Message encryption and decryption method and device based on national secret key, and electronic equipment

Abstract

The invention discloses a message encryption and decryption method and device based on a national secret key and electronic equipment, and relates to the technical field of data security, and the method comprises the following steps: receiving a session identifier SI D encrypted by using an SM2 public key and a starting mark sent by a partner client, carrying out decryption by using an SM2 private key corresponding to the client, obtaining an SM4 secret key according to the starting mark, and sending the SM4 secret key to the partner client; the method comprises the following steps: encrypting an SM4 secret key by using an SM2 public key of a client, sending a secret key encryption packet to the client, receiving a financial service exchange message encrypted by the client by using the SM4 secret key, decrypting the message to obtain financial service original information, and executing service logic based on the financial service original information. And encrypting the response financial service exchange message after service processing by using the SM4 key, and sending the response financial service exchange message to the client, thereby solving the technical problem of low security of message information caused by easy key leakage when exchange message transmission is carried out between a financial institution and a partner by using a national secret algorithm SM4 in the related technology.

Description

Technical Field

[0001] The present invention relates to the field of data security technology or other related fields, and in particular to a message encryption and decryption method and device, and electronic equipment based on a national secret key. Background Art

[0002] With the continuous development of information technology, data security and privacy protection have become key issues in various industries, especially in the fields of finance and institutions that have extremely high security requirements. National secret algorithms have been widely used in recent years, providing solid protection for data encryption with their strong security and compliance. Among them, SM2 and SM4 algorithms have become the mainstream choice for digital signatures, information encryption and decryption due to their respective advantages.

[0003] Currently, when financial institutions communicate with their partners, they usually choose the SM4 algorithm to ensure processing efficiency, but this sacrifices high security. In scenarios with high security requirements, such as the interaction between fund companies and bank account systems, the use of the SM4 algorithm cannot meet the communication needs of both efficiency and security.

[0004] Although the key exchange process of the SM2 algorithm is secure, its encryption and decryption speed is slow and is not suitable for real-time communication and encryption of large messages. Although the SM4 algorithm has fast encryption and decryption speed, its key management is relatively simple. Once the key is obtained by an unauthorized third party, the security of the message information will be seriously threatened.

[0005] Therefore, when financial institutions and their partners interact with highly sensitive information, they face the dual challenge of ensuring the efficiency of data transmission and the security of data content.

[0006] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0007] The embodiments of the present invention provide a method and device for message encryption and decryption based on a national secret key, and an electronic device, so as to at least solve the technical problem in the related technology that when financial institutions and partners use the national secret algorithm SM4 for message transmission, key leakage is prone to occur, resulting in low security of message information.

[0008] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a message encryption and decryption method based on national secret keys is provided, which is applied to the open platform service end of a financial institution, including: receiving a session identifier SID and an activation flag encrypted using an SM2 public key sent by a partner client; decrypting the session identifier SID and the activation flag using the SM2 private key corresponding to the partner client; obtaining an SM4 key according to the activation flag, encrypting the SM4 key using the SM2 public key of the partner client, and sending the key encryption package to the partner client; receiving a financial business transaction message encrypted by the partner client using the SM4 key, decrypting the financial business transaction message using the SM4 key, and parsing to obtain the original financial business information; executing business logic based on the original financial business information, and encrypting the response financial business transaction message after business processing using the SM4 key, and sending it to the partner client.

[0009] Optionally, the step of acquiring the SM4 key according to the enabling flag includes: when the enabling flag indicates no, generating a new SM4 key according to the session identifier SID and the server unique identifier, and storing the client identifier, the session identifier SID and the generated SM4 key in a database; or, when the enabling flag indicates yes, querying the SM4 key corresponding to the session identifier SID from the database, wherein the database stores a set of SM4 keys corresponding to all clients.

[0010] Optionally, the message encryption and decryption method based on the national secret key also includes: when the SM4 key is detected to be leaked, receiving a key update instruction sent by the partner client, wherein the key update instruction includes an instruction to update the SM4 key and a new session identifier SID; regenerating the SM4 key according to the new session identifier SID, and storing it in a database; and using the regenerated SM4 key to perform encryption and decryption operations of financial business transaction messages between the partner client and the partner client.

[0011] Optionally, the message encryption and decryption method based on the national secret key also includes: when the SM2 key is detected to be leaked, re-exchanging the SM2 key pair with the partner client.

[0012] Optionally, the session identifier SID of the message encryption and decryption method based on the national secret key includes: an enable flag, a flag used to indicate whether to enable the database to store the SM4 key; unique identification information of the partner client; and a session timestamp or a random number.

[0013] According to another aspect of an embodiment of the present invention, a message encryption and decryption method based on a national secret key is also provided, which is applied to a partner client, and the partner client pre-establishes a communication connection with the open platform server of any one of the above-mentioned financial institutions, including: generating a session identifier SID and setting an enablement flag; encrypting the session identifier SID and the enablement flag using the SM2 public key of the server, sending the encrypted session identifier SID and the enablement flag to the open platform server, and receiving the SM4 key encrypted using the SM2 public key of the partner client returned by the open platform server; decrypting the SM4 key using the SM2 private key of the partner client, and encrypting the financial business transaction message using the decrypted SM4 key; sending the session identifier SID, the encrypted financial business transaction message and authentication information to the open platform server to complete the financial business processing.

[0014] Optionally, the step of generating a session identifier SID includes: generating a session identifier SID including an enable flag according to a distributed ID generation algorithm negotiated between the partner client and the open platform server, wherein the enable flag is used to indicate whether the open platform server should search for an existing SM4 key from a database or generate a new SM4 key.

[0015] Optionally, the message encryption and decryption method based on the national secret key also includes: after the partner client completes a session with the open platform server, retains the lifecycle control mechanism of the SM4 key, wherein the lifecycle control mechanism includes: controlling the usage status of the SM4 key by updating the enable flag in the session identifier SID, and when the SM4 key is leaked or expired, sending the regenerated session identifier SID to the open platform server to obtain a new SM4 key.

[0016] Optionally, the message encryption and decryption method based on the national secret key also includes: using the reserved SM4 key to decrypt the financial business transaction message returned by the open platform server; and executing the business logic of the original financial business information indicated by the financial business transaction message.

[0017] According to another aspect of an embodiment of the present invention, there is also provided a message encryption and decryption device based on a national secret key, which is applied to an open platform server of a financial institution, and includes: an identifier receiving unit, which is used to receive a session identifier SID and an activation flag encrypted using an SM2 public key and sent by a partner client; an identifier decryption unit, which is used to decrypt using an SM2 private key corresponding to the partner client to obtain the session identifier SID and the activation flag; a key encryption unit, which is used to obtain an SM4 key according to the activation flag, encrypt the SM4 key using the SM2 public key of the partner client, and send the key encryption package to the partner client; an encrypted message receiving unit, which is used to receive a financial business transaction message encrypted by the partner client using the SM4 key, and decrypt the financial business transaction message using the SM4 key to parse and obtain the original financial business information; a business execution unit, which is used to execute business logic based on the original financial business information, and encrypt the response financial business transaction message after business processing using the SM4 key, and send it to the partner client.

[0018] Optionally, the key encryption unit includes: a new key generation module, which is used to generate a new SM4 key according to the session identifier SID and the server unique identifier when the enable flag indicates no, and store the client identifier, the session identifier SID and the generated SM4 key into a database; or, a key query module, which is used to query the SM4 key corresponding to the session identifier SID from the database when the enable flag indicates yes, wherein the database stores the SM4 key set corresponding to all clients.

[0019] Optionally, the message encryption and decryption device based on the national secret key also includes: a key update unit, which is used to receive a key update instruction sent by the partner client when the SM4 key is detected to be leaked, wherein the key update instruction includes an instruction to update the SM4 key and a new session identifier SID; a key regeneration unit, which is used to regenerate the SM4 key according to the new session identifier SID and store it in a database; and a message encryption and decryption unit, which is used to use the regenerated SM4 key to perform encryption and decryption operations on financial business transaction messages between the partner client and the partner client.

