Data processing method, device and system, electronic equipment, medium and product
By exchanging SM2 elliptic curve public keys and generating random numbers between the client and server, an SM4 data encryption key is derived, which solves the problem of easy key prediction in existing technologies and improves the security of data processing.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-23
- Publication Date
- 2026-03-10
AI Technical Summary
The single national cryptographic algorithm and simple generation mechanism of existing key exchange schemes make keys easy to predict, resulting in low data processing security.
By using the SM2 elliptic curve public key exchange between the client and server, a pre-master key is generated, and a key set, including the SM4 data encryption key, is derived from the random number and the master key to realize a two-way independent key mechanism and improve security.
It enhances key security, reduces the risk of key prediction, and achieves higher data processing security.
Smart Images
Figure CN121644084A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of information security technology, and in particular to a data processing method, apparatus, system, electronic device, medium and product. Background Technology
[0002] In data networks and distributed systems, key exchange is a core technology for ensuring data security. Currently, there are various key exchange schemes: Diffie-Hellman key exchange protocol, RSA key exchange, elliptic curve Diffie-Hellman, pre-shared key schemes, and identity-based key exchange. The single national cryptographic algorithm and simple generation mechanism of existing schemes make keys easily predictable and vulnerable to attack, resulting in low data processing security. Summary of the Invention
[0003] The purpose of this application is to provide a data processing method, apparatus, system, electronic device, medium, and product to solve the problem of low data processing security.
[0004] To solve the above-mentioned technical problems, this application is implemented as follows:
[0005] In a first aspect, embodiments of this application provide a data processing method, executed by a client, the method comprising:
[0006] Send a first random number, a first national cryptographic SM2 elliptic curve public key, and an identifier to the server, and receive a second random number, a second national cryptographic SM2 elliptic curve public key, and the identifier sent by the server;
[0007] Based on the first national cryptographic SM2 elliptic curve private key and the second national cryptographic SM2 elliptic curve public key, a pre-master key is obtained, and a master key is generated based on the pre-master key, the first random number, and the second random number.
[0008] A key set is derived from the master key, wherein the key set includes a first SM4 data encryption key;
[0009] The transaction data is encrypted using the first SM4 data encryption key, and the encrypted transaction data is sent to the server.
[0010] Secondly, embodiments of this application also provide a data processing method, executed by a server, the method comprising:
[0011] Receive a first random number, a first national cryptographic SM2 elliptic curve public key and an identifier sent by the client, and send a second random number, a second national cryptographic SM2 elliptic curve public key and the identifier to the client;
[0012] Based on the second national cryptographic SM2 elliptic curve private key and the first national cryptographic SM2 elliptic curve public key, a pre-master key is obtained, and a master key is generated according to the pre-master key, the first random number and the second random number;
[0013] A key set is derived from the master key, wherein the key set includes a first SM4 data encryption key;
[0014] The system receives encrypted transaction data sent by the client and decrypts the encrypted transaction data based on the first SM4 data encryption key to obtain the transaction data.
[0015] Thirdly, embodiments of this application also provide a data processing apparatus applied to a client, the apparatus comprising:
[0016] The first transmission module is used to send a first random number, a first national cryptographic SM2 elliptic curve public key and an identifier to the server, and to receive a second random number, a second national cryptographic SM2 elliptic curve public key and the identifier sent by the server.
[0017] The first generation module is used to obtain a pre-master key based on the first national cryptographic SM2 elliptic curve private key and the second national cryptographic SM2 elliptic curve public key, and to generate a master key based on the pre-master key, the first random number and the second random number;
[0018] A first processing module is configured to derive a key set based on the master key, wherein the key set includes a first SM4 data encryption key;
[0019] The first encryption module is used to encrypt the transaction data based on the first SM4 data encryption key and send the encrypted transaction data to the server.
[0020] Fourthly, embodiments of this application also provide a data processing apparatus applied to a server, the apparatus comprising:
[0021] The second transmission module is used to receive a first random number, a first national cryptographic SM2 elliptic curve public key and an identifier sent by the client, and to send a second random number, a second national cryptographic SM2 elliptic curve public key and the identifier to the client.
[0022] The second generation module is used to obtain a pre-master key based on the second national cryptographic SM2 elliptic curve private key and the first national cryptographic SM2 elliptic curve public key, and to generate a master key based on the pre-master key, the first random number and the second random number;
[0023] The second processing module is used to derive a key set based on the master key, wherein the key set includes a first SM4 data encryption key;
[0024] The first decryption module is used to receive the encrypted transaction data sent by the client, and decrypt the encrypted transaction data based on the first SM4 data encryption key to obtain the transaction data.
[0025] Fifthly, embodiments of this application also provide a data processing system, including a client and a server, wherein the client is used to execute the steps of the data processing method as described in the first aspect, or the server is used to execute the steps of the data processing method as described in the second aspect.
[0026] In a sixth aspect, embodiments of this application also provide an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the data processing method described in the first or second aspect above.
[0027] In a seventh aspect, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the data processing method described in the first or second aspect.
[0028] Eighthly, embodiments of this application also provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the data processing method described in the first or second aspect.
