Data processing and encryption method and system based on SM9 algorithm

Abstract

The invention discloses a data processing and encryption method and system based on an SM9 algorithm. The method comprises the following steps: receiving a processing request of a target user; verifying the to-be-processed data according to the first message authentication code, and if the verification is passed, processing the to-be-processed data by using a main public key or a user private key of the target user according to the type of the processing request; otherwise, not processing the to-be-processed data; after the to-be-processed data is processed, deriving an exclusive session key based on the identifier of the target user in the processing request and the main public key; encrypting the processed data through a symmetric encryption algorithm by using the session key, adding a second message authentication code, and outputting the encrypted data to a target user sending the processing request; the second message authentication code is generated based on calculation of the encrypted data. According to the invention, the security assurance of the core key and the data in the application scene of the SM9 algorithm is effectively enhanced.

Description

Technical Field

[0001] This invention relates to the field of algorithm security technology, and in particular to a data processing and encryption method and system based on the SM9 algorithm. Background Technology

[0002] SM9, a cryptographic algorithm standard issued by the State Cryptography Administration, falls under the category of asymmetric cryptography. Its core technology is to achieve certificate-free key management by directly using the user identifier as the public key. In commercial cryptography systems, SM9 is primarily used for authentication, data encryption, and key negotiation, and its encryption strength is recognized as equivalent to that of a 3072-bit RSA algorithm.

[0003] Despite the significant advantages of the SM9 algorithm, it still has the following key shortcomings in practical applications: data processed by the SM9 algorithm is still at risk of being cracked and leaked during transmission; in SM9 application scenarios, most existing hardware and software lack effective protection against side-channel attacks such as timing attacks and power consumption analysis, and key information may be leaked through the physical characteristics of the algorithm during execution; there is a lack of systematic key update, revocation, and archiving mechanisms, making it difficult to respond in a timely manner and control the spread of risks, especially when security incidents such as key leaks occur. Summary of the Invention

[0004] The main objective of this invention is to provide a data processing and encryption method and system based on the SM9 algorithm. By combining the SM9 algorithm with a symmetric encryption algorithm and setting up dual message authentication, the security of core keys and data in the application scenarios of the SM9 algorithm is effectively improved.

[0005] The technical solution adopted in this invention is: a data processing and encryption method based on the SM9 algorithm, comprising: Receive a processing request from a target user, the processing request including the target user's identifier, data to be processed, and a first message authentication code; The data to be processed is verified according to the first message authentication code. If the verification is successful, the data to be processed is processed using the master public key or the target user's private key, depending on the type of the processing request. Otherwise, the data to be processed is not processed. The target user's private key is generated based on the master private key and the pre-input identifier of the target user. The master private key and the master public key are generated based on the SM9 algorithm. After processing the data to be processed, a unique session key is derived based on the target user's identifier and the master public key in the processing request; using the session key, the processed data is encrypted using a symmetric encryption algorithm, and after attaching a second message authentication code, it is output to the target user who sent the processing request; the second message authentication code is generated based on the encrypted data.

[0006] According to the above technical solution, the generated master private key and user private key are stored in a security chip with a security level higher than EAL4+.

[0007] According to the above technical solution, from the moment a processing request is received until the data is encrypted using a symmetric encryption algorithm and a second message authentication code is attached, side-channel attacks are defended using a constant-time algorithm and a randomization algorithm.

[0008] According to the above technical solution, the processing request of the target user is received through a unified standardized application programming interface, or data encrypted by a symmetric encryption algorithm and attached with a second message authentication code is output.

[0009] According to the above technical solution, when a key update instruction or security alarm message is received, the currently used master private key and corresponding user private key are destroyed, a new master private key and corresponding user private key are generated, and the key update and destruction information is broadcast.

[0010] According to the above technical solution, the method for verifying the data to be processed based on the first message authentication code includes: calculating the verification value of the first message authentication code based on the received data to be processed; The verification value of the first message authentication code is compared with the received first message authentication code. If they are the same, the verification is successful; otherwise, the verification fails.