[0020] Optionally, the message encryption and decryption device based on the national secret key also includes: a key pair re-interaction unit, which is used to re-interact the SM2 key pair with the partner client when a leakage of the SM2 key is detected.

[0021] Optionally, the session identifier SID includes: an enable flag, a flag used to indicate whether to enable the database to store the SM4 key; unique identification information of the partner client; and a session timestamp or a random number.

[0022] According to another aspect of an embodiment of the present invention, there is also provided a message encryption and decryption device based on a national secret key, which is applied to a partner client, and the partner client pre-establishes a communication connection with the open platform server of any one of the above-mentioned financial institutions, including: an identifier generation unit, used to generate a session identifier SID and set an enablement flag; an identifier encryption unit, used to encrypt the session identifier SID and the enablement flag using the SM2 public key of the server, send the encrypted session identifier SID and the enablement flag to the open platform server, and receive the SM4 key encrypted using the SM2 public key of the partner client returned by the open platform server; a key decryption unit, used to decrypt the SM4 key using the SM2 private key of the partner client, and use the decrypted SM4 key to encrypt financial business transaction messages; an information sending unit, used to send the session identifier SID, the encrypted financial business transaction message and authentication information to the open platform server to complete financial business processing.

[0023] Optionally, the identifier generation unit includes: an identifier generation module, used to generate a session identifier SID including an enable flag bit according to a distributed ID generation algorithm negotiated between the partner client and the open platform server, wherein the enable flag bit is used to indicate whether the open platform server should search for an existing SM4 key from a database or generate a new SM4 key.

[0024] Optionally, the message encryption and decryption device based on the national secret key also includes: a key lifecycle control unit, which is used for the partner client to retain the lifecycle control mechanism of the SM4 key after completing a session with the open platform server, wherein the lifecycle control mechanism includes: controlling the usage status of the SM4 key by updating the enable flag in the session identifier SID, and when the SM4 key is leaked or expired, sending the regenerated session identifier SID to the open platform server to obtain a new SM4 key.

[0025] Optionally, the message encryption and decryption device based on the national secret key also includes: a message decryption module, used to use the retained SM4 key to decrypt the financial business transaction message returned by the open platform server; a financial business execution module, used to execute the business logic of the original financial business information indicated by the financial business transaction message.

[0026] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned message encryption and decryption methods based on national secret keys.

[0027] According to another aspect of an embodiment of the present invention, an electronic device is also provided, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned message encryption and decryption methods based on national secret keys.

[0028] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including a computer program, which, when executed by a processor, implements the steps of any one of the above-mentioned message encryption and decryption methods based on national secret keys.

[0029] In the present disclosure, a session identifier SID and an activation flag encrypted using an SM2 public key and sent by a partner client can be received, decrypted using the SM2 private key corresponding to the partner client to obtain the session identifier SID and the activation flag, an SM4 key can be obtained based on the activation flag, the SM4 key can be encrypted using the SM2 public key of the partner client, and then the key encryption package can be sent to the partner client, financial business transaction messages encrypted using the SM4 key by the partner client are received, the financial business transaction messages are decrypted using the SM4 key, the original financial business information is parsed, the business logic based on the original financial business information is executed, and the response financial business transaction message after business processing is encrypted using the SM4 key and sent to the partner client.

[0030] Based on the above-mentioned public content, the SM2 and SM4 algorithms can be combined to ensure the security of financial business message transmission while ensuring the high efficiency of communication, reducing data delays, improving user experience and system response speed, and achieving fast message encryption and decryption, thereby ensuring the safe and fast transmission of financial transaction information and improving transaction success rate, thereby solving the technical problem in the related technology that financial institutions and partners use the national secret algorithm SM4 for message transmission, which is prone to key leakage and leads to low security of message information. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0032] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a message encryption and decryption method based on a national secret key is shown;

[0033] Figure 2 is a flowchart of an optional message encryption and decryption method based on a national secret key according to an embodiment of the present invention;

[0034] Figure 3 is a flowchart of another optional message encryption and decryption method based on a national secret key according to an embodiment of the present invention;

[0035] Figure 4 It is a schematic diagram of an optional universal encryption and decryption method for messages based on national secret keys according to an embodiment of the present invention;

[0036] Figure 5 is a schematic diagram of an optional message encryption and decryption device based on a national secret key according to an embodiment of the present invention;

[0037] Figure 6 is a schematic diagram of another optional message encryption and decryption device based on a national secret key according to an embodiment of the present invention;

[0038] Figure 7 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0039] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0040] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0041] To facilitate those skilled in the art to understand the present invention, some terms or nouns involved in the embodiments of the present invention are explained below:

[0042] The SM2 algorithm is an asymmetric encryption algorithm based on elliptic curve cryptography. It has high security strength. However, since its operation involves complex mathematical calculations, the encryption and decryption speed is relatively slow.

[0043] The SM4 algorithm is a group symmetric encryption algorithm with high encryption speed and low processing cost. It is suitable for scenarios where large amounts of data are quickly encrypted and decrypted. However, its security depends on the management and protection of keys. Once the keys are leaked, it will directly threaten the security of the data.

[0044] Snowflake algorithm is a distributed ID generation algorithm for generating unique IDs. It is an ID generation algorithm developed by Twitter and can generate globally unique IDs in distributed systems.

[0045] It should be noted that the message encryption and decryption method based on national secret keys and the device thereof disclosed in the present invention can be used in the field of data security technology to encrypt and decrypt financial business information between financial institutions and partners based on data security.

[0046] It should be noted that the information (including but not limited to the key pair information of the partner, the client information of the partner, the user device information, the user's personal information, etc.) and data (including but not limited to the data used for analysis, the data stored, the data displayed, etc.) collected by this disclosure are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and the relevant users or institutions. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or institution through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or institution.

[0047] It should be noted that in the present disclosure, when collecting and analyzing customer information, corresponding operation entrances are provided for users to choose to agree or reject the automated decision results; if the user chooses to reject, the expert decision-making process is entered.

[0048] The following embodiments of the present invention can be applied to various systems / applications / devices for message encryption and decryption based on national secret keys. The present invention provides a complete universal message encryption and decryption method based on the improved national secret algorithm, which can effectively improve the encryption and decryption algorithm speed of the message body, reduce the risk of exchanging keys, and reduce the difficulty of overall application transformation at a security level equivalent to SM2, so as to be suitable for commercial message encryption and decryption scenarios such as financial institutions and various types of partners conducting account system transactions and business transactions.

[0049] The present invention is described in detail below in conjunction with various embodiments.

[0050] Embodiment 1

[0051] According to an embodiment of the present invention, an embodiment of a message encryption and decryption method based on a national secret key is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0052] The message encryption and decryption method embodiment based on the national secret key provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing a message encryption and decryption method based on a national secret key is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more ( Figure 1 , 102a, 102b, ..., 102n are used to illustrate) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU (Microcontroller Unit) or a programmable logic device FPGA (Field Programmable Gate Array)), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a Universal Serial Bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. Those skilled in the art can understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0053] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0054] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the message encryption and decryption method based on the national secret key in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned message encryption and decryption method based on the national secret key is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0055] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0056] The display may be, for example, a touch screen liquid crystal display (LCD), which may enable a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0057] Under the above operating environment, this application provides Figure 2 The message encryption and decryption method based on the national secret key is shown. Figure 2 It is a flowchart of an optional message encryption and decryption method based on a national secret key according to an embodiment of the present invention.