[0029] Compared with existing technologies, the method provided in this application involves a client sending a first random number, a first national cryptographic SM2 elliptic curve public key, and an identifier to a server, and receiving a second random number, a second national cryptographic SM2 elliptic curve public key, and the identifier from the server. The client and server exchange the identifier, random number, and national cryptographic SM2 elliptic curve public key corresponding to the context, dynamically adjusting the key exchange strategy and security parameters according to environmental changes. The client obtains a pre-master key based on the first national cryptographic SM2 elliptic curve private key and the second national cryptographic SM2 elliptic curve public key. The pre-master key acts as a top-level protection layer, further improving key security. A master key is generated based on the pre-master key, the first random number, and the second random number, with further enhanced randomness to reduce the risk of key prediction. A key set is derived from the master key, realizing a bidirectional independent key mechanism, with complete separation of client and server keys. The key set includes a first SM4 data encryption key. Transaction data is encrypted based on the first SM4 data encryption key, and the encrypted transaction data is sent to the server, improving data processing security. Attached Figure Description
[0030] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0031] Figure 1 This is a flowchart of a data processing method provided in an embodiment of this application;
[0032] Figure 2 This is a flowchart of another data processing method provided in an embodiment of this application;
[0033] Figure 3 This is a structural diagram of a data processing apparatus provided in an embodiment of this application;
[0034] Figure 4 This is a structural diagram of another data processing apparatus provided in the embodiments of this application;
[0035] Figure 5 This is a network topology diagram of a data processing system provided in an embodiment of this application;
[0036] Figure 6 This is an architecture diagram of a data processing system provided in an embodiment of this application;
[0037] Figure 7 This is a flowchart of the process by which the initiator generates a session key, provided in an embodiment of this application.
[0038] Figure 8 This is a flowchart of the receiver generating a session key provided in an embodiment of this application;
[0039] Figure 9 This is a hierarchical diagram of a data processing system provided in an embodiment of this application;
[0040] Figure 10 This is a structural diagram of an electronic device provided in an embodiment of this application;
[0041] Figure 11 This is a structural diagram of another electronic device provided in an embodiment of this application. Detailed Implementation
[0042] The terms "first," "second," etc., used in this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, without limiting the number of objects; for example, the first object can be one or more. Furthermore, "or" in this application indicates at least one of the connected objects. For example, "A or B" covers three scenarios: Scenario 1: including A but not B; Scenario 2: including B but not A; Scenario 3: including both A and B. The character " / " generally indicates that the preceding and following objects are in an "or" relationship.
[0043] The term "instruction" in this application can be either a direct instruction (or explicit instruction) or an indirect instruction (or implicit instruction). A direct instruction can be understood as one in which the sender explicitly informs the receiver of specific information, the operation to be performed, or the requested result, etc., in the instruction sent. An indirect instruction can be understood as one in which the receiver determines the corresponding information based on the instruction sent by the sender, or makes a judgment and determines the operation to be performed or the requested result, etc., based on the judgment result.
[0044] To make the technical problems, technical solutions and advantages of this application clearer, a detailed description will be provided below in conjunction with the accompanying drawings and specific embodiments.
[0045] It should be noted that the client mentioned in this application can be the initiator of data processing, and the server can be the destination (receiver) of data processing.
[0046] This application provides a data processing method, executed by a client. For example... Figure 1 As shown, Figure 1 This is a flowchart of the data processing method provided in the embodiments of this application, such as... Figure 1 As shown, it includes the following steps:
[0047] Step 101: Send a first random number, a first national cryptographic SM2 elliptic curve public key and an identifier to the server, and receive a second random number, a second national cryptographic SM2 elliptic curve public key and the identifier sent by the server;
[0048] In this step, the client (which can be understood as the initiator) generates a first random number, a first SM2 elliptic curve private key, and a first SM2 elliptic curve public key, and sends the client's first random number, identifier, and first SM2 elliptic curve public key to the server (which can be understood as the receiver or destination). The client receives a second random number, a second SM2 elliptic curve public key, and an identifier from the server. The client and server complete the exchange of the identifier, random number, and SM2 elliptic curve public key corresponding to the context. The identifier mentioned in this application is the transaction number (TransactionId). The client monitors information in real time and dynamically adjusts the key exchange strategy and security parameters according to environmental changes.
[0049] Among them, the first random number is the client's random number, the first SM2 elliptic curve private key is the client's SM2 elliptic curve private key, the first SM2 elliptic curve public key is the client's SM2 elliptic curve public key, the second random number is the server's random number, and the second SM2 elliptic curve public key is the server's SM2 elliptic curve public key.
[0050] Step 102: Based on the first national cryptographic SM2 elliptic curve private key and the second national cryptographic SM2 elliptic curve public key, obtain the pre-master key, and generate the master key according to the pre-master key, the first random number and the second random number;
[0051] In this step, the client calculates the pre-master key using elliptic curve private key (first national cryptography SM2) and elliptic curve public key (second national cryptography SM2), employing elliptic curve scalar multiplication (ScalarMult). The client's elliptic curve-based algorithm offers higher efficiency at the same security level. The pre-master key establishes the initial trust foundation, acting as a top-level protection layer and enhancing the security of key exchange. The client constructs a seed by merging the first and second random numbers. By increasing the random number, the risk of key prediction is reduced, preventing key attacks. Using HMAC_SM3 to construct the PRF method, the client iterates through multiple rounds to obtain the master key, providing a unified, secure, and reliable source for subsequent derivations.
[0052] Step 103: Derive a key set based on the master key, wherein the key set includes a first SM4 data encryption key;
[0053] In this step, the client uses the master key to derive a key set through the HKDF-SM3 derivation process, resulting in three independent keys. This improves key freshness and security, and ensures complete separation between client and server keys, implementing a two-way independent key mechanism to further enhance the security of key exchange. The first SM4 data encryption key is used to encrypt the client's transaction data and can also be used to decrypt encrypted transaction data sent from the server to the client.
[0054] Step 104: Encrypt the transaction data based on the first SM4 data encryption key, and send the encrypted transaction data to the server.
[0055] In this step, the client encrypts the transaction data using the first SM4 data encryption key, initiates a transaction with the server, and sends the encrypted transaction data to the server.
