based on the first digital certificate CA;

[0012] Step S3, using an asymmetric encryption algorithm or a symmetric encryption algorithm and using the initial encryption key to encrypt the original electronic bidding document entered into the electronic bidding system;

[0013] Step S4, encapsulating the encrypted electronic bidding document to generate an encrypted electronic bidding document in a special format; the encrypted electronic bidding document in a special format includes a file header, encrypted content and metadata; the file header includes a first coding ID; the first coding ID is used as one of the message contents of the encrypted two-dimensional code generated during decryption;

[0014] Step S5, after receiving the user's decryption request, the electronic bidding system generates a second encrypted QR code; the mobile application APP is used to scan the second encrypted QR code, and the CA authentication server performs decryption authorization authentication; at the same time, the second coding ID unique to the second digital certificate CA assigned by the CA authentication server is obtained from the message content of the second encrypted QR code, and the second coding ID is compared with the first coding ID to confirm whether the second digital certificate CA is the same as the first digital certificate CA;

[0015] Step S6, when the decryption authentication is passed and the second digital certificate CA is the same as the first digital certificate CA, an initial decryption key corresponding to the initial encryption key is generated based on the first digital certificate CA through the corresponding physical unclonable function PUF;

[0016] Step S7, using the corresponding asymmetric encryption algorithm or the symmetric encryption algorithm and using the initial decryption key to decrypt the encrypted electronic bidding document;

[0017] Step S8, integrating the decrypted data to restore the original electronic bidding document.

[0018] Furthermore, when the mobile application APP is enabled in step S1, authorization authentication is first performed;

[0019] When the mobile application APP is enabled in step S6, authorization authentication is performed first.

[0020] In the present invention, when the mobile application APP is enabled, authorization authentication such as digital signature, face recognition, fingerprint recognition, etc. is used to ensure the legitimacy of the mobile application APP.

[0021] Further, the asymmetric encryption algorithm used in step S3 includes an RSA asymmetric encryption algorithm, an ECC asymmetric encryption algorithm or an SM2 asymmetric encryption algorithm;

[0022] The symmetric encryption algorithm used in step S3 includes an AES symmetric encryption algorithm, a DES symmetric encryption algorithm, a 3DES symmetric encryption algorithm, an IDEA symmetric encryption algorithm or an SM4 symmetric encryption algorithm.

[0023] The asymmetric encryption algorithm in the present invention has great difficulty in cracking ciphertext, while the encryption and decryption speed of the symmetric encryption algorithm is very fast, and the specific selection can be made according to actual needs.

[0024] Furthermore, before encapsulating the electronic bidding document in step S4, the encrypted electronic bidding document is first divided, and part of the key information is hidden in a hidden partition defined by the electronic bidding system; wherein the part of the key information includes content involving the commercial secrets of the bidder; the encrypted electronic bidding document in a special format also includes relevant information of the hidden partition;

[0025] Furthermore, after the part of the key information in step S4 is hidden in the hidden partition, the part of the key information is re-encrypted using an independent re-encryption key;

[0026] After the encrypted electronic bidding document is decrypted in step S7, the secondary decryption key corresponding to the secondary encryption key is used to perform secondary decryption on the portion of key information.

[0027] In order to further improve the security of the electronic bidding document in the present invention, some key information is hidden in a hidden partition designated by the electronic bidding system before packaging the electronic bidding document, and an independent secondary encryption key and a corresponding secondary decryption key are further used to perform secondary encryption and secondary decryption on the part of the key information.

[0028] Furthermore, before encrypting the electronic bidding document in step S3, an initial hash value of the electronic bidding document is calculated;

[0029] After the encrypted electronic bidding document is encapsulated in step S4, the encrypted electronic bidding document is identified and an encrypted hash value of the encrypted electronic bidding document is calculated;

[0030] Compare the initial hash value and the encrypted hash value. If they are consistent, it indicates that the file is complete. Otherwise, it is necessary to re-execute step S3 and step S4 or step S2 to step S4.

