A data security transmission method and device based on a national secret algorithm

Abstract

The application provides a data security transmission method and device based on a national secret algorithm, which comprises the following steps: a client generates a signature value according to a local key and sends the signature value to an encryption end; the encryption end requests an authentication credential from a server end according to the signature value, and sends the authentication credential to the client; the client initiates an access authentication to the encryption end through the authentication credential and receives a check result; the encryption end transmits the authentication credential and the check result; the server end generates a check result according to the authentication credential; and the client establishes a data transmission connection with the server end according to the check result. Through the cooperative authentication of the encryption end and the server end, the security problems such as identity forgery, data tampering, behavior denial and sensitive information interception are solved from the root, and the user does not need to carry additional hardware such as UKey, and the original use habit of the user is not changed.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, and specifically to a data security transmission method and apparatus based on Chinese cryptographic algorithms. Background Technology

[0002] General business systems lack national cryptographic authentication capabilities and cannot meet compliance requirements such as information security level protection and information security assessment. Therefore, existing authentication methods need to be modified. To achieve enhanced user authentication and channel protection, the main technical solutions currently include:

[0003] Users use compliant national cryptographic UKey storage digital certificates, combined with PIN codes for identity authentication. Certificates are issued by compliant CA institutions or self-signed CAs, and support SM2 signature verification. Users need to carry hardware devices, and mobile terminals need to support OTG or NFC (some mobile phones have poor compatibility). Furthermore, the procurement, distribution, and management costs of UKeys are high, and certificates need to be reissued if lost.

[0004] Dynamic passwords (hardware tokens or APP tokens) generated based on the SM3 algorithm, combined with username / password to achieve two-factor authentication, require a seed key and are subject to the risk of mass forgery; time-based OTP requires device time synchronization and network latency may affect verification; and requires manual input of dynamic codes, which involves many steps.

[0005] Based on the SM2 algorithm and blockchain technology, a decentralized electronic identity card (eID) is generated. Combined with QR code or facial recognition authentication, it requires the construction of a node network, resulting in high operation and maintenance costs. The blockchain consensus mechanism has high latency, making it unsuitable for real-time authentication. The application of blockchain identity in China is not yet fully open, which may raise compliance issues. Summary of the Invention

[0006] In view of the aforementioned problems, this application is proposed to provide a data security transmission method and apparatus based on national cryptographic algorithms to overcome or at least partially solve the aforementioned problems, comprising:

[0007] A data security transmission method based on Chinese national cryptographic algorithms is disclosed. The method involves a client, an encryption terminal, and a server. The client is used to receive user operation instructions, store local keys, and initiate requests. The encryption terminal has user information login verification permissions. The server is used to transmit encrypted data.

[0008] The method includes:

[0009] When a login request is received from a user, the client retrieves the corresponding local key based on the login request.

[0010] The client generates a signature value based on the local key and sends it to the encryption terminal; the encryption terminal requests an authentication credential from the server based on the signature value and sends the authentication credential to the client.

[0011] The client initiates access authentication to the encryption terminal using the authentication credential and receives the verification result; the encryption terminal transmits the authentication credential and the verification result; the server generates the verification result based on the authentication credential.

[0012] The client establishes a data transmission connection with the server based on the verification result.

[0013] Furthermore, the method also includes the client downloading a local key based on the login request, including the following steps:

[0014] The client sends a key download request and user identification information to the encryption terminal; the encryption terminal sends the user identification information to the server; the server generates an authentication command based on the user identification information.

[0015] The client receives the authentication instruction, performs authentication according to the instruction to obtain an authentication result, and sends the authentication result to the encryption terminal; the encryption terminal sends the authentication result to the server; the server generates key data based on the authentication result and sends the key data to the encryption terminal; the encryption terminal encrypts the key data and sends it to the client.

[0016] The client decrypts the key data and stores the decrypted key data locally to obtain a local key.

[0017] Furthermore, it also includes:

[0018] The client sends a secure connection establishment request to the encryption terminal based on the authentication credentials; the encryption terminal returns connection configuration parameters based on the authentication credentials.

[0019] The client receives the connection configuration parameters and initializes the local encrypted channel according to the connection configuration parameters;

[0020] When a user triggers a disconnection operation, the client sends a secure connection disconnection request and current connection status information to the encrypted terminal; the encrypted terminal sends a disconnection confirmation command to the client based on the current connection status information.

[0021] The client receives the disconnection confirmation command, closes the local encrypted channel, and clears the temporary cache data of this connection.

[0022] Further, the steps of the client generating a signature value based on the local key and sending it to the encryption end; the encryption end requesting an authentication credential from the server based on the signature value and sending the authentication credential to the client include:

[0023] The client receives a random challenge value generated by the server and forwarded by the encrypted terminal;

[0024] The client calls the local key to perform a national cryptographic algorithm signature operation on the random challenge value, generating a signature value with a dynamic factor;

[0025] The client sends the random challenge value and the signature value to the encryption terminal, and the encryption terminal and the server jointly verify the signature value.

[0026] Furthermore, it also includes:

[0027] The client generates a KS key in the key storage module of the corresponding terminal system;

[0028] The client randomly generates a PIN code, encrypts the PIN code using the KS key, and then stores it.

[0029] When the client needs to use the PIN code, it triggers local verification. After successful verification, it obtains the KS key and decrypts the PIN code using the KS key.

[0030] Furthermore, it also includes:

[0031] The client detects the usage period of the local key or receives a key rotation instruction from the server, and sends a key update request and the current key identifier to the encryption terminal.

[0032] The client receives the new key data forwarded by the encryption terminal, decrypts it, and replaces the original local key.

[0033] The client performs a secure destruction operation on the obsolete key by repeatedly overwriting the storage area or calling the hardware encryption module to clear the obsolete key data.

[0034] Furthermore, after the client and server establish a data transmission connection, the process also includes a data integrity protection step:

[0035] The client uses the SM3 national cryptographic hash algorithm to generate an integrity verification value for the transmitted data.

[0036] The client sends the transmitted data and the integrity check value to the server; the server verifies the transmitted data based on the integrity check value and obtains the verification result.

[0037] The client receives the verification result. If the verification does not match, the data transmission is terminated and a retransmission process is triggered.

[0038] An enhanced identity authentication and secure data transmission method based on Chinese national cryptographic algorithms is disclosed. The method involves a client, an encryption terminal, and a server. The client is used to receive user operation instructions, store local keys, and initiate requests. The encryption terminal has user information login verification permissions. The server is used to transmit encrypted data.

[0039] The method includes:

[0040] When the client receives the signature value generated by calling the local key in response to the user login request, the encryption terminal requests an authentication credential from the server based on the signature value, and sends the authentication credential returned by the server to the client.

[0041] The encryption terminal receives the access authentication association request initiated by the client based on the authentication credential, collaborates with the server to perform legality verification on the authentication credential and generate a verification result, and sends the verification result to the client.

[0042] A data security transmission method based on Chinese national cryptographic algorithms is disclosed. The method involves a client, an encryption terminal, and a server. The client is used to receive user operation instructions, store local keys, and initiate requests. The encryption terminal has user information login verification permissions. The server is used to transmit encrypted data.

[0043] The method includes:

[0044] When the server receives the signature value generated by the client using the local key in response to the user login request, the server receives the signature value and performs a validity check.

[0045] After the server verifies the signature value and it passes the verification, it generates an authentication credential and sends the authentication credential to the encryption terminal; the encryption terminal then forwards it to the client.

[0046] The server receives the access authentication request initiated by the client based on the authentication credential, performs secondary verification on the authentication credential and generates a verification result, and sends the verification result to the encryption terminal; the encryption terminal sends the verification result to the client.

[0047] When the verification result is valid, the server establishes an encrypted data transmission connection with the client based on the national cryptographic algorithm.

[0048] A data security transmission device based on Chinese national cryptographic algorithms, comprising a client, an encryption terminal, and a server, wherein the client is used to receive user operation instructions, store local keys, and initiate requests; the encryption terminal has user information login verification permissions; and the server is used to transmit encrypted data; the enhanced identity authentication and data security transmission device based on Chinese national cryptographic algorithms implements the steps of any one of the above-mentioned enhanced identity authentication and data security transmission methods based on Chinese national cryptographic algorithms:

[0049] include:

[0050] The login module is used so that when a login request is received from a user, the client can retrieve the corresponding local key based on the login request.

[0051] The authentication module is used for the client to generate a signature value based on the local key and send it to the encryption terminal; the encryption terminal requests an authentication credential from the server based on the signature value and sends the authentication credential to the client.

[0052] The verification module is used for the client to initiate access authentication to the encryption terminal using the authentication credential and receive the verification result; the encryption terminal to transmit the authentication credential and the verification result; and the server to generate the verification result based on the authentication credential.

[0053] The transmission module is used by the client to establish a data transmission connection with the server based on the verification result.

