Encryption operation method and system based on national cryptographic algorithm

Abstract

The invention relates to the technical field of data encryption, in particular to an encryption operation method and system based on a national cryptographic algorithm. The method comprises the steps that an encryption request is received through a security service interface layer, the encryption request is analyzed to determine a security target and data attribute information, and the security target comprises one or more combinations of confidentiality, integrity and non-repudiation; an encryption algorithm is selected according to the security target and the data attribute information, and a corresponding key is acquired from a key management unit according to the encryption algorithm; encrypting to-be-encrypted data in the encryption request by using an encryption algorithm and a key to obtain encrypted data; and the encrypted data is returned to the requester through the security service interface layer, and a corresponding encryption operation log is generated and stored in the auditing module. According to the method and the device, personalized encryption requirements in different scenes can be met.

Description

Technical Field

[0001] This application relates to the field of data encryption technology, and in particular to an encryption operation method and system based on the national cryptographic algorithm. Background Technology

[0002] With the rapid development of information technology and the increasing demand for data security, encryption technology, as a core means of ensuring information security, is widely used in key areas such as finance, government affairs, and communications. As a cryptographic standard independently developed by my country, the national cryptographic algorithms (such as SM2, SM3, and SM4) play an irreplaceable role in ensuring national information security and avoiding dependence on foreign encryption algorithms.

[0003] Most encryption systems in related technologies often use a single national cryptographic algorithm to handle encryption requests, lacking fine-grained adaptation to different encryption requirements and data attributes. This makes it difficult to balance encryption efficiency and security strength in practical applications. For example, some systems use the same encryption process regardless of data size and security requirements. This can lead to inefficiency when encrypting massive amounts of data, while inappropriate algorithm selection may pose security risks for highly sensitive data, failing to meet the encryption needs of diverse scenarios. Summary of the Invention

[0004] To address the problem that existing technologies cannot meet the personalized encryption needs of different scenarios, this application provides an encryption operation method and system based on the national cryptographic algorithm.

[0005] Firstly, this application provides an encryption operation method based on the national cryptographic algorithm, employing the following technical solution: An encryption operation method based on the Chinese national cryptographic algorithm includes: The encryption request is received through the security service interface layer, and the encryption request is parsed to determine the security objectives and data attribute information. The security objectives include one or more combinations of confidentiality, integrity and non-repudiation. An encryption algorithm is selected based on the security objective and the data attribute information, and the corresponding key is obtained from the key management unit based on the encryption algorithm. The encrypted data is obtained by encrypting the data to be encrypted in the encryption request using the encryption algorithm and the key. The encrypted data is returned to the requester through the security service interface layer, and a corresponding encrypted operation log is generated and stored in the audit module.

[0006] By adopting the above technical solution, the national cryptographic algorithm kernel module receives and parses encryption requests through the security service interface layer to determine the security target and data attributes. Combining these two factors, it selects an encryption algorithm, obtains the key from the key management unit, performs encryption, returns the data, and generates a log which is stored in the audit module. Through the collaborative work of various modules in the system, a closed-loop process is achieved, from request reception, algorithm selection, key acquisition to encryption execution and log auditing. This not only relies on the national cryptographic algorithm to ensure data security but also improves the standardization and traceability of encryption operations through modular division of labor, meeting the compliance and security requirements of data encryption in key areas.

[0007] In a preferred embodiment, this application can be further configured as follows: receiving the encryption request through the security service interface layer and parsing the encryption request to determine the security target and data attribute information includes: Receive the encryption request received and sent by the security service interface, obtain the request header of the encryption request, and parse the requester ID, timestamp and SM2 signature value from the request header; The requester ID, the timestamp, and the SM2 signature value are verified sequentially. When the requester ID, the timestamp, and the SM2 signature value are all successfully verified, the security target is parsed in order of priority by extracting explicit identifiers, analyzing interface paths, and matching content features. If the previous method fails, the next method is automatically enabled until the security target is successfully parsed. Extract the data to be encrypted from the encryption request, determine the data type and data volume of the data to be encrypted, and the data type and data volume constitute the data attribute information.

[0008] By adopting the above technical solutions, illegal requests and replay attacks are blocked through multi-layered verification (identity, timeliness, and integrity), ensuring the credibility of the request source. Prioritizing the parsing of security targets improves the robustness of target identification and avoids process interruption caused by the failure of a single parsing method. Meanwhile, clarifying data attributes lays the foundation for accurate selection of subsequent algorithms and further ensures encryption compatibility.

[0009] In a preferred embodiment, this application can be further configured such that: the selection of an encryption algorithm from the set of national cryptographic algorithms based on the security objective and the data attribute information includes: Retrieve the target algorithm mapping relationship, which includes: confidentiality corresponds to the SM4 algorithm or the SM2 algorithm, integrity corresponds to the SM3 algorithm, and non-repudiation corresponds to the SM2 algorithm and the SM3 algorithm; The initial encryption algorithm for the encryption request is obtained by matching the target algorithm mapping relationship with the security target; The encryption algorithm is obtained by adjusting the initial encryption algorithm based on the data type and data volume in the data attribute information.

[0010] By adopting the above technical solutions, the pre-defined mapping relationship ensures the basic compatibility between the security target and the national cryptographic algorithm, avoiding the randomness of algorithm selection; adjusting the algorithm based on data attributes achieves on-demand adaptation, ensuring both security requirements and encryption efficiency, and avoiding resource waste.

[0011] In a preferred embodiment, this application can be further configured such that obtaining the corresponding key from the key management unit according to the encryption algorithm includes: A key request is constructed based on a key request template. The key request includes: an encryption algorithm identifier, a requester ID, a key request timestamp, and a key usage scenario. The key usage scenario is consistent with the request scenario of the encryption request. The key request is sent to the key management unit so that the key management unit can verify the key access permission of the requester ID, verify the validity of the key request timestamp, and after the key access permission and the key request timestamp validity are verified, retrieve the key from the key pool based on the encryption algorithm identifier and the key usage scenario, and encrypt the key using a temporary session encryption algorithm. Receive the encrypted key transmitted by the key management unit through the encryption channel.

