Message encryption and decryption methods, devices, and electronic equipment based on national cryptographic keys

Abstract

This invention discloses a message encryption and decryption method, apparatus, and electronic device based on the national cryptographic key, relating to the field of data security technology. The method includes: receiving a session identifier (SID) and an enable flag encrypted using an SM2 public key sent by a partner client; decrypting the SID using the SM2 private key corresponding to the client; obtaining an SM4 key based on the enable flag; encrypting the SM4 key using the client's SM2 public key; sending the encrypted key packet to the client; receiving financial transaction messages encrypted by the client using the SM4 key; decrypting the messages to obtain the original financial transaction information; executing business logic based on the original financial transaction information; encrypting the processed response financial transaction message using the SM4 key; and sending the processed response financial transaction message to the client. This invention solves the technical problem in related technologies where the use of the national cryptographic algorithm SM4 for message transmission between financial institutions and partners easily leads to key leakage, resulting in low security of message information.

Description

Technical Field

[0001] This invention relates to the field of data security technology or other related fields. Specifically, it relates to a message encryption and decryption method and apparatus, and electronic equipment based on national cryptographic keys. Background Technology

[0002] With the continuous development of information technology, data security and privacy protection have become critical issues across various industries, especially in sectors with extremely high security requirements such as finance and institutions. National cryptographic algorithms have been widely adopted in recent years, providing a solid guarantee for data encryption due to their strong security and compliance. Among them, the SM2 and SM4 algorithms, due to their respective advantages, have become the mainstream choices for implementing digital signatures, information encryption, and decryption.

[0003] Currently, financial institutions typically choose the SM4 algorithm to ensure processing efficiency when communicating with partners, but this sacrifices a high level of security. In scenarios with high security requirements, such as the interaction between fund companies and bank accounting systems, the SM4 algorithm cannot meet the communication needs of being both efficient and secure.

[0004] While the SM2 algorithm offers secure key exchange, its slow encryption and decryption speeds make it unsuitable for real-time communication and large message encryption scenarios. Conversely, the SM4 algorithm, despite its fast encryption and decryption speeds, has relatively simple key management; however, if an unauthorized third party obtains the key, the security of the message information will be severely compromised.

[0005] Therefore, financial institutions and their partners face the dual challenge of ensuring both the efficiency of data transmission and the security of data content when exchanging highly sensitive information.

[0006] There is currently no effective solution to the above problems. Summary of the Invention

[0007] This invention provides a message encryption and decryption method, apparatus, and electronic device based on the national cryptographic key, to at least solve the technical problem in related technologies where financial institutions and their partners use the national cryptographic algorithm SM4 for message transmission, which is prone to key leakage and results in low security of message information.

[0008] To achieve the above objectives, according to one aspect of this application, a message encryption and decryption method based on a national cryptographic key is provided, applied to the open platform server of a financial institution, comprising: receiving a session identifier (SID) and an enable flag encrypted using an SM2 public key sent by a partner client; decrypting the session identifier (SID) and the enable flag using an SM2 private key corresponding to the partner client; obtaining an SM4 key based on the enable flag; encrypting the SM4 key using the partner client's SM2 public key; sending the encrypted key packet to the partner client; receiving financial transaction messages encrypted using the SM4 key by the partner client; decrypting the financial transaction messages using the SM4 key to parse and obtain original financial transaction information; executing business logic based on the original financial transaction information; encrypting the processed response financial transaction messages using the SM4 key; and sending them to the partner client.

[0009] Optionally, the step of obtaining the SM4 key according to the enable flag includes: if the enable flag indicates no, generating a new SM4 key based on the session identifier SID and the server unique identifier, and storing the client identifier, the session identifier SID and the generated SM4 key in a database; or, if the enable flag indicates yes, querying the database for the SM4 key corresponding to the session identifier SID, wherein the database stores a set of SM4 keys corresponding to all clients.

[0010] Optionally, the message encryption and decryption method based on the national cryptographic key further includes: upon detecting a leak of the SM4 key, receiving a key update instruction sent by the partner client, wherein the key update instruction includes an instruction to update the SM4 key and a new session identifier (SID); regenerating the SM4 key according to the new session identifier (SID) and storing it in the database; and using the regenerated SM4 key to perform encryption and decryption operations on financial transaction messages between the partner client and the partner client.

[0011] Optionally, the message encryption and decryption method based on the national cryptographic key also includes: in the event of a leak of the SM2 key, re-exchanging the SM2 key pair with the partner client.

[0012] Optionally, the session identifier SID in the message encryption and decryption method based on the national cryptographic key includes: an enable flag, used to indicate whether the database storage of the SM4 key is enabled; the unique identification information of the partner client; and a session timestamp or random number.

[0013] According to another aspect of the present invention, a message encryption and decryption method based on a national cryptographic key is also provided, applied to a partner client. The partner client establishes a communication connection with the open platform server of any of the above-mentioned financial institutions in advance, including: generating a session identifier (SID) and setting an enable flag; encrypting the session identifier (SID) and the enable flag using the server's SM2 public key, sending the encrypted session identifier (SID) and the enable flag to the open platform server, and receiving an SM4 key encrypted using the partner client's SM2 public key returned by the open platform server; decrypting the SM4 key using the partner client's SM2 private key, and encrypting financial transaction messages using the decrypted SM4 key; and sending the session identifier (SID), the encrypted financial transaction messages, and authentication information to the open platform server to complete the financial transaction processing.

[0014] Optionally, the step of generating a session identifier (SID) includes: generating a session identifier (SID) containing an enable flag bit according to a distributed ID generation algorithm negotiated between the partner client and the open platform server, wherein the enable flag bit is used to indicate whether the open platform server should search for an existing SM4 key in the database or generate a new SM4 key.

[0015] Optionally, the message encryption and decryption method based on the national cryptographic key further includes: after the partner client completes a session with the open platform server, it retains a lifecycle control mechanism for the SM4 key, wherein the lifecycle control mechanism includes: controlling the usage status of the SM4 key by updating the enable flag in the session identifier SID, and sending a regenerated session identifier SID to the open platform server to obtain a new SM4 key when the SM4 key is leaked or expires.

[0016] Optionally, the message encryption and decryption method based on the national cryptographic key further includes: using the reserved SM4 key to decrypt the financial transaction messages returned by the open platform server; and executing the business logic of the original financial transaction information indicated by the financial transaction messages.

[0017] According to another aspect of the present invention, a message encryption and decryption device based on a national cryptographic key is also provided, applied to the open platform server of a financial institution, comprising: an identifier receiving unit, configured to receive a session identifier SID and an enable flag encrypted using an SM2 public key sent by a partner client; an identifier decryption unit, configured to decrypt the session identifier SID and the enable flag using an SM2 private key corresponding to the partner client; a key encryption unit, configured to obtain an SM4 key based on the enable flag, encrypt the SM4 key using the SM2 public key of the partner client, and send the key encryption package to the partner client; an encrypted message receiving unit, configured to receive financial transaction messages encrypted by the partner client using an SM4 key, and decrypt the financial transaction messages using the SM4 key to parse and obtain original financial transaction information; and a business execution unit, configured to execute business logic based on the original financial transaction information, and encrypt the processed response financial transaction messages using an SM4 key, and send them to the partner client.

[0018] Optionally, the key encryption unit includes: a new key generation module, configured to generate a new SM4 key based on the session identifier SID and the server unique identifier when the enable flag indicates no, and store the client identifier, the session identifier SID, and the generated SM4 key in a database; or, a key query module, configured to query the database for the SM4 key corresponding to the session identifier SID when the enable flag indicates yes, wherein the database stores a set of SM4 keys corresponding to all clients.

[0019] Optionally, the message encryption / decryption device based on the national cryptographic key further includes: a key update unit, configured to receive a key update instruction sent by the partner client when the SM4 key is detected to be leaked, wherein the key update instruction includes an instruction to update the SM4 key and a new session identifier (SID); a key regeneration unit, configured to regenerate the SM4 key according to the new session identifier (SID) and store it in a database; and a message encryption / decryption unit, configured to use the regenerated SM4 key to perform encryption / decryption operations on financial transaction messages between the device and the partner client.