[0056] Optionally, the method further includes:
[0057] Establish the association between the identifier and the key set, and save the key set;
[0058] The encryption of transaction data based on the first SM4 data encryption key further includes:
[0059] Obtain the key set associated with the identifier based on the identifier;
[0060] Obtain the first SM4 data encryption key from the key set, and encrypt the transaction data based on the first SM4 data encryption key.
[0061] In this implementation, the client stores the key set using an identifier as the index key and reuses the keys through a transaction ticket (TransactionId) mechanism to avoid the overhead of repeated key exchanges. When data exchange is performed, the first SM4 data encryption key is searched within this key set using the identifier as the index key, and the transaction data is encrypted using this first SM4 data encryption key.
[0062] Optionally, sending the first random number, the first national cryptographic SM2 elliptic curve public key, and the identifier to the server further includes:
[0063] Determine whether the identifier exists in an associated first key set;
[0064] If the identifier does not have an associated first key set, send a first random number, a first national cryptographic SM2 elliptic curve public key, and the identifier to the server.
[0065] In this implementation, if the client does not have a corresponding identifier associated with the first dataset, it sends a request to the server for key exchange. Otherwise, the client can directly use the first SM4 data encryption key to encrypt the transaction data. When the server sends the encrypted data to the client, it directly uses the second SM4 data encryption key to decrypt the encrypted transaction data. Session reuse reduces handshake overhead, avoids unnecessary key exchanges, and reduces network overhead. The first key set includes the first SM4 data encryption key and the second SM4 data encryption key.
[0066] Optionally, the key set further includes:
[0067] The second SM4 data encryption key is used to decrypt the encrypted transaction data sent by the server.
[0068] The first SM3-HMAC message authentication key is used for key information verification.
[0069] The second SM3-HMAC message authentication key is used for key information verification.
[0070] The first GCM mode IV vector generation key is used to prevent IV vector reuse.
[0071] The second GCM mode IV vector generation key is used to prevent IV vector reuse.
[0072] In this embodiment, the SM4 data encryption key is used to encrypt and decrypt transaction data. It is specifically used to calculate / verify the SM3-HMAC value of each ciphertext or control message, enabling the SM3-HMAC message authentication key to identify the data source and prevent data tampering. The IV vector can be understood as the initial vector. The GCM mode IV vector generation key derives a unique IV vector for each SM4-GCM call, ensuring that the ciphertext encrypted with the same key is completely different each time, preventing replay and traffic analysis, while also ensuring that the GCM CTR counter starts from an unpredictable starting point.
[0073] Optionally, the method further includes:
[0074] After the encrypted transaction data is sent to the server, the first SM4 data encryption key is destroyed, or, if the first SM4 data encryption key becomes invalid, the first SM4 data encryption key is destroyed.
[0075] In this implementation, after the transaction data identified by the client is sent, the first SM4 data encryption key can be destroyed. If the first SM4 data encryption key becomes invalid, it is automatically destroyed. Timely cleanup of key materials enables streaming key processing and reduces memory spikes. Invalidation occurs when: the key has expired, been marked as invalid by the system, been replaced by a new key, or is forcibly taken offline by a policy.
[0076] The method provided in this application embodiment involves a client sending a first random number, a first national cryptographic SM2 elliptic curve public key, and an identifier to a server, and receiving a second random number, a second national cryptographic SM2 elliptic curve public key, and the identifier from the server. The client and server exchange the identifier, random number, and national cryptographic SM2 elliptic curve public key corresponding to the context, dynamically adjusting the key exchange strategy and security parameters according to environmental changes. Based on the first national cryptographic SM2 elliptic curve private key and the second national cryptographic SM2 elliptic curve public key, a pre-master key is obtained, which acts as a top-level protection layer to further improve key security. A master key is generated based on the pre-master key, the first random number, and the second random number, with further enhancements to the random number to reduce the risk of key prediction. A key set is derived from the master key, realizing a bidirectional independent key mechanism, with complete separation of client and server keys. The key set includes a first SM4 data encryption key. Transaction data is encrypted based on the first SM4 data encryption key, and the encrypted transaction data is sent to the server, improving data processing security.
[0077] This application also provides a data processing method, executed by a server. For example... Figure 2 As shown, Figure 2 This is a flowchart of the data processing method provided in the embodiments of this application, such as... Figure 2 As shown, it includes the following steps:
[0078] Step 201: Receive the first random number, the first national cryptographic SM2 elliptic curve public key and the identifier sent by the client, and send the second random number, the second national cryptographic SM2 elliptic curve public key and the identifier to the client;
[0079] Step 202: Based on the second national cryptographic SM2 elliptic curve private key and the first national cryptographic SM2 elliptic curve public key, obtain the pre-master key, and generate the master key according to the pre-master key, the first random number and the second random number;
[0080] Step 203: Derive a key set based on the master key, wherein the key set includes a first SM4 data encryption key;
[0081] Step 204: Receive the encrypted transaction data sent by the client, and decrypt the encrypted transaction data based on the first SM4 data encryption key to obtain the transaction data.
[0082] Optionally, the method further includes:
[0083] Establish the association between the identifier and the key set, and save the key set;
[0084] The step of decrypting the encrypted transaction data based on the first SM4 data encryption key further includes:
[0085] Obtain the key set associated with the identifier based on the identifier;
[0086] Obtain the first SM4 data encryption key from the key set, and decrypt the encrypted transaction data based on the first SM4 data encryption key.
[0087] Optionally, the first random number, the first national cryptographic SM2 elliptic curve public key, and the identifier sent by the receiving client further include:
[0088] Determine whether the identifier exists in an associated first key set;
[0089] In the case where the identifier does not have an associated first key set, the first random number, the first national cryptographic SM2 elliptic curve public key, and the identifier are sent by the receiving client.
[0090] Optionally, the key set further includes:
[0091] The first SM3-HMAC message authentication key is used for key information verification.