[0012] By adopting the above technical solutions, the standardized key request format ensures request parsability, the authorization verification prevents unauthorized entities from obtaining the key, and the timestamp verification avoids the risk of expired requests. The dual protection of key security through encryption before key transmission and encryption channel transmission prevents key leakage during distribution, thus building a solid security foundation for encryption operations from the source.

[0013] In a preferred embodiment, this application can be further configured such that: encrypting the data to be encrypted in the encryption request using the encryption algorithm and the key to obtain encrypted data includes: The data to be encrypted is subjected to standardization processing, which includes one or more of the following: removing redundant characters, reordering, data fragmentation, and encoding conversion. The encryption algorithm and the key are subjected to compatibility verification. If the compatibility check is successful, the encryption algorithm is executed. The encrypted data is obtained by encapsulating the encrypted ciphertext and associated parameters into a standard encrypted data format.

[0014] By adopting the above technical solutions, standardized processing optimizes the data structure, reduces redundancy, unifies the format, and improves encryption efficiency and compatibility; adaptability verification identifies algorithm and key mismatch issues in advance, avoiding encryption failures or security vulnerabilities; and standard format encapsulation facilitates parsing and verification by the requesting party, ensuring the consistency and operability of encrypted data during the interaction process.

[0015] In a preferred embodiment, this application can be further configured such that executing the encryption algorithm includes: When the encryption algorithm is a combination of multiple algorithms, the execution order and data interaction between the algorithms are determined according to a preset process; If the security objectives include confidentiality and non-repudiation, then the SM3 hash value of the data to be encrypted is signed using the SM2 algorithm and a private key, and then the signed data is encrypted using the SM4 algorithm and a symmetric key.

[0016] By adopting the above technical solutions, the execution logic of the combined algorithms is clarified, avoiding the loss of security objectives due to disordered algorithm order. Taking the first signature and then encryption as an example, non-repudiation is achieved through signing, while the confidentiality of the signature information and the original data is guaranteed through encryption, ensuring that the composite security objectives are fully implemented and improving the rigor of the encryption scheme.

[0017] In a preferred embodiment, this application can be further configured as follows: returning the encrypted data to the requester through the security service interface layer and generating corresponding encryption operation logs for storage in the audit module includes: The SM3 algorithm is used to calculate the hash value of the encrypted data to generate an integrity check digest; The encrypted data is associated with the integrity verification digest and returned to the requester through the national cryptographic SSL channel of the security service interface layer. At the same time, the data transmission status is monitored in real time during the transmission process, and a retransmission mechanism is triggered if the transmission is interrupted. An encrypted operation log is generated, and after being signed using the SM2 algorithm, it is stored in the encrypted log library of the audit module.

[0018] By adopting the above technical solutions, the SM3 digest and the national cryptographic SSL channel provide dual protection for the integrity and confidentiality of data transmission. The retransmission mechanism solves the problem of transmission failure caused by network fluctuations, ensuring reliable data delivery. Log signing and encrypted storage ensure the authenticity and security of logs, providing a reliable basis for subsequent auditing and tracing, and meeting compliance requirements.

[0019] Secondly, this application provides an encrypted operating system based on the national cryptographic algorithm, employing the following technical solution: An encrypted operating system based on Chinese national cryptographic algorithms includes: The security service interface layer is used to receive encryption requests and encrypted data returned by the national cryptographic algorithm kernel module; A key management unit, wherein the key management unit is used to store keys; The national cryptographic algorithm kernel module is used to parse the encryption request to determine the security objective and data attribute information. The security objective includes one or more combinations of confidentiality, integrity, and non-repudiation. It selects an encryption algorithm based on the security objective and the data attribute information, and obtains the corresponding key from the key management unit based on the encryption algorithm. It then uses the encryption algorithm and the key to encrypt the data to be encrypted in the encryption request to obtain encrypted data. Finally, it generates an encryption operation log. The audit module is used to receive and store the encryption operation logs transmitted by the national cryptographic algorithm kernel module.

[0020] In a preferred embodiment, this application can be further configured such that: when the national cryptographic algorithm kernel module executes the step of receiving an encryption request through the security service interface layer and parsing the encryption request to determine the security target and data attribute information, it is specifically used for: Receive the encryption request received and sent by the security service interface, obtain the request header of the encryption request, and parse the requester ID, timestamp and SM2 signature value from the request header; The requester ID, the timestamp, and the SM2 signature value are verified sequentially. When the requester ID, the timestamp, and the SM2 signature value are all successfully verified, the security target is parsed in order of priority by extracting explicit identifiers, analyzing interface paths, and matching content features. If the previous method fails, the next method is automatically enabled until the security target is successfully parsed. Extract the data to be encrypted from the encryption request, determine the data type and data volume of the data to be encrypted, and the data type and data volume constitute the data attribute information.

[0021] In summary, this application includes the following beneficial technical effects: The national cryptographic algorithm kernel module receives and parses encryption requests through the security service interface layer to determine the security target and data attributes. It then selects an encryption algorithm based on these factors, obtains the key from the key management unit, performs encryption, returns the data, and generates a log which is stored in the audit module. Through the collaborative work of various modules, a closed-loop process is achieved, from request reception, algorithm selection, key acquisition to encryption execution and log auditing. This not only relies on the national cryptographic algorithm to ensure data security but also improves the standardization and traceability of encryption operations through modular division of labor, meeting the compliance and security requirements of data encryption in key areas. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the structure of an encrypted operating system based on the national cryptographic algorithm provided in an embodiment of this application; Figure 2 This is a flowchart illustrating an encryption operation method based on the national cryptographic algorithm provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0023] The following is in conjunction with the appendix Figure 1 To be continued Figure 3 This application will be described in further detail.