[0031] Further, after the original electronic bidding document is restored in step S8, a decrypted hash value of the electronic bidding document is calculated;

[0032] Compare the decrypted hash value with the initial hash value. If the two are consistent, it indicates that the file is complete. Otherwise, it is necessary to re-execute the step S7 and the step S8 or the step S6 to the step S8.

[0033] Furthermore, in the process of restoring the original electronic bidding document in step S8, redundant storage technology is used to store multiple copies of important data parts; wherein the important data parts at least include part or all of the data related to the encrypted content;

[0034] When it is detected that a certain copy is damaged or erroneous, it can automatically switch to another intact copy to continue recovery.

[0035] Furthermore, in the step S8, the intermediate process file generated in the process of restoring the original electronic bidding document is synchronously subjected to process hash value calculation, and the process hash value is compared with the initial hash value to verify data accuracy, and the data integrity of the intermediate process file is synchronously checked.

[0036] The electronic bidding document of the present invention calculates the hash value of the corresponding file during the encryption process and the decryption process, which can be specifically performed using algorithms such as the MD5 algorithm and the SHA-256 algorithm. The present invention ensures the accuracy and integrity of the corresponding file by comparing the process hash value, the encrypted hash value, the decrypted hash value with the initial hash value.

[0037] The beneficial effects of the present invention are:

[0038] The present invention designs a bidding document encryption and decryption method, which adopts a mobile application APP and a corresponding digital certificate CA to perform encryption and decryption on the electronic bidding document by combining multiple encryption technologies. The key is not easy to be cracked, and the security is improved. At the same time, the mobile application APP and the corresponding digital certificate CA are both held by the user, and the initial encryption key and the corresponding initial decryption key are dynamically generated, which are not completely controlled by the platform of the electronic bidding system, and the risk of early decryption is low. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 It is a schematic diagram of the flow of the bidding document encryption and decryption method in the embodiment. DETAILED DESCRIPTION

[0041] The embodiments of the invention are described in detail below with reference to the accompanying drawings.

[0042] Example 1

[0043] A bidding document encryption and decryption method, the process is as follows Figure 1 The bidding document encryption and decryption method is used to encrypt and decrypt bidding documents in an electronic bidding system using a mobile application APP and a digital certificate CA, and includes the following steps:

[0044] Step S1, when enabling the mobile application APP, first use a digital signature (i.e., a digital password) to perform authorization authentication. If the digital signature is correct, the mobile application APP is enabled normally; otherwise, the mobile application APP returns a prompt message of "input error". After receiving the user's encryption request, the electronic bidding system generates a first encrypted QR code; the mobile application APP is used to scan the first encrypted QR code, and the CA authentication server of the electronic bidding system performs encryption authorization authentication on the first digital certificate CA bound to the mobile application APP. Among them, the message content of the first encrypted QR code includes the unique first coding ID assigned by the CA authentication server when the first digital certificate CA is bound to the mobile application.

[0045] Step S2: after the encryption authentication is passed, an initial encryption key is generated based on the first digital certificate CA through a physically unclonable function PUF.

[0046] Step S3, adopting the AES symmetric encryption algorithm and using the initial encryption key to encrypt the original electronic bidding document entered into the electronic bidding system.

[0047] Step S4, the electronic bidding document is divided after encryption, and part of the key information is hidden in the hidden partition defined by the electronic bidding system, and then the part of the key information hidden in the hidden partition is re-encrypted using an independent secondary encryption key; the encrypted electronic bidding document is encapsulated to generate an encrypted electronic bidding document in a special format; the encrypted electronic bidding document in a special format includes a file header, encrypted content, metadata and related information of the hidden partition; the file header includes a first coding ID; the first coding ID is used as one of the message contents of the encrypted QR code generated during decryption. The part of the key information includes content involving the bidder's commercial secrets, such as bidding technical solutions, bidding cost accounting details, and documents proving the bidder's qualifications and reputation. The relevant information of the hidden partition includes storage paths, etc.