[0020] Optionally, the message encryption and decryption device based on the national cryptographic key further includes: a key pair re-interaction unit, used to re-interact the SM2 key pair with the partner client in the event of a leak of the SM2 key.

[0021] Optionally, the session identifier SID includes: an enable flag indicating whether the database storage of the SM4 key is enabled; unique identification information of the partner client; and a session timestamp or random number.

[0022] According to another aspect of the present invention, a message encryption and decryption device based on a national cryptographic key is also provided, applied to a partner client. The partner client has a pre-established communication connection with the open platform server of any of the above-mentioned financial institutions, and includes: an identifier generation unit, used to generate a session identifier SID and set an enable flag; an identifier encryption unit, used to encrypt the session identifier SID and the enable flag using the server's SM2 public key, send the encrypted session identifier SID and the enable flag to the open platform server, and receive an SM4 key encrypted using the partner client's SM2 public key returned by the open platform server; a key decryption unit, used to decrypt the SM4 key using the partner client's SM2 private key, and use the decrypted SM4 key to encrypt financial transaction messages; and an information sending unit, used to send the session identifier SID, the encrypted financial transaction messages, and authentication information to the open platform server to complete the financial transaction processing.

[0023] Optionally, the identifier generation unit includes: an identifier generation module, used to generate a session identifier SID containing an enable flag bit according to the distributed ID generation algorithm negotiated between the partner client and the open platform server, wherein the enable flag bit is used to indicate whether the open platform server should search for an existing SM4 key in the database or generate a new SM4 key.

[0024] Optionally, the message encryption and decryption device based on the national cryptographic key further includes: a key lifecycle control unit, used to retain a lifecycle control mechanism for the SM4 key after the partner client completes a session with the open platform server, wherein the lifecycle control mechanism includes: controlling the usage status of the SM4 key by updating the enable flag bit in the session identifier SID, and sending a regenerated session identifier SID to the open platform server to obtain a new SM4 key when the SM4 key is leaked or expires.

[0025] Optionally, the message encryption and decryption device based on the national cryptographic key further includes: a message decryption module, used to decrypt the financial transaction messages returned by the open platform server using the reserved SM4 key; and a financial transaction execution module, used to execute the business logic of the original financial transaction information indicated by the financial transaction messages.

[0026] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute any of the above-mentioned message encryption and decryption methods based on national cryptographic keys.

[0027] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the message encryption and decryption method based on the national cryptographic key as described above.

[0028] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the message encryption and decryption method based on the national cryptographic key described above.

[0029] In this disclosure, a session identifier (SID) and an enable flag encrypted using an SM2 public key can be received from a partner client. The session identifier (SID) and the enable flag can be decrypted using the SM2 private key corresponding to the partner client. An SM4 key can be obtained based on the enable flag. The SM4 key can be encrypted using the partner client's SM2 public key. The encrypted key packet can then be sent to the partner client. The system can also receive financial transaction messages encrypted using the SM4 key from the partner client, decrypt the financial transaction messages using the SM4 key, parse the original financial transaction information, execute business logic based on the original financial transaction information, encrypt the processed response financial transaction messages using the SM4 key, and send them to the partner client.

[0030] Based on the above-mentioned public information, by combining the SM2 and SM4 algorithms, while ensuring the security of financial business communication message transmission, the use of the SM4 algorithm to encrypt large messages ensures communication efficiency, reduces data latency, improves user experience and system response speed, and enables fast message encryption and decryption. This ensures the secure and rapid transmission of financial transaction information, improves transaction success rate, and thus solves the technical problem in related technologies where the use of the national cryptographic algorithm SM4 for message transmission between financial institutions and their partners is prone to key leakage, resulting in low security of message information. Attached Figure Description

[0031] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0032] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a message encryption and decryption method based on Chinese national cryptographic keys is shown.

[0033] Figure 2 This is a flowchart of an optional message encryption / decryption method based on a national cryptographic key according to an embodiment of the present invention;

[0034] Figure 3 This is a flowchart of another optional message encryption and decryption method based on the national cryptographic key according to an embodiment of the present invention;

[0035] Figure 4 This is a schematic diagram of an optional general encryption and decryption method for messages based on national cryptographic keys according to an embodiment of the present invention;

[0036] Figure 5 This is a schematic diagram of an optional message encryption / decryption device based on a national cryptographic key according to an embodiment of the present invention;

[0037] Figure 6 This is a schematic diagram of another optional message encryption / decryption device based on a national cryptographic key according to an embodiment of the present invention;

[0038] Figure 7 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0039] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0040] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0041] To facilitate understanding of the present invention by those skilled in the art, some terms or nouns involved in the various embodiments of the present invention are explained below:

[0042] The SM2 algorithm is an asymmetric encryption algorithm based on elliptic curve cryptography. It has high security strength; however, due to the complex mathematical calculations involved in its operation, the encryption and decryption speed is relatively slow.

[0043] The SM4 algorithm is a block symmetric encryption algorithm characterized by high encryption speed and low processing cost, making it suitable for scenarios involving rapid encryption and decryption of large amounts of data. However, its security depends on key management and protection; once the key is leaked, it will directly threaten the security of the data.

[0044] Snowflake is a distributed ID generation algorithm used to generate unique IDs. Developed by Twitter, it's an algorithm that generates globally unique IDs in a distributed system.

[0045] It should be noted that the message encryption and decryption method and apparatus based on national cryptographic keys disclosed herein can be used in the field of data security technology for encrypting and decrypting financial business information between financial institutions and their partners based on data security.

[0046] It should be noted that the information collected in this public disclosure (including but not limited to key pair information of partners, client information of partners, user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data, etc.) are information and data authorized by users or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with the relevant laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, this system has interfaces with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned users or organizations through the interface, and the relevant information is obtained only after receiving consent from the aforementioned users or organizations.

[0047] It should be noted that in this disclosure, customer information is collected and analyzed, and users are provided with corresponding operation entry points to choose whether to agree to or reject the automated decision results; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0048] The following embodiments of the present invention can be applied to various systems / applications / devices for message encryption and decryption based on national cryptographic keys. The present invention provides a complete universal message encryption and decryption method based on an improved national cryptographic algorithm. At a security level equivalent to SM2, it effectively improves the encryption and decryption algorithm speed of the message body, reduces the risk of key exchange, and decreases the difficulty of modifying the overall application. Therefore, it is suitable for commercial message encryption and decryption scenarios such as accounting system transactions and business transactions between financial institutions and various types of partners.

[0049] The present invention will now be described in detail with reference to various embodiments.

[0050] Example 1

[0051] According to an embodiment of the present invention, an embodiment of a message encryption and decryption method based on a national cryptographic key is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0052] The message encryption and decryption method based on the national cryptographic key provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a message encryption and decryption method based on national cryptographic keys is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1 (Illustrated as 102a, 102b, ..., 102n) Processor 102 (processor 102 may include, but is not limited to, a microprocessor MCU (Microcontroller Unit) or a programmable gate array (FPGA), etc.), memory 104 for storing data, and transmission device 106 for communication functions. In addition, it may include: a display, input / output interface (I / O interface), Universal Serial Bus (USB) port (which may be included as one of the ports of a BUS bus), network interface, power supply, and / or camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0053] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0054] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the message encryption and decryption method based on the national cryptographic key in this embodiment of the application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned message encryption and decryption method based on the national cryptographic key. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0055] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0056] The display can be, for example, a touchscreen liquid crystal display (LCD), which allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0057] Under the aforementioned operating environment, this application provides the following: Figure 2 The method shown is a message encryption and decryption method based on the national cryptographic key. Figure 2 This is a flowchart of an optional message encryption / decryption method based on a national cryptographic key according to an embodiment of the present invention.