[0054] This application has the following advantages:

[0055] In the embodiments of this application, compared to the existing technology where enhancing user identity confidentiality in business systems requires modifications to the overall architecture, resulting in high costs and complexity, this application provides a data security transmission method based on national cryptographic algorithms. The method involves a client, an encryption terminal, and a server. The client is used to receive user operation instructions, store local keys, and initiate requests. The encryption terminal has user information login verification permissions. The server is used to transmit encrypted data. The method includes: when a user initiates a login request; the client calls the corresponding local key based on the login request; the client generates a signature value based on the local key and sends it to the encryption terminal; the encryption terminal requests an authentication credential from the server based on the signature value and sends the authentication credential to the client; the client initiates access authentication with the encryption terminal using the authentication credential and receives the verification result; the encryption terminal transmits the authentication credential and the verification result; the server generates a verification result based on the authentication credential; and the client establishes a data transmission connection with the server based on the verification result. By coordinating authentication between the encrypted end and the server, security issues such as identity forgery, data tampering, repudiation of behavior, and interception of sensitive information are fundamentally solved. It eliminates the need for users to carry additional hardware such as UKeys, does not change users' original usage habits, and supports multiple terminal systems such as Android, iOS, and HarmonyOS, as well as multiple technical architectures such as native APP, Uniapp, and Flutter. The unified interface design reduces the difficulty and cycle of modifying existing business systems, and can quickly meet compliance requirements such as information security level protection and information security assessment. It balances high security of identity authentication and data transmission, multi-scenario compatibility, low-cost modification, and ease of use for users. Attached Figure Description

[0056] To more clearly illustrate the technical solution of this application, the drawings used in the description of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 This is a flowchart of the client steps for a data security transmission method based on Chinese cryptographic algorithms provided in an embodiment of this application;

[0058] Figure 2 This is a structural block diagram of a client for a data security transmission device based on a national cryptographic algorithm, provided in one embodiment of this application.

[0059] Figure 3 This is a flowchart of the encryption end of a data security transmission method based on Chinese cryptographic algorithms provided in an embodiment of this application;

[0060] Figure 4 This is a structural block diagram of the encryption end of a data security transmission device based on the national cryptographic algorithm provided in one embodiment of this application;

[0061] Figure 5 This is a flowchart of the server-side steps of a data security transmission method based on Chinese cryptographic algorithms provided in an embodiment of this application;

[0062] Figure 6 This is a structural block diagram of the server side of a data security transmission device based on Chinese cryptographic algorithms provided in an embodiment of this application;

[0063] Figure 7 This is an architecture diagram of a data security transmission method based on national cryptographic algorithms provided in an embodiment of this application;

[0064] Figure 8 This is a flowchart illustrating a user authentication method for secure data transmission based on Chinese cryptographic algorithms, provided in one embodiment of this application.

[0065] Figure 9 This is a flowchart of a data security transmission method based on Chinese cryptographic algorithms provided in an embodiment of this application, illustrating secure access using Chinese cryptographic algorithms.

[0066] Figure 10 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention;

[0067] 1. Computer equipment; 2. External devices; 3. Processing unit; 4. Bus; 5. Network adapter; 6. I / O interface; 7. Display; 8. Memory; 9. Random access memory; 10. Cache memory; 11. Storage system; 12. Program / utility; 13. Program module. Detailed Implementation

[0068] To make the objectives, features, and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0069] The inventors, through analysis of existing technologies, discovered that: The national cryptographic UKey solution requires users to carry additional hardware devices; mobile terminals have high compatibility requirements with OTG or NFC; and the costs of hardware procurement, distribution, and management are high. If the device is lost, a new certificate needs to be issued. Dynamic password solutions based on the SM3 algorithm rely on seed keys, posing a risk of mass forgery. Time-based OTPs require device time synchronization, and network latency affects verification accuracy. Users also need to manually input dynamic codes, making the process cumbersome. Electronic ID card solutions based on the SM2 algorithm and blockchain technology require building a node network, resulting in high maintenance costs. The consensus mechanism leads to high authentication latency, making them unsuitable for real-time authentication scenarios. Furthermore, related applications in China are not yet fully open, posing compliance risks. These existing solutions generally suffer from high modification difficulty, long cycles, high costs, and poor compatibility. Some solutions also change user habits, making it difficult to meet compliance requirements such as information security and cryptographic assessment, and failing to balance security, ease of use, and low-cost modification needs.

[0070] In any embodiment of this application,

[0071] Client:

[0072] The terminal carrier directly faces the user, integrates the national cryptographic security SDK and business interaction functions, and is the main body for receiving user operation instructions, storing local keys, initiating requests and encrypting / decrypting data. It is compatible with multiple terminal systems and multiple technical architectures, and can achieve enhanced identity authentication and secure data transmission without additional hardware dependencies.

[0073] Terminal compatibility: Supports mainstream mobile terminal systems such as Android, iOS, and HarmonyOS;

[0074] Architecture adaptation: Compatible with native APP framework, Uniapp framework, Flutter framework and WeChat Work extension plugins (integrated in the form of aar package, framework package, plugin, etc.);

[0075] Core modules:

[0076] The system integrates the authentication module, encryption / decryption module, and secure access module of the business interface adaptation layer, as well as the system adaptation components of the platform interface adaptation layer, to provide a unified external interaction interface.

[0077] Function:

[0078] Receive user operation instructions (such as entering a mobile phone number, SMS verification code, PIN code, triggering login, connection establishment / disconnection, etc.);

[0079] Store local keys (securely store SM2 / SM9 national cryptographic keys through the key storage module built into the terminal system, such as the keystore of Android / HarmonyOS or the keychain of iOS).

[0080] Perform national cryptographic algorithm operations (generate signature values ​​based on local keys, encrypt transmitted data, generate integrity verification values ​​through the SM3 algorithm, etc.);

[0081] Initiate various requests (key download request, authentication credential request, secure connection establishment / disconnection request, etc.);

[0082] Security protection PIN code (KS key is generated through terminal key storage module, PIN code is encrypted and protected, and biometric verification is required to access KS key).

[0083] Encryption end

[0084] It serves as an intermediary hub connecting the client and server, possessing national cryptographic algorithm computing capabilities, authentication permissions, and request forwarding / result encapsulation functions. It is the core component for achieving collaborative signature, encrypted key transmission, and secure connection management, and is composed of secure middleware and a unified cryptographic service platform (Tongfu).

[0085] Components:

[0086] The secure middleware (CryptoTerminate) includes a key management layer module, a cryptographic operation layer module, and a secure access module. It is responsible for calling national cryptographic algorithms, processing key transfers, and connecting to VPN network connections.

[0087] Unified Cryptography Service Platform (U-KMS): Responsible for receiving middleware requests, generating key data through the Collaborative Cryptographic Machine (KGC), issuing authentication credentials, and verifying the validity of signature values.

[0088] Function:

[0089] Forwarding Requests and Results: Forward the client's key download request, signature value, connection request, etc. to the server, and encapsulate the authentication instructions, key data, authentication credentials, connection configuration parameters, etc. generated by the server and send them back to the client;

[0090] National cryptographic algorithm operation: collaborative client and server implement collaborative signature after key splitting, encryption and decryption of SM2 / SM9 algorithms, signature value verification, etc.;

[0091] Authentication collaboration: Receives user identity information from the client, forwards it to the server to generate authentication instructions, and verifies the authentication results returned by the client (SMS verification code, biometric results, etc.).

[0092] Secure connection management: Receives connection establishment / disconnection requests from clients, calls the VPN network connection module of the middleware to complete connection configuration or closure operations, and provides feedback on the connection status.

[0093] Server side

[0094] The core entity responsible for business logic, data storage and transmission, and permission verification is responsible for generating authentication credentials, verifying access legitimacy, issuing access policies, and ensuring the compliance and security of data transmission. It mainly includes the business system server and its supporting secure access gateway (RSC).

[0095] Components:

[0096] Business system server: It carries the core business logic, receives access authentication requests from clients, and returns business data;

[0097] Secure Access Gateway (RSC): Works with security middleware to enable VPN network access and manages terminal access permissions to intranet resources of business systems;

[0098] Supporting modules: integration with SMS platform (for sending authentication SMS messages) and cryptographic machine (KGC, for generating national cryptographic key data).

[0099] Function:

[0100] Generate key credentials and instructions: Generate authentication instructions based on client identity information, and generate authentication credentials based on the signature value forwarded by the encrypted end;

[0101] Legality verification: Verify the validity of authentication credentials, the integrity of transmitted data (based on SM3 checksum), and client access permissions, etc.

[0102] Transmit encrypted data: Establish an encrypted transmission connection with the client based on the national cryptographic algorithm to transmit business data, and access policies can be configured and issued according to the scenario;

[0103] Key management support: Generates user key data, forwards it to the client through the encryption terminal, issues key rotation instructions, and manages the key lifecycle.

[0104] Reference Figure 1 This application illustrates a data security transmission method based on a national cryptographic algorithm, according to an embodiment of the present application. The method involves a client, an encryption terminal, and a server. The client is used to receive user operation instructions, store local keys, and initiate requests. The encryption terminal has user information login verification permissions. The server is used to transmit encrypted data, including:

[0105] S110. When a login request is received from a user, the client retrieves the corresponding local key based on the login request.

[0106] S120. The client generates a signature value based on the local key and sends it to the encryption terminal; the encryption terminal requests an authentication credential from the server based on the signature value and sends the authentication credential to the client.

[0107] S130, The client initiates access authentication to the encryption terminal using the authentication credential and receives the verification result; the encryption terminal transmits the authentication credential and the verification result; the server generates the verification result based on the authentication credential.

[0108] S140. The client establishes a data transmission connection with the server based on the verification result.