[0024] This specific embodiment is merely an explanation of this application and is not intended to limit it. After reading this specification, those skilled in the art can make modifications to this embodiment without contributing any inventive step, but such modifications are protected by patent law as long as they fall within the scope of the claims of this application.

[0025] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article, unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship.

[0027] It should be noted that, in the optional embodiments of this application, the data related to object information, when applied to specific products or technologies, requires the permission or consent of the object. Furthermore, the collection, use, and processing of this data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. In other words, if the embodiments of this application involve data related to an object, it must be obtained with the object's authorization and consent, the authorization and consent of relevant departments, and in accordance with the relevant laws, regulations, and standards of the country and region. If the embodiments involve personal information, the acquisition of all personal information requires the individual's consent. If sensitive information is involved, the separate consent of the information subject is required. The embodiments also need to be implemented with the object's authorization and consent.

[0028] This application provides an encrypted operating system based on Chinese national cryptographic algorithms, such as... Figure 1 As shown, the system includes: a security service interface layer 101, a key management unit 102, a national cryptographic algorithm kernel module 103, and an audit module 104. The system is loaded onto an electronic device, which can be a server or a terminal device. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The terminal device can be a smartphone, tablet, laptop, desktop computer, etc., but is not limited to these. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, and this embodiment does not impose any limitations.

[0029] This application provides an encryption operation method based on the national cryptographic algorithm, such as... Figure 2 As shown, the method provided in this embodiment is executed by the national cryptographic algorithm kernel module, and the method includes steps S201-S204, wherein: S201. Receive encryption requests through the security service interface layer, parse the encryption requests to determine security objectives and data attribute information. Security objectives include one or more combinations of confidentiality, integrity and non-repudiation.

[0030] Specifically, the security service interface layer acts as a security gateway for system-to-external interaction. It receives encryption requests and forwards them to the national cryptographic algorithm kernel module, while also providing secure data transmission channels, such as the national cryptographic SSL channel. The requesting party (such as an application system or user terminal) sends an instruction containing the data to be encrypted as an encryption request. This request is encapsulated in a structured format, including a request header and a request body, with the data to be encrypted contained within the request body. The security objective represents the requesting party's security requirements for the data. Data attribute information indicates the data type and volume of the data to be encrypted.

[0031] After receiving a request through the interface layer, the legitimacy of the request is first verified, and then the security objectives and data attributes are extracted from the request to provide a basis for subsequent algorithm selection. The verification process ensures that the request source is trustworthy, has not been tampered with, and is within the valid time frame, while the parsing process ensures the accuracy of the security objectives and data attributes through multi-dimensional extraction.

[0032] S202. Select an encryption algorithm based on the security objective and data attribute information, and obtain the corresponding key from the key management unit according to the encryption algorithm.

[0033] Specifically, the national cryptographic algorithm set consists of cryptographic algorithms independently developed in my country, including SM2 (asymmetric encryption / signature), SM3 (hash algorithm), and SM4 (symmetric encryption). The key management unit is responsible for the modules of key generation, storage, distribution, and revocation, and maintains the key pool (containing keys for different algorithms) and access permission policies. The key request template is a standardized key retrieval instruction format, ensuring that the key management unit can accurately parse the request parameters.

[0034] Based on the basic algorithm for security target mapping, the algorithm combination is adjusted according to data attributes (type, magnitude) to ensure that the algorithm is adapted to the needs of the scenario; the corresponding key is obtained from the key management unit through standardized requests, and the permissions of the requester are verified at the same time to ensure the security of key distribution.

[0035] S203. Use an encryption algorithm and a key to encrypt the data to be encrypted in the encryption request to obtain encrypted data.

[0036] Specifically, the data to be encrypted undergoes standardization to ensure uniform format, reduce redundancy, and improve encryption efficiency. The compatibility of the encryption algorithm and key is then verified. Finally, the data to be encrypted is encrypted and encapsulated into a standard encrypted data format.

[0037] S204. Return the encrypted data to the requester through the security service interface layer, and generate corresponding encrypted operation logs to be stored in the audit module.

[0038] Specifically, encrypted data is returned through a secure channel with attached verification information to ensure that the recipient obtains complete data; signed logs are generated and stored to ensure traceability of operations and immutability of logs.

[0039] In this embodiment, the Chinese cryptographic algorithm kernel module receives and parses encryption requests through the security service interface layer to determine the security target and data attributes. It then selects an encryption algorithm based on these factors, obtains the key from the key management unit, performs encryption, returns the data, and generates a log which is stored in the audit module. Through the collaborative work of various modules, a closed-loop process is achieved, from request reception, algorithm selection, key acquisition to encryption execution and log auditing. This not only relies on the Chinese cryptographic algorithm to ensure data security but also improves the standardization and traceability of encryption operations through modular division of labor, meeting the compliance and security requirements of data encryption in key areas.

[0040] One possible implementation of this application embodiment involves receiving an encryption request through a security service interface layer, parsing the encryption request to determine the security target and data attribute information, including: Receive the encryption request sent by the security service interface, obtain the request header of the encryption request, and parse the requester ID, timestamp and SM2 signature value from the request header; The requester ID, timestamp, and SM2 signature value are verified sequentially. When the requester ID, timestamp, and SM2 signature value are all successfully verified, the security target is parsed in order of priority by extracting explicit identifiers, analyzing interface paths, and matching content features. If the previous method fails, the next method is automatically used until the security target is successfully parsed. Extract the data to be encrypted from the encryption request, determine the data type and data volume of the data to be encrypted, and the data type and data volume constitute the data attribute information.

