A method and system for email data security based on identifier public key cryptography

Abstract

This invention relates to a method and system for email data security based on identifier public-key cryptography, belonging to the field of information security technology. The method includes: the sender encrypting email attachments using a symmetric key to obtain ciphertext for the attachments; obtaining the recipient's identifier public key based on the recipient's email address; encrypting the email body using the symmetric key to obtain ciphertext for the body; generating email ciphertext structure data by creating a digital envelope based on the sender's identifier private key's signature of the body, the ciphertext, and key factors of the symmetric key encapsulated in the recipient's identifier public key, and sending this data to the recipient; the recipient obtaining the signature, ciphertext, and digital envelope based on the ciphertext structure data, and decrypting the digital envelope using the recipient's identifier private key to obtain the symmetric key; decrypting the ciphertext using the symmetric key to obtain the email body and verifying the signature using the sender's identifier public key; and decrypting the ciphertext for the attachments to obtain the email attachments. This invention achieves end-to-end security for email data, solving server-side performance bottlenecks and key management security issues.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and system for email data security based on identifier public key cryptography. Background Technology

[0002] Currently, the security development of the email industry is moving from basic channel protection to a deeper level of systematic construction. Mainstream email services have widely adopted the TLS protocol to encrypt the transmission link and comprehensively utilize technologies such as DKIM (DomainKeysIdentified Mail), DMARC (Domain-based Message Authentication, Reporting & Conformance), and SPF (Sender Policy Framework) to verify sender identity, effectively combating phishing emails and domain fraud. Meanwhile, AI-based content security scanning has become standard practice, capable of intelligently identifying malicious links and fraudulent information.

[0003] However, the industry still faces core challenges: most solutions remain at the level of "transmission security" and "server-side security." While data is encrypted during transmission, it often needs to be decrypted upon arrival at the mail server and stored in plaintext or encrypted form using the server-side key. This leads to the risk of data leakage at the server level due to internal misuse or external attacks. True end-to-end encryption solutions have not yet been widely adopted in ordinary enterprise emails and personal mailboxes due to factors such as complex key management and poor user experience.

[0004] Therefore, how to solve the problem of protecting data throughout its entire lifecycle, from sending to storage to receiving, while ensuring ease of use, and build a true "end-to-end" security closed loop, is a problem that the industry needs to focus on solving. Summary of the Invention

[0005] Based on the above analysis, the present invention aims to disclose an email data security method and system based on identifier public key cryptography. By decentralizing encryption and decryption operations to the user client and utilizing public key cryptography technology identified by email addresses, end-to-end security of email data is achieved, effectively solving server-side performance bottlenecks and key management security issues.

[0006] On the one hand, the present invention provides an email data security method based on identifier public key cryptography, specifically including the following steps:

[0007] The sender uses a symmetric key Encrypting email attachments yields ciphertext, which is then stored in a data storage system and associated with the email based on the email identifier.

[0008] Based on symmetric key The encrypted email body is obtained as the ciphertext.

[0009] The recipient's public key is calculated based on the recipient's email address. ;

[0010] Based on the sender's private key A digital signature is obtained by signing the email body.

[0011] Based on the recipient's identifier public key Encapsulated symmetric key The key factors are obtained through digital envelopes;

[0012] Based on digital signatures, encrypted text, and digital envelopes, generate encrypted email structure data and send it to the recipient;

[0013] The recipient obtains the digital signature, encrypted text, and digital envelope based on the encrypted email structure data;

[0014] Based on the recipient's identifier private key Decrypting the digital envelope yields the symmetric key. ;

[0015] Based on symmetric key Decrypting the ciphertext yields the email body, which is then identified by the sender's public key. Verify signature;

[0016] The encrypted attachment is retrieved from the data storage system based on the email identifier, and then based on the symmetric key. Decrypt the encrypted attachment to obtain the email attachment.

[0017] Furthermore, the sender randomly generates an SM2 key pair. Based on public key Determine the symmetric key private key For symmetric keys The key factor.

[0018] Furthermore, the generated email ciphertext structure data based on digital signature, ciphertext body, and digital envelope includes:

[0019] Based on symmetric key Generate verification code ;

[0020] Based on email identifiers, digital signatures, encrypted message content, digital envelopes, and verification codes. Generate encrypted email structure data.