[0109] In the embodiments of this application, compared to the existing technology where enhancing user identity confidentiality in business systems requires modifications to the overall architecture, resulting in high costs and complexity, this application provides a data security transmission method based on national cryptographic algorithms. The method involves a client, an encryption terminal, and a server. The client is used to receive user operation instructions, store local keys, and initiate requests. The encryption terminal has user information login verification permissions. The server is used to transmit encrypted data. The method includes: when a user initiates a login request; the client calls the corresponding local key based on the login request; the client generates a signature value based on the local key and sends it to the encryption terminal; the encryption terminal requests an authentication credential from the server based on the signature value and sends the authentication credential to the client; the client initiates access authentication with the encryption terminal using the authentication credential and receives the verification result; the encryption terminal transmits the authentication credential and the verification result; the server generates a verification result based on the authentication credential; and the client establishes a data transmission connection with the server based on the verification result. By coordinating authentication between the encrypted end and the server, security issues such as identity forgery, data tampering, repudiation of behavior, and interception of sensitive information are fundamentally solved. It eliminates the need for users to carry additional hardware such as UKeys, does not change users' original usage habits, and supports multiple terminal systems such as Android, iOS, and HarmonyOS, as well as multiple technical architectures such as native APP, Uniapp, and Flutter. The unified interface design reduces the difficulty and cycle of modifying existing business systems, and can quickly meet compliance requirements such as information security level protection and information security assessment. It balances high security of identity authentication and data transmission, multi-scenario compatibility, low-cost modification, and ease of use for users.

[0110] In a specific implementation, refer to Figure 7 The Enterprise WeChat SDK adopts a vertically layered architecture and a horizontally distributed interface design. The architecture is mainly divided into a platform interface adaptation layer, a business interface adaptation layer, and a cryptographic middleware adaptation layer, with the specific division of labor as follows:

[0111] Platform Interface Adaptation Layer: Provides SDK adaptation for various platforms, and provides different development packages according to the actual integration environment. Enterprise WeChat extensions are packaged and built in the form of aar packages through Tencent Wecrm.

[0112] Business Interface Adaptation Layer: Provides business interfaces for different needs scenarios to the upper layer, mainly including authentication modules, encryption / decryption modules, secure access, identity authentication modules, etc., and unifies interface naming, input / output parameters, and callback responses for external interfaces.

[0113] Cryptographic Middleware Adapter Layer: Provides basic cryptographic components for the upper layer, mainly including modules such as key management, cryptographic operations, secure access, and logging.

[0114] The main process of implementing national cryptographic security login using the Enterprise WeChat SDK is divided into two parts: user identity authentication process and national cryptographic security access process.

[0115] Reference Figure 8 The user authentication module process is as follows: To start logging in, the user opens the application, enters the login interface, and logs in by entering their mobile phone number.

[0116] The application requests the SDK's "Get Device Key" interface to enumerate keys. The SDK returns a list of keys that have been downloaded locally on the device (if no key is found, the key download process begins; if a key is found, the authentication process begins).

[0117] The key download process is as follows:

[0118] When sending an SMS, the user enters their mobile phone number on the page, triggering the sending of an SMS verification code. The application then sends the mobile phone number to request the SMS sending interface of the SDK. The SDK calls the middleware function, and the middleware calls the REST interface to request the unified service platform to send the SMS. The unified service platform then sends the SMS to the user through the SMS platform.

[0119] The system returns a result, which is processed by the unified service platform and sent back to the middleware. The SDK encapsulates the result and sends it to the application. The application processes the result and sends it to the user.

[0120] To obtain the key token, the user enters the SMS verification code, the application sends the mobile phone number and SMS verification code to request the SDK's key token acquisition interface, the SDK calls the middleware function, and the middleware calls the REST interface to request the unified service platform to issue the key token;

[0121] The unified service platform generates a user key token and returns it to the middleware. The SDK then encapsulates the result and sends it to the application.

[0122] Download key, user sets PIN code, application sends mobile phone number, key token, PIN code to SDK download key interface, SDK calls middleware function, middleware calls REST interface to request unified service platform download key (middleware generates SM2 public and private key pair and uses platform SM9 public key to encrypt uplink data).

[0123] The unified service platform returns the key data to the middleware (the unified service uses SM9 to decrypt, generates the user key, and uses the SM2 public key to encrypt the downlink data).

[0124] The middleware stores the user's key locally (the middleware uses the SM2 private key to decrypt the key data and store it).

[0125] The SDK encapsulates the results and returns them to the application.

[0126] The identity authentication process is as follows:

[0127] Load key: The user selects the key identifier that has been downloaded to the device and enters the PIN code to load the key (the PIN code can be entered and can come from biometric protection).

[0128] The application requests an authentication token by passing its mobile phone number and PIN code to the SDK's interface for obtaining the authentication token. The SDK calls a middleware function, which in turn calls a REST interface and submits a signature value to request the unified service platform to issue the authentication token.

[0129] The system returns an authentication token to the middleware upon successful verification of the signature value by the unified service platform. The middleware then returns the token to the SDK, which in turn encapsulates the result and sends it to the application.

[0130] Submit an authentication token. The application sends the authentication token to the business backend authentication interface. The business backend and the unified service platform verify whether the token value is legal and valid.

[0131] After the unified service platform successfully verifies the authentication token, it returns the corresponding user information to the business backend, and the business platform returns the login result to the application.

[0132] Complete the identity verification process.

[0133] Reference Figure 9 The process for secure access using national cryptographic standards is as follows:

[0134] Connection establishment process:

[0135] 1) Triggering a connection: The user has configured connection information. After triggering the connection operation, the application requests the connectNtls interface, the SDK calls the middleware function, and the middleware VPN network connection module establishes an internal connection.

[0136] 2) Returning results: The middleware returns the internal connection status to the SDK in the form of a callback. The SDK returns the status to the application in the form of a callback. The application parses the callback status and displays the current connection status. If the connection is successful, the relevant resources can be accessed within the tunnel.

[0137] Disconnection process:

[0138] 1) Disconnect: After the user triggers the disconnect operation, the application requests the disconnectNtls interface, the SDK calls the middleware function, and the middleware VPN network connection module disconnects the internal connection.

[0139] 2) Returning results: The middleware returns the internal connection status to the SDK in the form of a callback, and the SDK returns it to the application in the form of a callback. The application parses the callback status and displays the current connection status. If the connection is successfully disconnected, data access within the tunnel is not allowed for the relevant resources.

[0140] The following will further explain a data security transmission method based on national cryptographic algorithms in this exemplary embodiment.

[0141] As described in step S110, when a login request is received from a user, the client calls the corresponding local key based on the login request.

[0142] It should be noted that when a login request is received from a user (such as when a user opens the Enterprise WeChat client or an application integrating this solution's SDK, enters their mobile phone number, and clicks login), the client will immediately trigger a local key retrieval process. This step is the core starting point for subsequent national cryptographic authentication and secure transmission, aiming to provide a foundation for subsequent encryption operations using a pre-stored security key. The local key is a national cryptographic key (generated based on the SM2 / SM9 algorithm) that the client previously obtained and stored through the key download process. It corresponds one-to-one with the user's identity information (such as a mobile phone number) and is stored in the secure storage area of ​​the terminal system (key vault for Android / HarmonyOS, keychain for iOS). It can only be accessed through PIN code or biometric verification to ensure the security of key storage.

[0143] When a client calls a local key, it first associates the user's input identity information and checks if a corresponding, unexpired, and complete key exists in the local secure storage area. If it exists, the client verifies the legitimacy of the user's operation through the terminal security mechanism and then temporarily loads the key into memory for subsequent calculations. The loading process does not persist the key to memory to avoid key leakage. If there is no corresponding key locally, the client will automatically jump to the key download process, complete the identity verification, key acquisition and storage, and then return to this step to load a new key.

[0144] This step, through the logic of "identity association query - key status verification - secure loading", not only connects user operations with subsequent encryption processes, providing core encryption elements for signature value generation and authentication credential acquisition, but also simplifies user login operations through local key reuse, eliminating the need to reapply for keys each time. It ensures both security and ease of use, and is compatible with multi-terminal and multi-architecture features without changing users' original usage habits.

[0145] As described in step S120, the client generates a signature value based on the local key and sends it to the encryption terminal; the encryption terminal requests an authentication credential from the server based on the signature value and sends the authentication credential to the client.

[0146] It's important to note that the process of the client generating the signature value and obtaining authentication credentials is a core step connecting local key invocation with subsequent access authentication, and its security is ensured throughout by relying on national cryptographic algorithms. After the client invokes the locally stored SM2 / SM9 national cryptographic key, it combines the user's identity information and dynamic parameters issued by the server, using key splitting technology to divide the signature key into client-side fragments. A collaborative signature operation is then performed to generate a signature value with dynamic factors, ensuring that the signature result cannot be forged or reused. After generating the signature value, the client sends it to the encryption end through a secure channel. This encryption end consists of a secure middleware and a unified cryptographic service platform, responsible for request forwarding and algorithmic collaborative computation.

[0147] After receiving the signature value, the encryption terminal first performs a preliminary verification of the signature's integrity and legality using the national cryptographic algorithm. If the verification passes, it sends an authentication credential request to the server (Enterprise Microelectronics Business System Server) and simultaneously transmits the signature value and associated user identity information. Upon receiving the request, the server performs collaborative signature verification by combining its own key fragments. After confirming the user's legitimacy, it generates a unique authentication credential and then sends the credential back to the encryption terminal.