[0041] In this embodiment, the security service interface layer listens on a designated port through a preset communication protocol (such as HTTPS or WebSocket). When an encrypted request from the requester is detected, a temporary communication connection is established and the request data packet is received. The received data packet is parsed into structured data according to the protocol specification (such as HTTP / 2), separating the request header and request body. The requester ID, timestamp (request timestamp), and SM2 signature value are extracted from the request header.

[0042] The system maintains a list of authorized requesters, containing the IDs of all legitimate requesters, their corresponding SM2 public keys, and permission ranges. The system queries the list for the requester ID extracted in step one: if not found, it's considered an illegal request, rejected, and an exception is logged; if found, the requester's SM2 public key is obtained, and the process proceeds to the next verification step. The system reads the current timestamp and calculates the difference between it and the request timestamp. If the difference exceeds a preset threshold (e.g., 5 minutes), it's considered an expired request (potentially a replay attack) and rejected; if within the threshold, the process proceeds to the next verification step. The system extracts the original request content (including request header fields excluding the signature and the request body), converting it to a byte stream using UTF-8 encoding. The hash value (digest) of the original content is calculated using the SM3 algorithm and used as the verification benchmark. The extracted SM2 signature value is decrypted using the requester's SM2 public key to obtain the hash value corresponding to the signature. The decrypted hash value is compared with the benchmark hash value calculated by SM3: if they match, verification passes; if they don't match, the request is considered tampered with and rejected.

[0043] Extract explicit identifiers (first priority): Parse the predefined fields in the request body (such as the `security_goals` field in JSON format) and check if they contain standard identifiers for security goals (such as `confidentiality` for confidentiality, `integrity` for integrity, and `non-repudiation` for non-repudiation). If the request body does not have a `security_goals` field or the field value is empty, proceed to the next step. Analyze the API path (second priority): Parse the API path of the request, predefine path target mapping rules, and each predefined path corresponds to a specific security goal. Security goals can be extracted through path matching. If no matching path is found, proceed to the next step. Content feature matching (third priority): Extract content features from the request body content, match the content features with the predefined features corresponding to confidentiality, integrity, and non-repudiation, and select all security goals with a match score higher than a predefined match score threshold.

[0044] The data to be encrypted is the raw data that the requester needs to encrypt, which may be in the form of text, binary stream, etc. The data type is the format classification of the data to be encrypted. The data volume is the size of the data to be encrypted.

[0045] This embodiment uses multi-layered verification (identity, timeliness, integrity) to block illegal requests and replay attacks, ensuring the credibility of the request source; prioritizing the parsing of security targets improves the robustness of target identification and avoids process interruption caused by the failure of a single parsing method; and clearly defining data attributes lays the foundation for accurate selection of subsequent algorithms, further ensuring encryption compatibility.

[0046] One possible implementation of this application embodiment involves selecting an encryption algorithm from a set of national cryptographic algorithms based on security objectives and data attribute information, including: Retrieve the target algorithm mapping relationship, which includes: confidentiality corresponds to SM4 algorithm or SM2 algorithm, integrity corresponds to SM3 algorithm, and non-repudiation corresponds to SM2 algorithm and SM3 algorithm; The initial encryption algorithm for the encryption request is obtained by matching the target algorithm mapping relationship with the security target; The initial encryption algorithm is adjusted based on the data type and data volume in the data attribute information to obtain the encryption algorithm.

[0047] In this embodiment, a target algorithm mapping relationship is pre-defined based on the fixed characteristics of the national cryptographic algorithms and the essential requirements of different security objectives. SM4 is a symmetric encryption algorithm, known for its fast processing speed and high efficiency, making it ideal for encrypting large amounts of data (such as files and video streams) to ensure its content is not accessed by unauthorized individuals. SM2 is an asymmetric encryption algorithm, its core advantages lying in key exchange and digital signatures. Confidentiality corresponds to either the SM4 or SM2 algorithm, with SM4 having higher priority. SM3 is a hash algorithm that converts any input data into a fixed-length, unique hash value (digest). Before sending data, the sender calculates its SM3 hash value and sends it along with the data. Upon receiving the data, the receiver calculates the hash value using the same method and compares it with the received hash value. If they match, it indicates that the data has not been tampered with during transmission. This is a standard, efficient, and lightweight method for achieving integrity verification. The core of non-repudiation is digital signatures, and the SM2 algorithm inherently includes digital signature functionality. Signing requires a private key, which is held only by the signer, thus constituting non-repudiable evidence. Directly signing large amounts of data is inefficient. The best practice is to hash first and then sign. The sender first calculates the hash digest of the original data using the SM3 algorithm, and then signs this short digest using its own SM2 private key. The receiver verifies the signature using the sender's public key, obtains the digest, and then calculates the SM3 digest of the received data for comparison. This ensures both efficiency and achieves the security goal of non-repudiation by the sender.

[0048] In one possible scenario, with a single security objective, the initial encryption algorithm is directly matched. For confidentiality, the initial encryption algorithm is SM4, which is preferred by default due to its high efficiency and suitability for most scenarios. Only when the requester explicitly specifies that the data to be encrypted is key-level data will the initial encryption algorithm be SM2 (asymmetric encryption offers higher security and is suitable for sensitive key transmission). For integrity, the initial encryption algorithm is SM3. For non-repudiation, the initial encryption algorithm is a combination of SM2 and SM3 (SM3 calculates the data digest, and SM2 signs the digest).

[0049] In another possible scenario, the security objective is a composite requirement. When the security objective is confidentiality and integrity, the initial encryption algorithm is SM4 / SM2+SM3, where SM4 / SM2 guarantees confidentiality and SM3 guarantees integrity. When the security objective is confidentiality and non-repudiation, the initial encryption algorithm is SM4 / SM2+SM2+SM3, where SM4 / SM2 guarantees confidentiality and SM2+SM3 guarantees non-repudiation. When the security objective is integrity and non-repudiation, the initial encryption algorithm is SM2+SM3. When the security objective is confidentiality, integrity, and non-repudiation, the initial encryption algorithm is SM4 / SM2+SM3+SM2.