[0048] Among them, before encrypting the electronic bidding document in step S3, the initial hash value of the electronic bidding document is calculated first; after encapsulating the encrypted electronic bidding document in step S4, the encrypted electronic bidding document is identified and the encrypted hash value of the encrypted electronic bidding document is calculated; the initial hash value and the encrypted hash value are compared, and if the two are consistent, it indicates that the file is complete; otherwise, it is necessary to re-execute steps S2 to S4.

[0049] Step S5, when enabling the mobile application APP, first use a digital signature (i.e., a digital password) to perform authorization authentication. If the digital signature is correct, the mobile application APP is enabled normally; otherwise, the mobile application APP returns a prompt message of "input error". After receiving the user's decryption request, the electronic bidding system generates a second encrypted QR code; the mobile application APP is used to scan the second encrypted QR code, and the CA authentication server performs decryption authorization authentication. The second encoding ID unique to the second digital certificate CA assigned by the CA authentication server is obtained from the message content of the second encrypted QR code, and the second encoding ID is compared with the first encoding ID to confirm whether the second digital certificate CA is the same as the first digital certificate CA.

[0050] Step S6: When the decryption authentication is passed and the second digital certificate CA is the same as the first digital certificate CA, an initial decryption key corresponding to the initial encryption key is generated based on the first digital certificate CA through the corresponding physical unclonable function PUF.

[0051] Step S7: adopt the corresponding AES symmetric encryption algorithm and use the initial decryption key to decrypt the encrypted electronic bidding document.

[0052] Step S8, integrating the decrypted data to restore the original electronic bidding document.

[0053] Among them, after restoring the original electronic bidding document in step S8, the decrypted hash value of the electronic bidding document is calculated; the decrypted hash value is compared with the initial hash value, and if the two are consistent, it indicates that the file is complete; otherwise, it is necessary to re-execute steps S6 to S8.

[0054] In the process of restoring the original electronic bidding document in step S8, redundant storage technology is used to store multiple copies of important data parts; wherein, the important data part includes at least part or all of the data related to the encrypted content; when it is detected that one of the copies is damaged or erroneous, it can automatically switch to other intact copies to continue recovery.

[0055] At the same time, the intermediate process file generated in the process of restoring the original electronic bidding document in step S8 synchronously calculates the process hash value, and the process hash value is compared with the initial hash value to verify the data accuracy, and the data integrity check is synchronously performed on the intermediate process file.

[0056] The bidding document encryption and decryption method in this embodiment uses a mobile application APP and a corresponding digital certificate CA to encrypt and decrypt the electronic bidding documents using a combination of multiple encryption technologies. The key is not easy to be cracked, and the security is improved. At the same time, the mobile application APP and the corresponding digital certificate CA are both held by the user, and the initial encryption key and the corresponding initial decryption key are dynamically generated, which are not completely controlled by the platform of the electronic bidding system, and the risk of early decryption is low.

Claims

1. A bidding document encryption and decryption method, which is used to encrypt and decrypt electronic bidding documents in an electronic bidding system using a mobile application APP and a digital certificate CA, characterized in that: The following steps are involved: Step S1, after receiving the encryption request from the user, the electronic bidding system generates a first encrypted QR code; the mobile application APP is used to scan the first encrypted QR code, and the CA authentication server of the electronic bidding system performs encryption authorization authentication on the first digital certificate CA bound to the mobile application APP; wherein the message content of the first encrypted QR code includes the unique first coding ID assigned by the CA authentication server when the first digital certificate CA is bound to the mobile application; Step S2, after the encryption authentication is passed, an initial encryption key is generated through a physical unclonable function PUF based on the first digital certificate CA; Step S3, using an asymmetric encryption algorithm or a symmetric encryption algorithm and using the initial encryption key to encrypt the original electronic bidding document entered into the electronic bidding system; Step S4, encapsulating the encrypted electronic bidding document to generate an encrypted electronic bidding document in a special format; the encrypted electronic bidding document in a special format includes a file header, encrypted content and metadata; the file header includes a first coding ID; the first coding ID is used as one of the message contents of the encrypted two-dimensional code generated during decryption; Step S5, after receiving the user's decryption request, the electronic bidding system generates a second encrypted QR code; the mobile application APP is used to scan the second encrypted QR code, and the CA authentication server performs decryption authorization authentication; at the same time, the second coding ID unique to the second digital certificate CA assigned by the CA authentication server is obtained from the message content of the second encrypted QR code, and the second coding ID is compared with the first coding ID to confirm whether the second digital certificate CA is the same as the first digital certificate CA; Step S6, when the decryption authentication is passed and the second digital certificate CA is the same as the first digital certificate CA, an initial decryption key corresponding to the initial encryption key is generated based on the first digital certificate CA through the corresponding physical unclonable function PUF; Step S7, using the corresponding asymmetric encryption algorithm or the symmetric encryption algorithm and using the initial decryption key to decrypt the encrypted electronic bidding document; Step S8, integrating the decrypted data to restore the original electronic bidding document.