[0021] Furthermore, the method based on the recipient's identifier public key... Encapsulated symmetric key The key factors obtained from the digital envelope include:

[0022] Determine the length of the recipient's email address based on the recipient's email address;

[0023] Generate a corresponding message digest based on the recipient's email address;

[0024] Based on the recipient's identifier public key The key factor for encryption is the private key in the key pair. Obtain the key ciphertext data;

[0025] A digital envelope is obtained by encapsulating the recipient's email address length, recipient's email address, message digest, and key ciphertext data.

[0026] Furthermore, when there are multiple recipients, each recipient corresponds to a digital envelope.

[0027] Furthermore, the method based on email identifier, digital signature, encrypted text, digital envelope, and verification code... The generated encrypted email structure data includes:

[0028] The encryption algorithm identifier is set based on the symmetric encryption algorithm of encrypted email attachments and encrypted email body;

[0029] The length of the signature information is determined based on the digital signature.

[0030] Based on email type identifier, email identifier, encryption algorithm identifier, signature information length, digital signature, number of recipients, and verification code. The digital envelope and the encrypted body text generate the encrypted email structure data, where the email type identifier is determined by the email system when a new email is created.

[0031] Furthermore, the private key based on the recipient's identifier... Decrypting the digital envelope yields the symmetric key. include:

[0032] The digital envelope is desealed using the recipient's private key to obtain the public key from the key pair. ,based on Obtain the symmetric key ;

[0033] based on Calculated ,like This indicates a symmetric key. If the restoration is successful, proceed to the next step; otherwise, if the restoration fails, the operation will terminate.

[0034] Furthermore, the symmetric key-based Decrypting the ciphertext yields the email body, which is then identified by the sender's public key. Signature verification includes:

[0035] Based on symmetric key Decrypt the ciphertext to obtain the email body;

[0036] Based on the sender's public key Verify the digital signature. If it fails, terminate the operation. If it succeeds, display the email body.

[0037] On the other hand, the present invention also provides an email data security system based on identifier public key cryptography, characterized in that it includes:

[0038] A key system is used to manage and distribute keys, including a recipient's identifying private key and a public key, and a sender's identifying private key and a public key.

[0039] Data storage system for storing and managing email attachments;

[0040] An email system is used to send and receive emails, and to upload email attachments to a data storage system or retrieve email attachments from a data storage system based on email identifiers.

[0041] A client is used by the sender to encrypt and send emails, or by the recipient to receive and decrypt emails.

[0042] Furthermore, the sender encrypts and sends emails including:

[0043] The sender uses a symmetric key Encrypting email attachments yields ciphertext, which is then stored in a data storage system and associated with the email based on the email identifier.

[0044] Based on symmetric key The encrypted email body is obtained as the ciphertext.

[0045] The recipient's public key is calculated based on the recipient's email address. ;

[0046] Based on the sender's private key Obtain a digital signature for the email body;

[0047] Based on the recipient's identifier public key Encapsulated symmetric key The key factors are obtained through digital envelopes;

[0048] Based on digital signatures, encrypted text, and digital envelopes, generate encrypted email structure data and send it to the recipient;

[0049] The recipient receives and decrypts emails including:

[0050] The recipient obtains the digital signature, encrypted text, and digital envelope based on the encrypted email structure data;

[0051] Based on the recipient's identifier private key Decrypting the digital envelope yields the symmetric key. ;

[0052] Based on symmetric key Decrypting the ciphertext yields the email body, which is then identified by the sender's public key. Verify its signature;

[0053] The encrypted attachment is obtained based on the email identifier data storage system, and based on the symmetric key. Decrypt the encrypted attachment to obtain the email attachment.

[0054] The present invention can achieve at least one of the following beneficial effects:

[0055] This method achieves email data security through an identifier-based public-key cryptography system. It encrypts, decrypts, signs, and verifies email data based on identifier-based public-key cryptography. The public key corresponding to the email address can be calculated from the email address, and the calculation process is also the proof process of the public key. It eliminates the need for digital certificates to bind email addresses and public keys, simplifying the difficulty and cost of key distribution and management. It achieves encrypted and integrity protection throughout the entire lifecycle of data from sending to storage to receiving, realizing an end-to-end security closed loop that does not rely on transmission protocols and where the server does not handle plaintext.

[0056] By transferring the encryption and decryption of email body and attachments entirely from the server to the user client, data is encrypted at the source and decrypted when finally used, ensuring that data exists in encrypted form throughout the entire transmission and storage process, i.e., full encryption of storage and transmission.