[0050] Furthermore, the initial encryption algorithm is adjusted based on the data type and data volume to obtain the final encryption algorithm. For text data, which is mainly a character stream with a regular structure, block encryption is suitable. If the initial algorithm contains SM4 / SM2 (corresponding to confidentiality), only SM4 is retained because text blocks have a large data volume, and symmetric encryption algorithms are more efficient. The signature is retained using the SM2 algorithm (corresponding to non-repudiation). For binary data, which is characterized by an irregular byte stream, the adjustment rule is: if the initial algorithm contains SM4 / SM2 (corresponding to confidentiality), only SM2 is retained if the data volume is less than a preset data volume threshold (e.g., 1KB); otherwise, only SM4 is retained. SM3 and the signature are retained using SM2 (corresponding to non-repudiation). For key data, which is characterized by an extremely small data volume and high sensitivity, the adjustment rule is: if the initial algorithm contains SM4 (corresponding to confidentiality or non-repudiation), it is replaced with SM2. Asymmetric encryption can prevent key transmission leakage, while symmetric encryption cannot guarantee the security of the key itself.

[0051] In this embodiment, the preset mapping relationship ensures the basic compatibility between the security target and the national cryptographic algorithm, avoiding the randomness of algorithm selection; the algorithm adjustment based on data attributes realizes on-demand adaptation, which not only ensures security requirements but also takes into account encryption efficiency, avoiding resource waste.

[0052] One possible implementation of this application embodiment involves obtaining the corresponding key from the key management unit according to the encryption algorithm, including: A key request is constructed based on a key request template. The key request includes: encryption algorithm identifier, requester ID, key request timestamp, and key usage scenario. The key usage scenario is consistent with the request scenario of the encryption request. The key request is sent to the key management unit so that the key management unit can verify the key access rights of the requester ID, verify the validity of the key request timestamp, and after the key access rights and key request timestamp validity are verified, the key is retrieved from the key pool based on the encryption algorithm identifier and key usage scenario, and the key is encrypted using a temporary session encryption algorithm. The received key management unit transmits the encrypted key through the encrypted channel.

[0053] In this embodiment, the key request template is a standardized key application format preset by the system. It defines the core fields that the key request must include, ensuring that the request information is complete and formatted uniformly, and preventing the key management unit from being unable to parse it due to missing fields or inconsistent formats. The encryption algorithm identifier is used to uniquely identify the encryption algorithm used in the current encryption process (such as SM4-128, SM2-256), enabling the key management unit to clearly identify the key type to be retrieved. The key request timestamp is the precise time when the key request was generated, used to prevent replay attacks (attackers repeatedly using expired requests to obtain keys). The key usage scenario describes the specific application scenario of the key (such as file encryption, API communication encryption, key distribution). The request scenario of the encryption request can be included in the request header or obtained by matching scenario features between the requester information and the request body content.

[0054] The national cryptographic algorithm kernel module sends the key request data packet to the request receiving interface of the key management unit through an encrypted channel. During transmission, TCP protocol and data fragmentation verification are enabled (each fragment uses SM3 to calculate a hash value) to ensure the complete transmission of the request data packet. The request receiving module of the key management unit listens on the port, and after receiving the request data packet, it first verifies the integrity of the data packet through SM3 hash verification (comparing the fragment hash values ​​during transmission with the overall hash value). If the verification fails, the packet is discarded directly.

[0055] The key management unit extracts the key request template content, separates the signature field from other core fields, and verifies the signature value using the requester's SM2 public key to confirm that the request has not been tampered with (if signature verification fails, it returns "Request tampered, processing refused"). The key management unit queries the key access permission list corresponding to the requester ID from the permission database. It compares the encryption algorithm identifier and key usage scenario in the request with the permission list: if the duration and scenario of the requested encryption algorithm key are both within the permission range, the permission verification passes; if either is outside the range, it returns "Insufficient permissions, key acquisition refused". The key management unit reads the current system time and calculates the difference between the current time and the timestamp in the request. If the difference is not greater than the preset key request threshold, the timestamp verification passes; if the difference is greater than the preset key request threshold, it is determined to be an expired request (possibly a replay attack), and it returns "Request expired, processing refused", and records the abnormal request log (including requester ID, timestamp, etc.).

[0056] The key pool is an encrypted database within the key management unit that stores keys for various national cryptographic algorithms. It is categorized by algorithm type, usage scenario, and key status (active / expired / destroyed). All keys are encrypted using the root key (SM4-256) of the key management unit. The temporary session encryption algorithm (which can be fixed as SM2 asymmetric encryption) is a temporarily negotiated encryption algorithm between the key management unit and the national cryptographic algorithm kernel module. It is used to encrypt the target key to be transmitted, preventing key interception during transmission.

[0057] The key management unit constructs query conditions based on the encryption algorithm identifier and the key usage scenario. For example, for a request of SM4-128 (file encryption - contract upload), the query conditions would be: Algorithm type = SM4, Key length = 128, Usage scenario = file encryption - contract upload, Status = Active. It queries the key pool for keys that meet the conditions. If multiple active keys exist, the key with the longest idle time is prioritized to avoid the risk of leakage due to prolonged use of a single key. If no active key exists, the key generation process is triggered, generating a 128-bit random key using the SM4 algorithm, marking its status as active, and storing it in the key pool after associating it with the scenario. The retrieved target key is extracted and decrypted using the root key of the key management unit to obtain the final key.