[0058] It should be noted that the message encryption and decryption method based on national cryptographic keys provided in this embodiment is applicable to the following scenarios: 1. Interaction between a partner's data system and a bank's accounting system, where high security is required. The bank's accounting system involves a large amount of financial transactions and user privacy data, making data security and confidentiality paramount, while also requiring efficient communication between different systems. This embodiment combines the SM2 and SM4 algorithms to achieve fast message encryption and decryption while ensuring data transmission security, meeting real-time or near-real-time communication needs. 2. Data exchange between fund companies and banks: Information exchange between fund companies and banks involves sensitive data such as fund net asset value, transaction records, and user information. The message encryption and decryption method based on national cryptographic keys provided in this embodiment ensures the security of this data during transmission. Simultaneously, by using the SM4 algorithm to encrypt large messages, it ensures high communication efficiency, reduces data latency, and improves user experience and system response speed. 3. Real-time online trading scenarios: For online transactions that require real-time response, such as securities trading and foreign exchange trading, the message encryption and decryption method based on national cryptographic keys provided in this embodiment of the invention can provide high-speed encryption and decryption processing, ensure the secure and rapid transmission of transaction information, reduce transaction delays, and improve the transaction success rate.

[0059] According to one aspect of this application, a message encryption and decryption method based on national cryptographic keys is provided and applied to the open platform server of a financial institution. For example... Figure 2 As shown, the message encryption and decryption method based on the national cryptographic key includes the following steps:

[0060] It should be noted that the partner client in this embodiment can refer to an institution / enterprise / factory that has a cooperative relationship with a financial institution (such as a bank or securities company).

[0061] By using a combination of SM2 and SM4 encryption schemes, partner clients can ensure the confidentiality, integrity, and availability of data during transmission, while reducing the complexity of key management and lowering the overall system security risks.

[0062] It should be noted that before implementing the message encryption and decryption method based on the national cryptographic key, the partner client and the financial institution's open platform server each need to set up a set of SM2 key pairs and exchange SM2 key pairs with each other.

[0063] The partner client first needs to generate a Session Identifier (SID). The SID is a unique identifier that may contain, but is not limited to, a client ID, a random number, and a timestamp, used to identify a single message exchange session. Additionally, the client needs to set an enable flag, which indicates whether the server should search for an existing SM4 key in the database or generate a new SM4 key.

[0064] Step S201: Receive the session identifier SID and enable flag encrypted using the SM2 public key sent by the partner client.

[0065] At the start of communication, the financial institution's server connects to clients from various partners and receives encrypted data packets from those clients. These packets are encrypted using the server's SM2 public key and contain a session identifier (SID) and an enable flag. The SID is a unique identifier generated by the client to identify this communication session, while the enable flag can be a boolean value indicating whether the server should use an existing SM4 key in its database or generate a new one.

[0066] Optionally, the Session Identifier (SID) for message encryption and decryption based on the national cryptographic key includes: an enable flag indicating whether the database storage of the SM4 key is enabled; unique identification information of the partner client; and a session timestamp or random number.

[0067] A SID is a crucial identifier in communication, used to identify a session and ensure the accuracy and security of encryption and decryption operations. The composition of a SID should ensure its uniqueness and unpredictability. When generating a SID, the client can consider encoding various information, such as a timestamp and client ID, to enhance its uniqueness and security. After receiving the SID, the server can perform preliminary verification, such as checking the SID format and verifying the timestamp, to ensure the integrity and timeliness of data packets. The SID contains an enable flag indicating whether the current session should use an existing SM4 key in the database. This is a binary bit; if set to "yes," it means the client wants to continue using the existing key; if set to "no," it instructs the server to generate a new SM4 key. The SID should also contain unique identification information for partner clients, such as client ID, MAC address, or hash value of a digital certificate. This helps the server quickly locate sessions and key information associated with a specific client. Additionally, a session timestamp or random number can be added to the SID to help ensure its uniqueness and prevent session replay attacks. Timestamps can be time values ​​accurate to milliseconds or finer granularity, while random numbers should be generated by a secure random number generator to ensure their unpredictability.

[0068] Step S202: Use the SM2 private key corresponding to the partner client to decrypt and obtain the session identifier SID and enable flag.

[0069] Decryption is fundamental to secure communication, ensuring the privacy and integrity of data. The server uses its corresponding SM2 private key to decrypt the encrypted data packet received in step S201. This process reveals the original values ​​of the SID and the enable flag. The use of the SM2 algorithm guarantees that even if the data packet is intercepted during transmission, a third party without the corresponding private key cannot decrypt the message, protecting the confidentiality of the SID and the enable flag. Furthermore, after decryption, the server can further verify the validity of the SID and the enable flag, such as checking whether the SID has been used before and whether the enable flag conforms to preset rules, to prevent potential security threats.

[0070] Step S203: Obtain the SM4 key based on the enable flag, encrypt the SM4 key using the partner client's SM2 public key, and then send the key encryption packet to the partner client.

[0071] Based on the decrypted enable flag, the server decides whether to use the existing SM4 key or generate a new SM4 key. Then, it encrypts the SM4 key using the client's SM2 public key, forming a key encryption packet, which is then sent to the client.

[0072] Optionally, the step of obtaining the SM4 key based on the enable flag includes: if the enable flag indicates no, generating a new SM4 key based on the session identifier SID and the server unique identifier, and storing the client identifier, session identifier SID and the generated SM4 key in the database; or, if the enable flag indicates yes, querying the database for the SM4 key corresponding to the session identifier SID, wherein the database stores a set of SM4 keys corresponding to all clients.

[0073] In this embodiment, the key usage strategy is determined by examining the specific information of the enable flag. When the flag is "No," the server generates an SM4 key using the SID and its own unique identifier. This process can employ methods such as random number generation and hash functions to ensure the security and uniqueness of the key. For example, when the enable flag in the SID sent by the client is set to "No," it usually indicates that the client wants to start a new session, or that the currently used SM4 key may be insecure or expired. In this case, the server will generate a new SM4 key. Specifically, the server can generate a new SM4 key based on the SID and its own unique identifier (e.g., server UUID, Universally Unique Identifier) ​​using a secure random number generator and / or a specific Key Derivation Function (KDF). This process ensures that each generated SM4 key is unique, increasing the difficulty for attackers to predict or guess the key. The server stores the newly generated SM4 key along with the client's identification information (such as client ID) and SID in the database, forming or updating the key set associated with that session. The server uses the client's SM2 public key to encrypt the newly generated SM4 key, forming a key encryption packet, and then sends it back to the client for subsequent message encryption and decryption.

[0074] If the enable flag in the SID sent by the client is set to "Yes," this typically indicates that the client wishes to continue using the previously exchanged SM4 key. The server retrieves the SM4 key associated with the SID from the database, ensuring key continuity and consistency. Encrypting the SM4 key with the SM2 public key is based on asymmetric encryption security; even if the encrypted packet is intercepted, a third party without the client's private key cannot decrypt the SM4 key, protecting the key security during encryption and decryption. Specifically, the server can query the key set stored in the database based on the parsed SID to find the SM4 key associated with it. The database design should support efficient queries to avoid impacting message encryption and decryption speed due to excessive query time. If the SM4 key corresponding to the SID is found, the server will use this key for subsequent message decryption and encryption / decryption operations without generating a new key. If the key corresponding to the SID does not exist in the database, the server will generate a new SM4 key, store it, and encrypt it before sending.

[0075] Additionally, when the enable flag is "Yes", the server also needs to monitor the status of the SM4 key to ensure its validity. If the key has expired or poses a security risk, the server should proactively send a new SID and a "No" enable flag to the client to trigger a key update.

[0076] By following the steps above, the use and updating of SM4 keys can be flexibly controlled, achieving the goal of maintaining high security while ensuring efficient communication. Generating a new key when the condition is "No" increases system security; while using the existing key when the condition is "Yes" improves communication efficiency, reduces unnecessary key generation and exchange, and simplifies implementation costs on both the client and server sides.