[0057] By using random numbers as the symmetric key to encrypt emails, a unique key is implemented for each email (each email has a different key), enhancing email security. By encapsulating the symmetric key with the recipient's email address as the identifier public key, it is ensured that only the recipient designated by the sender can decrypt the email; no one else (including the sender) can decrypt the encrypted email, effectively preventing internal theft and external eavesdropping.

[0058] By restricting encryption to the sender's email client and decryption to the recipient's client, encryption and decryption no longer consume server resources. The encryption and decryption calculations are completely distributed across various clients, eliminating the bottleneck of computational performance. This not only completely eliminates the risk of data leakage on the server side but also significantly reduces the performance pressure on the server side under high concurrency, especially in scenarios with large attachments, thereby improving efficiency and fundamentally solving the dual bottlenecks of security and performance in traditional email systems.

[0059] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0060] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0061] Figure 1 This is a schematic diagram illustrating the process of encrypting and sending emails by the sender in this invention;

[0062] Figure 2 This is a diagram of the encrypted email structure data of the present invention;

[0063] Figure 3 This is a schematic diagram illustrating the process of receiving and decrypting emails by the recipient in this invention. Detailed Implementation

[0064] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0065] Method Implementation Examples

[0066] Another specific embodiment of the present invention discloses an email data security method based on identifier public key cryptography, comprising the following steps:

[0067] The sender uses a symmetric key Encrypting email attachments yields ciphertext, which is then stored in a data storage system and associated with the email based on the email identifier.

[0068] Based on symmetric key The encrypted email body is obtained as the ciphertext.

[0069] The recipient's public key is calculated based on the recipient's email address. ;

[0070] Based on the sender's private key A digital signature is obtained by signing the email body.

[0071] Based on the recipient's identifier public key Encapsulated symmetric key The key factors are obtained through digital envelopes;

[0072] Based on digital signatures, encrypted text, and digital envelopes, generate encrypted email structure data and send it to the recipient;

[0073] The recipient obtains the digital signature, encrypted text, and digital envelope based on the encrypted email structure data;

[0074] Based on the recipient's identifier private key Decrypting the digital envelope yields the symmetric key. ;

[0075] Based on symmetric key Decrypting the ciphertext yields the email body, which is then identified by the sender's public key. Verify signature;

[0076] The encrypted attachment is retrieved from the data storage system based on the email identifier, and then based on the symmetric key. Decrypt the encrypted attachment to obtain the email attachment.

[0077] In this embodiment, by delegating the encryption and decryption operations of emails to the user's email client, and based on public-key cryptography technology identified by email addresses, the entire lifecycle of data from sending to storage to receiving is protected by encrypted data and integrity, ensuring end-to-end security of email data and effectively solving server-side performance bottlenecks and key management security issues.

[0078] Specifically, an email data security method based on identifier public key cryptography includes the sender encrypting and sending emails, and the recipient receiving and decrypting emails.

[0079] Sender encrypts and sends emails

[0080] In this invention, it is assumed that the email sender is... The recipient is Sender The email client needs to have the following preset parameters: (1) Private key identifier (The private key can usually be stored using cryptographic devices such as software shields or security USB shields); (2) System master public key .

[0081] The sender encrypts and sends the email, including steps S101 to S111.

[0082] S101, Sender When creating a new email in the email client,

[0083] Email clients randomly generate SM2 key pairs Based on public key Determine the symmetric key ,in, Bits 0x00 to 0x7F are the symmetric key. Bits 0x80 to 0xFF are the initialization vector. ;like Figure 1 As shown in Figure 1; further, the private key Called a symmetric key Key factors;

[0084] The email system generates a unique email identifier for each email. The email identifier is hexadecimal data and is 32 bytes in length.

[0085] The email type identifier is determined based on a random number generated by the email system during deployment and sent to the sender's email client. The email type identifier is used to identify that the email is an encrypted email. The email type identifier is byte stream data with a length of 8 bytes, such as "0FBC13EB49ADB90F" (hexadecimal representation).

[0086] S102, The sender uses a symmetric key. Encrypting email attachments yields ciphertext, which is then stored in a data storage system and associated with the email based on its identifier. Figure 1 As shown in Figures 2 and 3.

[0087] Specifically, it includes S102-1 to S102-4.