[0058] It should be noted that the message encryption and decryption method based on the national secret key provided in this embodiment is applicable to the following scenarios: 1. The interaction between the partner data system with high security requirements and the bank account system. The bank account system involves a large amount of financial transactions and user privacy data. The security and confidentiality of the data are extremely important, and efficient communication is required between different systems. The embodiment of the present invention combines the SM2 and SM4 algorithms to achieve fast message encryption and decryption while ensuring the security of data transmission to meet real-time or quasi-real-time communication requirements. 2. Data exchange scenario between fund companies and banks: The information interaction between fund companies and banks involves sensitive data such as fund net value, transaction records, and user information. The message encryption and decryption method based on the national secret key provided in the embodiment of the present invention can ensure the security of these data during transmission. At the same time, by using the SM4 algorithm to encrypt large messages, the efficiency of communication is guaranteed, data delay is reduced, and user experience and system response speed are improved. 3. Real-time online transaction scenario: For online transactions that require real-time response, such as securities trading, foreign exchange trading, etc., the message encryption and decryption method based on national secret keys provided in the embodiment of the present invention can provide high-speed encryption and decryption processing, ensure the safe and fast transmission of transaction information, reduce transaction delays, and improve transaction success rate.

[0059] According to one aspect of the present application, a message encryption and decryption method based on a national secret key is provided, which is applied to an open platform server of a financial institution. Figure 2 As shown, the message encryption and decryption method based on the national secret key includes the following steps:

[0060] It should be noted that the partner client in this embodiment may refer to an institution / enterprise / factory, etc. that has a cooperative relationship with a financial institution (eg, a bank, a securities company).

[0061] By using a combination of SM2 and SM4 encryption schemes, partner clients can ensure the confidentiality, integrity and availability of data during transmission, while reducing the complexity of key management and lowering the security risks of the entire system.

[0062] It should be noted that before executing the message encryption and decryption method based on the national secret key, the partner client needs to set up a set of SM2 key pairs with the financial institution's open platform server and exchange SM2 key pairs with each other.

[0063] The partner client first needs to generate a session identifier SID. SID is a unique identifier that can include but is not limited to customer ID, random number, timestamp and other information, used to identify a message interaction session. In addition, the client also needs to set an enable flag, which indicates whether the server should search the database for an existing SM4 key or generate a new SM4 key.

[0064] Step S201: receiving a session identifier SID and an activation flag encrypted using the SM2 public key sent by a partner client.

[0065] At the beginning of the communication, the financial institution's server connects to the clients from various partners and receives an encrypted data packet from the client of the partner. The data packet is encrypted using the server's SM2 public key and contains a session identifier SID and an enable flag. SID is a unique identifier generated by the client to identify this communication session, and the enable flag can be a Boolean value indicating whether the server should use the SM4 key already in the database or generate a new SM4 key.

[0066] Optionally, the session identifier SID of the message encryption and decryption method based on the national secret key includes: an enable flag, a flag used to indicate whether to enable the database to store the SM4 key; unique identification information of the partner client; and a session timestamp or a random number.

[0067] SID is a crucial identifier in the communication process, which is used to identify a session and ensure the accuracy and security of encryption and decryption operations. The composition of SID should ensure its uniqueness and unpredictability. Among them, when the client generates SID, it can consider encoding various information in SID, such as timestamp, client ID, etc., to enhance the uniqueness and security of SID. After receiving SID, the server can perform preliminary verification, such as checking SID format, verifying timestamp, etc., to ensure the integrity and timeliness of data packets. SID contains an enable flag to indicate whether the current session should use the SM4 key already in the database. This is a binary bit. If it is set to "yes", it means that the client wants to continue to use the existing key; if it is set to "no", it indicates that the server should generate a new SM4 key. The ID should also contain the unique identification information of the partner client, such as the client ID, MAC address or hash value of the digital certificate, which helps the server quickly locate the session and key information related to a specific client. In addition, the SID can also add a session timestamp or a random number to help ensure the uniqueness of the SID and prevent session replay attacks. The timestamp can be a time value accurate to milliseconds or finer granularity, while the random number should be generated by a secure random number generator to ensure its unpredictability.

[0068] Step S202: Use the SM2 private key corresponding to the partner client to decrypt and obtain the session identifier SID and the activation flag.

[0069] The decryption operation is the basis of secure communication, ensuring the privacy and integrity of the data. The server uses the corresponding SM2 private key to decrypt the encrypted data packet received in step S201. This process reveals the original values ​​of the SID and the enable flag. The use of the SM2 algorithm ensures that even if the data packet is intercepted during transmission, a third party without the corresponding private key cannot decrypt the message, protecting the confidentiality of the SID and the enable flag. In addition, after decryption, the server can further verify the validity of the SID and the enable flag, such as checking whether the SID has been used and whether the enable flag complies with the preset rules, to prevent potential security threats.

[0070] Step S203, obtaining the SM4 key according to the activation flag, encrypting the SM4 key using the SM2 public key of the partner client, and then sending the key encryption package to the partner client.

[0071] Based on the decrypted activation flag, the server decides whether to use the existing SM4 key or generate a new SM4 key. Then, the SM4 key is encrypted using the client's SM2 public key to form a key encryption package, which is then sent to the client.

[0072] Optionally, the step of obtaining the SM4 key according to the enabling flag includes: when the enabling flag indicates no, generating a new SM4 key according to the session identifier SID and the server unique identifier, and storing the client identifier, the session identifier SID and the generated SM4 key in a database; or, when the enabling flag indicates yes, querying the SM4 key corresponding to the session identifier SID from the database, wherein the database stores a set of SM4 keys corresponding to all clients.

[0073] In this embodiment, the key usage policy is determined by checking the specific information of the enablement flag. When the flag is "no", the server generates an SM4 key through the SID and its own unique identifier. This process can use methods such as random number generation and hash function to ensure the security and uniqueness of the key. For example, when the enablement flag in the SID sent by the client is set to no, it usually means that the client wants to start a new session, or the currently used SM4 key may be insecure or expired. In this case, the server will generate a new SM4 key. Specifically, the server can generate a new SM4 key based on the SID and its own unique identifier (for example, the server UU ID, Universally Unique Identifier) ​​through a secure random number generator and / or a specific key derivation function (KDF). This process ensures that each generated SM4 key is unique, which increases the difficulty for attackers to try to predict or guess the key. The server stores the newly generated SM4 key together with the client's identification information (such as client ID) and SID in the database to form or update the key set related to the session. The server uses the client's SM2 public key to encrypt the newly generated SM4 key to form a key encryption package, which is then sent back to the client for subsequent message encryption and decryption.

[0074] If the enable flag in the SID sent by the client is set to yes, this usually means that the client wants to continue using the SM4 key that has been exchanged previously. The server retrieves the SM4 key associated with the SID from the database to ensure the continuity and consistency of the key. The use of the SM2 public key to encrypt and transmit the SM4 key is based on the security of asymmetric encryption. Even if the encrypted packet is intercepted, a third party without the client's private key cannot decrypt the SM4 key, which protects the key security of the encryption and decryption process. Specifically, the server can query the key set stored in the database based on the parsed S ID to find the SM4 key associated with the SID. The design of the database should support efficient query to avoid affecting the encryption and decryption speed of the message due to long query time. If the SM4 key corresponding to the SID is queried, the server will use this key for subsequent message decryption and encryption and decryption operations without generating a new key again. If the key corresponding to the SID does not exist in the database, the server will also generate a new SM4 key according to the "no" situation, and store and encrypt and send it.

[0075] In addition, when the enable flag is "yes", the server also needs to monitor the status of the SM4 key to ensure its validity. If the key has expired or there is a security risk, the server should actively send a new SID and an enable flag of "no" to the client to trigger the key update.

[0076] Through the above steps, the use and update of SM4 keys can be flexibly controlled to achieve the purpose of maintaining efficient communication while ensuring high security. In the case of "no", new keys are generated to increase the security of the system; in the case of "yes", existing keys are used to improve communication efficiency, reduce unnecessary key generation and exchange, and simplify the implementation costs of the client and server.

[0077] Step S204: receiving the financial business transaction message encrypted by the partner client using the SM4 key, decrypting the financial business transaction message using the SM4 key, and parsing to obtain the original financial business information.

[0078] When the encryption and decryption keys have been determined, the server receives the business message encrypted by the client using the SM4 key. The same SM4 key is used to decrypt the message, extract the original financial business information in the message, and provide basic data for business processing.