[0148] After the encryption terminal encapsulates the authentication credentials returned by the server, it forwards them to the client through an encrypted channel. Throughout the process, the transmission and verification of the signature value, as well as the generation and circulation of credentials, are all protected by national cryptographic algorithms. This not only enhances the security of identity authentication, but also ensures that the interaction between the client and the server is compliant and efficient through the intermediate coordination of the encryption terminal, without changing the user's operating habits, thus laying the foundation for subsequent access authentication and secure data transmission.

[0149] In one embodiment of the present invention, the specific process of step S120, "the client generates a signature value based on the local key and sends it to the encryption terminal; the encryption terminal requests an authentication credential from the server based on the signature value and sends the authentication credential to the client," can be further described in conjunction with the following description.

[0150] As described in the following steps, the client receives a random challenge value generated by the server and forwarded by the encrypted terminal;

[0151] As described in the following steps, the client calls the local key to perform a national cryptographic algorithm signature operation on the random challenge value, generating a signature value with a dynamic factor;

[0152] As described in the following steps, the client sends the random challenge value and the signature value to the encryption terminal, and the encryption terminal and the server jointly verify the signature value.

[0153] It should be noted that the random challenge value received by the client is a dynamic random parameter generated by the server and forwarded by the encryption terminal (composed of a security middleware and a unified cryptographic service platform). This parameter is specifically designed to prevent replay attacks and ensure the uniqueness of each authentication. After the server generates the random challenge value, it is transmitted to the client through the secure channel of the encryption terminal. The transmission process relies on national cryptographic algorithms for encryption protection to prevent the challenge value from being intercepted or tampered with. This provides the foundation for the subsequent generation of dynamic signature values ​​and upgrades the authentication from static verification to a dynamic collaborative verification mode.

[0154] The client invokes its locally stored SM2 / SM9 national cryptographic key to perform a signature operation using the national cryptographic algorithm on the received random challenge value. During the operation, the client utilizes key segmentation technology, using only fragments of its own signature key for independent computation, without transmitting or exposing the complete key. This ensures key security and fulfills the core prerequisite for collaborative signatures. The final generated signature value, bound to the dynamic factor of the random challenge value, possesses one-time validity, effectively mitigating the risks of static signatures being easily reused or forged, further enhancing the security of identity authentication.

[0155] After the signature calculation is complete, the client sends the random challenge value and the corresponding signature value together through an encrypted channel to the encryption end, ensuring that the association between the two is not broken. Upon receiving the data, the encryption end does not directly generate authentication credentials, but forwards the data to the server. At the same time, it uses its own key fragmentation to collaborate with the server in signature verification. The encryption end completes local fragmentation calculation and returns the result. The server combines its own key fragmentation and the client's identity information to complete the full signature validity verification, forming a closed loop of "client generation - encryption end forwarding - two-end collaborative verification".

[0156] The entire process, through the dynamic generation of random challenge values, signature calculation using national cryptographic algorithms, and collaborative verification between the encryption and server sides, completely resolves the security vulnerabilities of traditional identity authentication, such as replay attacks and impersonation, from a technical perspective. Furthermore, the process is fully automated through collaboration between the client, encryption, and server sides, requiring no additional user intervention, maintaining existing usage habits, and being compatible with multiple terminals and architectures. This ensures high security while also balancing ease of use and low-cost system modification.

[0157] As described in step S130, the client initiates access authentication to the encryption terminal using the authentication credential and receives the verification result; the encryption terminal transmits the authentication credential and the verification result; and the server generates the verification result based on the authentication credential.

[0158] It should be noted that after obtaining the authentication credentials forwarded by the encryption terminal, the client immediately initiates an access authentication request to the encryption terminal. This request carries the authentication credentials and user identity association information, and is a crucial step for the client to apply for access to the server-side encrypted transmission channel. The client sends the request to the encryption terminal through a unified interface, relying entirely on national cryptographic algorithms to protect the security of transmitted data. No additional user intervention is required, perfectly meeting the "security without user awareness" requirement, while also adapting to the interface consistency requirements of multiple terminal systems and multiple technical architectures.

[0159] The encrypted endpoint acts as the interaction hub between the client and server. Upon receiving an access authentication request from the client, it first performs a preliminary verification of the request's integrity. Then, it accurately transmits the authentication credentials and associated information to the server, maintaining the mapping between the request and subsequent verification results. After the server generates the verification result, the encrypted endpoint encapsulates and processes the result, then sends it back to the client through an encrypted channel. Its core function is to achieve secure forwarding of requests and results, avoiding direct exposure of the server's core interfaces, while simultaneously ensuring the compliance and efficiency of the interaction process.

[0160] After receiving the authentication credentials from the encrypted end, the server rigorously verifies the legitimacy and validity of the credentials by combining its stored user key information and permission configuration—including whether the credentials were generated by the system, whether they are within their validity period, and whether they match the identity of the requesting user. Upon completion of the verification, the server generates a clear verification result (legal or invalid) and returns it to the encrypted end. This process relies on national cryptographic algorithms to ensure the security of the verification and, through collaboration with the unified cryptographic service platform, ensures that the verification result complies with the compliance requirements of information security level protection and cryptographic assessment for identity authentication, laying the foundation for establishing an encrypted transmission connection between the client and the server.

[0161] As described in step S140, the client establishes a data transmission connection with the server based on the verification result.

[0162] It should be noted that after receiving the verification result forwarded by the encryption end, the client only triggers the data transmission connection establishment process with the server if the result is "valid". If the verification fails, the connection is terminated and the user is prompted that the authentication failed, ensuring that only legitimate users who have passed the enhanced authentication can access the network, thus blocking unauthorized access at the source. This connection establishment process relies entirely on national cryptographic algorithms to build a secure transmission channel, requiring no additional user operation. The encryption process is imperceptible to the user, ensuring access security without changing the user's original usage habits.

[0163] When the client initiates a connection request based on the verification result, it sends a secure connection establishment request to the encrypted terminal, carrying authentication credentials and terminal adaptation information. The encrypted terminal returns the adapted connection configuration parameters, and the client completes local encrypted channel initialization based on the parameters. It supports three channel protection modes: IPSec, SSL, and transparent encryption, allowing for flexible selection based on business scenarios. Furthermore, this process is compatible with the client's multi-terminal and multi-architecture adaptation features. Whether it's Android, iOS, HarmonyOS systems, or native apps and frameworks like Uniapp, connection establishment can be achieved through a unified interface, reducing integration and adaptation costs.

[0164] Once the connection is established, all data transmission between the client and server is protected through a national cryptographic encryption channel. Transmitted data undergoes integrity verification using the SM3 national cryptographic hash algorithm to ensure it is not intercepted or tampered with during transmission. The server can also configure and issue access policies based on the scenario, precisely controlling client access permissions to intranet resources within the business system. This satisfies the compliance requirements of information security level protection and cryptographic assessment for encrypted data transmission, achieving dual protection of "secure transmission + access control," while not affecting the operation of existing business systems, enabling low-cost compliance transformation.

[0165] In one embodiment of the present invention, the client further includes downloading a local key based on the login request, including the following steps:

[0166] The client sends a key download request and user identification information to the encryption terminal; the encryption terminal sends the user identification information to the server; the server generates an authentication command based on the user identification information.

[0167] The client receives the authentication instruction, performs authentication according to the instruction to obtain an authentication result, and sends the authentication result to the encryption terminal; the encryption terminal sends the authentication result to the server; the server generates key data based on the authentication and sends the key data to the encryption terminal; the encryption terminal encrypts the key data and sends it to the client.

[0168] The client decrypts the key data and stores the decrypted key data locally to obtain a local key.

[0169] It should be noted that the process of the client downloading the local key based on the login request is a fundamental prerequisite for ensuring subsequent identity authentication and secure data transmission. This process is automatically triggered only when the client cannot find a corresponding valid key locally. It relies entirely on the collaborative interaction between the client, the encryption layer, and the server, without adding any extra operational burden to the user. The client first sends a key download request to the encryption layer (composed of security middleware and a unified cryptographic service platform), along with user identification information (such as a mobile phone number). This request is initiated through a unified interface, adapting to the interface consistency requirements of multiple terminal systems and multiple technical architectures, ensuring process uniformity across different integration scenarios.

[0170] After receiving the key download request and user identification information from the client, the encrypted terminal acts as an intermediate interaction hub. It does not perform any additional processing on the information, but only accurately transmits the user identification information to the server (Enterprise Micro Business System Server) through a secure channel. Its core function is to isolate the direct interaction between the client and the server, avoid exposing the core interfaces of the server, and ensure the confidentiality of information transmission, laying the foundation for subsequent identity verification and key generation.

[0171] After receiving the user's identity information from the encrypted end, the server generates a corresponding identity verification command (such as an SMS verification command) based on the system's preset verification rules. This command aims to further confirm the legitimacy of the user's identity and prevent unauthorized users from maliciously requesting keys. After generating the command, the server returns it to the encrypted end, which then forwards it to the client. Throughout the entire process, the generation and flow of commands are protected by national cryptographic algorithms to prevent tampering or forgery, ensuring the security of the verification process.

[0172] After receiving the authentication command forwarded by the encrypted terminal, the client automatically adapts to the characteristics of the terminal system to trigger the verification operation, supporting SMS two-factor authentication or biometric authentication (such as fingerprint or facial recognition). Users only need to complete the verification as usual (such as entering the SMS verification code and completing the facial scan), without changing their original usage habits. After verification, the client sends the generated verification result (such as a valid verification code or biometric pass mark) to the encrypted terminal, ensuring the real-time transmission and accuracy of the verification result.