[0011] According to the above technical solution, the types of processing requests include: encryption requests, decryption requests, signature requests, and signature verification requests; When processing a request that is an encryption request or a signature verification request, the master public key is used to encrypt or verify the data to be processed based on the SM9 algorithm. When the processing request is a decryption request or a signature request, the data to be processed is decrypted or signed using the private key of the target user who sent the processing request, based on the SM9 algorithm.

[0012] According to the above technical solution, the method for deriving a unique session key based on the target user's identifier and the master public key in the processing request includes: combining the master public key, the target user's identifier in the processing request, and a random number, and then inputting the combination into the HKDF algorithm to obtain the unique session key.

[0013] Another aspect of the present invention provides a data processing and encryption system based on the SM9 algorithm, comprising: The SM9 request-response module is used to receive a processing request from a target user, the processing request including the target user's identifier, data to be processed, and a first message authentication code; The SM9 data processing module is used to verify the data to be processed according to the first message authentication code. If the verification is successful, the data to be processed is processed using the master public key or the target user's private key, depending on the type of the processing request. Otherwise, the data to be processed is not processed. The target user's private key is generated based on the master private key and the pre-input identifier of the target user. The master private key and the master public key are generated based on the SM9 algorithm. The session key derivation and symmetric encryption module is used to derive a unique session key based on the target user's identifier and the master public key in the processing request after processing the data to be processed; using the session key, the processed data is encrypted using a symmetric encryption algorithm, and a second message authentication code is attached before being output to the target user who sent the processing request; the second message authentication code is generated based on the encrypted data.

[0014] Another aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described data processing and encryption method based on the SM9 algorithm.

[0015] The beneficial effects of this invention are as follows: This invention verifies the data to be processed in the request using a first message authentication code, and only processes the data after successful verification, thus ensuring the integrity of the initial data and the legitimacy of the request. Furthermore, after each request is processed, a unique session key is generated for symmetric encryption, achieving key isolation between individual data processing sessions while improving the security of data transmission after SM9 processing. Finally, a second message authentication code is appended to the symmetrically encrypted data to prevent tampering during subsequent transmission. This invention, by combining the SM9 algorithm with symmetric encryption and a dual message authentication mechanism, effectively enhances the security of core keys and data in SM9 algorithm application scenarios.

[0016] Furthermore, this invention employs constant-time and randomization algorithms to resist side-channel attacks, thereby enhancing the anti-cracking capability of core keys or data.

[0017] Furthermore, this invention uses a unified, standardized application programming interface (API) to receive and process requests or output encrypted data, achieving compatibility with different user systems and devices. It eliminates the need to develop dedicated interfaces for different scenarios, thus optimizing the scenario adaptability of the method or system.

[0018] Furthermore, upon receiving a key update instruction or security alarm information, this invention destroys the old master private key, generates a new key, and broadcasts the update and destruction information, thereby achieving dynamic security management of the key. This can promptly prevent the risk spread after key leakage and optimize the emergency response capability and long-term security of the key system.

[0019] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of the data processing and encryption method based on the SM9 algorithm according to an embodiment of the present invention; Figure 2 This is a structural diagram of a data processing and encryption system based on the SM9 algorithm according to an embodiment of the present invention; Figure 3 This is a flowchart of the SM9 key generation and management process in the data processing and encryption method based on the SM9 algorithm according to an embodiment of the present invention; Figure 4 This is a flowchart of the SM9 request-response and data processing process in the data processing and encryption method based on the SM9 algorithm according to an embodiment of the present invention; Figure 5 This is a flowchart of the session key derivation and data encryption process in the data processing and encryption method based on the SM9 algorithm according to an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0023] It should be noted that the illustrations provided in the embodiments of the present invention are only schematic representations of the basic concept of the present invention. Therefore, the drawings only show the components related to the present invention and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0024] In this invention, it should also be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application. Furthermore, the terms "first" and "second" are used only for descriptive and distinguishing purposes and should not be construed as indicating or implying relative importance.