[0079] Among them, the decrypted original information may include specific details of various financial service operations, such as transaction amount, account information, transaction time, etc. This information will be used for subsequent business logic processing.

[0080] Step S205, execute the business logic based on the original information of the financial business, and use the SM4 key to encrypt the response financial business transaction message after the business processing, and send it to the partner client.

[0081] The server performs business logic processing based on the decrypted original financial business information, such as account balance check, transaction review, data record update, etc. After processing, the response message is encrypted using the same SM4 key to ensure the security of communication, and then the encrypted message is sent back to the client.

[0082] The execution of business logic is the core function of the server, ensuring the accuracy and compliance of financial services. Using the SM4 key to encrypt the response message can prevent unauthorized third parties from obtaining the server's processing results on the original message, protecting the security of customer information and transaction data. In addition, when encrypting the response message, the server can recheck the validity of the SID to ensure the consistency and security of the session and prevent any possible key attacks or data tampering.

[0083] Through the above steps, the session identifier SID and the activation flag encrypted by the SM2 public key sent by the partner client can be received, and the session identifier SID and the activation flag can be decrypted using the SM2 private key corresponding to the partner client, and the SM4 key can be obtained according to the activation flag, and the SM4 key can be encrypted using the SM2 public key of the partner client, and then the key encryption package can be sent to the partner client, and the financial business transaction message encrypted by the partner client using the SM4 key can be received, and the financial business transaction message can be decrypted using the SM4 key, and the original financial business information can be obtained by parsing, and the business logic based on the original financial business information can be executed, and the response financial business transaction message after the business processing is encrypted using the SM4 key, and sent to the partner client. In this embodiment, the SM2 and SM4 algorithms can be combined to ensure the security of financial business message transmission while ensuring the high efficiency of communication, reducing data delays, improving user experience and system response speed, and achieving fast message encryption and decryption, thereby ensuring the safe and fast transmission of financial transaction information and improving transaction success rates. This solves the technical problem in related technologies that financial institutions and partners use the national secret algorithm SM4 for message transmission, which is prone to key leakage and leads to low security of message information.

[0084] It should be noted that the key leakage situation can be effectively handled in this embodiment, and the message encryption and decryption method based on the national secret key also includes: when the SM4 key is detected to be leaked, receiving the key update instruction sent by the partner client, wherein the key update instruction includes an instruction to update the SM4 key and a new session identifier SID; regenerating the SM4 key according to the new session identifier SID, and storing it in the database; using the regenerated SM4 key to perform encryption and decryption operations of financial business transaction messages between the partner client and the partner client.

[0085] Among them, receiving the key update instruction sent by the partner client in the case of detecting the leakage of the SM4 key means that when the server detects that the currently used SM4 key may have been leaked, that is, the security of the key is threatened, the system needs to take immediate action to prevent unauthorized access to sensitive information. The partner client should send a key update instruction, which contains a clear instruction to update the SM4 key and a new session identifier SID.

[0086] It should be noted that the server in this embodiment can detect the leakage of SM4 keys in a variety of ways, such as monitoring abnormal patterns in network traffic, regularly performing key strength analysis, and implementing audits of key usage logs. Once a key leakage is detected, the system immediately enters an emergency response state. After receiving the key leakage notification from the server, or when the client itself detects a key security risk, the client will generate and send a new SID, and set the "no" enable flag in the SID to explicitly instruct the server to generate a new SM4 key. The SID should contain sufficient information to ensure its uniqueness, such as the client's unique identification information, session timestamp, or random number. After receiving the key update instruction, the server regenerates the SM4 key based on the SID, and stores the new key together with the SID in the database for subsequent use.

[0087] The server uses the newly generated SM4 key to perform subsequent message encryption and decryption operations to ensure data security during communication. At the same time, the client should also use the new SID and SM4 key to encrypt and decrypt messages.

[0088] When the SM2 key is leaked, the SM2 key pair is re-interacted with the partner client, and the SM2 key is used as an asymmetric key to encrypt the SID and the SM4 key, thereby ensuring the secure distribution of the symmetric key SM4. Once the SM2 key is leaked, it means that the foundation of encrypted communication is seriously damaged. At this time, it is necessary to re-interact the SM2 key pair with the partner client to restore the security of communication. Among them, in this embodiment, when detecting whether the SM2 key is leaked, it can be found by monitoring abnormal data packets in the network or direct key auditing. Once the SM2 key is confirmed to be leaked, the service end should immediately stop using the current SM2 key, contact the client, and start the key update process. After both parties have updated the SM2 key pair, the new key should be used immediately to re-execute the SID encryption and sending process, as well as the subsequent encryption and distribution of the SM4 key.

[0089] When the SM2 key is detected to be leaked, this embodiment provides an emergency response and key update mechanism to quickly restore the security state and prevent unauthorized access and data leakage. Optionally, the message encryption and decryption method based on the national secret key also includes: when the SM2 key is detected to be leaked, re-exchanging the SM2 key pair with the partner client.

[0090] Among them, detecting SM2 key leakage is a key link in secure communication. In this embodiment, detection can be performed in a variety of ways. For example, regular security audits may find that SM2 keys are recorded in unsafe environments, such as log files, configuration files, or vulnerable storage areas. Alternatively, continuous monitoring of network traffic, especially during the key exchange process, can help identify potential man-in-the-middle attacks or key leaks. If unexpected login attempts or data access patterns are detected, especially those attempting to access or decrypt data encrypted using SM2 keys, it may indicate that the key has been leaked. Through security intelligence systems or third-party security notifications, information that the SM2 key may have been obtained by a third party can be obtained. Once the SM2 key is confirmed to be leaked, immediate action must be taken to re-interact the SM2 key pair with the partner client to restore secure communications.

[0091] In the event of confirmed SM2 key leakage, the server needs to immediately notify the partner client of the SM2 key leakage and indicate the need to urgently update the key pair. In order to securely exchange new SM2 key pairs, the two parties need to establish a secure communication channel. This can be achieved through pre-shared keys, digital certificates, or other security protocols to ensure the security and integrity of the keys during transmission. The server should regenerate a set of SM2 key pairs, including a new public key and private key. Similarly, the client should also regenerate its SM2 key pair to cooperate with the server's update, and use the partner client's historical SM2 public key (or pre-shared key, if any) to encrypt the newly generated SM2 public key to ensure the security of the key during transmission. The client should also use the server's historical SM2 public key to encrypt the newly generated public key for transmission, and update the key pair in a symmetrical manner.

[0092] After both parties complete the key pair update, they should confirm the key pair update is successful through secure communication to ensure that the encryption and decryption operations of subsequent messages can proceed normally. After updating the SM2 key pair, all subsequent communications should use the new key pair, which means that in the subsequent SID generation and encryption and decryption operations, the public key and private key in the new key pair will be used to ensure that the security of communications and the confidentiality of information are not affected by previous key leaks.

[0093] Through the above implementation steps, in the event of SM2 key leakage, the SM2 key pair can be quickly and securely re-interacted with the partner client to restore a secure communication environment, which not only enhances the security protection capability of the system, but also reduces the potential impact of key leakage on business continuity and data security.

[0094] The present invention is described below by another implementation method.

[0095] According to another aspect of an embodiment of the present invention, a message encryption and decryption method based on a national secret key is also provided, which is applied to a partner client, and the partner client pre-establishes a communication connection with the open platform server of any of the above-mentioned financial institutions.

[0096] Figure 3 is a flowchart of another optional message encryption and decryption method based on a national secret key according to an embodiment of the present invention, such as Figure 3 As shown, the message encryption and decryption method based on the national secret key includes:

[0097] Step S301, generate a session identifier SID and set an enable flag.

[0098] Optionally, when generating a session identifier SID, it includes: generating a session identifier SID including an enable flag according to a distributed ID generation algorithm negotiated between the partner client and the open platform server, wherein the enable flag is used to indicate whether the open platform server should search for an existing SM4 key from a database or generate a new SM4 key.