[0088] S102-1: Sender Select attachment, use symmetric key. and initialization vector The attachment stream data is symmetrically encrypted and uploaded to the email system. The process involves encrypting the attachment stream data while uploading it to obtain the ciphertext of the attachment. The ciphertext of the attachment is not stored locally on the sender's device. The symmetric encryption algorithm used is SM4 or AES.

[0089] It should be noted that for email attachments, currently the sender may perform the data upload operation when selecting the file, and at this time the user may not have set the recipient. Therefore, this embodiment implements symmetric encryption of the attachment stream data directly during the upload process; and the symmetric key for encrypting the attachment is the same as the key for encrypting the body (i.e., one key per email).

[0090] S102-2: The email system writes the received encrypted attachments to the data storage system for storage via data storage services, and associates the email with the attachment based on the email identifier, such as... Figure 1 As shown in Figure 4.

[0091] S102-3: The data storage system returns the encrypted attachment storage result to the email system, such as... Figure 1 As shown in Figure 5.

[0092] S102-4: The email system will return the received storage results and encrypted attachment upload results to the sender's email client to notify the sender, such as... Figure 1 As shown in Figure 6.

[0093] S103, Based on symmetric key and initialization vector The encrypted email body is obtained as the ciphertext of the body, such as... Figure 1 As shown in Figure 7. The symmetric encryption algorithm used is either SM4 or AES. It should be noted that the encrypted email body and encrypted email attachments can use the same encryption algorithm or different encryption algorithms.

[0094] S104. Calculate the recipient's public key based on the recipient's email address. .

[0095] Specifically, it includes:

[0096] The sender's email client retrieves the recipient's declared public key from the key system based on the recipient's email address. ,like Figure 1 As shown in Figures 8 and 9;

[0097] Based on the recipient's email address and the recipient's declared public key and the pre-set system master public key The recipient's identifier public key is calculated according to method A1~A3 of section 6.4 User Key Pair Verification Mechanism in "GM / T 0130-2023 Certificateless and Implicit Certificate Public Key Mechanism Based on SM2 Algorithm". ,like Figure 1 As shown in Figure 10.

[0098] S105, Based on the sender's identifier private key A digital signature is obtained by signing the email body; the signature algorithm is SM2 or ECDSA; the signature information value of the digital signature is byte stream data with a length of 248 bytes (padding with 0s if the length is insufficient);

[0099] S106, Based on the recipient's identifier public key Encapsulated symmetric key The key factor is the private key in the key pair. Get a digital envelope (e.g.) Figure 1 As shown in Figure 11), it includes step ad:

[0100] a. Determine the length of the recipient's email address based on the recipient's email address; the recipient's email address length is stored as an integer, with a length of 4 bytes;

[0101] b. Generate a corresponding message digest based on the recipient's email address. The digest is 20 bytes long and is a byte stream data. This is used when the email address exceeds 32 bytes. If the length is no more than 32 bytes, this item can be ignored.

[0102] c. Based on the recipient's public key identifier Encrypt the private key in the key pair Obtain the key ciphertext data. 64 bytes in length, byte stream data;

[0103] d. A digital envelope is obtained by encapsulating the recipient's email address length, the recipient's email address, the message digest, and the key ciphertext data. The digital envelope is 120 bytes long. Among them, the recipient's email address is 32 bytes long and is a string data. If the length is less than 32 bytes, it is padded with '\0'. If the length is more than 32 bytes, the first 32 bytes are taken.

[0104] It should be noted that when there are multiple recipients, each recipient corresponds to a digital envelope, and each digital envelope is 120 bytes long.

[0105] S107. Generate encrypted email structure data based on digital signature, encrypted body text, and digital envelope, and send it to the recipient. This includes S107-1 to S107-2.

[0106] S107-1, Based on Symmetric Key Generate verification code , It is a cyclic redundancy check code, 2 bytes long, a short integer;

[0107] S107-2, Based on email identifiers, digital signatures, encrypted message body, digital envelopes, and verification codes Generate encrypted email structure data, including step AC:

[0108] A. Set an encryption algorithm identifier based on the symmetric encryption algorithm of encrypted email attachments and encrypted email body. The identifier is 4 bytes long and is an integer type.

[0109] B. Determine the length of the signature information based on the digital signature. The length is 4 bytes and the type is integer.

[0110] C. Based on email type identifier, email identifier, encryption algorithm identifier, signature information length, digital signature, number of recipients (2 bytes long, short integer), and checksum. The ciphertext structure data is generated from digital envelopes (one or more) and ciphertext body (length depends on the length of the email body text, byte stream data).