[0077] Step S204: Receive financial transaction messages encrypted by the partner client using the SM4 key, and decrypt the financial transaction messages using the SM4 key to obtain the original financial transaction information.

[0078] With the encryption and decryption keys already determined, the server receives business messages encrypted by the client using the SM4 key. The server then decrypts the messages using the same SM4 key, extracting the original financial business information to provide the foundational data for business processing.

[0079] The decrypted original information may include specific details of various financial service operations, such as transaction amount, account information, and transaction time. This information will be used for subsequent business logic processing.

[0080] Step S205: Execute business logic based on the original information of the financial business, and use the SM4 key to encrypt the response financial business communication message after business processing, and send it to the partner client.

[0081] The server performs business logic processing based on the decrypted original financial transaction information, such as account balance checks, transaction verification, and data record updates. After processing, the server encrypts the response message using the same SM4 key to ensure communication security, and then sends the encrypted message back to the client.

[0082] The execution of business logic is the core function of the server, ensuring the accuracy and compliance of financial transactions. Using SM4 keys to encrypt response messages prevents unauthorized third parties from obtaining the server's processing results of the original messages, protecting the security of customer information and transaction data. Furthermore, when encrypting response messages, the server can re-check the validity of the SID, ensuring session consistency and security and preventing any potential key attacks or data tampering.

[0083] Through the above steps, we can receive the Session Identifier (SID) and Enable Flag encrypted with the SM2 public key sent by the partner client, decrypt them using the SM2 private key corresponding to the partner client to obtain the Session Identifier (SID) and Enable Flag, obtain the SM4 key based on the Enable Flag, encrypt the SM4 key using the partner client's SM2 public key, and then send the encrypted key packet to the partner client. We can also receive the financial transaction messages encrypted with the SM4 key from the partner client, decrypt the financial transaction messages using the SM4 key, parse out the original financial transaction information, execute the business logic based on the original financial transaction information, encrypt the processed response financial transaction messages using the SM4 key, and send them to the partner client. In this embodiment, the SM2 and SM4 algorithms can be combined to ensure the security of financial business communication messages. By using the SM4 algorithm to encrypt large messages, the high efficiency of communication is guaranteed, data latency is reduced, user experience and system response speed are improved, and fast message encryption and decryption are achieved. This ensures the secure and rapid transmission of financial transaction information and improves the transaction success rate. This solves the technical problem in related technologies where financial institutions and their partners use the national cryptographic algorithm SM4 for message transmission, which is prone to key leakage and results in low security of message information.

[0084] It should be noted that this embodiment can effectively handle key leakage situations. The message encryption and decryption method based on the national cryptographic key also includes: when SM4 key leakage is detected, receiving a key update instruction sent by the partner client, wherein the key update instruction includes an instruction to update the SM4 key and a new session identifier SID; regenerating the SM4 key according to the new session identifier SID and storing it in the database; and using the regenerated SM4 key to perform encryption and decryption operations on financial business communication messages between the partner client and the partner client.

[0085] Specifically, in the event of an SM4 key breach, receiving a key update instruction from the partner client means that when the server detects that the currently used SM4 key may have been compromised, i.e., the key's security is threatened, the system needs to take immediate action to prevent unauthorized access to sensitive information. The partner client should send a key update instruction containing an explicit instruction to update the SM4 key and a new session identifier (SID).

[0086] It should be noted that the server in this embodiment can detect SM4 key leakage in various ways, such as monitoring abnormal patterns in network traffic, performing regular key strength analysis, and auditing key usage logs. Once a key leakage is detected, the system immediately enters an emergency response state. Upon receiving a key leakage notification from the server, or when the client detects a key security risk itself, it generates and sends a new SID, setting a "No" enable flag in the SID to explicitly instruct the server to generate a new SM4 key. The SID should contain sufficient information to ensure its uniqueness, such as the client's unique identifier, session timestamp, or random number. Upon receiving the key update instruction, the server regenerates the SM4 key based on the SID and stores the new key along with the SID in the database for future use.

[0087] The server uses the newly generated SM4 key for subsequent message encryption and decryption operations to ensure data security during communication. Simultaneously, the client should also use the new SID and SM4 key to encrypt and decrypt messages.

[0088] In the event of an SM2 key leak, when re-exchanging the SM2 key pair with the partner client, the SM2 key, as an asymmetric key, is used to encrypt the SID and SM4 key, ensuring the secure distribution of the symmetric key SM4. Once the SM2 key is leaked, the foundation of encrypted communication is severely compromised, necessitating a re-exchange of the SM2 key pair with the partner client to restore communication security. In this embodiment, SM2 key leaks can be detected by monitoring abnormal data packets in the network or through direct key auditing. Once an SM2 key leak is confirmed, the server should immediately stop using the current SM2 key and contact the client to initiate a key update process. After both parties update the SM2 key pair, the encryption and transmission process of the SID, as well as the subsequent encryption and distribution of the SM4 key, should be re-executed immediately using the new key.

[0089] In the event of a detected SM2 key breach, this embodiment provides an emergency response and key update mechanism to quickly restore a secure state and prevent unauthorized access and data leakage. Optionally, the message encryption and decryption method based on the national cryptographic key further includes: in the event of a detected SM2 key breach, re-exchanging the SM2 key pair with the partner client.

[0090] Detecting SM2 key leaks is a crucial step in secure communication. This embodiment can employ various methods for detection. For instance, regular security audits may reveal SM2 keys logged in insecure environments, such as log files, configuration files, or vulnerable storage areas. Alternatively, continuous monitoring of network traffic, especially during key exchange, can help identify potential man-in-the-middle attacks or key leaks. Detecting unexpected login attempts or data access patterns, particularly those attempting to access or decrypt data encrypted with SM2 keys, may indicate a key leak. Security intelligence systems or third-party security alerts can provide information that the SM2 key may have been obtained by a third party. Once an SM2 key leak is confirmed, immediate action must be taken to re-exchange the SM2 key pair with the partner client to restore secure communication.

[0091] Upon confirmation of an SM2 key breach, the server must immediately notify the partner client of the breach and instruct them to urgently update the key pair. To securely exchange the new SM2 key pair, both parties need to establish a secure communication channel. This can be achieved through pre-shared keys, digital certificates, or other security protocols to ensure the security and integrity of the keys during transmission. The server should regenerate a new SM2 key pair, including a new public and private key. Similarly, the client should also regenerate its SM2 key pair to align with the server's update, encrypting the newly generated SM2 public key using the partner client's historical SM2 public key (or a pre-shared key, if available) to ensure key security during transmission. The client should also encrypt the newly generated public key using the server's historical SM2 public key during transmission, updating the key pair in a symmetric manner.

[0092] After both parties complete the key pair update, they should confirm the successful key pair update through secure communication to ensure that subsequent message encryption and decryption operations can proceed normally. After updating the SM2 key pair, all subsequent communications should use the new key pair. This means that in subsequent SID generation and encryption / decryption operations, the public and private keys in the new key pair will be used to ensure that the security of communication and the confidentiality of information are not affected by previous key leaks.

[0093] Through the above implementation steps, in the event of SM2 key leakage, the system can quickly and securely re-exchange the SM2 key pair with the partner client, restoring a secure communication environment. This not only enhances the system's security protection capabilities but also reduces the potential impact of key leakage on business continuity and data security.

[0094] The present invention will now be described through another implementation method.

[0095] According to another aspect of the present invention, a message encryption and decryption method based on national cryptographic keys is also provided, which is applied to a partner client, wherein the partner client has a pre-established communication connection with the open platform server of the financial institution described in any of the above embodiments.

[0096] Figure 3 This is a flowchart of another optional message encryption / decryption method based on a national cryptographic key according to an embodiment of the present invention, such as... Figure 3 As shown, the message encryption and decryption method based on the national cryptographic key includes:

[0097] Step S301: Generate Session Identifier (SID) and set the Enable flag.