[0099] Before the client establishes communication with the open platform server, the two parties need to first negotiate an ID generation algorithm based on a distributed environment, such as the Snowflake Algor ithm. The Snowflake Algor ithm is a distributed ID generation algorithm that can generate a globally unique and increasing 64-bit integer ID, which usually includes a timestamp, a work node ID, a serial number, and other parts. When generating a SID, an enable flag can be embedded in the SID. The enable flag in this embodiment can be a binary bit used to indicate whether the server should search the database for an existing SM4 key for the session, or whether a new SM4 key should be generated.

[0100] Among them, when setting the enable flag, it is up to the client to decide based on the actual situation. If it is set to "yes", it means that the client wants to continue to use the SM4 key of the existing session, which usually means that the two parties have had one or more successful communication sessions before, and the current SM4 key is still valid and secure. If it is set to "no", it indicates that the server should generate a new SM4 key. This situation may include: when the initial session is established, there is no existing SM4 key, or the client detects that the SM4 key of the current session may have been leaked or is no longer secure, or the client believes that it is necessary to update the key to improve security, such as required by the regular key rotation policy.

[0101] It should be noted that the session identifier SID provided in this embodiment may include but is not limited to the following information: enable flag: a bit used to indicate whether to use the existing SM4 key or generate a new key; client identification information: such as client ID, MAC address or device ID, used to identify a specific partner client; timestamp or random number: used to generate the global uniqueness of the SID to prevent session replay or prediction. The timestamp can be accurate to milliseconds or finer granularity, and the random number should be generated by a secure random number generator; session sequence number: in some implementations, the SID may include a session sequence number to help track and manage multiple concurrent sessions.

[0102] After the client generates the SID according to the negotiated distributed ID generation algorithm, it uses the server's SM2 public key to encrypt the SID to form an encrypted SID data packet. The encryption process ensures the confidentiality of the SID during transmission. Even if the data packet is intercepted, the attacker cannot parse the specific content of the SID, including key information such as the enable flag. By enabling the flag, the client can flexibly instruct the server to use the existing SM4 key or generate a new key, which not only improves the efficiency and security of message encryption and decryption, but also simplifies the complexity of key management, ensuring a safe, efficient and flexible message encryption and decryption method under the national encryption algorithm framework.

[0103] By generating the SID mechanism, the message is doubly protected during transmission, that is, the asymmetric SM2 key is used to protect the symmetric SM4 key and session identifier, and the SM4 key is used to quickly encrypt and decrypt the message content, ensuring that the communication efficiency can be maintained under the premise of high security. At the same time, the enable flag in the SID provides a dynamic key management function, which enables the system to automatically adjust the use of keys according to actual needs, enhancing the flexibility and security of the overall solution.

[0104] Step S302, encrypt the session identifier SID and the enable flag bit using the SM2 public key of the server, send the encrypted session identifier SID and the enable flag bit to the open platform server, and receive the SM4 key encrypted using the SM2 public key of the partner client returned by the open platform server.

[0105] The partner client uses the server's SM2 public key to encrypt the SID and the enable flag to form an encrypted data packet. The encryption process is based on the national encryption algorithm standard and uses the elliptic curve encryption characteristics of SM2 to ensure the security of data during transmission. Even if the data packet is intercepted, the attacker cannot decrypt and obtain the SID and enable flag information.

[0106] It should be noted that, after sending the encrypted SID and the enable flag to the server, the partner client in this embodiment waits to receive the encrypted data packet returned by the server, which may contain the SM4 key encrypted by the server using the client's SM2 public key. The partner client decrypts the data packet using its own SM2 private key to obtain the SM4 key, thus completing the secure distribution of the SM4 key.

[0107] Step S303: Use the SM2 private key of the partner client to decrypt the SM4 key, and use the decrypted SM4 key to encrypt the financial business transaction message.

[0108] After receiving the encrypted SM4 key data packet returned by the server, the partner client uses its own SM2 private key to decrypt it. The use of the SM2 private key is based on an asymmetric encryption mechanism, ensuring that only the entity with the correct private key, that is, the client itself, can decrypt and obtain the SM4 key.

[0109] It should be noted that the partner client in this embodiment uses the SM4 key to encrypt the financial business transaction message after decrypting it. SM4 is a block encryption algorithm with higher speed and efficiency than SM2. It is suitable for encrypting and decrypting large amounts of data, such as financial transaction messages. The encryption process follows the national encryption algorithm standard to ensure the confidentiality and integrity of the message content.

[0110] Step S304: Send the session identifier SID, the encrypted financial service transaction message and the authentication information to the open platform server to complete the financial service processing.

[0111] Here, after the partner client encrypts the financial service message with the SM4 key, it combines the encrypted message, SID and necessary authentication information (such as user name, password, etc.) into a data packet and sends it to the server. The authentication information is used to verify the identity of the client and ensure the legitimacy of the message sender. After receiving the data packet, the server first uses the SM4 key associated with the SID to decrypt the encrypted financial service message and restore the original content of the message. The decrypted message will be further processed by business logic according to its content, such as account query, transaction confirmation, fund transfer, etc. The decryption and processing of the message by the server reflects the ultimate goal of encrypted communication, that is, financial business transactions can be carried out normally under the premise of ensuring information security. After the server completes the business processing, it uses the same SM4 key to encrypt the response message, and then repackages the encrypted response message, SID and possible other authentication information and sends it back to the client to form an encrypted response data packet.

[0112] The above implementation steps can generate a session identifier SID and set an enable flag, encrypt the session identifier SID and the enable flag using the SM2 public key of the server, send the encrypted session identifier SID and the enable flag to the open platform server, receive the SM4 key encrypted using the SM2 public key of the partner client returned by the open platform server, decrypt the SM4 key using the SM2 private key of the partner client, encrypt the financial business transaction message using the decrypted SM4 key, send the session identifier SID, the encrypted financial business transaction message and the authentication information to the open platform server, and complete the financial business processing. In this embodiment, on the partner's client side, the SM2 and SM4 national encryption algorithms can be combined to achieve efficient and secure communication of financial business transaction messages. The asymmetric encryption SM2 is used for the secure distribution of keys, while the symmetric encryption SM4 is used for the efficient encryption of large amounts of data. While ensuring the security of the transmission of financial business transaction messages, by using the SM4 algorithm to encrypt large messages, the efficiency of communication is guaranteed, the user experience and system response speed are improved, fast message encryption and decryption are achieved, the safe and fast transmission of financial transaction information is ensured, and the transaction success rate is improved, thereby solving the technical problem in the related technology that the national encryption algorithm SM4 is used for the transmission of messages between financial institutions and partners, which is prone to key leakage and leads to low security of message information.

[0113] It should be noted that the partner client in this embodiment retains lifecycle control over the SM4 key during the session. Optionally, the message encryption and decryption method based on the national secret key also includes: after the partner client completes a session with the open platform server, it retains the lifecycle control mechanism for the SM4 key, wherein the lifecycle control mechanism includes: by updating the enable flag in the session identifier SID, controlling the use status of the SM4 key, and when the SM4 key is leaked or expired, sending the regenerated session identifier SID to the open platform server to obtain a new SM4 key.

[0114] When it is detected that the current SM4 key may have been leaked (for example, through security audits or monitoring of suspicious activities) or has reached its preset life cycle end (for example, key expiration), the partner client will update the enable flag in the SID to "No", generate a new SID, and then send it to the server. This action triggers the server to generate and send a new SM4 key. After sending the updated SID, the partner client waits to receive the new SM4 key returned by the server. Once the new key is obtained, the partner client will use this SM4 key for subsequent encryption and decryption operations to ensure the security and confidentiality of the data.

[0115] Optionally, the message encryption and decryption method based on the national secret key also includes: using the reserved SM4 key to decrypt the financial business transaction message returned by the open platform server; and executing the business logic of the original financial business information indicated by the financial business transaction message.

[0116] After a successful session, the partner client will retain the SM4 key instead of discarding it immediately. The purpose of this is that in subsequent sessions, as long as the enable flag in the SID indicates "yes", the retained SM4 key can be used immediately, avoiding the overhead of regenerating and distributing keys and improving communication efficiency.