[0025] Example 1 This embodiment provides a data processing and encryption method based on the SM9 algorithm, including the following steps: S1. Receive a processing request from the target user, the processing request including the target user's identifier, data to be processed, and a first message authentication code.

[0026] S2. Verify the data to be processed based on the first message authentication code. If the verification passes, proceed to step S3; otherwise, terminate the execution of this method. This verification process ensures the integrity of the initial data and the legitimacy of the request.

[0027] Furthermore, the method for verifying the data to be processed based on the first message authentication code includes: calculating a verification value of the first message authentication code using a first authentication algorithm on the received data to be processed; the first authentication algorithm is the algorithm used by the request sender when generating the first message authentication code based on the data to be processed; comparing the verification value of the first message authentication code with the first message authentication code; if they are the same, the verification passes; otherwise, the verification fails.

[0028] The message sender generates a message authentication code based on the original data using a hash function and a key. By comparing the verification value of the message authentication code with the received message authentication code, it is possible to accurately determine whether the data has been tampered with during transmission, thus ensuring the integrity of the initial data and the legitimacy of the request. The first message authentication code is calculated based on the user's private key and a hash function. Each user's private key is distributed to the request sender corresponding to the target user through a secure channel after generation. The second message authentication code is calculated based on the session key and a hash function. The data receiver, located at the target user's location, decrypts the session key using its own user private key.

[0029] S3. Based on the type of processing request, process the data to be processed using the master public key or the target user's private key. The target user's private key is generated based on the master private key and a pre-entered identifier of the target user, and the master private key and master public key are generated based on the SM9 algorithm.

[0030] Furthermore, the types of processing requests include: encryption requests, decryption requests, signature requests, and signature verification requests. When the processing request is an encryption request or a signature verification request, the master public key is used to encrypt or verify the data to be processed based on the SM9 algorithm. When the processing request is a decryption request or a signature request, the user's private key corresponding to the target user sending the processing request is used to decrypt or sign the data to be processed based on the SM9 algorithm.

[0031] Furthermore, the generated master private key and user private key are stored in a security chip with a security level higher than EAL4+. EAL4+ is a security level defined in the general standard for information security assessment, representing that the chip has strong resistance to physical and logical attacks, effectively preventing the keys from being illegally read or tampered with, and providing hardware-level security protection for the core keys.

[0032] S4. Based on the target user's identifier and the master public key in this processing request, a unique session key is derived. This step utilizes a unique session key for each processing operation to achieve key isolation for single data processing, thus optimizing the security protection of the core key.

[0033] Furthermore, the method for generating a session key includes: combining the master public key, the target user identifier, and the random number generated in this instance to form initial key material and inputting it into the HKDF algorithm, which uses a randomization factor to generate a session key of a specified length.

[0034] S5. Encrypt the processed data using a symmetric encryption algorithm, attach a second message authentication code, and output it to the target user who sent the processing request.

[0035] Furthermore, from the moment a processing request is received until the processed data is encrypted using a symmetric encryption algorithm and a second authentication code is attached, a constant-time algorithm and a randomization algorithm are employed to defend against side-channel attacks. Side-channel attacks are attacks that crack keys by analyzing physical characteristics such as device runtime consumption and power consumption changes. The constant-time algorithm can eliminate differences in operation time, and the randomization algorithm can mask resource consumption patterns. The combination of the two can significantly improve the system's resistance to side-channel attacks.

[0036] Furthermore, through a unified and standardized application programming interface (API), processing requests from target users are received, or data encrypted using a symmetric encryption algorithm and appended with a second authentication code is output. A standardized interface refers to an interaction protocol that follows unified technical specifications, enabling seamless integration between different systems and devices, reducing development costs for cross-platform integration, and improving the method's versatility.

[0037] Furthermore, upon receiving a key update command or security alert, the old master private key is destroyed, a new master private key and corresponding user private key are generated, and the key update and destruction information is broadcast. This dynamic key update mechanism can cut off attack paths by destroying the old key and generating a new key when a key is suspected of being compromised or has reached its lifespan. Broadcasting the information ensures that all users update their keys synchronously, avoiding data interaction failures due to key asynchrony.