[0092] The second SM3-HMAC message authentication key is used for key information verification.
[0093] The first GCM mode IV vector generation key is used to prevent IV vector reuse.
[0094] The second GCM mode IV vector generation key is used to prevent IV vector reuse.
[0095] Optionally, the method further includes:
[0096] After the encrypted transaction data is decrypted based on the first SM4 data encryption key, the first SM4 data encryption key is destroyed; or, if the first SM4 data encryption key becomes invalid, the first SM4 data encryption key is destroyed.
[0097] It should be noted that this embodiment has been specifically described in the aforementioned client implementation method. To avoid repeating the description, this embodiment will not be repeated, and it can achieve the same beneficial effect.
[0098] The various methods of the embodiments of this application have been described above. Apparatus for implementing the above methods will now be provided.
[0099] This application also provides a data processing apparatus for use on a client side. For example... Figure 3 As shown, Figure 3 This is a structural diagram of the data processing apparatus provided in the embodiments of this application, such as... Figure 3 As shown, it includes the following modules:
[0100] The first transmission module 301 is used to send a first random number, a first national cryptographic SM2 elliptic curve public key and an identifier to the server, and to receive a second random number, a second national cryptographic SM2 elliptic curve public key and the identifier sent by the server.
[0101] The first generation module 302 is used to obtain a pre-master key based on the first national cryptographic SM2 elliptic curve private key and the second national cryptographic SM2 elliptic curve public key, and to generate a master key based on the pre-master key, the first random number and the second random number.
[0102] The first processing module 303 is used to derive a key set based on the master key, wherein the key set includes a first SM4 data encryption key;
[0103] The first encryption module 304 is used to encrypt the transaction data based on the first SM4 data encryption key and send the encrypted transaction data to the server.
[0104] Optionally, the device further includes:
[0105] The first storage module is used to establish the association between the identifier and the key set, and to store the key set;
[0106] The first encryption module 304 further includes:
[0107] The first acquisition unit is configured to acquire the key set associated with the identifier based on the identifier;
[0108] The first encryption unit is used to obtain the first SM4 data encryption key from the key set and encrypt the transaction data based on the first SM4 data encryption key.
[0109] Optionally, the first transmission module 301 further includes:
[0110] The first judgment unit is used to determine whether the identifier has an associated first key set;
[0111] The first transmission unit is configured to send a first random number, a first national cryptographic SM2 elliptic curve public key, and the identifier to the server when the identifier does not have an associated first key set.
[0112] Optionally, the key set further includes:
[0113] The second SM4 data encryption key is used to decrypt the encrypted transaction data sent by the server.
[0114] The first SM3-HMAC message authentication key is used for key information verification.
[0115] The second SM3-HMAC message authentication key is used for key information verification.
[0116] The first GCM mode IV vector generation key is used to prevent IV vector reuse.
[0117] The second GCM mode IV vector generation key is used to prevent IV vector reuse.
[0118] Optionally, the device further includes:
[0119] The first destruction module is used to destroy the first SM4 data encryption key after the encrypted transaction data is sent to the server, or to destroy the first SM4 data encryption key when the first SM4 data encryption key becomes invalid.
[0120] It should be noted that the apparatus in this embodiment corresponds to the data processing method described above. The implementation methods in each of the above embodiments are applicable to the embodiments of this apparatus and can achieve the same technical effect. The apparatus provided in this application embodiment can implement all the method steps implemented in the above method embodiments and can achieve the same technical effect. Therefore, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail here.
[0121] This application also provides a data processing apparatus for use on a server. For example... Figure 4 As shown, Figure 4 This is a structural diagram of the data processing apparatus provided in the embodiments of this application, such as... Figure 4 As shown, it includes the following modules:
[0122] The second transmission module 401 is used to receive a first random number, a first national cryptographic SM2 elliptic curve public key and an identifier sent by the client, and to send a second random number, a second national cryptographic SM2 elliptic curve public key and the identifier to the client.
[0123] The second generation module 402 is used to obtain a pre-master key based on the second national cryptographic SM2 elliptic curve private key and the first national cryptographic SM2 elliptic curve public key, and to generate a master key based on the pre-master key, the first random number and the second random number.
[0124] The second processing module 403 is used to derive a key set based on the master key, wherein the key set includes a first SM4 data encryption key;
[0125] The first decryption module 404 is used to receive the encrypted transaction data sent by the client, and decrypt the encrypted transaction data based on the first SM4 data encryption key to obtain the transaction data.
[0126] Optionally, the device further includes:
[0127] The second storage module is used to establish the association between the identifier and the key set, and to store the key set;
[0128] The first decryption module 404 further includes:
[0129] The second acquisition unit is used to acquire the key set associated with the identifier based on the identifier;
[0130] The second encryption unit is used to obtain the first SM4 data encryption key from the key set and decrypt the encrypted transaction data based on the first SM4 data encryption key.
[0131] Optionally, the second transmission module 401 further includes:
[0132] The second judgment unit is used to determine whether the identifier is associated with a first key set;
[0133] The second transmission unit is used to receive a first random number, a first national cryptographic SM2 elliptic curve public key, and an identifier sent by the client when the identifier does not have an associated first key set.
[0134] Optionally, the key set further includes:
[0135] The second SM4 data encryption key is used to encrypt transaction data sent to the client;
[0136] The first SM3-HMAC message authentication key is used for key information verification.
[0137] The second SM3-HMAC message authentication key is used for key information verification.
[0138] The first GCM mode IV vector generation key is used to prevent IV vector reuse.
[0139] The second GCM mode IV vector generation key is used to prevent IV vector reuse.
[0140] Optionally, the device further includes:
[0141] The second destruction module is used to destroy the first SM4 data encryption key after the encrypted transaction data is decrypted based on the first SM4 data encryption key, or to destroy the first SM4 data encryption key when the first SM4 data encryption key becomes invalid.