[0098] Optionally, when generating the session identifier (SID), the process includes: generating a session identifier (SID) containing an enable flag based on a distributed ID generation algorithm negotiated between the partner client and the open platform server, wherein the enable flag is used to indicate whether the open platform server should look up an existing SM4 key from the database or generate a new SM4 key.

[0099] Before the client and the open platform server establish communication, they need to agree on an ID generation algorithm based on a distributed environment, such as the Snowflake Algorithm. The Snowflake Algorithm is a distributed ID generation algorithm that generates globally unique and incrementally increasing 64-bit integer IDs, typically including a timestamp, worker node ID, and sequence number. When generating the SID, an enable flag can be embedded in the SID. In this embodiment, the enable flag can be a binary bit used to indicate whether the server should search the database for an existing SM4 key for the session, or whether a new SM4 key should be generated.

[0100] When setting the enable flag, the client decides based on the actual situation. If set to "Yes," it indicates that the client wants to continue using the existing SM4 key for the current session. This usually means that the two parties have had one or more successful communication sessions before, and the current SM4 key is still valid and secure. If set to "No," it instructs the server to generate a new SM4 key. This may be in situations where: there is no existing SM4 key when the initial session is established; the client detects that the current session's SM4 key may have been compromised or is no longer secure; or the client believes it is necessary to update the key to improve security, as required by a periodic key rotation policy.

[0101] It should be noted that the Session Identifier (SID) provided in this embodiment may include, but is not limited to, the following information: Enable flag: a single bit used to indicate whether to use an existing SM4 key or generate a new key; Client identification information: such as client ID, MAC address, or device ID, used to identify a specific partner client; Timestamp or random number: used to generate the global uniqueness of the SID, preventing session replay or prediction. The timestamp can be accurate to milliseconds or finer granularity, while the random number should be generated by a secure random number generator; Session sequence number: in some implementations, the SID may include a session sequence number to help track and manage multiple concurrent sessions.

[0102] After generating a SID according to the negotiated distributed ID generation algorithm, the client encrypts the SID using the server's SM2 public key, forming an encrypted SID data packet. This encryption process ensures the confidentiality of the SID during transmission; even if the data packet is intercepted, attackers cannot decipher the specific content of the SID, including critical information such as the enabled flag. By enabling the flag, the client can flexibly instruct the server to use the existing SM4 key or generate a new key. This not only improves the efficiency and security of message encryption and decryption but also simplifies key management complexity, ensuring a secure, efficient, and flexible message encryption and decryption method within the framework of Chinese cryptographic algorithms.

[0103] By generating a SID, messages receive dual protection during transmission: the asymmetric SM2 key protects the symmetric SM4 key and session identifier, while the SM4 key is used for rapid encryption and decryption of message content, ensuring high security while maintaining high communication efficiency. Simultaneously, the enable flag in the SID provides dynamic key management, allowing the system to automatically adjust key usage according to actual needs, enhancing the overall flexibility and security of the solution.

[0104] Step S302: Encrypt the session identifier SID and the enable flag using the server's SM2 public key, send the encrypted session identifier SID and enable flag to the open platform server, and receive the SM4 key encrypted using the partner client's SM2 public key returned by the open platform server.

[0105] The partner client uses the server's SM2 public key to encrypt the SID and enable flag, forming an encrypted data packet. The encryption process follows the national cryptographic algorithm standard and utilizes the elliptic curve cryptography of SM2 to ensure data security during transmission. Even if the data packet is intercepted, attackers cannot decrypt and obtain the SID and enable flag information.

[0106] It should be noted that, in this embodiment, after the collaborating client sends the encrypted SID and enable flag to the server, it waits to receive an encrypted data packet returned by the server. This encrypted data packet may contain an SM4 key encrypted by the server using the client's SM2 public key. The collaborating client uses its own SM2 private key to decrypt this data packet, obtain the SM4 key, and complete the secure distribution of the SM4 key.

[0107] Step S303: Use the SM2 private key of the partner client to decrypt the SM4 key, and use the decrypted SM4 key to encrypt financial transaction messages.

[0108] Upon receiving the encrypted SM4 key data packet from the server, the partner client decrypts it using its own SM2 private key. The use of the SM2 private key is based on an asymmetric encryption mechanism, ensuring that only the entity possessing the correct private key, i.e., the client itself, can decrypt and obtain the SM4 key.

[0109] It should be noted that in this embodiment, the collaborating client uses the SM4 key to encrypt financial transaction messages after decrypting to obtain the SM4 key. SM4 is a block cipher algorithm, which is faster and more efficient than SM2. It is suitable for encrypting and decrypting large amounts of data, such as financial transaction messages. The encryption process follows the national cryptographic algorithm standard to ensure the confidentiality and integrity of the message content.

[0110] Step S304: Send the session identifier SID, the encrypted financial transaction message, and the authentication information to the open platform server to complete the financial transaction processing.

[0111] Here, after encrypting the financial transaction message using the SM4 key, the client combines the encrypted message, SID, and necessary authentication information (such as username and password) into a data packet and sends it to the server. The authentication information verifies the client's identity, ensuring the legitimacy of the message sender. Upon receiving the data packet, the server first decrypts the encrypted financial transaction message using the SM4 key associated with the SID, restoring the original content. The decrypted message is then used for further business logic processing, such as account inquiries, transaction confirmations, and fund transfers. The server's decryption and processing of the message reflects the ultimate goal of encrypted communication: to ensure normal financial transactions while maintaining information security. After completing the business processing, the server encrypts the response message using the same SM4 key, then repackages the encrypted response message, SID, and any other possible authentication information and sends it back to the client, forming an encrypted response data packet.

[0112] The above implementation steps can generate a session identifier (SID) and set an enable flag. The SID and enable flag are encrypted using the server's SM2 public key. The encrypted SID and enable flag are sent to the open platform server. The server receives an SM4 key encrypted using the partner client's SM2 public key. The partner client's SM2 private key is used to decrypt the SM4 key. The decrypted SM4 key is used to encrypt financial transaction messages. The SID, the encrypted financial transaction messages, and authentication information are sent to the open platform server to complete the financial transaction processing. In this embodiment, the SM2 and SM4 national cryptographic algorithms can be combined on the client side to achieve efficient and secure communication of financial business transaction messages. The asymmetric encryption SM2 is used for secure key distribution, while the symmetric encryption SM4 is used for efficient encryption of large amounts of data. While ensuring the security of financial business transaction message transmission, the use of the SM4 algorithm to encrypt large messages ensures communication efficiency, improves user experience and system response speed, and enables fast message encryption and decryption. This ensures the secure and rapid transmission of financial transaction information, improves transaction success rate, and solves the technical problem in related technologies where the use of the SM4 national cryptographic algorithm for message transmission between financial institutions and partners is prone to key leakage, resulting in low security of message information.

[0113] It should be noted that the collaborating client in this embodiment retains lifecycle control over the SM4 key during the session. Optionally, the message encryption and decryption method based on the national cryptographic key further includes: after completing a session with the open platform server, the collaborating client retains a lifecycle control mechanism for the SM4 key, wherein the lifecycle control mechanism includes: controlling the usage status of the SM4 key by updating the enable flag in the session identifier SID; and sending a regenerated session identifier SID to the open platform server to obtain a new SM4 key when the SM4 key is leaked or expires.

[0114] When the current SM4 key is detected as potentially compromised (e.g., through security audits or suspicious activity) or reaches its preset lifecycle end (e.g., key expiration), the partner client will update the enable flag in the SID to "No" and generate a new SID, which will then be sent to the server. This action triggers the server to generate and send a new SM4 key. After sending the updated SID, the partner client waits to receive the new SM4 key returned by the server. Once the new key is obtained, the partner client will use it for subsequent encryption and decryption operations to ensure data security and confidentiality.

[0115] Optionally, the message encryption and decryption method based on the national cryptographic key also includes: using the reserved SM4 key to decrypt the financial transaction messages returned by the open platform server; and executing the business logic of the original financial transaction information indicated in the financial transaction messages.