[0058] The key management unit generates a temporary SM2 key pair (session public key / session private key). The session private key is used only in this key transmission and is destroyed immediately after transmission. The session public key is sent to the national cryptographic algorithm kernel module through an encrypted channel (the kernel module receives it and temporarily stores it in memory for subsequent decryption of the target key). After receiving the session public key, the national cryptographic algorithm kernel module returns a session public key reception confirmation (including the SM3 hash value). The key management unit verifies the integrity of the confirmation information to ensure that the session public key transmission is error-free. The key management unit uses the temporary session public key to perform SM2 asymmetric encryption on the original target key to obtain the target key (using the SM2 standard encryption mode, the encryption result is 64 bytes of ciphertext). Key metadata (including key ID, validity period, algorithm identifier, and usage scenario) is added to the encrypted target key. The hash value of the encryption key and metadata is calculated using SM3 as an integrity verification credential. The encrypted target key, key metadata, and SM3 hash value are encapsulated together into a key response data packet, and a response ID (corresponding to the request ID, used for tracking) is added.

[0059] The national cryptographic algorithm kernel module listens for the key response data packets on the encrypted channel's response port. It performs preliminary verification on the received data packets: checking if the packet format conforms to preset standards, such as whether it contains fields like the encryption key, metadata, and SM3 hash value. If the format is incorrect, it requests retransmission from the key management unit, setting a maximum number of retransmissions; once this limit is reached, the encryption process stops.

[0060] Extract the encrypted target key and key metadata from the data packet, recalculate the hash value using the SM3 algorithm, and compare it with the SM3 hash value in the data packet: if they match, the data packet has not been tampered with; if they do not match, return the retransmission instruction. Extract the signature of the response data packet made with the SM2 private key of the key management unit from the data packet, and verify the signature using the public key of the key management unit: if the signature verification passes, the data packet is confirmed to come from a legitimate key management unit; if the verification fails, it is determined to be an illegal response, the data packet is discarded, and a security log is recorded.

[0061] The national cryptographic algorithm kernel module calls the temporary session private key to perform SM2 decryption on the encrypted target key, and obtains the original target key, which means that the encrypted key transmitted by the key management unit through the encryption channel has been successfully received.

[0062] In this embodiment, the standardized key request format ensures request parsability, permission verification prevents unauthorized entities from obtaining the key, and timestamp verification avoids the risk of expired requests. The dual protection of key security through encryption before key transmission and encrypted channel transmission prevents key leakage during distribution, thus building a solid security foundation for encryption operations from the source.

[0063] One possible implementation of this application embodiment involves encrypting the data to be encrypted in an encryption request using an encryption algorithm and a key to obtain encrypted data, including: The encrypted data is to be standardized. Standardization includes one or more of the following: removing redundant characters, reordering, data fragmentation, and encoding conversion. Perform compatibility verification on the encryption algorithm and key; If the compatibility check is successful, the encryption algorithm will be executed. The encrypted ciphertext and associated parameters are encapsulated into a standard encrypted data format to obtain encrypted data.

[0064] In this embodiment, removing redundant characters means deleting meaningless characters from the data, such as spaces and newlines in text, reducing data volume and lowering the computational load for encryption. Sequential reorganization means reordering unstructured data according to preset rules to form structured data, facilitating processing by the encryption algorithm in fixed blocks. Preset rules can be based on field priority or alphabetical sorting. Data fragmentation, for large datasets, splits the data according to the block size of the encryption algorithm, generating multiple data fragments to support parallel encryption. Encoding conversion converts non-binary data into a binary byte stream supported by the encryption algorithm.

[0065] The compatibility check verifies whether the currently selected encryption algorithm type and the obtained key match. If the algorithm type includes SM4, the corresponding key type is a symmetric key; otherwise, it is considered incompatible. If the algorithm type includes SM2, the corresponding key type is an asymmetric key / public key for encryption / private key for signing; otherwise, it is considered incompatible. If the algorithm type only includes SM3, the compatibility check step is skipped. Further checks can be performed on the key's length and validity.

[0066] Standard encrypted data format represents a unified encapsulation format for encrypted results, including ciphertext, associated parameters (such as algorithm identifier, initialization vector, hash digest, signature value, key metadata) and format identifier, ensuring that the receiver can parse, verify and decrypt according to fixed rules, while being compatible with different combinations of encryption algorithms.

[0067] This embodiment optimizes the data structure through standardization, reduces redundancy, unifies the format, and improves encryption efficiency and compatibility; adaptability verification checks in advance to identify algorithm and key mismatch issues, avoiding encryption failures or security vulnerabilities; standard format encapsulation facilitates parsing and verification by the requesting party, ensuring the consistency and operability of encrypted data during the interaction process.

[0068] One possible implementation of this application embodiment involves executing an encryption algorithm, including: When the encryption algorithm is a combination of multiple algorithms, the execution order and data interaction between the algorithms are determined according to a preset process; If the security objectives include confidentiality and non-repudiation, the SM2 algorithm and the private key are used to sign the SM3 hash value of the data to be encrypted, and then the SM4 algorithm and the symmetric key are used to encrypt the signed data.

[0069] In this embodiment, if the encryption algorithm contains only one type of algorithm, then the encryption is performed directly using that algorithm.

[0070] If the encryption algorithm includes multiple algorithm types, each algorithm will be executed according to a preset procedure, as follows: In one possible scenario, the encryption algorithm combination is SM4+SM3. The encryption process is as follows: the data is encrypted using the SM4 algorithm to generate ciphertext; the hash digest (256 bits) of the original data is calculated using the SM3 algorithm to verify that the data has not been tampered with before encryption; the SM4 ciphertext and the SM3 digest are stored together, and during decryption, the integrity of the digest is verified first, and then decryption is performed using the SM4 key.