[0142] It should be noted that the apparatus in this embodiment corresponds to the data processing method described above. The implementation methods in each of the above embodiments are applicable to the embodiments of this apparatus and can achieve the same technical effect. The apparatus provided in this application embodiment can implement all the method steps implemented in the above method embodiments and can achieve the same technical effect. Therefore, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail here.
[0143] The technical solution provided in this application can be applied to data processing networks, such as... Figure 5 As shown, Figure 5 This is a network topology diagram of the data processing system provided in the embodiments of this application, such as... Figure 5 As shown, the data processing network includes an initiator, a destination, a node authentication module, and an Overlay network. The initiator includes an encryption application and an initiator node. The encryption application encrypts transaction data sent to the destination, and the initiator node transmits the initiator's identity information. The destination includes a decryption application and destination nodes. The decryption application decrypts the transaction data sent by the initiator, and the destination nodes transmit the destination's identity information. Overlay network technology abstracts and optimizes the underlying network topology. The Overlay network includes multiple relay nodes, and during data processing, the multi-hop functionality of these relay nodes enables secure data transmission. A centralized node authentication module manages and authenticates all participating nodes. This module includes node authentication and node routing. The initiator registers with and completes identity verification with the node authentication module, and the destination registers with and completes identity verification with the node authentication module. The node authentication module then sends participating node routing information to the Overlay network. The initiator sends encrypted data packets via HTTPS, and the destination receives the encrypted data packets after multi-hop transmission. End-to-end encryption protection is achieved from the initiator's encryption application to the destination's decryption application. Through the distributed architecture of the network topology of the Internet of Things, key exchange can be carried out in cross-border / cross-domain scenarios, solving the problem of insufficient adaptability of traditional key exchange protocols in complex network topologies.
[0144] This application also provides a data processing system, including an initiator (which can be understood as a client) and a receiver (which can be understood as a server). For example... Figure 6 As shown, Figure 6 This is an architecture diagram of the data processing system provided in the embodiments of this application, such as... Figure 6 As shown, it includes the following stages:
[0145] In Phase 1, if the initiating encryption machine does not have a first key set associated with the transaction number (which can be understood as an identifier), it sends a request to the receiving machine to exchange keys. The initiating encryption machine generates a first random number, a first national cryptographic SM2 elliptic curve private key, and a first national cryptographic SM2 elliptic curve public key, and sends the first random number, transaction number, and first national cryptographic SM2 elliptic curve public key to the receiving encryption machine. The receiving encryption machine receives the first random number, transaction number, and first national cryptographic SM2 elliptic curve public key sent by the initiating encryption machine. The receiving encryption machine generates a second random number, a second national cryptographic SM2 elliptic curve private key, and a second national cryptographic SM2 elliptic curve public key, and sends the second random number, transaction number, and second national cryptographic SM2 elliptic curve public key to the initiating encryption machine. The initiating and receiving machines complete the exchange of the identifier, random number, and national cryptographic SM2 elliptic curve public key corresponding to the context.
[0146] Phase 2, such as Figure 7 As shown, Figure 7 This is a flowchart of the initiator generating a session key provided in an embodiment of this application, such as... Figure 7 As shown, the process includes the following:
[0147] The initiating encryption machine calculates the pre-master key using elliptic curve scalar multiplication (ScalarMult) based on the first national cryptographic standard SM2 elliptic curve private key and the second national cryptographic standard SM2 elliptic curve public key. The initiating encryption machine combines the first and second random numbers to construct a seed. Based on the pseudo-random function (PRF) constructed by HMAC_SM3, the master key is generated through multiple rounds of iteration. The initiating encryption machine uses the HKDF-SM3 derivation protocol to derive the SM3-HMAC message authentication key, SM4 data encryption key, and GCM mode IV vector generation key for both parties. Among them, the SM3-HMAC message authentication key is used for message integrity verification between the communicating parties, the SM4 data encryption key is used for subsequent data encryption and decryption operations, and the GCM mode IV vector generation key is used to derive the initialization vector (IV) required for the GCM mode, ensuring the semantic security of the encryption.
[0148] like Figure 8 As shown, Figure 8This is a flowchart of the receiver generating a session key provided in the embodiments of this application. Since the principle of the receiver generating a session key is similar to that of the initiator generating a session key in the embodiments of this application, the implementation of the receiver generating a session key can refer to the implementation of the initiator generating a session key, and the repeated parts will not be described again.
[0149] Phase 3 employs the SM2-SM3 national cryptographic signature scheme. Both parties verify the message using their local private keys (msk) and then calculate a deterministic signature, Auth_A = Sign_msk(ID_A || PA || T), where ID_A is the entity identifier, PA is the public key parameter for this session, and T is the timestamp. The verifier uses the SM2 elliptic curve public key to verify the signature, completing two-way identity authentication and binding session parameters and timeliness information, thus achieving mutual identity authentication.
[0150] The SM3-HMAC-based key verification mechanism works as follows: After key derivation from the shared intermediate key K, both parties independently calculate Confirm_A = MAC_K(ID_A || ID_B || PA || PB), where ID_A and ID_B are entity identifiers, PA and PB are the public key parameters for this session, and T is a timestamp, to confirm that the other party possesses the same key materials. The protocol integrates the identities of both parties, the session public key, and a random component to ensure key consistency, non-forgeability, and resistance to man-in-the-middle attacks, thus implementing the key verification protocol.
[0151] The certificate validity period is verified by using |T - current_time()| < threshold, where T is the timestamp, current_time() is the local current time, and threshold is the preset maximum allowed time deviation. This implements timestamp verification and checks that the handshake between the two communicating parties has not timed out. If the timeout occurs, the handshake is discarded and resources are released, thus implementing handshake timeout protection and preventing denial-of-service attacks. The random number is integrated with the timestamp to enhance protection against replay attacks.