[0116] After a successful session, the partner client retains the SM4 key instead of discarding it immediately. This is done so that in subsequent sessions, the retained SM4 key can be used immediately as long as the enable flag in the SID indicates "yes," avoiding the overhead of regenerating and distributing keys and improving communication efficiency.

[0117] When the server returns encrypted financial transaction messages, the client decrypts the messages using a reserved SM4 key. The decryption process ensures the integrity and confidentiality of the message content; only clients with the correct SM4 key can decrypt and read the message content. The decrypted financial transaction messages are then processed by the client's business system, executing the business logic of the original financial transaction information indicated in the message. This may include, but is not limited to, updating account information, verifying transaction records, and processing fund transfers. The execution of business logic is based on the decrypted message content, ensuring the correctness and security of the financial transactions.

[0118] The following describes in detail another optional implementation method.

[0119] The embodiments of the present invention provide a complete general encryption and decryption method for messages based on the improved national cryptographic algorithm. It can effectively improve the encryption and decryption algorithm speed of the message body, reduce the risk of key exchange, and reduce the difficulty of overall application modification under the same security level as SM2, thus making it suitable for a wider range of commercial message encryption and decryption scenarios.

[0120] In financial institution API open platforms, due to the uncertainty of message size, encryption / decryption speed, and ease of key exchange, symmetric key algorithms are currently used for message encryption and decryption. While this ensures processing efficiency, it cannot meet higher confidentiality requirements. The implementation method of this invention, however, is applicable to partners with more sensitive information who interact through financial institution APIs. By combining database operations, the time complexity of encryption and decryption processing is essentially equivalent to that of symmetric key algorithms, such as interactions between fund companies and financial institution accounting systems.

[0121] Figure 4 This is a schematic diagram of an optional general encryption and decryption method for messages based on national cryptographic keys according to an embodiment of the present invention, as shown below. Figure 4 Shown, including:

[0122] (1) The collaborating client and the server each possess a pair of SM2 keys. That is, the collaborating client has its own SM2 private key and public key (which can be regarded as key pair A), and the server also has its own SM2 private key and public key (key pair B). This key distribution method is based on the traditional mechanism of asymmetric encryption. In key pair A, the public key is used by the server to encrypt data to the collaborating client, while the private key is used by the collaborating client for decryption. Similarly, in key pair B, the public key is used by the collaborating client to encrypt data to the server, while the private key is used by the server for decryption.

[0123] (2) The communicating parties do not need to exchange private keys directly. In actual communication, the client and server only need to exchange their respective SM2 public keys. The private keys should always remain on their respective sides and not be transmitted to ensure the security of the asymmetric encryption mechanism.

[0124] (3) The partner client generates a session identifier (SID) containing an enable flag. The SID can be generated in various ways, such as using a distributed ID generation mechanism like the snowflake algorithm, to ensure the global uniqueness of the SID. The partner client encrypts the SID using the server's SM2 public key B and sends it to the server.

[0125] (4) The server uses its SM2 private key B to decrypt the received encrypted SID, retrieving the SID and the enable flag. Based on the enable flag, the server determines whether to search the database for an existing SM4 key. If the enable flag is set to "No," it indicates that the partner client requests a regeneration of the SM4 key, and the server will generate a new SM4 key based on the SID and its own UUID. If the enable flag is set to "Yes," the server should attempt to find the SM4 key associated with the SID in the database. If not found, a new SM4 key should also be generated, and the database record updated.

[0126] (5) The server uses the SM2 public key A of the partner client to encrypt the newly generated SM4 key, and then returns the encrypted SM4 key data packet to the partner client.

[0127] (6) After receiving the data packet returned by the server, the partner client decrypts the data packet using its own SM2 private key A to obtain the SM4 key. This process completes the secure distribution of the SM4 key.

[0128] (7) The partner client uses the obtained SM4 key to encrypt financial transaction messages, and then sends the encrypted messages along with authentication information such as SID, username, and password to the server.

[0129] (8) After receiving the encrypted message from the partner client, the server looks up the corresponding SM4 key in the database according to the SID, uses the key to decrypt the message, executes the business logic, generates a response message, encrypts it using the same SM4 key, and sends the encrypted response message and SID back to the partner client.

[0130] (9) The partner client uses the same SM4 key to decrypt the response message returned by the server and execute the business logic indicated in the message.

[0131] (10) The generation of the SID of the partner client should indeed adopt a distributed ID generation mechanism such as the snowflake algorithm, which includes an enable flag to control the usage status of the SM4 key.

[0132] (11) The server should store the SM4 key associated with the SID and its lifecycle status. Whether a new SM4 key is generated or an existing key is used for each communication is controlled by the partner client through the enable flag in the SID. This ensures dynamic management of the SM4 key and improves the security and flexibility of the system.

[0133] (12) When there are signs of SM4 key leakage, the partner client and / or server can trigger the generation of a new SM4 key by updating the enable flag in the SID to "No", without having to re-exchange the SM2 key pair. However, if the SM2 key pair is leaked, this will seriously jeopardize the security of the entire communication. In this case, both parties must stop the current communication session, regenerate and exchange the SM2 key pair to restore a secure communication environment.

[0134] Through the above implementation steps, the message encryption and decryption method based on the national cryptographic key provided in this embodiment not only offers a secure data transmission mechanism but also enhances the robustness and security of the system by allowing the partner client to control the lifecycle of the SM4 key. This mechanism allows for rapid response when a security threat is detected, while maintaining high communication efficiency and avoiding unnecessary key generation and distribution. It is well-suited for financial scenarios requiring real-time or near-real-time communication, such as account information exchange and transaction confirmation between banks and partners.

[0135] The embodiments of the present invention overcome the shortcomings of the prior art and provide a message encryption and decryption method that is simple and efficient under the premise of sufficient key security. It can effectively control the implementation cost and is not limited by platform or language, reducing the difficulty of modifying the overall application, thus making it suitable for a wider range of commercial message encryption and decryption scenarios.

[0136] The following is a detailed description with reference to another embodiment.

[0137] Example 2

[0138] The message encryption and decryption device based on the national cryptographic key provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in Embodiment 1 above.

[0139] This invention provides a message encryption and decryption device based on national cryptographic keys, which is applied to the open platform server of financial institutions. Figure 5 This is a schematic diagram of an optional message encryption / decryption device based on a national cryptographic key according to an embodiment of the present invention, as shown below. Figure 5 As shown, the message encryption and decryption device based on the national cryptographic key may include: an identifier receiving unit 51, an identifier decryption unit 52, a key encryption unit 53, an encrypted message receiving unit 54, and a service execution unit 55.

[0140] The identifier receiving unit 51 is used to receive the session identifier SID and enable flag sent by the partner client using the SM2 public key encryption.

[0141] The identifier decryption unit 52 is used to decrypt the session identifier SID and the enable flag using the SM2 private key corresponding to the partner client.

[0142] The key encryption unit 53 is used to obtain the SM4 key according to the enable flag, encrypt the SM4 key using the SM2 public key of the partner client, and send the key encryption package to the partner client.

[0143] The encrypted message receiving unit 54 is used to receive financial transaction messages encrypted by the partner client using the SM4 key, and to decrypt the financial transaction messages using the SM4 key to obtain the original financial transaction information.

[0144] The business execution unit 55 is used to execute business logic based on the original information of financial business, and to encrypt the response financial business communication messages after business processing using the SM4 key and send them to the partner client.