[0071] In another possible scenario, the encryption algorithm combination is SM2+SM3. The encryption process is as follows: the hash digest of the key data is calculated using the SM3 algorithm to avoid directly signing the key, thereby reducing the risk of key exposure; the sender's SM2 private key is used to sign the SM3 digest to generate a digital signature; the original key data is encrypted using the receiver's SM2 public key; the SM2 encryption key + SM3 digest + SM2 signature are transmitted, and the receiver verifies the signature using the sender's public key and decrypts the key using its own private key.

[0072] In another possible scenario, the encryption algorithm combination is SM4+SM2+SM3. The encryption process is as follows: calculate the overall hash digest using the SM3 algorithm; sign the SM3 digest using the sender's SM2 private key to generate a digital signature; encrypt the SM4 key using the receiver's SM2 public key to prevent SM4 key leakage; combine the ciphertext + encrypted SM4 key + SM3 digest + SM2 signature, and the receiver follows the process of signature verification → decrypting the SM4 key → verifying the digest → decryption.

[0073] If the data is too large and needs to be fragmented, the encryption process is as follows: fragmentation, generating a fragment list; encrypting each fragment with SM4 to obtain fragment ciphertext; calculating the overall hash digest of all fragment ciphertexts using the SM3 algorithm (to verify the integrity after fragment merging); signing the SM3 digest with the sender's SM2 private key to generate a digital signature; encrypting the SM4 key with the receiver's SM2 public key to prevent SM4 key leakage; merging the fragment ciphertext + encrypted SM4 key + SM3 digest + SM2 signature, with the receiver following the process of signature verification → decrypting the SM4 key → merging fragments → verifying the digest → decrypting fragments.

[0074] This embodiment avoids missing security objectives due to disordered algorithm order by clearly defining the execution logic of the combined algorithm. Taking signing before encryption as an example, it achieves non-repudiation through signing and ensures the confidentiality of the signature information and the original data through encryption, ensuring that the composite security objectives are fully implemented and improving the rigor of the encryption scheme.

[0075] One possible implementation of this application embodiment involves returning encrypted data to the requester through a security service interface layer and generating corresponding encryption operation logs which are stored in the audit module, including: The SM3 algorithm is used to calculate the hash value of the encrypted data and generate an integrity verification digest. The encrypted data is associated with the integrity verification digest and returned to the requester through the national cryptographic SSL channel of the security service interface layer. At the same time, the data transmission status is monitored in real time during the transmission process, and a retransmission mechanism is triggered if the transmission is interrupted. An encrypted operation log is generated, and after being signed using the SM2 algorithm, it is stored in the encrypted log library of the audit module.

[0076] In this embodiment, after the first transmission fails, the data packet is automatically retransmitted, and the SM3 digest is recalculated before each retransmission (to avoid the original digest becoming invalid). If the retransmission fails after a preset maximum number of attempts, a transmission failure error code is returned to the requester, and a transmission log is recorded, which includes the reason for the failure, the time, and the number of retransmissions. If the transmission is successful, the requester's acceptance confirmation response is received.

[0077] In this embodiment, the SM3 digest and the national cryptographic SSL channel provide dual protection for the integrity and confidentiality of data transmission. The retransmission mechanism solves the problem of transmission failure caused by network fluctuations, ensuring reliable data delivery. Log signing and encrypted storage ensure the authenticity and security of logs, providing a reliable basis for subsequent auditing and tracing, and meeting compliance requirements.

[0078] This application provides an encrypted operating system based on Chinese national cryptographic algorithms, including: Security service interface layer 101 is used to receive encryption requests and encrypted data returned by the national cryptographic algorithm kernel module; Key management unit 102, the key management unit is used to store keys; The national cryptographic algorithm kernel module 103 is used to parse the encryption request to determine the security objective and data attribute information. The security objective includes one or more combinations of confidentiality, integrity, and non-repudiation. It selects an encryption algorithm based on the security objective and the data attribute information, and obtains the corresponding key from the key management unit based on the encryption algorithm. It then uses the encryption algorithm and the key to encrypt the data to be encrypted in the encryption request to obtain encrypted data. Finally, it generates an encryption operation log. The audit module 104 is used to receive and store the encryption operation log transmitted by the national cryptographic algorithm kernel module.

[0079] This application provides an electronic device, such as... Figure 3 As shown, Figure 3 The illustrated electronic device 300 includes a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, for example, via a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in practical applications, the transceiver 304 is not limited to one type, and the structure of this electronic device 300 does not constitute a limitation on the embodiments of this application.

[0080] Processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 301 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0081] Bus 302 may include a pathway for transmitting information between the aforementioned components. Bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 302 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 3 The symbol is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0082] The memory 303 may be a ROM (Read Only Memory) or other type of static storage device capable of storing static information and instructions, RAM (Random Access Memory) or other type of dynamic storage device capable of storing information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0083] The memory 303 is used to store the application code that executes the scheme of this application, and its execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the content shown in the aforementioned embodiment of the encryption operation method based on the national cryptographic algorithm.

[0084] Figure 3 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0085] This application provides a computer-readable storage medium storing a computer program that, when run on a computer, enables the computer to execute the content shown in the aforementioned embodiment of the encryption operation method based on the national cryptographic algorithm.

[0086] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0087] This application provides a computer program product, including a computer program that, when executed by a processor, implements the content shown in the aforementioned embodiment of the encryption operation method based on the national cryptographic algorithm.

[0088] The above are only some embodiments of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for encryption operation based on a national secret algorithm, characterized in that, The application is applied to a national secret algorithm-based encryption operating system, and the system comprises a security service interface layer, a key management unit, a national secret algorithm kernel module and an audit module. The method is executed by the national secret algorithm kernel module and comprises the following steps: receiving an encryption request through the security service interface layer, analyzing the encryption request to determine a security target and data attribute information, wherein the security target comprises one or more combinations of confidentiality, integrity and non-repudiation; selecting an encryption algorithm according to the security target and the data attribute information, and obtaining a corresponding key from the key management unit according to the encryption algorithm; encrypting to-be-encrypted data in the encryption request by using the encryption algorithm and the key to obtain encrypted data; returning the encrypted data to a requester through the security service interface layer, and generating a corresponding encryption operation log to be stored in the audit module.