[0152] The KDF is constructed based on the SM3 PRF: session_key = KDF(K || ID_A || ID_B || T || N), where K is the shared secret negotiated by the two parties in the key exchange, ID_A and ID_B are the identity identifiers of the communicating parties, T is the timestamp, and N is a random number. The derivation process is bidirectional and independent, with each party generating its own encryption / authentication key to achieve forward security. The random number and time-varying parameters are input together to eliminate the risks of key prediction and cross-session reuse. Session reuse reduces handshake overhead, and the context-aware mechanism avoids unnecessary key exchanges, reducing network overhead.
[0153] The initiating encryption machine sends a security verification request to the receiving encryption machine. The receiving encryption machine receives the security verification request, completes the security verification, and sends the request result back to the initiating encryption machine.
[0154] In phase 4, the initiating encryption machine stores the key set using the transaction number as the index key, and similarly, the receiving encryption machine stores the key set using the transaction number as the index key.
[0155] In Phase 5, the initiating encryption machine uses the transaction number as the index key to look up the first SM4 data encryption key, encrypts the transaction data using the first SM4 data encryption key, obtains encrypted data, and returns the encrypted data to the initiating application. Upon receiving the encrypted data, the initiating application sends the encrypted data to the receiving application via OTN / HTN. After receiving the encrypted data sent by the initiating application, the receiving application returns the encrypted data and the transaction number to the receiving encryption machine. The receiving encryption machine uses the first SM4 data encryption key to decrypt the encrypted data and returns the decrypted encrypted data to the receiving application, thus completing the exchange of transaction data between the two parties.
[0156] Phase 6: After the initiating application sends encrypted data, the initiating encryption machine destroys the first SM4 data encryption key, or if the first SM4 data encryption key becomes invalid during data processing, the initiating encryption machine automatically destroys the first SM4 data encryption key.
[0157] In this embodiment, the data processing system completes multiple hops through the initiator, initiator gateway, receiver gateway, and receiver, avoiding the single point of trust problem of traditional PKI system. A distributed trust chain is established between gateways to support cross-domain trust transfer.
[0158] like Figure 9 As shown, Figure 9 This is a hierarchical diagram of the data processing system provided in the embodiments of this application, such as... Figure 9 As shown, the network comprises the following layers: application layer, protocol layer, management layer, security layer, and network layer. The application layer provides interfaces for data networking applications, APIs for key exchange services, security services, user authentication, and system monitoring; it also controls data access. The protocol layer implements the dynamic key exchange protocol, including core functions such as key negotiation, update, and revocation. The management layer manages key lifecycle, policy configuration, node trust levels, and audit logs; it is responsible for key generation, distribution, storage, and destruction; and it can also monitor anomalies. The security layer implements the underlying elliptic curve cryptography algorithm, providing basic security services such as encryption, digital signatures, timestamp verification, hash algorithms, and key derivation. The network layer provides TLS / SSL secure communication channels, is aware of network topology, encrypts data transmission processes, manages connection status, and analyzes traffic monitoring to ensure network security during key exchange.
[0159] The core functional modules in the protocol layer include: a context-aware module, a dynamic key generation module, an intelligent negotiation module, a security verification module, and a real-time update module. The context-aware module monitors the network status in real time, including node joining or leaving, data access patterns, and security threats. The dynamic key generation module generates dynamic keys using a dynamic key generation algorithm based on elliptic curve cryptography and timestamps, automatically managing the generation, distribution, updating, and destruction of keys to ensure that the leakage of old keys does not affect the security of new sessions, guaranteeing forward security. The intelligent negotiation module intelligently selects key exchange strategies and parameters based on context information and can also handle abnormal situations such as network interruptions and node failures. The security verification module uses a multi-factor authentication mechanism to ensure the credibility of participants, verifies the integrity of data during key exchange, and performs timeliness checks to ensure that key exchange requests are within a valid time window. The real-time update module supports real-time key updates and forward security guarantees. This modular design facilitates system expansion and upgrades.
[0160] Adding multiple nodes also supports dynamic addition / removal of gateway nodes. Through load balancing and failover mechanisms, it improves horizontal scalability and achieves a provably optimal balance between compliance, security, and cost through unified management by the management center.
[0161] It should be noted that the system in this embodiment corresponds to the data processing method described above. The implementation methods in each of the above embodiments are applicable to the embodiments of this system and can achieve the same technical effect. The system provided in this application embodiment can implement all the method steps implemented in the above method embodiments and can achieve the same technical effect. Therefore, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail here.
[0162] This application also provides an electronic device for use in a client. For example... Figure 10 As shown, Figure 10 This is a structural diagram of the electronic device provided in the embodiments of this application, such as... Figure 10 As shown, it includes: transceiver 1010 for:
[0163] Send a first random number, a first national cryptographic SM2 elliptic curve public key, and an identifier to the server, and receive a second random number, a second national cryptographic SM2 elliptic curve public key, and the identifier sent by the server;
[0164] Processor 1000 is used to read the program from memory 1020 and execute the following procedures:
[0165] Based on the first national cryptographic SM2 elliptic curve private key and the second national cryptographic SM2 elliptic curve public key, a pre-master key is obtained, and a master key is generated based on the pre-master key, the first random number, and the second random number.
[0166] A key set is derived from the master key, wherein the key set includes a first SM4 data encryption key;
[0167] The transceiver 1010 is used for:
[0168] The transaction data is encrypted using the first SM4 data encryption key, and the encrypted transaction data is sent to the server.