[0111] Furthermore, the encrypted data structure of the email is as follows: Figure 2As shown in the diagram, the email type identifier, email identifier, encryption algorithm identifier, signature length, digital signature, number of recipients, and verification code are displayed. The storage location and length of the digital envelope and the encrypted body text in the email encrypted structure data.

[0112] It should be noted that the encrypted text in the diagram is stored at location 0x01A4+n*0x78~ in the encrypted email structure data, where n is the number of recipients.

[0113] S108. The sender's email client base-64 encodes the encrypted email structure data and sends it as the email body data to the email system. Figure 1 As shown in Figure 12.

[0114] S109. The email system sends the received encrypted email structure data to the data storage system, such as... Figure 1 As shown in Figure 13.

[0115] S110. The data storage system returns the operation result of storing the encrypted email structure data to the email system, such as... Figure 1 As shown in Figure 14.

[0116] S111. The email system returns the email sending result to the sender's email client and notifies the sender of the sending result information, such as... Figure 1 As shown in Figure 15.

[0117] Recipient receives and decrypts emails

[0118] Recipient The email client needs to have the following preset parameters: (1) Private key identifier (The private key can usually be stored using cryptographic devices such as software shields or security USB shields); (2) System master public key .in, The identifier public key and identifier private key satisfy .

[0119] The recipient's receiving and decryption of emails includes steps S201 to S213.

[0120] S201, Recipient When viewing the inbox in an email client, the client requests the body of the email to be viewed from the email system. In other words, the email client sends an email query request to the email system using an email identifier. Figure 3 As shown in Figure 1.

[0121] S202. After receiving an email query request from the client, the email system requests the encrypted email structure data from the email data storage system based on the email identifier, such as... Figure 3 As shown in Figure 2.

[0122] S203. The data storage system reads the encrypted structure data of the specified email and returns the encrypted structure data to the email system, such as... Figure 3 As shown in Figure 3.

[0123] S204. The email system returns the encrypted structure data of the email to the recipient's email client, such as... Figure 3 As shown in Figure 4.

[0124] S205. The email client decodes the returned encrypted email data using Base64 and verifies whether the identified recipient's email address contains the current recipient's email address identifier. If it does, proceed to the next step; otherwise, terminate.

[0125] S206. The recipient obtains the email type identifier, email identifier, encryption algorithm identifier, signature information length, digital signature, number of recipients, and verification code based on the received email encrypted structure data. Digital envelopes and encrypted text.

[0126] S206, Based on the recipient's identifier private key Decrypting the digital envelope yields the symmetric key. Specifically, The public key of the key pair is obtained. ,based on Obtain the symmetric key .based on Calculated ,like This indicates a symmetric key. If the restoration is successful, proceed to the next step; otherwise, if the restoration fails, the operation will terminate.

[0127] S207. Obtain the sender's encryption algorithm from the encryption algorithm identifier, based on the symmetric key. Decrypting the ciphertext yields the email body, such as... Figure 3 As shown in Figure 5.

[0128] S206-8, Based on the sender's identifier public key The system verifies the digital signature by checking the signature length. If the verification fails, the operation is terminated; if successful, the email body is displayed.

[0129] S209. When the recipient selects to download the attachment, the email client sends a request to the email system to download the attachment for that email. Figure 3 As shown in Figure 6.

[0130] S210. The email system forwards the download request for the attachment file to be downloaded in the email to the data storage system based on the email identifier, such as... Figure 3 As shown in Figure 7.

[0131] S211, The data storage system reads the encrypted attachment based on the requested email identifier and returns it to the email system, such as Figure 3 As shown in Figure 8.

[0132] S212. The email system will send the encrypted attachment data stream back to the recipient's email client in chunks, such as... Figure 3 As shown in Figure 9.

[0133] S213, Email clients use the encryption algorithm and symmetric key in the encryption algorithm identifier. The encrypted attachment is symmetrically decrypted (stream-based decryption, decrypting as it downloads) and stored in the recipient's specified local storage location, such as... Figure 3 As shown in Figure 10.

[0134] This embodiment discloses an email data security method based on identifier public key cryptography. The method achieves email data security through identifier public key cryptography, and encrypts, decrypts, signs, and verifies email data based on identifier public key cryptography. The public key corresponding to the email address can be calculated based on the email address, and the calculation process is also the proof process of the public key. It eliminates the need to use digital certificates to bind email addresses and public keys, simplifying the difficulty and cost of key distribution and management. It realizes encrypted protection and integrity protection of data throughout its entire lifecycle from sending to storage to receiving, and achieves an end-to-end security closed loop that does not rely on transmission protocols and where the server does not access the plaintext.