2. The bidding document encryption and decryption method according to claim 1 is characterized in that: When the mobile application APP is enabled in step S1, authorization authentication is first performed; When the mobile application APP is enabled in step S6, authorization authentication is performed first.

3. The bidding document encryption and decryption method according to claim 1, characterized in that: The asymmetric encryption algorithm used in step S3 includes an RSA asymmetric encryption algorithm, an ECC asymmetric encryption algorithm or an SM2 asymmetric encryption algorithm; The symmetric encryption algorithm used in step S3 includes an AES symmetric encryption algorithm, a DES symmetric encryption algorithm, a 3DES symmetric encryption algorithm, an IDEA symmetric encryption algorithm or an SM4 symmetric encryption algorithm.

4. The bidding document encryption and decryption method according to claim 1, characterized in that: Before encapsulating the electronic bidding document in step S4, the encrypted electronic bidding document is first divided, and some key information is hidden in the hidden partition designated by the electronic bidding system; wherein, the some key information includes content involving the commercial secrets of the bidder; the encrypted electronic bidding document in a special format also includes relevant information of the hidden partition.

5. The bidding document encryption and decryption method according to claim 4 is characterized in that: After the part of the key information in step S4 is hidden in the hidden partition, the part of the key information is re-encrypted using an independent re-encryption key; After the encrypted electronic bidding document is decrypted in step S7, the secondary decryption key corresponding to the secondary encryption key is used to perform secondary decryption on the portion of key information.

6. The bidding document encryption and decryption method according to any one of claims 1 to 5, characterized in that: Before encrypting the electronic bidding document in step S3, first calculate the initial hash value of the electronic bidding document; After the encrypted electronic bidding document is encapsulated in step S4, the encrypted electronic bidding document is identified and an encrypted hash value of the encrypted electronic bidding document is calculated; Comparing the initial hash value with the encrypted hash value, if the two are consistent, it indicates that the file is complete; Otherwise, it is necessary to re-execute the step S3 and the step S4 or the step S2 to the step S4.

7. The bidding document encryption and decryption method according to claim 6, characterized in that: After the original electronic bidding document is restored in step S8, a decrypted hash value of the electronic bidding document is calculated; Comparing the decrypted hash value with the initial hash value, if the two are consistent, it indicates that the file is complete; Otherwise, it is necessary to re-execute the step S7 and the step S8 or the step S6 to the step S8.

8. The bidding document encryption and decryption method according to any one of claims 1 to 5 and 7, characterized in that: In the process of restoring the original electronic bidding document in step S8, redundant storage technology is used to store multiple copies of important data parts; wherein the important data parts at least include part or all of the data related to the encrypted content; When it is detected that a certain copy is damaged or erroneous, it can automatically switch to another intact copy to continue recovery.

9. The bidding document encryption and decryption method according to claim 8, characterized in that: In the step S8, the intermediate process file generated in the process of restoring the original electronic bidding document is synchronously calculated by the process hash value, and the process hash value is compared with the initial hash value to verify the data accuracy, and the data integrity check is synchronously performed on the intermediate process file.

Images