[0038] This embodiment also provides a data processing and encryption system based on the SM9 algorithm, the structure of which is as follows: Figure 2 As shown, it includes: The SM9 request-response module is used to receive a processing request from a target user, the processing request including the target user's identifier, data to be processed, and a first message authentication code; The SM9 data processing module is used to verify the data to be processed according to the first message authentication code. If the verification is successful, the data to be processed is processed using the master public key or the target user's private key, depending on the type of the processing request. Otherwise, the data to be processed is not processed. The target user's private key is generated based on the master private key and the pre-input identifier of the target user. The master private key and the master public key are generated based on the SM9 algorithm. The session key derivation and symmetric encryption module is used to derive a unique session key based on the target user's identifier and the master public key in the processing request after processing the data to be processed; using the session key, the processed data is encrypted using a symmetric encryption algorithm, and a second message authentication code is attached before being output to the target user who sent the processing request; the second message authentication code is generated based on the encrypted data.

[0039] The way each module performs its function has been described in the method of this embodiment and will not be repeated here.

[0040] This embodiment also provides a computer device, characterized in that it includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described data processing and encryption method based on the SM9 algorithm.

[0041] This embodiment also provides a computer-readable storage medium, such as flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, server, app store, etc., which stores computer programs. When the program is executed by a processor, it performs corresponding functions. This embodiment's computer-readable storage medium, when executed by a processor, implements the data processing and encryption method based on the SM9 algorithm of the method embodiment.

[0042] Example 2 Based on Example 1, this example provides another data processing and encryption method based on the SM9 algorithm, including the following steps: T1. Generate the key and initialize hardware protection. The process for this step is as follows: Figure 3 As shown: T11. The Key Generation Center (KGC) uses the SM9 algorithm to generate the system's master public key and master private key.

[0043] T12 receives the input user identifier, such as user A, user N, etc., and combines it with the newly generated master private key to generate a unique user private key for each target user. These generated master public keys and user private keys are then transmitted through a secure channel to the SE secure element (hardware-level security module) for storage, awaiting subsequent use.

[0044] The T13 and SE security elements complete the import of the master public key and user private key, and properly store these core keys in a hardware-level security environment to ensure that they are not illegally stolen or tampered with.

[0045] Specifically, the Key Generation Center selects system parameters and generates a master private key using a random number generator. The master public key is then derived from the master private key and made public. Users provide identification (such as email address or phone number) to the Key Generation Center (KGC). The KGC uses the master private key and user identification to generate a user private key, which is distributed to the user through a secure channel. The user key is stored in secure chip hardware with a security level higher than EAL4+, and is encrypted by the application within the secure element of the SE (a non-volatile memory area).

[0046] T2. Based on the processing request, perform layered encryption and security operations. The process for this step is as follows: Figure 4 As shown: When data needs to be encrypted, the data to be encrypted is combined with the user identifier and processed by the master public key to generate encrypted data; in the signature verification scenario, the signature data, the original signature text and the user identifier are input and the signature verification operation is completed through processing by the master public key.

[0047] When decrypting data, the data to be decrypted is combined with the user identifier, and the decrypted data is obtained after processing with the user's private key. In the signing scenario, the data to be signed and the user identifier are input, and the signing operation is completed through processing with the user's private key.

[0048] Specifically, the system receives encryption, decryption, signing, and verification requests from external services. These requests include the target user's identifier, data to be encrypted, decrypted, signed, or verified, and a message authentication code. The system authenticates the received message authentication code. Upon successful authentication, the system uses the master public key to encrypt or verify the input data, or uses the corresponding user private key to decrypt or sign the input data.

[0049] The SM9 encryption, decryption, and signature verification processes are as follows: SM9 encryption: The algorithm is initially set up using a user identifier, and the data to be encrypted is encrypted using the SM9 master public key to obtain the encrypted result.

[0050] SM9 signature verification: The user identifier is used for initial algorithm settings, and the SM9 master public key is used to verify the signature data and the original signature text to obtain the signature verification result.