[0169] Among them, Figure 10 In this context, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 1000) and memory (memory 1020). The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 1010 may be multiple elements, including transmitters and transceivers, providing a unit for communicating with various other devices over a transmission medium. The processor 1000 is responsible for managing the bus architecture and general processing, and the memory 1020 may store data used by the processor 1000 during operation.
[0170] Optionally, the processor 1000 is configured to read the program from the memory 1020 and execute the following processes:
[0171] Establish the association between the identifier and the key set, and save the key set;
[0172] The processor 1000 is used to read the program in the memory 1020 and execute the following processes:
[0173] Obtain the key set associated with the identifier based on the identifier;
[0174] Obtain the first SM4 data encryption key from the key set, and encrypt the transaction data based on the first SM4 data encryption key.
[0175] Optionally, the processor 1000 is configured to read the program from the memory 1020 and execute the following processes:
[0176] Determine whether the identifier exists in an associated first key set;
[0177] The transceiver 1010 is used for:
[0178] If the identifier does not have an associated first key set, send a first random number, a first national cryptographic SM2 elliptic curve public key, and the identifier to the server.
[0179] Optionally, the key set further includes:
[0180] The second SM4 data encryption key is used to decrypt the encrypted transaction data sent by the server.
[0181] The first SM3-HMAC message authentication key is used for key information verification.
[0182] The second SM3-HMAC message authentication key is used for key information verification.
[0183] The first GCM mode IV vector generation key is used to prevent IV vector reuse.
[0184] The second GCM mode IV vector generation key is used to prevent IV vector reuse.
[0185] Optionally, the processor 1000 is configured to read the program from the memory 1020 and execute the following processes:
[0186] After the encrypted transaction data is sent to the server, the first SM4 data encryption key is destroyed, or, if the first SM4 data encryption key becomes invalid, the first SM4 data encryption key is destroyed.
[0187] It should be noted that the electronic device in this embodiment is the electronic device corresponding to the data processing method described above. The implementation methods in each of the above embodiments are applicable to the embodiments of this electronic device and can achieve the same technical effect. The electronic device provided in this application embodiment can implement all the method steps implemented in the above method embodiments and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail.
[0188] This application also provides an electronic device applied to a server. For example... Figure 11 As shown, Figure 11 This is a structural diagram of the electronic device provided in the embodiments of this application, such as... Figure 11 As shown, it includes: transceiver 1110 for:
[0189] Receive a first random number, a first national cryptographic SM2 elliptic curve public key and an identifier sent by the client, and send a second random number, a second national cryptographic SM2 elliptic curve public key and the identifier to the client;
[0190] Processor 1100 is used to read the program from memory 1120 and execute the following procedures:
[0191] Based on the second national cryptographic SM2 elliptic curve private key and the first national cryptographic SM2 elliptic curve public key, a pre-master key is obtained, and a master key is generated according to the pre-master key, the first random number and the second random number;
[0192] A key set is derived from the master key, wherein the key set includes a first SM4 data encryption key;
[0193] The transceiver 1110 is used for:
[0194] The system receives encrypted transaction data sent by the client and decrypts the encrypted transaction data based on the first SM4 data encryption key to obtain the transaction data.
[0195] Among them, Figure 11 In this context, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 1100) and memory (memory 1120). The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 1110 may be multiple elements, including transmitters and transceivers, providing a unit for communicating with various other devices over a transmission medium. The processor 1100 is responsible for managing the bus architecture and general processing, and the memory 1120 may store data used by the processor 1100 during operation.
[0196] Optionally, the processor 1100 is configured to read the program from the memory 1120 and execute the following procedures:
[0197] Establish the association between the identifier and the key set, and save the key set;
[0198] The processor 1100 is used to read the program in the memory 1120 and execute the following processes:
[0199] Obtain the key set associated with the identifier based on the identifier;
[0200] Obtain the first SM4 data encryption key from the key set, and decrypt the encrypted transaction data based on the first SM4 data encryption key.
[0201] Optionally, the processor 1100 is configured to read the program from the memory 1120 and execute the following procedures:
[0202] Determine whether the identifier exists in an associated first key set;
[0203] The transceiver 1110 is used for:
[0204] In the case where the identifier does not have an associated first key set, the first random number, the first national cryptographic SM2 elliptic curve public key, and the identifier are sent by the receiving client.
[0205] Optionally, the key set further includes:
[0206] The second SM4 data encryption key is used to encrypt transaction data sent to the client;
[0207] The first SM3-HMAC message authentication key is used for key information verification.
[0208] The second SM3-HMAC message authentication key is used for key information verification.
[0209] The first GCM mode IV vector generation key is used to prevent IV vector reuse.
[0210] The second GCM mode IV vector generation key is used to prevent IV vector reuse.
[0211] Optionally, the processor 1100 is configured to read the program from the memory 1120 and execute the following procedures:
[0212] After the encrypted transaction data is decrypted based on the first SM4 data encryption key, the first SM4 data encryption key is destroyed; or, if the first SM4 data encryption key becomes invalid, the first SM4 data encryption key is destroyed.
[0213] It should be noted that the electronic device in this embodiment is the electronic device corresponding to the data processing method described above. The implementation methods in each of the above embodiments are applicable to the embodiments of this electronic device and can achieve the same technical effect. The electronic device provided in this application embodiment can implement all the method steps implemented in the above method embodiments and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail.
[0214] This application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the various processes of the above-described data processing method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.
[0215] This application also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, they implement the various processes of the above-described data processing method embodiments and achieve the same technical effects. To avoid repetition, they will not be described again here.
[0216] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
[0217] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.
[0218] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.