[0173] After receiving the verification result from the client, the encryption terminal again acts as a forwarding hub, transmitting the verification result to the server. The server then performs a final verification of the result's legitimacy. Once the server-side verification is successful, confirming the user's legitimacy, it immediately invokes the cryptographic machine (KGC) to generate key data based on the SM2 / SM9 national cryptographic algorithm. This key data is the core element for the client to subsequently generate the signature value and achieve encrypted transmission. Its generation process strictly adheres to the national cryptographic algorithm specifications, ensuring the encryption strength and uniqueness of the key.

[0174] After the server generates the key data, it sends it to the encryption end. Upon receiving the key data, the encryption end uses the SM9 national cryptographic algorithm to encrypt it, further enhancing the security of the key during transmission and preventing interception or leakage. After encryption, the encryption end forwards the encrypted key data to the client through a secure channel, ensuring end-to-end encryption protection of the key data from the server to the client.

[0175] After receiving the encrypted key data forwarded by the encryption terminal, the client calls its locally preset national cryptographic algorithm decryption module to decrypt the key data using the corresponding SM2 national cryptographic algorithm, restoring the original key data. The decryption process is executed in the client's local secure environment, without involving data upload or third-party participation, ensuring the confidentiality of the key data is not compromised.

[0176] After decryption, the client stores the original key data in a secure local storage area. On Android / HarmonyOS systems, this is stored in the Keystore, and on iOS systems, it's stored in the Keychain. This storage area has system-level security protection capabilities, effectively preventing malicious programs from stealing and tampering with the data. At this point, the client has completed the download and storage of the local key, providing core support for subsequent signature calculations, access authentication, and encrypted data transmission. The entire download process meets the compliance requirements of information security standards and cryptographic assessments while also ensuring security, ease of use, and compatibility.

[0177] In one embodiment of the present invention, it further includes:

[0178] The client sends a secure connection establishment request to the encryption terminal based on the authentication credentials; the encryption terminal returns connection configuration parameters based on the authentication credentials.

[0179] The client receives the connection configuration parameters and initializes the local encrypted channel according to the connection configuration parameters;

[0180] When a user triggers a disconnection operation, the client sends a secure connection disconnection request and current connection status information to the encrypted terminal; the encrypted terminal sends a disconnection confirmation command to the client based on the current connection status information.

[0181] The client receives the disconnection confirmation command, closes the local encrypted channel, and clears the temporary cache data of this connection.

[0182] It's important to note that the establishment and disconnection of a secure connection is a crucial step in ensuring secure data transmission. This process is based on the collaborative interaction between the client and the encryption end, and it is fully adaptable to multiple terminals and architectures, with the encryption process remaining transparent to the user. After obtaining valid authentication credentials, the client sends a secure connection establishment request to the encryption end (composed of a security middleware and a unified cryptographic service platform). This request carries authentication credentials to prove its legitimacy. This request is initiated through a unified interface (such as the connectNtls interface) to ensure consistency across different systems and architectures.

[0183] After receiving the connection establishment request, the encrypted end will first verify the validity of the authentication credentials. Once it confirms that the client has passed identity authentication and has access permissions, it will return the corresponding connection configuration parameters according to the business scenario requirements. It supports parameter adaptation for three channel protection modes: IPSec, SSL, and transparent encryption, allowing the client to flexibly meet the transmission security requirements of different business systems. At the same time, the parameter transmission process is protected by encryption using national cryptographic algorithms to prevent configuration information from being leaked or tampered with.

[0184] After receiving the connection configuration parameters returned by the encryption end, the client calls the local secure access module to initialize the local encrypted channel based on the parameters. During initialization, the client loads the national cryptographic algorithm encryption component and establishes an encrypted transmission link based on the SM2 / SM9 algorithm to ensure the confidentiality and integrity of subsequent data transmission. This process is executed automatically on the client's local machine without any additional user intervention, meeting the requirement of "seamless security." Furthermore, it is deeply integrated with the terminal system's security mechanisms to ensure the stability and security of the channel initialization.

[0185] When a user actively triggers a disconnection operation after completing a business operation (such as clicking the "Disconnect" button), the client will immediately send a secure connection disconnection request to the encryption end, and at the same time synchronize the current connection status information (such as connection duration, amount of data transmitted, channel status, etc.) so that the encryption end can accurately grasp the connection status and avoid data residue or resource occupation problems caused by abnormal disconnection.

[0186] After receiving the disconnection request and connection status information, the encrypted end verifies the status information. If no data is currently being transmitted or there is an anomaly, it sends a disconnection confirmation command to the client, ensuring the orderly execution of the disconnection operation. Upon receiving the disconnection confirmation command, the client immediately closes its local encrypted channel, terminates the operation of the national cryptographic algorithm encryption component, and thoroughly clears all temporary cached data generated during this connection (such as session keys, configuration parameter copies, etc.) to prevent unauthorized access to cached data and ensure terminal security after the connection is closed. This entire process not only ensures end-to-end encrypted protection for data transmission but also avoids security risks through standardized connection management, while maintaining the user's existing operating habits and lowering the barrier to entry.

[0187] In one embodiment of the present invention, it further includes:

[0188] The client generates a KS key in the key storage module of the corresponding terminal system;

[0189] The client randomly generates a PIN code, encrypts the PIN code using the KS key, and then stores it.

[0190] When the client needs to use the PIN code, it triggers local verification. After successful verification, it obtains the KS key and decrypts the PIN code using the KS key.

[0191] It's important to note that PIN code security is achieved through deep collaboration between the client and the terminal system's key storage module. The core of this security relies on the encryption and local verification mechanism of the KS key to ensure the confidentiality of the PIN code throughout its storage and use. The client automatically generates a KS key in the corresponding secure storage module based on the characteristics of its terminal system—generated in the Keystore on Android or HarmonyOS systems, and in the Keychain on iOS systems. This key is secured by the underlying system and can only be accessed by the client, effectively preventing theft and tampering by malicious programs.

[0192] After generating the KS key, the client will randomly generate a unique PIN code. This PIN code is used to encrypt and protect the locally stored SM9 national cryptographic key, serving as a crucial security verification credential for key usage. To avoid the risk of leakage due to plaintext storage of the PIN code, the client encrypts the PIN code using the generated KS key. The encryption process adheres to national cryptographic algorithm standards, and the encrypted PIN code is stored in a secure local area on the terminal. Even if the terminal's storage medium is illegally accessed, a valid PIN code cannot be directly obtained, thus strengthening security at the storage level.

[0193] When a client needs to use a PIN code (such as when loading a local key or initiating authentication), the preset local verification process when generating the KS key is automatically triggered. This supports biometric verification (such as fingerprint or facial recognition) or system password verification, fully adapting to the security features of the terminal system. After successful verification, the client can retrieve the KS key from the terminal key storage module and then use this KS key to decrypt the encrypted PIN code, restoring the original PIN code for subsequent key decryption or identity verification operations. The entire process achieves closed-loop protection for the PIN code: "encrypted storage - verification and unlocking - decryption and use." This ensures the security of key usage while simplifying user operations through the terminal's native verification mechanism, without changing existing usage habits, and simultaneously meets the security management requirements for keys and identity credentials under the Information Security Protection and Authentication Assessment standards.

[0194] In one embodiment of the present invention, it further includes:

[0195] The client detects the usage period of the local key or receives a key rotation instruction from the server, and sends a key update request and the current key identifier to the encryption terminal.

[0196] The client receives the new key data forwarded by the encryption terminal, decrypts it, and replaces the original local key.

[0197] The client performs a secure destruction operation on the obsolete key by repeatedly overwriting the storage area or calling the hardware encryption module to clear the obsolete key data.

[0198] It is important to note that local key lifecycle management is a crucial aspect of ensuring long-term system security. The client triggers the key update process through a combination of proactive detection and reactive response, preventing the risk of key leakage due to prolonged use. The client continuously monitors the usage period of locally stored keys (e.g., whether they have reached a preset expiration date) or listens for key rotation commands issued by the server. When either trigger condition is met, the client automatically sends a key update request to the encryption end (composed of security middleware and a unified cryptographic service platform), carrying the current key identifier. This allows the encryption end and server to accurately identify the key object requiring updating, ensuring the update process is targeted.

[0199] After receiving the key update request and current key identifier from the client, the encryption terminal forwards the relevant information to the server. The server then verifies the legitimacy and validity of the current key. Upon successful verification, the server invokes the cryptographic machine (KGC) to generate new key data according to the national cryptographic algorithm standards. The new key adheres to the SM2 / SM9 national cryptographic algorithm standard, ensuring the encryption strength is consistent with the original key, while also maintaining its binding with the user's identity information. Once generated, the server sends the new key data to the encryption terminal, which encrypts it using the national cryptographic algorithm before forwarding it to the client, ensuring the confidentiality of the new key during transmission.

[0200] After receiving the new encrypted key data forwarded by the encryption terminal, the client calls the local national cryptographic algorithm decryption module to restore the new key data according to the corresponding decryption rules. Upon decryption, the client immediately replaces the locally stored original key with the new key. The new key remains stored in the secure storage area of ​​the terminal system (Android / HarmonyOS keystore, iOS keychain), ensuring storage security. The replacement process is executed atomically to avoid key loss or invalidation during the transition between old and new keys, ensuring business continuity.