2. The encryption operation method based on a national secret algorithm according to claim 1, characterized in that, The method of receiving an encryption request through the security service interface layer and analyzing the encryption request to determine a security target and data attribute information comprises the following steps: receiving the encryption request received and sent by the security service interface, obtaining a request header of the encryption request, and analyzing a requester ID, a timestamp and an SM2 signature value in the request header; sequentially verifying the requester ID, the timestamp and the SM2 signature value; when the requester ID, the timestamp and the SM2 signature value are all verified successfully, sequentially using the modes of extracting an explicit identifier, analyzing an interface path and content feature matching to analyze the security target according to a priority, and automatically enabling a next mode when a previous mode fails until the security target is successfully analyzed; extracting to-be-encrypted data from the encryption request, determining a data type and a data magnitude of the to-be-encrypted data, and using the data type and the data magnitude to constitute the data attribute information.

3. The encryption operation method based on a national secret algorithm according to claim 1, characterized in that, The method of selecting an encryption algorithm from a national secret algorithm set according to the security target and the data attribute information comprises the following steps: calling a target algorithm mapping relationship, wherein the target algorithm mapping relationship comprises: the confidentiality corresponds to an SM4 algorithm or an SM2 algorithm, the integrity corresponds to an SM3 algorithm, and the non-repudiation corresponds to an SM2 algorithm and an SM3 algorithm; matching the target algorithm mapping relationship and the security target to obtain an initial encryption algorithm of the encryption request; adjusting the initial encryption algorithm based on the data type and the data magnitude in the data attribute information to obtain the encryption algorithm.

4. The encryption operation method based on a national secret algorithm according to claim 1, characterized in that, The method of obtaining a corresponding key from the key management unit according to the encryption algorithm comprises the following steps: constructing a key request based on a key request template, wherein the key request comprises an encryption algorithm identifier, a requester ID, a key request timestamp and a key use scenario, and the key use scenario is consistent with a request scenario of the encryption request; sending the key request to the key management unit, so that the key management unit verifies a key access authority of the requester ID, checks the validity of the key request timestamp, and after the key access authority and the key request timestamp validity verification passes, retrieves a key from a key pool based on the encryption algorithm identifier and the key use scenario, and encrypts the key by using a temporary session encryption algorithm; Receive the encrypted key transmitted by the key management unit through the encryption channel.

5. The encryption operation method based on a national secret algorithm according to claim 1, characterized in that, The encryption of the to-be-encrypted data in the encryption request by using the encryption algorithm and the key to obtain encrypted data comprises: standardizing the to-be-encrypted data, wherein the standardization comprises one or more of removing redundant characters, reordering, data fragmentation, and encoding conversion; performing adaptability check on the encryption algorithm and the key; if the adaptability check is successful, executing the encryption algorithm; packaging the encrypted ciphertext and the associated parameters into a standard encryption data format to obtain the encrypted data.

6. The encryption operation method based on a national secret algorithm according to claim 5, characterized in that, The execution of the encryption algorithm comprises: when the encryption algorithm is a combination of multiple algorithms, determining the execution order and data interaction between the algorithms according to a preset procedure. If the security target comprises the confidentiality and the non-repudiation, the SM3 hash value of the to-be-encrypted data is signed by using an SM2 algorithm and a private key, and then the signed data is encrypted by using an SM4 algorithm and a symmetric key.

7. The encryption operation method based on a SM algorithm according to claim 1, characterized in that, The encrypted data is returned to the requester through the security service interface layer, and a corresponding encryption operation log is generated and stored in an audit module, comprising: calculating the hash value of the encrypted data by using an SM3 algorithm to generate an integrity check digest; associating the encrypted data with the integrity check digest, returning to the requester through the national cryptographic SSL channel of the security service interface layer, and monitoring the data transmission state in real time during transmission, and triggering a retransmission mechanism if the transmission is interrupted; generating an encryption operation log, signing the encryption operation log by using an SM2 algorithm, and storing the encryption operation log in an encryption log library of the audit module.

8. A cryptographic operating system based on a national cryptographic algorithm, characterized in that, comprise: a security service interface layer configured to receive an encryption request and encrypted data returned by a national cryptographic algorithm kernel module; a key management unit configured to store a key; the national cryptographic algorithm kernel module is configured to analyze the encryption request to determine a security target and data attribute information, wherein the security target comprises one or more combinations of confidentiality, integrity, and non-repudiation; select an encryption algorithm according to the security target and the data attribute information, and obtain a corresponding key from the key management unit according to the encryption algorithm; encrypt the to-be-encrypted data in the encryption request by using the encryption algorithm and the key to obtain encrypted data; and generate an encryption operation log; an audit module configured to receive and store the encryption operation log transmitted by the national cryptographic algorithm kernel module.

9. The encryption operating system based on the SM algorithm according to claim 8, characterized in that, When the national cryptographic algorithm kernel module receives the encryption request through the security service interface layer and analyzes the encryption request to determine the security target and the data attribute information, it is specifically configured to: receive the encryption request received and sent by the security service interface, obtain the request header of the encryption request, and analyze the requester ID, timestamp, and SM2 signature value from the request header; verify the requester ID, timestamp, and SM2 signature value in sequence; When the requestor ID, the timestamp and the SM2 signature value are all verified successfully, the security target is parsed in the order of extraction of explicit identification, analysis of interface path and matching of content characteristics, and the next method is automatically enabled when the previous method fails until the security target is successfully parsed. The encrypted data is extracted from the encryption request, and the data type and data magnitude of the encrypted data are determined, and the data type and data magnitude constitute the data attribute information.

Images