[0117] When the server returns the encrypted financial business transaction message, the client uses the retained SM4 key to decrypt the message. The decryption process ensures the integrity and confidentiality of the message content. Only the client with the correct SM4 key can decrypt and read the message content. The decrypted financial business message will be processed by the client's business system to execute the business logic of the original financial business information indicated in the message. This may include but is not limited to the update of account information, verification of transaction records, processing of fund transfers, etc. The execution of business logic is based on the decrypted message content, ensuring the correctness and security of financial business.

[0118] Another optional specific implementation is described in detail below.

[0119] The implementation mode of the present invention provides a complete universal encryption and decryption method for messages based on the improved national secret algorithm, which can effectively improve the encryption and decryption algorithm speed of the message body, reduce the risk of exchanging keys, and reduce the difficulty of overall application transformation at a security level equivalent to SM2, thereby being suitable for a wider range of commercial message encryption and decryption scenarios.

[0120] In the API open platform of financial institutions, due to the uncertainty of message size, encryption and decryption speed and the convenience of key interaction, the symmetric key algorithm is currently used for message encryption and decryption. Although the processing efficiency is guaranteed, it cannot meet the higher requirements of confidentiality. The implementation method of the present invention can be applied to partners who are more sensitive to information to exchange information through the API of financial institutions, and the time complexity of encryption and decryption processing combined with database operations is basically equivalent to that of symmetric key algorithms, such as: the interaction between fund companies and financial institutions' accounting systems.

[0121] Figure 4 is a schematic diagram of an optional universal message encryption and decryption method based on a national secret key according to an embodiment of the present invention, such as Figure 4 As shown, including:

[0122] (1) The partner client and the server each have a pair of SM2 keys, that is, the partner client has its own SM2 private key and public key (which can be regarded as key pair A), and the server also has its own SM2 private key and public key (key pair B). This key distribution method is based on the traditional mechanism of asymmetric encryption, in which the public key in key pair A is used by the server to encrypt data to the partner client, while the private key is used by the partner client for decryption; similarly, the public key in key pair B is used by the partner client to encrypt data to the server, while the private key is used by the server for decryption.

[0123] (2) The communicating parties do not need to exchange private keys directly. In actual communication, the partner client and the server only need to exchange their respective SM2 public keys. The private key should always be kept on each side and not transmitted to ensure the security of the asymmetric encryption mechanism.

[0124] (3) The partner client generates a session identifier SID that includes an enable flag. SID can be generated in a variety of ways, such as distributed ID generation mechanisms such as the snowflake algorithm to ensure the global uniqueness of the SID. The partner client encrypts the SID using the server's SM2 public key B and sends it to the server.

[0125] (4) The server uses its SM2 private key B to decrypt the received encrypted SID and parse out the SID and the enable flag. Based on the enable flag, the server determines whether to search the database for an existing SM4 key. If the enable flag is set to "No", it means that the partner client requires the SM4 key to be regenerated, and the server will generate a new SM4 key based on the SID and its own uu id. If the enable flag is set to "Yes", the server should try to find the SM4 key associated with the SID from the database. If it cannot be found, a new SM4 key should also be generated and the database record updated.

[0126] (5) The server uses the partner client's SM2 public key A to encrypt the newly generated SM4 key, and then returns the encrypted SM4 key data packet to the partner client.

[0127] (6) After receiving the data packet returned by the server, the partner client uses its own SM2 private key A to decrypt the data packet and obtain the SM4 key from it. This process completes the secure distribution of the SM4 key.

[0128] (7) The partner client uses the obtained SM4 key to encrypt the financial business transaction message, and then sends the encrypted message together with the SID, user name, password and other authentication information to the server.

[0129] (8) After receiving the encrypted message from the partner client, the server searches the database for the corresponding SM4 key based on the SID, uses the key to decrypt the message, executes the business logic, and generates a response message. After encrypting it using the same SM4 key, the encrypted response message and the SID are sent back to the partner client.

[0130] (9) The partner client uses the same SM4 key to decrypt the response message returned by the server and executes the business logic indicated in the message.

[0131] (10) The generation of the partner client SID should indeed adopt a distributed ID generation mechanism such as the snowflake algorithm, which includes an enable flag to control the usage status of the SM4 key.

[0132] (11) The server should store the SM4 key associated with the SID and its lifecycle status. Whether to generate a new SM4 key or use an existing key for each communication is controlled by the partner client through the enable flag in the SID. This ensures dynamic management of the SM4 key and improves the security and flexibility of the system.

[0133] (12) When the SM4 key shows signs of being leaked, the partner client and / or server can trigger the generation of a new SM4 key by updating the enable flag in the SID to "no" without re-exchanging the SM2 key pair. However, if the SM2 key pair is leaked, this will seriously endanger the security of the entire communication. At this time, both parties must stop the current communication session, regenerate and exchange the SM2 key pair to restore a secure communication environment.

[0134] According to the above implementation steps, the message encryption and decryption method based on the national secret key provided in this embodiment not only provides a secure data transmission mechanism, but also enhances the robustness and security of the system through the control of the SM4 key life cycle by the partner client. This mechanism allows for a quick response when a security threat is detected, while maintaining the efficiency of communication and avoiding unnecessary key generation and distribution. It is very suitable for financial scenarios that require real-time or quasi-real-time communication, such as account information exchange and transaction confirmation between banks and partners.

[0135] The embodiments of the present invention overcome the shortcomings of the prior art and provide a sufficiently simple and efficient message encryption and decryption method under the premise of sufficient key security, which can effectively control the implementation cost and is not restricted by platform and language, thereby reducing the difficulty of overall application transformation, thereby being suitable for a wider range of commercial message encryption and decryption scenarios.

[0136] The following is a detailed description in conjunction with another embodiment.

[0137] Embodiment 2

[0138] A message encryption and decryption device based on a national secret key provided in this embodiment includes multiple implementation units, and each implementation unit corresponds to each implementation step in the above-mentioned embodiment one.

[0139] A message encryption and decryption device based on a national secret key provided in an embodiment of the present invention is applied to an open platform server of a financial institution. Figure 5 is a schematic diagram of an optional message encryption and decryption device based on a national secret key according to an embodiment of the present invention, such as Figure 5 As shown, the message encryption and decryption device based on the national secret key may include: an identifier receiving unit 51, an identifier decryption unit 52, a key encryption unit 53, an encrypted message receiving unit 54, and a service execution unit 55.

[0140] The identifier receiving unit 51 is used to receive the session identifier SID and the activation flag encrypted by the SM2 public key sent by the partner client.

[0141] The identifier decryption unit 52 is used to use the SM2 private key corresponding to the partner client to decrypt and obtain the session identifier SID and the activation flag.

[0142] The key encryption unit 53 is used to obtain the SM4 key according to the activation flag, encrypt the SM4 key using the SM2 public key of the partner client, and send the key encryption package to the partner client.

[0143] The encrypted message receiving unit 54 is used to receive the financial business transaction message encrypted by the partner client using the SM4 key, and decrypt the financial business transaction message using the SM4 key to parse and obtain the original financial business information.

[0144] The business execution unit 55 is used to execute the business logic based on the original information of the financial business, and use the SM4 key to encrypt the response financial business transaction message after the business processing, and send it to the partner client.