[0135] By transferring the encryption and decryption of email body and attachments entirely from the server to the user client, data is encrypted at the source and decrypted when finally used, ensuring that data exists in encrypted form throughout the entire transmission and storage process, i.e., full encryption of storage and transmission.

[0136] By using random numbers as the symmetric key to encrypt emails, a unique key is achieved for each email (each email has a different key), further enhancing email security. By encapsulating the symmetric key's critical factor using the recipient's email address as the identifier public key, it is ensured that only the recipient designated by the sender can decrypt the email; no one else (including the sender) can decrypt the encrypted email, effectively preventing internal theft and external eavesdropping.

[0137] By restricting encryption to the sender's email client and decryption to the recipient's client, encryption and decryption no longer consume server resources. The encryption and decryption calculations are completely distributed across various clients, eliminating the bottleneck of computational performance. This not only completely eliminates the risk of data leakage on the server side but also significantly reduces the performance pressure on the server side under high concurrency, especially in scenarios with large attachments, thereby improving efficiency and fundamentally solving the dual bottlenecks of security and performance in traditional email systems.

[0138] System Implementation Examples

[0139] Another specific embodiment of the present invention discloses an email data security system based on identifier public-key cryptography, including a key system, a data storage system, an email system, and a client. Figure 1 It shows the working interaction relationships between the various parts of the email data security system.

[0140] A key system is used to manage and distribute keys, including the system's master key pair, recipient identifier private key, claim public key, and sender identifier private key, claim public key;

[0141] Data storage system for storing and managing email attachments;

[0142] An email system is used to send and receive emails, and to upload email attachments to a data storage system or retrieve email attachments from a data storage system based on email identifiers.

[0143] A client is used by the sender to encrypt and send emails, or by the recipient to receive and decrypt emails.

[0144] Furthermore, the sender encrypts and sends emails including:

[0145] The sender uses a symmetric key Encrypting email attachments yields ciphertext, which is then stored in a data storage system and associated with the email based on the email identifier.

[0146] Based on symmetric key The encrypted email body is obtained as the ciphertext.

[0147] The recipient's public key is calculated based on the recipient's email address. ;

[0148] Based on the sender's private key Obtain a digital signature for the email body;

[0149] Based on the recipient's identifier public key Encapsulated symmetric key The key factors are obtained through digital envelopes;

[0150] Based on digital signatures, encrypted text, and digital envelopes, generate encrypted email structure data and send it to the recipient;

[0151] The recipient receives and decrypts emails including:

[0152] The recipient obtains the digital signature, encrypted text, and digital envelope based on the encrypted email structure data;

[0153] Based on the recipient's identifier private key Decrypting the digital envelope yields the symmetric key. ;

[0154] Based on symmetric key Decrypting the ciphertext yields the email body, which is then identified by the sender's public key. Verify its signature;

[0155] The encrypted attachment is obtained based on the email identifier data storage system, and based on the symmetric key. Decrypt the encrypted attachment to obtain the email attachment.

[0156] Furthermore, the steps and methods for the sender to encrypt and send emails, and the recipient to receive and decrypt emails, are the same as in the previous embodiments.

[0157] Compared to existing technologies, the beneficial effects of the email data security system based on identifier public key cryptography provided in this embodiment are basically the same as those provided in the method embodiment, and will not be elaborated here.

[0158] It should be noted that the above embodiments are based on the same inventive concept, and any parts not described repeatedly can be referenced from each other.

[0159] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for securing email data based on identifier public-key cryptography, characterized in that, Includes the following steps: The sender uses a symmetric key Encrypting email attachments yields ciphertext, which is then stored in a data storage system and associated with the email based on the email identifier. Based on symmetric key The encrypted email body is obtained as the ciphertext. The recipient's public key is calculated based on the recipient's email address. ; Based on the sender's private key A digital signature is obtained by signing the email body. Based on the recipient's identifier public key Encapsulated symmetric key The key factors are obtained through digital envelopes; Based on digital signatures, encrypted text, and digital envelopes, generate encrypted email structure data and send it to the recipient; The recipient obtains the digital signature, encrypted text, and digital envelope based on the encrypted email structure data; Based on the recipient's identifier private key Decrypting the digital envelope yields the symmetric key. ; Based on symmetric key Decrypting the ciphertext yields the email body, which is then identified by the sender's public key. Verify signature; The encrypted attachment is retrieved from the data storage system based on the email identifier, and then based on the symmetric key. Decrypt the encrypted attachment to obtain the email attachment.