[0051] SM9 decryption: The algorithm is initially set up using the user identifier, and the encrypted data is decrypted using the SM9 user private key to obtain the decryption result.

[0052] SM9 signature: The algorithm is initially set up using the user identifier, and the data to be signed is signed using the SM9 user private key to obtain the signature result.

[0053] T3. Perform dynamic key update and revocation. The process is as follows: Figure 5 As shown: T31. Using the master public key as the core, introduce the user identifier and random number to obtain the session key, and combine the original SM9 operation result as input with the above session key.

[0054] T32. Use a symmetric encryption algorithm, such as SM4 / AES, to encrypt the result of the SM9 operation and attach a message authentication code.

[0055] Furthermore, in this embodiment, data transmission, including the receipt of processing requests and the output of processed data, adopts a method of ciphertext + message authentication code to prevent the transmitted data from being tampered with.

[0056] Furthermore, this embodiment generates a session key from the master key based on the HKDF algorithm. While establishing a connection between symmetric encrypted data and the target user's identity, it ensures that a unique key is used for each encryption, reducing the risk of key reuse and the impact of key leakage during a single processing on all core keys and computational data.

[0057] Furthermore, this embodiment optimizes overall security and efficiency through a unified SM9 API (Application Programming Interface) design. Input validation, memory cleanup, and exception handling mechanisms are built into the unified interface layer to prevent attacks such as buffer overflows. The unified SM9 API design, through standardized interface definitions, ensures seamless integration across different operating systems, reducing integration complexity. Standardized data formats and communication protocols improve cross-platform compatibility and reduce development costs caused by protocol differences.

[0058] Furthermore, in this embodiment, randomization and time constant algorithms are employed to defend against side-channel attacks during steps T2 and T3. The constant-time algorithm achieves defense by eliminating the correlation between execution time and input data, thus preventing side-channel attacks (such as timing attacks and power consumption analysis). It infers core key information by monitoring the physical characteristics of the algorithm's execution (such as runtime and energy consumption). All branch operations (such as conditional judgments) under the constant-time algorithm are executed at fixed times, thereby avoiding time differences caused by branch jumps. Randomization algorithm enhancement refers to introducing unpredictability through randomization to interfere with the attacker's analysis. Instruction randomization requires data randomness during instruction design, increasing the difficulty for attackers to construct attack models.

[0059] Furthermore, based on the key update command or security alarm information received from the external security policy engine, the embodiment triggers a master key rotation mechanism inside the security chip, generates a new master key and re-derives the user's private key, securely archives and destroys the old key, and broadcasts key update or revocation status information to relevant external systems through the public key infrastructure.

[0060] Furthermore, the keys are dynamically updated according to security policies such as automatically updating the master key every 90 days, and the old keys are securely destroyed through a key archiving system. Upon detection of a key breach, a key revocation protocol is immediately triggered, and the revocation status is broadcast via Public Key Infrastructure (PKI).

[0061] This embodiment also provides a data processing and encryption system based on the SM9 algorithm, including: The system consists of a key generation center (KGC), users, the SE secure element, and applications. The KGC, in the SM9 identity cipher, is responsible for selecting system parameters, generating the master key, and producing user private keys. Users provide uniquely identifiable information such as a name, email address, ID number, phone number, and street address. The SE secure element stores sensitive data and provides SM9 encryption / decryption and signature verification interfaces. Applications are used to implement SM9 functionalities based on the SE secure element and call the unified SM9 computation API.

[0062] In summary, this invention provides a data processing and encryption method and system based on the SM9 algorithm, which effectively improves the security of core keys and data in application scenarios of the SM9 algorithm.

[0063] It should be noted that, depending on the implementation needs, the various steps / components described in this application can be broken down into more steps / components, or two or more steps / components or parts of the operation of steps / components can be combined into new steps / components to achieve the purpose of this invention.