[0145] The above-mentioned message encryption and decryption device based on national secret keys can receive the session identifier SID and the activation flag encrypted by the SM2 public key sent by the partner client through the identifier receiving unit 51, decrypt the session identifier SID and the activation flag by using the SM2 private key corresponding to the partner client through the identifier decryption unit 52, obtain the SM4 key according to the activation flag through the key encryption unit 53, encrypt the SM4 key by using the SM2 public key of the partner client, and then send the key encryption package to the partner client, receive the financial business transaction message encrypted by the partner client using the SM4 key through the encrypted message receiving unit 54, decrypt the financial business transaction message by using the SM4 key, parse to obtain the original financial business information, execute the business logic based on the original financial business information through the business execution unit 55, and encrypt the response financial business transaction message after the business processing by using the SM4 key, and send it to the partner client. In this embodiment, the SM2 and SM4 algorithms can be combined to ensure the security of financial business message transmission while using the SM4 algorithm to encrypt large messages, thereby ensuring efficient communication, reducing data delays, improving user experience and system response speed, and achieving fast message encryption and decryption, ensuring the safe and fast transmission of financial transaction information, and improving transaction success rates, thereby solving the technical problem in the related technology that financial institutions and partners use the national secret algorithm SM4 for message transmission, which is prone to key leakage and leads to low security of message information. Among them,

[0146] Optionally, the key encryption unit includes: a new key generation module, which is used to generate a new SM4 key based on the session identifier SID and the server unique identifier when the enable flag indicates no, and store the client identifier, session identifier SID and the generated SM4 key in a database; or, a key query module, which is used to query the SM4 key corresponding to the session identifier SID from the database when the enable flag indicates yes, wherein the database stores the SM4 key set corresponding to all clients.

[0147] Optionally, the message encryption and decryption device based on the national secret key also includes: a key update unit, which is used to receive a key update instruction sent by the partner client when a leakage of the SM4 key is detected, wherein the key update instruction includes an instruction to update the SM4 key and a new session identifier SID; a key regeneration unit, which is used to regenerate the SM4 key according to the new session identifier SID and store it in a database; and a message encryption and decryption unit, which is used to use the regenerated SM4 key to perform encryption and decryption operations on financial business transaction messages between the partner client and the partner client.

[0148] Optionally, the message encryption and decryption device based on the national secret key also includes: a key pair re-interaction unit, which is used to re-interact the SM2 key pair with the partner client when the SM2 key is detected to be leaked.

[0149] Optionally, the session identifier SID includes: an enable flag, a flag used to indicate whether to enable the database to store the SM4 key; unique identification information of the partner client; and a session timestamp or a random number.

[0150] According to another aspect of an embodiment of the present invention, a message encryption and decryption device based on a national secret key is also provided, which is applied to a partner client. The partner client pre-establishes a communication connection with the open platform server of the financial institution in the above-mentioned embodiment one.

[0151] Figure 6 is a schematic diagram of another optional message encryption and decryption device based on a national secret key according to an embodiment of the present invention, such as Figure 6 As shown, the message encryption and decryption device based on the national secret key includes: an identifier generation unit 61, an identifier encryption unit 62, a key decryption unit 63, and an information sending unit 64.

[0152] The identifier generation unit 61 is used to generate a session identifier SID and set an activation flag.

[0153] The identifier encryption unit 62 is used to encrypt the session identifier SID and the enable flag bit using the SM2 public key of the server, send the encrypted session identifier SID and the enable flag bit to the open platform server, and receive the SM4 key encrypted using the SM2 public key of the partner client returned by the open platform server.

[0154] The key decryption unit 63 is used to use the SM2 private key of the partner client to decrypt the SM4 key, and use the decrypted SM4 key to encrypt the financial business transaction message.

[0155] The information sending unit 64 is used to send the session identifier SID, the encrypted financial service transaction message and the authentication information to the open platform server to complete the financial service processing.

[0156] The above-mentioned message encryption and decryption device based on the national secret key can generate a session identifier SID and set an activation flag through the identifier generation unit 61, encrypt the session identifier SID and the activation flag using the SM2 public key of the server through the identifier encryption unit 62, send the encrypted session identifier SID and the activation flag to the open platform server, and receive the SM4 key encrypted by the SM2 public key of the partner client returned by the open platform server, decrypt the SM4 key using the SM2 private key of the partner client through the key decryption unit 63, encrypt the financial business transaction message using the decrypted SM4 key, send the session identifier SID, the encrypted financial business transaction message and the authentication information to the open platform server through the information sending unit 64, and complete the financial business processing. In this embodiment, the SM2 and SM4 algorithms can be combined to ensure the security of financial business message transmission while ensuring the high efficiency of communication, reducing data delays, improving user experience and system response speed, and achieving fast message encryption and decryption, thereby ensuring the safe and fast transmission of financial transaction information and improving transaction success rates. This solves the technical problem in related technologies that financial institutions and partners use the national secret algorithm SM4 for message transmission, which is prone to key leakage and leads to low security of message information.

[0157] Optionally, the identifier generation unit includes: an identifier generation module, used to generate a session identifier SID including an enable flag bit according to a distributed ID generation algorithm negotiated between the partner client and the open platform server, wherein the enable flag bit is used to indicate whether the open platform server should search for an existing SM4 key from the database or generate a new SM4 key.

[0158] Optionally, the message encryption and decryption device based on the national secret key also includes: a key lifecycle control unit, which is used for the partner client to retain the lifecycle control mechanism of the SM4 key after completing a session with the open platform server, wherein the lifecycle control mechanism includes: controlling the usage status of the SM4 key by updating the enable flag in the session identifier SID, and when the SM4 key is leaked or expired, sending the regenerated session identifier SID to the open platform server to obtain a new SM4 key.

[0159] Optionally, the message encryption and decryption device based on the national secret key also includes: a message decryption module, used to use the retained SM4 key to decrypt the financial business transaction messages returned by the open platform server; a financial business execution module, used to execute the business logic of the original financial business information indicated by the financial business transaction message.

[0160] The above-mentioned message encryption and decryption device based on national secret keys may also include a processor and a memory. The above-mentioned identifier receiving unit 51, identifier decryption unit 52, key encryption unit 53, encrypted message receiving unit 54, service execution unit 55, and identifier generation unit 61, identifier encryption unit 62, key decryption unit 63, information sending unit 64, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0161] The above processor includes a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the financial business interaction between the financial institution and the partner client can be realized based on the national encryption algorithm by adjusting the kernel parameters.

[0162] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash memory (fl ash RAM), and the memory includes at least one storage chip.

[0163] Embodiment 3

[0164] An embodiment of the present application may provide an electronic device, Figure 7 is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 7 As shown, the electronic device may include: one or more ( Figure 7 (only one is shown) processor 702, memory 704, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0165] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the message encryption and decryption method and device based on the national secret key in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned message encryption and decryption method based on the national secret key. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0166] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: receive the session identifier SID and the activation flag encrypted using the SM2 public key sent by the partner client; use the SM2 private key corresponding to the partner client to decrypt and obtain the session identifier SID and the activation flag; obtain the SM4 key according to the activation flag, encrypt the SM4 key using the SM2 public key of the partner client, and send the key encryption package to the partner client; receive the financial business transaction message encrypted by the partner client using the SM4 key, and use the SM4 key to decrypt the financial business transaction message and parse to obtain the original financial business information; execute the business logic based on the original financial business information, and use the SM4 key to encrypt the response financial business transaction message after business processing, and send it to the partner client.

[0167] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: when the activation flag indicates no, generate a new SM4 key according to the session identifier SID and the server unique identifier, and store the client identifier, the session identifier SID and the generated SM4 key in the database; or, when the activation flag indicates yes, query the SM4 key corresponding to the session identifier SID from the database, wherein the database stores the SM4 key set corresponding to all clients.

[0168] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: when the SM4 key is detected to be leaked, receive the key update instruction sent by the partner client, wherein the key update instruction includes an instruction to update the SM4 key and a new session identifier SID; regenerate the SM4 key according to the new session identifier SID and store it in the database; use the regenerated SM4 key to perform encryption and decryption operations of financial business transaction messages between the partner client and the partner client.

[0169] The processor may also call the information and application program stored in the memory through the transmission device to perform the following steps: when a leakage of the SM2 key is detected, re-interact the SM2 key pair with the partner client.

[0170] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: the session identifier SID includes: an enable flag, a flag used to indicate whether to enable the database to store the SM4 key; the unique identification information of the partner client; a session timestamp or a random number.