[0145] The aforementioned message encryption and decryption device based on the national cryptographic key can receive the session identifier SID and enable flag encrypted with the SM2 public key sent by the partner client through the identifier receiving unit 51, decrypt the session identifier SID and enable flag using the SM2 private key corresponding to the partner client through the identifier decryption unit 52, obtain the session identifier SID and enable flag through the key encryption unit 53, obtain the SM4 key according to the enable flag, encrypt the SM4 key using the partner client's SM2 public key, and then send the key encryption packet to the partner client. It can also receive the financial transaction messages encrypted with the SM4 key by the encrypted message receiving unit 54, decrypt the financial transaction messages with the SM4 key, parse out the original financial transaction information, execute the business logic based on the original financial transaction information through the business execution unit 55, encrypt the processed response financial transaction messages with the SM4 key, and send them to the partner client. In this embodiment, the SM2 and SM4 algorithms can be combined to ensure the security of financial transaction message transmission. By using the SM4 algorithm to encrypt large messages, communication efficiency is guaranteed, data latency is reduced, user experience and system response speed are improved, and rapid message encryption and decryption are achieved. This ensures the secure and rapid transmission of financial transaction information, increases transaction success rate, and solves the technical problem in related technologies where the use of the national cryptographic algorithm SM4 for message transmission between financial institutions and partners is prone to key leakage, leading to low security of message information.

[0146] Optionally, the key encryption unit includes: a new key generation module, used to generate a new SM4 key based on the session identifier SID and the server unique identifier when the enable flag indicates no, and store the client identifier, session identifier SID and the generated SM4 key in the database; or, a key query module, used to query the SM4 key corresponding to the session identifier SID from the database when the enable flag indicates yes, wherein the database stores a set of SM4 keys corresponding to all clients.

[0147] Optionally, the message encryption and decryption device based on the national cryptographic key further includes: a key update unit, used to receive a key update instruction sent by a partner client when the SM4 key is detected to be leaked, wherein the key update instruction includes an instruction to update the SM4 key and a new session identifier (SID); a key regeneration unit, used to regenerate the SM4 key according to the new session identifier (SID) and store it in the database; and a message encryption and decryption unit, used to perform encryption and decryption operations on financial transaction messages between the device and the partner client using the regenerated SM4 key.

[0148] Optionally, the message encryption and decryption device based on the national cryptographic key further includes: a key pair re-interaction unit, used to re-interact the SM2 key pair with the partner client in the event of a leak of the SM2 key.

[0149] Optionally, the Session Identifier (SID) includes: an enable flag indicating whether the database storage of the SM4 key is enabled; unique identification information of the partner client; and a session timestamp or random number.

[0150] According to another aspect of the present invention, a message encryption and decryption device based on the national cryptographic key is also provided, which is applied to a partner client. The partner client has a pre-established communication connection with the open platform server of the financial institution in the first embodiment above.

[0151] Figure 6 This is a schematic diagram of another optional message encryption / decryption device based on a national cryptographic key according to an embodiment of the present invention, such as... Figure 6 As shown, the message encryption and decryption device based on the national cryptographic key includes: an identifier generation unit 61, an identifier encryption unit 62, a key decryption unit 63, and an information sending unit 64.

[0152] The identifier generation unit 61 is used to generate the session identifier SID and set the enable flag.

[0153] The identifier encryption unit 62 is used to encrypt the session identifier SID and the enable flag using the server's SM2 public key, send the encrypted session identifier SID and the enable flag to the open platform server, and receive the SM4 key encrypted using the partner client's SM2 public key returned by the open platform server.

[0154] The key decryption unit 63 is used to decrypt the SM4 key using the SM2 private key of the partner client, and to encrypt financial transaction messages using the decrypted SM4 key.

[0155] The information sending unit 64 is used to send the session identifier SID, the encrypted financial transaction message and the authentication information to the open platform server to complete the financial transaction processing.

[0156] The aforementioned message encryption and decryption device based on national cryptographic keys can generate a session identifier (SID) and set an enable flag through the identifier generation unit 61, encrypt the session identifier (SID) and enable flag using the server's SM2 public key through the identifier encryption unit 62, send the encrypted session identifier (SID) and enable flag to the open platform server, and receive the SM4 key returned by the open platform server, which is encrypted using the partner client's SM2 public key. The key decryption unit 63 decrypts the SM4 key using the partner client's SM2 private key, and uses the decrypted SM4 key to encrypt financial transaction messages. Finally, the information sending unit 64 sends the session identifier (SID), the encrypted financial transaction messages, and authentication information to the open platform server to complete the financial transaction processing. In this embodiment, the SM2 and SM4 algorithms can be combined to ensure the security of financial business communication messages. By using the SM4 algorithm to encrypt large messages, the high efficiency of communication is guaranteed, data latency is reduced, user experience and system response speed are improved, and fast message encryption and decryption are achieved. This ensures the secure and rapid transmission of financial transaction information and improves the transaction success rate. This solves the technical problem in related technologies where financial institutions and their partners use the national cryptographic algorithm SM4 for message transmission, which is prone to key leakage and results in low security of message information.

[0157] Optionally, the identifier generation unit includes: an identifier generation module, used to generate a session identifier SID containing an enable flag bit according to a distributed ID generation algorithm negotiated between the partner client and the open platform server, wherein the enable flag bit is used to indicate whether the open platform server should look up an existing SM4 key from the database or generate a new SM4 key.

[0158] Optionally, the message encryption and decryption device based on the national cryptographic key further includes: a key lifecycle control unit, which is used to retain the lifecycle control mechanism of the SM4 key after the partner client completes a session with the open platform server. The lifecycle control mechanism includes: controlling the usage status of the SM4 key by updating the enable flag in the session identifier SID; and sending the regenerated session identifier SID to the open platform server to obtain a new SM4 key when the SM4 key is leaked or expires.

[0159] Optionally, the message encryption and decryption device based on the national cryptographic key further includes: a message decryption module, used to decrypt the financial transaction messages returned by the open platform server using the reserved SM4 key; and a financial transaction execution module, used to execute the business logic of the original financial transaction information indicated by the financial transaction messages.

[0160] The aforementioned message encryption and decryption device based on national cryptographic keys may further include a processor and a memory. The identifier receiving unit 51, identifier decryption unit 52, key encryption unit 53, encrypted message receiving unit 54, service execution unit 55, identifier generation unit 61, identifier encryption unit 62, key decryption unit 63, information sending unit 64, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0161] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, financial business interactions between financial institutions and their partner clients can be implemented based on national cryptographic algorithms.

[0162] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0163] Example 3

[0164] Embodiments of this application may provide an electronic device. Figure 7 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 7 As shown, the electronic device may include: one or more ( Figure 7 Only one of the following is shown: processor 702, memory 704, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module, and display.

[0165] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the message encryption and decryption method and apparatus based on national cryptographic keys in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned message encryption and decryption method based on national cryptographic keys. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0166] The processor can access information and applications stored in memory via a transmission device to perform the following steps: receiving a session identifier (SID) and an enable flag encrypted using an SM2 public key sent by a partner client; decrypting the session identifier (SID) and the enable flag using the SM2 private key corresponding to the partner client; obtaining an SM4 key based on the enable flag; encrypting the SM4 key using the partner client's SM2 public key; sending the encrypted key packet to the partner client; receiving financial transaction messages encrypted using the SM4 key from the partner client; decrypting the financial transaction messages using the SM4 key; parsing the original financial transaction information; executing business logic based on the original financial transaction information; encrypting the processed response financial transaction message using the SM4 key; and sending it to the partner client.

[0167] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: if the enable flag indicates no, generate a new SM4 key based on the session identifier SID and the server unique identifier, and store the client identifier, the session identifier SID and the generated SM4 key in the database; or, if the enable flag indicates yes, query the database for the SM4 key corresponding to the session identifier SID, wherein the database stores a set of SM4 keys corresponding to all clients.

[0168] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: upon detecting a leak of the SM4 key, receiving a key update instruction sent by the partner client, wherein the key update instruction includes an instruction to update the SM4 key and a new session identifier (SID); regenerating the SM4 key based on the new session identifier (SID) and storing it in the database; and using the regenerated SM4 key to perform encryption and decryption operations on financial transaction messages between the processor and the partner client.

[0169] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: in the event of a leak of the SM2 key, re-interact with the partner client on the SM2 key pair.

[0170] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: The session identifier SID includes: an enable flag, which indicates whether the database storage of the SM4 key is enabled; the unique identification information of the partner client; and a session timestamp or random number.