[0201] For replaced obsolete keys, the client performs a rigorous security destruction process to eliminate the risk of leakage due to key remnants. The destruction method is adapted to the terminal characteristics: either by overwriting the original key data by repeatedly writing random data to the key storage area, or by directly calling the key clearing interface of the terminal's hardware encryption module to completely delete all traces of the obsolete key. The entire destruction process is completed locally on the client in a closed loop, without involving data upload, ensuring that obsolete keys cannot be recovered, further strengthening the security defense line throughout the key's lifecycle, and meeting the compliance requirements of information security level protection and cryptographic assessment for key management.

[0202] In one embodiment of the present invention, after the client and the server establish a data transmission connection, a data integrity protection step is further included:

[0203] The client uses the SM3 national cryptographic hash algorithm to generate an integrity verification value for the transmitted data.

[0204] The client sends the transmitted data and the integrity check value to the server; the server verifies the transmitted data based on the integrity check value and obtains the verification result.

[0205] The client receives the verification result. If the verification does not match, the data transmission is terminated and a retransmission process is triggered.

[0206] It should be noted that after the client and server establish an encrypted data transmission connection based on the national cryptographic algorithm, a new data integrity protection step is added. A full-link data verification mechanism is constructed using the SM3 national cryptographic hash algorithm to fundamentally prevent the risk of data tampering, replacement, or loss during transmission, further enhancing the security and reliability of data transmission. This step works deeply with the national cryptographic encrypted transmission channel, requiring no additional independent verification system, not affecting the original data transmission efficiency, and is completely imperceptible to the user.

[0207] Before initiating data transmission, the client automatically calls the local national cryptographic algorithm calculation module to perform SM3 national cryptographic hash algorithm calculations on the raw data to be transmitted (such as business request parameters, sensitive business data, etc.). As a hash algorithm recognized by the State Cryptography Administration, the SM3 algorithm has strong collision resistance and integrity verification capabilities. It can compress transmitted data of any length into a fixed-length hash value (i.e., integrity verification value). This verification value corresponds one-to-one with the original data. Once the data undergoes a slight change, the verification value will change significantly, ensuring the accuracy of the verification.

[0208] After generating the integrity check value, the client sends the original transmission data and the corresponding check value to the server through a national cryptographic encryption channel. During transmission, both the data and the check value are encrypted using the SM2 / SM9 national cryptographic algorithm to prevent data tampering or check value forgery after interception. This ensures that the combination of "data + check value" maintains integrity and confidentiality in the transmission link, achieving dual protection of "encrypted transmission + integrity verification".

[0209] After receiving the transmitted data and integrity check value, the server first decrypts and restores the original data and check value using the national cryptographic algorithm. Then, it calls its own national cryptographic algorithm module to re-execute the SM3 national cryptographic hash algorithm on the decrypted original data to generate the server-side check value. Subsequently, the server compares its generated check value with the check value sent by the client to complete the core data integrity verification process.

[0210] After verification, the server generates a clear verification result (same or different) and sends it back to the client via an encrypted channel. If the verification result is the same, it means the transmitted data has not been tampered with, and the client continues to execute subsequent data transmission or business interaction processes. If the verification result is different, the client immediately terminates the current data transmission to prevent invalid or tampered data from entering the business process. At the same time, it automatically triggers the data retransmission process, regenerates the transmitted data and verification value, and sends them to the server to ensure the accurate delivery of business data.

[0211] The entire data integrity protection process is fully automated, requiring no user intervention, and is compatible with multiple terminal systems and technical architectures. It not only meets the compliance requirements of information security level protection and confidentiality assessment for data integrity, but also ensures the security and authority of verification through the native support of national cryptographic algorithms. At the same time, it does not increase the complexity of system modification or data transmission latency, thus achieving an organic unity of security, compliance and practicality.

[0212] Reference Figure 3 This application also proposes an enhanced identity authentication and secure data transmission method based on national cryptographic algorithms. The method involves a client, an encryption terminal, and a server. The client is used to receive user operation instructions, store local keys, and initiate requests. The encryption terminal has user information login verification permissions. The server is used to transmit encrypted data.

[0213] The method includes:

[0214] S310. When the client receives the signature value generated by calling the local key in response to the user login request, the encryption terminal requests an authentication credential from the server based on the signature value, and sends the authentication credential returned by the server to the client.

[0215] S310. The encryption terminal receives the access authentication association request initiated by the client based on the authentication credential, collaborates with the server to perform legality verification on the authentication credential and generate a verification result, and sends the verification result to the client.

[0216] It should be noted that the encrypted terminal serves as the core interaction hub. Through collaborative operation with the client and server, it constructs a secure and efficient identity authentication chain. Security is ensured throughout the process using national cryptographic algorithms, and it is adaptable to multiple terminals and architectures. This method focuses on the core aspects of identity authentication, eliminating the need for redundant operations. When the encrypted terminal receives the signature value sent by the client, the authentication process is triggered—this signature value is generated by the client using the locally stored SM2 / SM9 national cryptographic key and serves as the core credential of the user's legitimacy. The encrypted terminal, acting as an intermediary bridge, avoids direct interaction between the client and server, effectively protecting the security of the server's core interfaces.

[0217] After receiving the signature value, the encryption end first performs a preliminary verification of the signature's integrity using the national cryptographic algorithm to ensure that the data has not been tampered with during transmission. If the verification passes, it sends an authentication credential request to the server (the enterprise micro-business system server) and simultaneously transmits the signature value and associated user identity information. Upon receiving the request, the server performs collaborative signature verification (based on key segmentation technology) using its own key fragments. After confirming the user's legitimacy, it generates a unique authentication credential. This credential is the key basis for subsequent client access authentication, and its generation process strictly adheres to the national cryptographic algorithm specifications, ensuring the credential's uniqueness and security.

[0218] After the server returns the authentication credentials to the encryption end, the encryption end encapsulates the credentials and forwards them to the client through an encrypted channel, ensuring the confidentiality of the credentials during transmission. Once the client obtains the authentication credentials, it initiates an access authentication association request to the encryption end based on these credentials to further confirm access permissions. Upon receiving this request, the encryption end no longer performs separate verification but collaborates with the server to conduct a secondary verification of the validity and legitimacy of the authentication credentials, including whether the credentials are within their validity period and whether they match the user's identity, forming a closed loop of "generation-forwarding-verification".

[0219] After verification, the server generates a clear verification result (valid or invalid) and sends it back to the client via the encrypted terminal. The client then decides whether to continue the subsequent process based on the result. This entire method organically links core steps such as signature verification, credential generation, and access verification through the coordinated scheduling of the encrypted terminal. It strengthens the security of identity authentication by leveraging national cryptographic algorithms and key splitting technology to resist risks such as forgery and repudiation. Furthermore, through a unified interface and middleware collaboration, it adapts to multiple terminals and technical architectures, including Android, iOS, and HarmonyOS. Integrators only need minor modifications to integrate, without changing user habits, while quickly meeting the compliance requirements of information security level protection and cryptographic evaluation for identity authentication, thus balancing security, compatibility, and ease of use.

[0220] Reference Figure 5 This application also proposes a data security transmission method based on national cryptographic algorithms. The method involves a client, an encryption terminal, and a server. The client is used to receive user operation instructions, store local keys, and initiate requests. The encryption terminal has user information login verification permissions. The server is used to transmit encrypted data.

[0221] The method includes:

[0222] S510. When the server receives the signature value generated by the client calling the local key in response to the user login request, the server receives the signature value and performs a validity check.

[0223] S520. After the server verifies the signature value, it generates an authentication credential and sends the authentication credential to the encryption terminal; the encryption terminal then forwards it to the client.

[0224] S530. The server receives the access authentication request initiated by the client based on the authentication credential, performs secondary verification on the authentication credential and generates a verification result, and sends the verification result to the encryption terminal; the encryption terminal sends the verification result to the client.

[0225] S540. When the verification result is valid, the server establishes an encrypted data transmission connection with the client based on the national cryptographic algorithm.

[0226] It should be noted that the server-side is the core control entity. Through collaborative interaction with the client and encryption terminals, it constructs a full-link secure transmission system encompassing "signature verification – credential generation – secondary verification – encrypted connection." The entire process relies on national cryptographic algorithms to ensure identity legitimacy and data transmission security, and is adaptable to multiple terminals and architectures. This method focuses on identity verification before data transmission and encryption protection during transmission, without altering user habits. Security upgrades are achieved solely through backend collaboration, effectively solving problems such as identity forgery and data interception in traditional transmission methods.

[0227] When the server receives the signature value sent by the client through the encrypted terminal, it immediately initiates the legitimacy verification process. The signature value is generated by the client using the locally stored SM2 / SM9 national cryptographic key and is bound to the user's identity information. The server, in conjunction with its own key fragmentation (based on key segmentation technology), completes collaborative signature verification through national cryptographic algorithms to accurately identify whether the signature value was generated by a legitimate client, preventing forged signatures or unauthorized access requests, and building the first line of defense for subsequent transmission security.

[0228] After the server verifies the signature value and confirms the client's initial legitimacy, it generates a unique authentication credential with an expiration date. This credential is encrypted using a national cryptographic algorithm and sent to the encryption terminal, which then forwards it to the client through a secure channel. The encryption terminal only acts as a secure forwarder in this process, preventing the server and client from directly exposing their interaction interfaces. It also ensures the confidentiality of the authentication credential during transmission, preventing interception or tampering and ensuring the validity of subsequent access authentication.