2. The email data security method based on identifier public key cryptography according to claim 1, characterized in that, The sender randomly generates an SM2 key pair. Based on public key Determine the symmetric key private key For symmetric keys The key factor.

3. The email data security method based on identifier public key cryptography according to claim 2, characterized in that, The email ciphertext structure data generated based on digital signature, ciphertext body, and digital envelope includes: Based on symmetric key Generate verification code ; Based on email identifiers, digital signatures, encrypted message content, digital envelopes, and verification codes. Generate encrypted email structure data.

4. The email data security method based on identifier public key cryptography according to claim 3, characterized in that, The public key based on the recipient's identifier Encapsulated symmetric key The key factors obtained from the digital envelope include: Determine the length of the recipient's email address based on the recipient's email address; Generate a corresponding message digest based on the recipient's email address; Based on the recipient's identifier public key The key factor for encryption is the private key in the key pair. Obtain the key ciphertext data; A digital envelope is obtained by encapsulating the recipient's email address length, recipient's email address, message digest, and key ciphertext data.

5. The email data security method based on identifier public key cryptography according to claim 4, characterized in that, When there are multiple recipients, each recipient corresponds to a digital envelope.

6. The email data security method based on identifier public key cryptography according to claim 4, characterized in that, The method is based on email identifier, digital signature, encrypted message, digital envelope, and verification code. The generated encrypted email structure data includes: The encryption algorithm identifier is set based on the symmetric encryption algorithm of encrypted email attachments and encrypted email body; The length of the signature information is determined based on the digital signature. Based on email type identifier, email identifier, encryption algorithm identifier, signature information length, digital signature, number of recipients, and verification code. The digital envelope and the encrypted body text generate the encrypted email structure data, where the email type identifier is determined by the email system when a new email is created.

7. The email data security method based on identifier public key cryptography according to claim 6, characterized in that, The private key based on the recipient's identifier Decrypting the digital envelope yields the symmetric key. include: The digital envelope is desealed using the recipient's private key to obtain the public key from the key pair. ,based on Obtain the symmetric key ; based on Calculated ,like This indicates a symmetric key. If the restoration is successful, proceed to the next step; otherwise, if the restoration fails, the operation will terminate.

8. The email data security method based on identifier public key cryptography according to claim 7, characterized in that, The symmetric key-based Decrypting the ciphertext yields the email body, which is then identified by the sender's public key. Signature verification includes: Based on symmetric key Decrypt the ciphertext to obtain the email body; Based on the sender's public key Verify the digital signature. If it fails, terminate the operation. If it succeeds, display the email body.

9. An email data security system based on identifier public-key cryptography, characterized in that, include: A key system is used to manage and distribute keys, including a recipient identification private key, a recipient claim public key, and a sender identification private key; Data storage system for storing and managing email attachments; An email system is used to send and receive emails, and to upload email attachments to a data storage system or retrieve email attachments from a data storage system based on email identifiers. A client is used by the sender to encrypt and send emails, or by the recipient to receive and decrypt emails. The sender encrypts and sends emails by using a symmetric key. Encrypting email attachments yields ciphertext, which is then stored in a data storage system and associated with the email based on its identifier; this is done using a symmetric key. The encrypted email body is used to obtain the ciphertext; the recipient's public key is calculated based on the recipient's email address. Based on the sender's identifier private key Obtain a digital signature for the email body; based on the recipient's public key. Encapsulated symmetric key The key factors are used to obtain a digital envelope; based on the digital signature, ciphertext, and digital envelope, the email ciphertext structure data is generated and sent to the recipient; the recipient's receipt and decryption of the email includes: the recipient obtaining a digital signature, ciphertext, and digital envelope based on the email ciphertext structure data; and based on the recipient's private key... Decrypting the digital envelope yields the symmetric key. Based on symmetric keys Decrypting the ciphertext yields the email body, which is then identified by the sender's public key. Verify its signature; obtain the encrypted attachment based on the email identifier data storage system, and use a symmetric key. Decrypt the encrypted attachment to obtain the email attachment.

Images