[0171] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: generating a session identifier (SID) and setting an enable flag; encrypting the SID and the enable flag using the server's SM2 public key, sending the encrypted SID and enable flag to the open platform server, and receiving an SM4 key encrypted using the partner client's SM2 public key returned by the open platform server; decrypting the SM4 key using the partner client's SM2 private key, and encrypting financial transaction messages using the decrypted SM4 key; and sending the SID, the encrypted financial transaction messages, and authentication information to the open platform server to complete the financial transaction processing.

[0172] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: generate a session identifier SID containing an enable flag bit according to the distributed ID generation algorithm negotiated between the partner client and the open platform server, wherein the enable flag bit is used to indicate whether the open platform server should look up an existing SM4 key from the database or generate a new SM4 key.

[0173] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: After the partner client completes a session with the open platform server, it retains a lifecycle control mechanism for the SM4 key, wherein the lifecycle control mechanism includes: controlling the usage status of the SM4 key by updating the enable flag in the session identifier SID, and sending the regenerated session identifier SID to the open platform server to obtain a new SM4 key when the SM4 key is leaked or expires.

[0174] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: decrypting the financial transaction messages returned by the open platform server using the reserved SM4 key; and executing the business logic of the original financial transaction information indicated by the financial transaction messages.

[0175] By employing the embodiments of this application, the SM2 and SM4 algorithms can be combined to ensure the security of financial business communication message transmission. At the same time, by using the SM4 algorithm to encrypt large messages, the high efficiency of communication is guaranteed, data latency is reduced, user experience and system response speed are improved, and fast message encryption and decryption are achieved. This ensures the secure and rapid transmission of financial transaction information and improves the transaction success rate. Thus, it solves the technical problem in related technologies where the use of the national cryptographic algorithm SM4 for message transmission between financial institutions and their partners is prone to key leakage, resulting in low security of message information.

[0176] Those skilled in the art will understand that Figure 7 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 7 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 7 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 7 The different configurations shown.

[0177] Those skilled in the art will understand that all or part of the steps in the various message encryption and decryption methods based on national cryptographic keys in the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0178] Example 4

[0179] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the message encryption / decryption method based on the national cryptographic key provided in Embodiment 1.

[0180] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute any of the message encryption and decryption methods based on the national cryptographic key in the first embodiment above.

[0181] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0182] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the message encryption and decryption methods based on national cryptographic keys described in various embodiments of this application.

[0183] This application also provides a computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the message encryption and decryption method based on the national cryptographic key described in various embodiments of this application.

[0184] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0185] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0186] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0187] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0188] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0189] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0190] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A message encryption and decryption method based on a national cryptographic key, characterized in that, Open platform servers used in financial institutions include: Receive the session identifier (SID) and enable flag encrypted with the SM2 public key from the partner client; The session identifier SID and the enable flag are obtained by decryption using the SM2 private key corresponding to the partner client; The SM4 key is obtained according to the enable flag. The SM4 key is encrypted using the SM2 public key of the partner client. The encrypted key packet is then sent to the partner client. Receive financial transaction messages encrypted by the partner's client using the SM4 key, and decrypt the financial transaction messages using the SM4 key to obtain the original financial transaction information; The system executes business logic based on the original information of the financial transaction, and uses the SM4 key to encrypt the processed response financial transaction messages before sending them to the partner client.

2. The message encryption / decryption method according to claim 1, characterized in that, The steps for obtaining the SM4 key based on the enabled flag include: If the enable flag indicates no, a new SM4 key is generated based on the session identifier (SID) and the server's unique identifier, and the client identifier, the session identifier (SID), and the generated SM4 key are stored in the database; or... When the enable flag is enabled, the SM4 key corresponding to the session identifier SID is queried from the database, wherein the database stores a set of SM4 keys corresponding to all clients.

3. The message encryption / decryption method according to claim 1, characterized in that, Also includes: If the SM4 key is detected to be leaked, a key update instruction sent by the partner client is received, wherein the key update instruction includes an instruction to update the SM4 key and a new session identifier (SID); The SM4 key is regenerated based on the new session identifier SID and stored in the database; The newly generated SM4 key is used to perform encryption and decryption operations on financial transaction messages between the client and the partner.

4. The message encryption / decryption method according to claim 1, characterized in that, Also includes: In the event of a detected SM2 key leak, the SM2 key pair is re-exchanged with the partner client.

5. The message encryption / decryption method according to claim 1, characterized in that, The session identifier SID includes: Enable flag, used to indicate whether to enable database storage of SM4 keys; The unique identification information of the partner's client; Session timestamp or random number.

6. A message encryption and decryption method based on a national cryptographic key, characterized in that, Applied to a partner client, wherein the partner client has a pre-established communication connection with the open platform server of the financial institution as described in any one of claims 1 to 5, including: Generate a session identifier (SID) and set the enable flag; The session identifier SID and the enable flag are encrypted using the server's SM2 public key. The encrypted session identifier SID and the enable flag are sent to the open platform server, and the SM4 key encrypted using the partner client's SM2 public key is received from the open platform server. The SM4 key is decrypted using the SM2 private key of the partner client, and the decrypted SM4 key is used to encrypt financial transaction messages. The session identifier (SID), the encrypted financial transaction message, and the authentication information are sent to the open platform server to complete the financial transaction processing.

7. The message encryption / decryption method according to claim 6, characterized in that, The steps for generating a session identifier (SID) include: Based on the distributed ID generation algorithm negotiated between the partner client and the open platform server, a session identifier SID containing an enable flag is generated, wherein the enable flag is used to indicate whether the open platform server should look up an existing SM4 key from the database or generate a new SM4 key.

8. The message encryption / decryption method according to claim 6, characterized in that, Also includes: After completing a session with the open platform server, the partner client retains a lifecycle control mechanism for the SM4 key. The lifecycle control mechanism includes: controlling the usage status of the SM4 key by updating the enable flag in the session identifier SID; and sending a regenerated session identifier SID to the open platform server to obtain a new SM4 key when the SM4 key is leaked or expires.

9. The message encryption / decryption method according to claim 6, characterized in that, Also includes: Use the reserved SM4 key to decrypt the financial transaction messages returned by the open platform server; The business logic that executes the original financial transaction information indicated in the financial transaction message.

10. A message encryption / decryption device based on a national cryptographic key, characterized in that, Open platform servers used in financial institutions include: The identifier receiving unit is used to receive the session identifier SID and enable flag sent by the partner client using the SM2 public key encryption. The identifier decryption unit is used to decrypt the session identifier SID and the enable flag using the SM2 private key corresponding to the partner client. The key encryption unit is used to obtain the SM4 key according to the enable flag, encrypt the SM4 key using the SM2 public key of the partner client, and send the key encryption package to the partner client; The encrypted message receiving unit is used to receive financial transaction messages encrypted by the partner client using the SM4 key, and to decrypt the financial transaction messages using the SM4 key to obtain the original financial transaction information. The business execution unit is used to execute business logic based on the original information of the financial business, and to encrypt the response financial business communication messages after business processing using the SM4 key and send them to the partner client.

11. A message encryption / decryption device based on a national cryptographic key, characterized in that, Applied to a partner client, wherein the partner client has a pre-established communication connection with the open platform server of the financial institution as described in claim 10, including: The identifier generation unit is used to generate the session identifier SID and set the enable flag. The identifier encryption unit is used to encrypt the session identifier SID and the enable flag using the SM2 public key of the server, send the encrypted session identifier SID and the enable flag to the open platform server, and receive the SM4 key encrypted using the SM2 public key of the partner client returned by the open platform server. The key decryption unit is used to decrypt the SM4 key using the SM2 private key of the partner client, and to encrypt financial transaction messages using the decrypted SM4 key. The information sending unit is used to send the session identifier (SID), the encrypted financial transaction message, and the authentication information to the open platform server to complete the financial transaction processing.

12. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the message encryption and decryption method based on the national cryptographic key as described in any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the message encryption and decryption method based on the national cryptographic key as described in any one of claims 1 to 9.

Images