[0229] After obtaining authentication credentials, the client initiates an access authentication request to the server based on those credentials. The request is forwarded to the server via an encrypted terminal. The server initiates a secondary verification of the authentication credentials, focusing on checking the validity, expiration date, and match between the credentials and the client's identity. This dual verification mechanism further confirms the legitimacy of the access entity, preventing security risks arising from credential theft or reuse. After verification, the server generates a clear verification result (valid or invalid), which is then sent back to the client via an encrypted terminal.

[0230] When the verification result is valid, the server and client immediately establish an encrypted data transmission connection based on national cryptographic algorithms. It supports three channel protection modes: IPSec, SSL, and transparent encryption, and can be flexibly adapted to different business scenarios. After the connection is established, all transmitted data is encrypted using the SM2 / SM9 national cryptographic algorithms, while the SM3 national cryptographic hash algorithm ensures data integrity, guaranteeing that data is not intercepted, tampered with, or leaked during transmission. This entire method, through core server-side control and deep application of national cryptographic algorithms, not only meets the compliance requirements of information security level protection and information security assessment for data transmission, but also reduces the cost of modifying existing business systems through a unified interface design, balancing security, compatibility, and ease of use.

[0231] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0232] Reference Figure 2This application illustrates a data security transmission device based on a national cryptographic algorithm, comprising a client, an encryption terminal, and a server. The client receives user operation instructions, stores local keys, and initiates requests. The encryption terminal has user information login verification permissions. The server transmits encrypted data. The enhanced identity authentication and data security transmission device based on the national cryptographic algorithm implements the steps of the enhanced identity authentication and data security transmission method based on the national cryptographic algorithm described above, specifically including the following modules:

[0233] Specifically, it includes:

[0234] Login module 210 is used to, when a login request is received from a user, have the client invoke the corresponding local key based on the login request;

[0235] Authentication module 220 is used for the client to generate a signature value based on the local key and send it to the encryption terminal; the encryption terminal requests an authentication credential from the server based on the signature value and sends the authentication credential to the client;

[0236] Verification module 230 is used for the client to initiate access authentication to the encryption terminal through the authentication credential and receive the verification result; the encryption terminal to transmit the authentication credential and the verification result; and the server to generate the verification result based on the authentication credential.

[0237] The transmission module 240 is used for the client to establish a data transmission connection with the server based on the verification result.

[0238] In one embodiment of the present invention, a local key download module is further included, which is used by the client to download a local key based on the login request.

[0239] The local key download module includes:

[0240] The request download submodule is used for the client to send a key download request and user identification information to the encryption terminal; the encryption terminal sends the user identification information to the server; and the server performs an authentication instruction based on the user identification information.

[0241] The verification submodule is used for the client to receive the authentication instruction, perform authentication according to the authentication instruction to obtain the verification result, and send the verification result to the encryption terminal; the encryption terminal sends the verification result to the server; the server generates key data according to the verification and sends the key data to the encryption terminal; the encryption terminal encrypts the key data and sends it to the client;

[0242] The decryption and download submodule is used by the client to decrypt the key data and store the decrypted key data locally to obtain a local key.

[0243] In one embodiment of the present invention, it further includes:

[0244] A secure connection establishment request module is used for the client to send a secure connection establishment request to the encryption terminal based on the authentication credentials; the encryption terminal returns connection configuration parameters based on the authentication credentials.

[0245] The configuration parameter module is used by the client to receive the connection configuration parameters and complete the initialization of the local encrypted channel based on the connection configuration parameters;

[0246] The disconnect module is used so that when a user triggers a disconnect operation, the client sends a secure connection disconnect request and current connection status information to the encryption terminal; the encryption terminal sends a disconnect confirmation command to the client based on the current connection status information.

[0247] The clearing module is used by the client to receive the disconnection confirmation command, close the local encrypted channel, and clear the temporary cache data of this connection.

[0248] In one embodiment of the present invention, the authentication module 220 includes:

[0249] The challenge value submodule is used by the client to receive a random challenge value generated by the server and forwarded by the encrypted terminal;

[0250] The signature value submodule is used by the client to call the local key to perform a national cryptographic algorithm signature operation on the random challenge value, generating a signature value with a dynamic factor;

[0251] The collaborative verification submodule is used by the client to send the random challenge value and the signature value to the encryption terminal, and the encryption terminal and the server to perform collaborative verification on the signature value.

[0252] In one embodiment of the present invention, it further includes:

[0253] The KS key module is used by the client to generate a KS key in the key storage module of the corresponding terminal system.

[0254] The PIN code module is used by the client to randomly generate a PIN code, encrypt the PIN code using the KS key, and then store it.

[0255] The decryption module is used to trigger local verification when the client needs to use the PIN code, obtain the KS key after successful verification, and decrypt the PIN code using the KS key.

[0256] In one embodiment of the present invention, it further includes:

[0257] The update module is used by the client to detect the usage period of the local key or receive the key rotation instruction issued by the server, and send a key update request and the current key identifier to the encryption terminal.

[0258] The replacement module is used by the client to receive new key data forwarded by the encryption terminal, decrypt it, and replace the original local key.

[0259] The destruction module is used by the client to perform a secure destruction operation on the obsolete key, which is to clear the obsolete key data by overwriting the storage area multiple times or by calling the hardware encryption module.

[0260] In one embodiment of the present invention, an integrity protection module is further included, the integrity protection module comprising:

[0261] The integrity verification submodule is used by the client to generate an integrity verification value for the transmitted data using the SM3 national cryptographic hash algorithm.

[0262] The verification value submodule is used by the client to send the transmitted data and the integrity verification value to the server; the server verifies the transmitted data based on the integrity verification value and obtains the verification result.

[0263] The verification result submodule is used by the client to receive the verification result. If the verification is inconsistent, the data transmission is terminated and a retransmission process is triggered.

[0264] Reference Figure 4 This application illustrates a data security transmission device based on a national cryptographic algorithm, comprising a client, an encryption terminal, and a server. The client receives user operation instructions, stores local keys, and initiates requests. The encryption terminal has user information login verification permissions. The server transmits encrypted data. The enhanced identity authentication and data security transmission device based on the national cryptographic algorithm implements the steps of the enhanced identity authentication and data security transmission method based on the national cryptographic algorithm described above, specifically including the following modules:

[0265] Specifically, it includes:

[0266] The authentication credential module 410 is used to, when receiving a signature value generated by the client calling the local key in response to a user login request, request an authentication credential from the server based on the signature value, and send the authentication credential returned by the server to the client.

[0267] The collaborative verification module 420 is used to receive the access authentication association request initiated by the client based on the authentication credential from the encryption terminal, collaborate with the server to perform legality verification on the authentication credential and generate a verification result, and send the verification result to the client.

[0268] Reference Figure 6 This application illustrates a data security transmission device based on a national cryptographic algorithm, comprising a client, an encryption terminal, and a server. The client receives user operation instructions, stores local keys, and initiates requests. The encryption terminal has user information login verification permissions. The server transmits encrypted data. The enhanced identity authentication and data security transmission device based on the national cryptographic algorithm implements the steps of the enhanced identity authentication and data security transmission method based on the national cryptographic algorithm described above, specifically including the following modules:

[0269] Specifically, it includes:

[0270] The legitimacy verification module 610 is used to receive the signature value generated by the client calling the local key in response to the user login request and to perform legitimacy verification on the server side.

[0271] The authentication credential generation module 620 is used to generate an authentication credential after the server verifies the signature value and sends the authentication credential to the encryption terminal; the encryption terminal then forwards it to the client.

[0272] The secondary verification module 630 is used for the server to receive an access authentication request initiated by the client based on the authentication credential, perform secondary verification on the authentication credential and generate a verification result, and send the verification result to the encryption terminal; the encryption terminal sends the verification result to the client.

[0273] The transmission connection module 640 is used to establish an encrypted data transmission connection based on the national cryptographic algorithm between the server and the client when the verification result is valid.

[0274] Reference Figure 10 The present invention illustrates a computer device for implementing a data security transmission method based on Chinese cryptographic algorithms, which may specifically include the following:

[0275] The aforementioned computer device 1 is in the form of a general-purpose computing device. The components of the computer device 1 may include, but are not limited to: one or more processors or processing units 3, memory 8, and a bus 4 connecting different system components (including memory 8 and processing unit 3).

[0276] Bus 4 represents one or more of several bus architectures, including memory buses or memory controllers, peripheral buses, graphics acceleration ports, processors, or local buses using any of the various bus architectures. For example, these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Audio / Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0277] Computer device 1 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by computer device 1, including volatile and non-volatile media, removable and non-removable media.

[0278] Memory 8 may include computer system readable media in the form of volatile memory, such as random access memory 9 and / or cache memory 10. Computer device 1 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 11 may be used to read and write non-removable, non-volatile magnetic media (commonly referred to as a "hard disk drive"). Although Figure 10 As not shown, a disk drive for reading and writing to a removable non-volatile disk (such as a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (such as a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 4 via one or more data media interfaces. The memory may include at least one program product having a set (e.g., at least one) of program modules 13 configured to perform the functions of the embodiments of this application.

[0279] A program / utility 12 having a set (at least one) of program modules 13 may be stored, for example, in memory. Such program modules 13 include—but are not limited to—an operating system, one or more application programs, other program modules 13, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 13 typically perform the functions and / or methods described in the embodiments of this application.