Claims
1. A data processing method, characterized by, The method is executed by a client, and the method comprises: sending a first random number, a first national SM2 elliptic curve public key and an identifier to a server, and receiving a second random number, a second national SM2 elliptic curve public key and the identifier sent by the server; obtaining a pre-master key based on a first national SM2 elliptic curve private key and the second national SM2 elliptic curve public key, and generating a master key according to the pre-master key, the first random number and the second random number; deriving a key set according to the master key, wherein the key set comprises a first SM4 data encryption key; encrypting transaction data based on the first SM4 data encryption key, and sending the encrypted transaction data to the server.
2. The data processing method according to claim 1, characterized in that, The method further comprises: establishing an association between the identifier and the key set, and saving the key set; The method further comprises: obtaining the key set associated with the identifier according to the identifier; obtaining the first SM4 data encryption key in the key set, and encrypting transaction data based on the first SM4 data encryption key.
3. The data processing method of claim 1, wherein, The method further comprises: judging whether the identifier is associated with a first key set; in a case where the identifier is not associated with a first key set, sending the first random number, the first national SM2 elliptic curve public key and the identifier to the server.
4. The data processing method of claim 1, wherein, The key set further comprises: a second SM4 data encryption key, which is used for decrypting the encrypted transaction data sent by the server; a first SM3-HMAC message authentication key, which is used for key information verification; a second SM3-HMAC message authentication key, which is used for key information verification; a first GCM mode IV vector generation key, which is used for preventing IV vector reuse; a second GCM mode IV vector generation key, which is used for preventing IV vector reuse.
5. The data processing method of claim 1, wherein, The method further comprises: after the encrypted transaction data is sent to the server, destroying the first SM4 data encryption key, or, in a case where the first SM4 data encryption key is invalid, destroying the first SM4 data encryption key.
6. A data processing method, characterized by, The method is executed by a server, and the method comprises: receiving a first random number, a first national SM2 elliptic curve public key and an identifier sent by a client, and sending a second random number, a second national SM2 elliptic curve public key and the identifier to the client; obtaining a pre-master key based on a second national SM2 elliptic curve private key and the first national SM2 elliptic curve public key, and generating a master key according to the pre-master key, the first random number and the second random number; deriving a key set according to the master key, wherein the key set comprises a first SM4 data encryption key; receive the encrypted transaction data sent by the client, and decrypt the encrypted transaction data based on the first SM4 data encryption key to obtain the transaction data.
7. The data processing method according to claim 6, characterized in that, The method further includes: establishing an association between the identifier and the key set, and saving the key set; decrypting the encrypted transaction data based on the first SM4 data encryption key further includes: obtaining the key set associated with the identifier according to the identifier; obtaining the first SM4 data encryption key in the key set, and decrypting the encrypted transaction data based on the first SM4 data encryption key.
8. The data processing method of claim 6, wherein, The receiving of the first random number, the first national SM2 elliptic curve public key and the identifier sent by the client further includes: determining whether the identifier is associated with a first key set; in the case that the identifier is not associated with a first key set, receiving the first random number, the first national SM2 elliptic curve public key and the identifier sent by the client.
9. The data processing method according to claim 6, characterized in that, The key set further includes: a second SM4 data encryption key, which is used to encrypt transaction data sent to the client; a first SM3-HMAC message authentication key, which is used for key information verification; a second SM3-HMAC message authentication key, which is used for key information verification; a first GCM mode IV vector generation key, which is used to prevent IV vector reuse; a second GCM mode IV vector generation key, which is used to prevent IV vector reuse.
10. The data processing method according to claim 6, characterized in that, The method further includes: after decrypting the encrypted transaction data based on the first SM4 data encryption key, destroying the first SM4 data encryption key, or, in the case that the first SM4 data encryption key is invalid, destroying the first SM4 data encryption key.
11. A data processing apparatus, characterized by The apparatus applied to the client includes: a first transmission module configured to send a first random number, a first national SM2 elliptic curve public key and an identifier to a server, and receive a second random number, a second national SM2 elliptic curve public key and the identifier sent by the server; a first generation module configured to obtain a pre-master key based on a first national SM2 elliptic curve private key and the second national SM2 elliptic curve public key, and generate a master key according to the pre-master key, the first random number and the second random number; a first processing module configured to derive a key set according to the master key, wherein the key set includes a first SM4 data encryption key; a first encryption module configured to encrypt transaction data based on the first SM4 data encryption key, and send the encrypted transaction data to the server.
12. A data processing apparatus, characterized by The apparatus applied to the server includes: a second transmission module configured to receive a first random number, a first national SM2 elliptic curve public key and an identifier sent by a client, and send a second random number, a second national SM2 elliptic curve public key and the identifier to the client; The second generating module is configured to obtain a pre-master key based on a second national SM2 elliptic curve private key and the first national SM2 elliptic curve public key, and generate a master key according to the pre-master key, the first random number and the second random number; The second processing module is configured to derive a key set according to the master key, wherein the key set includes a first SM4 data encryption key. The first decryption module is configured to receive the encrypted transaction data sent by the client, decrypt the encrypted transaction data based on the first SM4 data encryption key, and obtain the transaction data.
13. A data processing system, characterized by The client is configured to perform the steps of the data processing method according to any one of claims 1 to 5, and the server is configured to perform the steps of the data processing method according to any one of claims 6 to 10.
14. An electronic device, comprising: The computer program is executed by the processor to implement the steps of the data processing method according to any one of claims 1 to 5, or the computer program is executed by the processor to implement the steps of the data processing method according to any one of claims 6 to 10.
15. A computer-readable storage medium, characterized in that, The computer program is executed by the processor to implement the steps of the data processing method according to any one of claims 1 to 5, or the computer program is executed by the processor to implement the steps of the data processing method according to any one of claims 6 to 10.
16. A computer program product, characterised in that, The computer program is executed by the processor to implement the steps of the data processing method according to any one of claims 1 to 5, or the computer program is executed by the processor to implement the steps of the data processing method according to any one of claims 6 to 10.