[0171] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: generate a session identifier SID and set an enable flag; use the SM2 public key of the server to encrypt the session identifier SID and the enable flag, send the encrypted session identifier SID and the enable flag to the open platform server, and receive the SM4 key encrypted by the SM2 public key of the partner client returned by the open platform server; use the SM2 private key of the partner client to decrypt the SM4 key, and use the decrypted SM4 key to encrypt the financial business transaction message; send the session identifier SID, the encrypted financial business transaction message and authentication information to the open platform server to complete the financial business processing.

[0172] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: generate a session identifier SID including an enable flag bit according to the distributed ID generation algorithm negotiated by the partner client and the open platform server, wherein the enable flag bit is used to indicate whether the open platform server should search for an existing SM4 key from the database or generate a new SM4 key.

[0173] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: after the partner client completes a session with the open platform server, the life cycle control mechanism of the SM4 key is retained, wherein the life cycle control mechanism includes: controlling the usage status of the SM4 key by updating the enable flag in the session identifier SID, and when the SM4 key is leaked or expired, sending the regenerated session identifier SID to the open platform server to obtain a new SM4 key.

[0174] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: use the retained SM4 key to decrypt the financial business transaction message returned by the open platform server; execute the business logic of the original financial business information indicated by the financial business transaction message.

[0175] By adopting the embodiments of the present application, the SM2 and SM4 algorithms can be combined to ensure the security of financial business message transmission. By using the SM4 algorithm to encrypt large messages, the efficiency of communication is guaranteed, data delays are reduced, user experience and system response speed are improved, and fast message encryption and decryption are achieved. The safe and fast transmission of financial transaction information is ensured, and the transaction success rate is improved, thereby solving the technical problem in the related technology that the national secret algorithm SM4 is used for message transmission between financial institutions and partners, which is prone to key leakage and leads to low security of message information.

[0176] It can be understood by those skilled in the art that Figure 7 The structure shown is for illustration only, and the electronic device may also be a terminal device such as a smart phone, a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, etc. Figure 7 The structure of the electronic device is not limited. Figure 7 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 7 Different configurations are shown.

[0177] A person of ordinary skill in the art can understand that all or part of the steps in the various message encryption and decryption methods based on national secret keys in the above-mentioned embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0178] Embodiment 4

[0179] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the message encryption and decryption method based on the national secret key provided in the first embodiment.

[0180] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, and the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the message encryption and decryption methods based on the national secret key in the above-mentioned embodiment one.

[0181] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0182] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the message encryption and decryption method based on the national secret key described in each embodiment of the present application.

[0183] The present application also provides a computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the message encryption and decryption method based on the national secret key described in each embodiment of the present application are implemented.

[0184] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0185] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0186] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0187] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0188] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0189] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0190] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A message encryption and decryption method based on a national secret key, characterized in that: The open platform server used in financial institutions includes: Receive the session identifier SID and the activation flag sent by the partner client, which are encrypted using the SM2 public key; Decrypt using the SM2 private key corresponding to the partner client to obtain the session identifier SID and the activation flag; Acquire an SM4 key according to the activation flag, encrypt the SM4 key using the SM2 public key of the partner client, and send the key encryption package to the partner client; Receive the financial business transaction message encrypted by the partner client using the SM4 key, decrypt the financial business transaction message using the SM4 key, and parse to obtain the original financial business information; Execute the business logic based on the original information of the financial business, and use the SM4 key to encrypt the response financial business transaction message after the business processing, and send it to the partner client.

2. The message encryption and decryption method according to claim 1, characterized in that: The step of obtaining the SM4 key according to the enabling flag includes: If the enable flag indicates no, a new SM4 key is generated according to the session identifier SID and the server unique identifier, and the client identifier, the session identifier SID and the generated SM4 key are stored in a database; or, In a case where the enabling flag indicates yes, an SM4 key corresponding to the session identifier SID is queried from a database, wherein the database stores a set of SM4 keys corresponding to all clients.

3. The message encryption and decryption method according to claim 1, characterized in that: Also includes: In the case of detecting that the SM4 key is leaked, receiving a key update instruction sent by the partner client, wherein the key update instruction includes an instruction to update the SM4 key and a new session identifier SID; Regenerate the SM4 key according to the new session identifier SID and store it in the database; The regenerated SM4 key is used to perform encryption and decryption operations on financial business transaction messages between the partner client and the partner client.

4. The message encryption and decryption method according to claim 1, characterized in that: Also includes: When the SM2 key is detected to be leaked, the SM2 key pair is re-exchanged with the partner client.

5. The message encryption and decryption method according to claim 1, characterized in that: The session identifier SID includes: Enable flag, used to indicate whether to enable the database to store SM4 keys; Unique identification information of the partner client; Session timestamp or random number.

6. A message encryption and decryption method based on a national secret key, characterized in that: Applied to a partner client, the partner client pre-establishes a communication connection with the open platform server of the financial institution as claimed in any one of claims 1 to 5, comprising: Generate a session identifier SID and set the enable flag; Encrypt the session identifier SID and the enable flag bit using the SM2 public key of the server, send the encrypted session identifier SID and the enable flag bit to the open platform server, and receive the SM4 key encrypted using the SM2 public key of the partner client returned by the open platform server; Decrypt the SM4 key using the SM2 private key of the partner client, and encrypt the financial business transaction message using the decrypted SM4 key; The session identifier SID, the encrypted financial business transaction message and the authentication information are sent to the open platform server to complete the financial business processing.

7. The message encryption and decryption method according to claim 6, characterized in that: The steps of generating a session identifier SID include: According to the distributed ID generation algorithm negotiated by the partner client and the open platform server, a session identifier SID including an enable flag is generated, wherein the enable flag is used to indicate whether the open platform server should search for an existing SM4 key from a database or generate a new SM4 key.

8. The message encryption and decryption method according to claim 6, characterized in that: Also includes: After completing a session with the open platform server, the partner client retains a lifecycle control mechanism for the SM4 key, wherein the lifecycle control mechanism includes: controlling the usage status of the SM4 key by updating the enable flag in the session identifier SID, and when the SM4 key is leaked or expired, sending the regenerated session identifier SID to the open platform server to obtain a new SM4 key.

9. The message encryption and decryption method according to claim 6, characterized in that: Also includes: Decrypt the financial business transaction message returned by the open platform server using the reserved SM4 key; Execute the business logic of the original financial business information indicated by the financial business transaction message.

10. A message encryption and decryption device based on a national secret key, characterized in that: The open platform server used in financial institutions includes: An identifier receiving unit, used to receive a session identifier SID and an activation flag encrypted using the SM2 public key sent by a partner client; An identifier decryption unit, configured to use the SM2 private key corresponding to the partner client to decrypt and obtain the session identifier SID and the activation flag; A key encryption unit, configured to obtain an SM4 key according to the activation flag, encrypt the SM4 key using the SM2 public key of the partner client, and send the key encryption package to the partner client; An encrypted message receiving unit, used to receive the financial business transaction message encrypted by the partner client using the SM4 key, and decrypt the financial business transaction message using the SM4 key to parse and obtain the original financial business information; The business execution unit is used to execute the business logic based on the original information of the financial business, and use the SM4 key to encrypt the response financial business transaction message after the business processing, and send it to the partner client.

11. A message encryption and decryption device based on national secret key, characterized in that: Applied to partner clients, including: An identifier generation unit, used to generate a session identifier SID and set an enable flag; an identifier encryption unit, configured to encrypt the session identifier SID and the enable flag bit using the SM2 public key of the server, send the encrypted session identifier SID and the enable flag bit to the open platform server, and receive the SM4 key encrypted using the SM2 public key of the partner client returned by the open platform server; A key decryption unit, used to decrypt the SM4 key using the SM2 private key of the partner client, and encrypt the financial business transaction message using the decrypted SM4 key; The information sending unit is used to send the session identifier SID, the encrypted financial business transaction message and the authentication information to the open platform server to complete the financial business processing.

12. An electronic device, characterized in that: It includes one or more processors and a memory, the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the message encryption and decryption method based on the national secret key as described in any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the message encryption and decryption method based on the national secret key described in any one of claims 1 to 9 are implemented.

Images