[0280] Computer device 1 can also communicate with one or more external devices 2 (e.g., keyboard, pointing device, monitor 7, camera, etc.), and with one or more devices that enable an operator to interact with computer device 1, and / or with any device that enables computer device 1 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed through I / O interface 6. Furthermore, computer device 1 can also communicate with one or more networks (e.g., local area network (LAN)), wide area network (WAN), and / or public networks (e.g., the Internet) through network adapter 5. Figure 10 As shown, network adapter 5 communicates with other modules of computer device 1 via bus 4. It should be understood that, although... Figure 10 Not shown, it can be combined with computer device 1 to use other hardware and / or software modules, including but not limited to: microcode, device drivers, redundant processing unit 3, external disk drive array, RAID system, tape drive and data backup storage system 11, etc.

[0281] The processing unit 3 executes various functional applications and data processing by running programs stored in memory 8, such as implementing a data security transmission method based on national cryptographic algorithms provided in the embodiments of this application.

[0282] That is, when the above-mentioned processing unit 3 executes the above program, it implements the following: when a user initiates a login request, the client calls the corresponding local key according to the login request;

[0283] The client generates a signature value based on the local key and sends it to the encryption terminal; the encryption terminal requests an authentication credential from the server based on the signature value and sends the authentication credential to the client.

[0284] The client initiates access authentication to the encryption terminal using the authentication credential and receives the verification result; the encryption terminal transmits the authentication credential and the verification result; the server generates the verification result based on the authentication credential.

[0285] The client establishes a data transmission connection with the server based on the verification result.

[0286] In this application embodiment, this application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a data security transmission method based on national cryptographic algorithms as provided in all embodiments of this application.

[0287] That is, when the program is executed by the processor, the following is implemented: when a login request is received from a user, the client calls the corresponding local key based on the login request;

[0288] The client generates a signature value based on the local key and sends it to the encryption terminal; the encryption terminal requests an authentication credential from the server based on the signature value and sends the authentication credential to the client.

[0289] The client initiates access authentication to the encryption terminal using the authentication credential and receives the verification result; the encryption terminal transmits the authentication credential and the verification result; the server generates the verification result based on the authentication credential.

[0290] The client establishes a data transmission connection with the server based on the verification result.

[0291] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0292] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including—but not limited to—electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0293] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the operator's computer, partially on the operator's computer, as a standalone software package, partially on the operator's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the operator's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider). The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably.

[0294] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0295] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0296] The above provides a detailed description of a data security transmission method and apparatus based on national cryptographic algorithms provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A data security transmission method based on national cryptographic algorithms, characterized in that, The method involves a client, an encryption terminal, and a server. The client is used to receive user operation instructions, store local keys, and initiate requests. The encrypted terminal has user information login verification permissions; The server is used to transmit encrypted data; The method includes: When a login request is received from a user, the client retrieves the corresponding local key based on the login request. The client generates a signature value based on the local key and sends it to the encryption terminal; the encryption terminal requests an authentication credential from the server based on the signature value and sends the authentication credential to the client. The client initiates access authentication to the encryption terminal using the authentication credential and receives the verification result; the encryption terminal transmits the authentication credential and the verification result; the server generates the verification result based on the authentication credential. The client establishes a data transmission connection with the server based on the verification result; The client downloads the local key based on the login request, including the following steps: The client sends a key download request and user identification information to the encryption terminal; the encryption terminal sends the user identification information to the server; the server generates an authentication command based on the user identification information. The client receives the authentication instruction, performs authentication according to the instruction to obtain an authentication result, and sends the authentication result to the encryption terminal; the encryption terminal sends the authentication result to the server; the server generates key data based on the authentication result and sends the key data to the encryption terminal; the encryption terminal encrypts the key data and sends it to the client. The client decrypts the key data and stores the decrypted key data locally to obtain a local key.

2. The method according to claim 1, characterized in that, Also includes: The client sends a secure connection establishment request to the encryption terminal based on the authentication credentials; the encryption terminal returns connection configuration parameters based on the authentication credentials. The client receives the connection configuration parameters and initializes the local encrypted channel according to the connection configuration parameters; When a user triggers a disconnection operation, the client sends a secure connection disconnection request and current connection status information to the encrypted terminal. The encryption terminal sends a disconnection confirmation command to the client based on the current connection status information; The client receives the disconnection confirmation command, closes the local encrypted channel, and clears the temporary cache data of this connection.

3. The method according to claim 1, characterized in that, The steps of the client generating a signature value based on the local key and sending it to the encryption terminal; the encryption terminal requesting an authentication credential from the server based on the signature value and sending the authentication credential to the client include: The client receives a random challenge value generated by the server and forwarded by the encrypted terminal; The client calls the local key to perform a national cryptographic algorithm signature operation on the random challenge value, generating a signature value with a dynamic factor; The client sends the random challenge value and the signature value to the encryption terminal, and the encryption terminal and the server jointly verify the signature value.

4. The method according to claim 1, characterized in that, Also includes: The client generates a KS key in the key storage module of the corresponding terminal system; The client randomly generates a PIN code, encrypts the PIN code using the KS key, and then stores it. When the client needs to use the PIN code, it triggers local verification. After successful verification, it obtains the KS key and decrypts the PIN code using the KS key.

5. The method according to claim 1, characterized in that, Also includes: The client detects the usage period of the local key or receives a key rotation instruction from the server, and sends a key update request and the current key identifier to the encryption terminal. The client receives the new key data forwarded by the encryption terminal, decrypts it, and replaces the original local key. The client performs a secure destruction operation on the obsolete key by repeatedly overwriting the storage area or calling the hardware encryption module to clear the obsolete key data.

6. The method according to claim 1, characterized in that, After the client and server establish a data transmission connection, the process also includes a data integrity protection step: The client uses the SM3 national cryptographic hash algorithm to generate an integrity verification value for the transmitted data. The client sends the transmitted data and integrity verification value to the server. The server verifies the transmitted data based on the integrity check value and obtains the verification result; The client receives the verification result. If the verification does not match, the data transmission is terminated and a retransmission process is triggered.

7. A method for enhanced identity authentication and secure data transmission based on national cryptographic algorithms, characterized in that, The method involves a client, an encryption terminal, and a server. The client is used to receive user operation instructions, store local keys, and initiate requests. The encrypted terminal has user information login verification permissions; The server is used to transmit encrypted data; The method includes: When the client receives the signature value generated by calling the local key in response to the user login request, the encryption terminal requests an authentication credential from the server based on the signature value, and sends the authentication credential returned by the server to the client. The encryption terminal receives the access authentication association request initiated by the client based on the authentication credential, collaborates with the server to perform a validity verification of the authentication credential and generates a verification result, and sends the verification result to the client; The encryption terminal receives a key download request and user identification information sent by the client, and sends the user identification information to the server. The server generates an authentication instruction based on the user identification information and sends the authentication instruction to the client. The client performs authentication based on the authentication instruction to obtain an authentication result. The encryption terminal receives the verification result and sends the verification result to the server. The server generates key data based on the verification result and sends the key data to the encryption terminal. The encryption terminal encrypts the key data and sends it to the client. The client decrypts the key data and stores the decrypted key data locally to obtain a local key.

8. A data security transmission method based on national cryptographic algorithms, characterized in that, The method involves a client, an encryption terminal, and a server. The client is used to receive user operation instructions, store local keys, and initiate requests. The encrypted terminal has user information login verification permissions; The server is used to transmit encrypted data; The method includes: When the server receives the signature value generated by the client using the local key in response to the user login request, the server receives the signature value and performs a validity check. After the server verifies the signature value and it passes the verification, it generates an authentication credential and sends the authentication credential to the encryption terminal; the encryption terminal then forwards it to the client. The server receives the access authentication request initiated by the client based on the authentication credential, performs secondary verification on the authentication credential and generates a verification result, and sends the verification result to the encryption terminal; the encryption terminal sends the verification result to the client. When the verification result is valid, the server establishes an encrypted data transmission connection with the client based on the national cryptographic algorithm. The server receives a key download request and user identification information, generates an authentication command based on the user identification information, and sends the authentication command to the client; the client receives the authentication command, performs authentication based on the authentication command to obtain an authentication result, and sends the authentication result to the encryption terminal; the encryption terminal sends the authentication result to the server. The server generates key data based on the verification result and sends the key data to the encryption terminal; the encryption terminal encrypts the key data and sends it to the client; the client decrypts the key data and stores the decrypted key data locally to obtain a local key.

9. A data security transmission device based on national cryptographic algorithms, characterized in that, The device comprises a client, an encryption terminal, and a server. The client is used to receive user operation instructions, store local keys, and initiate requests. The encryption terminal has user information login verification permissions. The server is used to transmit encrypted data; The data security transmission device implements the steps of the enhanced identity authentication and data security transmission method based on the national cryptographic algorithm as described in claim 7: include: The login module is used so that when a login request is received from a user, the client can retrieve the corresponding local key based on the login request. The authentication module is used for the client to generate a signature value based on the local key and send it to the encryption terminal; the encryption terminal requests an authentication credential from the server based on the signature value and sends the authentication credential to the client. The verification module is used for the client to initiate access authentication to the encryption terminal using the authentication credential and receive the verification result; the encryption terminal to transmit the authentication credential and the verification result; and the server to generate the verification result based on the authentication credential. The transmission module is used by the client to establish a data transmission connection with the server based on the verification result.

Images