[0064] The order of the steps in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0065] It should be understood that those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A data processing and encryption method based on an SM9 algorithm, characterized in that, The method comprises the following steps: receiving a processing request of a target user, the processing request comprising an identity of the target user, to-be-processed data and a first message authentication code; verifying the to-be-processed data according to the first message authentication code, and if the verification is passed, processing the to-be-processed data according to the type of the processing request by using a master public key or a user private key of the target user; otherwise, not processing the to-be-processed data; wherein the user private key of the target user is generated based on a master private key and the identity of the target user input in advance, and the master private key and the master public key are generated based on an SM9 algorithm; after processing the to-be-processed data, deriving a special session key based on the identity of the target user in the processing request and the master public key, encrypting the processed data by using the session key through a symmetric encryption algorithm, and outputting the data with a second message authentication code to the target user who sends the processing request; the second message authentication code is generated based on the encrypted data.

2. The data processing and encryption method based on the SM9 algorithm according to claim 1, characterized in that, The generated master private key and user private key are stored in a secure chip with a security level higher than EAL4+.

3. The data processing and encryption method based on the SM9 algorithm according to claim 1, characterized in that, From receiving the processing request to completing the encryption of the processed data by using the symmetric encryption algorithm and adding the second message authentication code, constant time algorithm and randomization algorithm are used to prevent side channel attacks.

4. The data processing and encryption method based on the SM9 algorithm according to claim 1, characterized in that, The processing request of the target user is received or the data encrypted by using the symmetric encryption algorithm and added with the second message authentication code is outputted through a unified standardized application program interface.

5. The data processing and encryption method based on the SM9 algorithm according to claim 1, characterized in that, When a key update instruction or a security warning information is received, the currently used master private key and corresponding user private key are destroyed, new master private key and corresponding user private key are generated, and key update and destruction information are broadcasted.

6. The data processing and encryption method based on the SM9 algorithm according to claim 1, characterized in that, The method for verifying the to-be-processed data according to the first message authentication code comprises the following steps: calculating a first message authentication code verification value according to the received to-be-processed data; 7. The data processing and encryption method based on the SM9 algorithm according to claim 1, characterized in that, comparing the first message authentication code verification value with the received first message authentication code, and if they are the same, the verification is passed; otherwise, the verification is not passed. The type of the processing request comprises an encryption request, a decryption request, a signature request and a signature verification request; when the processing request is the encryption request or the signature verification request, the to-be-processed data is encrypted or verified by using the master public key based on the SM9 algorithm; 8. The data processing and encryption method based on the SM9 algorithm according to claim 1, characterized in that, when the processing request is the decryption request or the signature request, the to-be-processed data is decrypted or signed by using the user private key of the target user who sends the processing request based on the SM9 algorithm.

9. A data processing and encryption system based on the SM9 algorithm, characterized in that, The method for deriving the special session key based on the identity of the target user in the processing request and the master public key comprises the following steps: combining the master public key, the identity of the target user in the processing request and a random number to input an HKDF algorithm to obtain the special session key. The method comprises the following steps: an SM9 request response module is configured to receive a processing request of a target user, the processing request comprising an identity of the target user, to-be-processed data and a first message authentication code; an SM9 data processing module is configured to verify the to-be-processed data according to the first message authentication code, and if the verification is passed, process the to-be-processed data according to the type of the processing request by using a master public key or a user private key of the target user; Otherwise, the to-be-processed data is not processed; wherein the user private key of the target user is generated based on a master private key and a pre-input identification of the target user, and the master private key and a master public key are generated based on an SM9 algorithm; A session key derivation and symmetric encryption module is configured to derive a dedicated session key based on the identification of the target user in the processing request and the master public key after processing the to-be-processed data; encrypt the processed data by using the session key through a symmetric encryption algorithm, and output the data to the target user who sends the processing request after adding a second message authentication code; and the second message authentication code is generated based on the calculation of the encrypted data.

10. A computer device, comprising: A computer program stored in the memory and executable on the processor, when the processor executes the computer program, implements the steps of the data processing and encryption method based on the SM9 algorithm in any one of claims 1-8.

Images