CN112351037B - Information processing method and device for secure communication - Google Patents

Information processing method and device for secure communication Download PDF

Info

Publication number
CN112351037B
CN112351037B CN202011233403.2A CN202011233403A CN112351037B CN 112351037 B CN112351037 B CN 112351037B CN 202011233403 A CN202011233403 A CN 202011233403A CN 112351037 B CN112351037 B CN 112351037B
Authority
CN
China
Prior art keywords
algorithm
encryption
target
security domain
decryption
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202011233403.2A
Other languages
Chinese (zh)
Other versions
CN112351037A (en
Inventor
朱丙营
辛知
徐登伟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alipay Hangzhou Information Technology Co Ltd
Original Assignee
Alipay Hangzhou Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alipay Hangzhou Information Technology Co Ltd filed Critical Alipay Hangzhou Information Technology Co Ltd
Priority to CN202011233403.2A priority Critical patent/CN112351037B/en
Publication of CN112351037A publication Critical patent/CN112351037A/en
Application granted granted Critical
Publication of CN112351037B publication Critical patent/CN112351037B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms

Abstract

The embodiment of the specification provides an information processing method and device for secure communication. The method may be applied to a first security domain on the terminal device and also to a second security domain. When the method is applied to a first security domain, the method comprises: receiving a secure channel establishment request from a target application on the terminal device, wherein the secure channel establishment request comprises a domain identifier of a second secure domain; responding to the establishment request, and sending algorithm information to a second security domain, wherein the algorithm information comprises algorithm identifications of a plurality of encryption and decryption algorithms supported by the target application, and the plurality of encryption and decryption algorithms correspond to a plurality of algorithm types required by the security channel; receiving an encryption strategy from a second security domain, wherein the encryption strategy shows algorithm identifications of a plurality of target algorithms, and the target algorithms are respectively designated with data types for encryption and decryption, and the target algorithms correspond to the algorithm types and are encryption and decryption algorithms supported by both target application and the second security domain; and executing the initialization operation of the secure channel according to the encryption strategy.

Description

Information processing method and device for secure communication
Technical Field
The embodiment of the specification relates to the technical field of information security, in particular to an information processing method and device for secure communication.
Background
Currently, a terminal device may be installed with a client application having a secure communication requirement (hereinafter, referred to as a target application), and may also be configured with a security domain (hereinafter, referred to as a first security domain), such as a TEE (Trusted Execution Environment) or the like. When the target application needs to communicate with applications on a server or other terminal devices, a secure channel between the target application and the second security domain can be established through the first security domain, and message transmission is performed through the secure channel. And the second security domain is a security domain corresponding to the application on the server or other terminal equipment.
In practice, the terminal environment is realized based on various different chip platforms, has different algorithm capabilities and encryption capabilities, has security channel protocols which are not matched with each other, and cannot meet the uniform requirements of interactive services between a client and between the client and a server if one set of encryption algorithm protocol is used.
Therefore, a reasonable and reliable scheme is urgently needed, which not only can realize the secure communication between the first security domain and the second security domain, but also can meet the unified requirements of interactive services between the client and the client, and between the client and the server.
Disclosure of Invention
The embodiment of the specification provides an information processing method and device for secure communication.
In a first aspect, an embodiment of the present specification provides an information processing method for secure communication, which is applied to a first security domain in a terminal device, and includes: receiving a secure channel establishment request from a target application on the terminal device, wherein the establishment request comprises a domain identifier of a second secure domain; sending algorithm information to the second security domain in response to the establishment request, wherein the algorithm information comprises algorithm identifications of a plurality of encryption and decryption algorithms supported by the target application, and the plurality of encryption and decryption algorithms correspond to a plurality of algorithm types required by a secure channel; receiving an encryption policy from the second security domain, the encryption policy showing algorithm identifications of a plurality of target algorithms, and the plurality of target algorithms being respectively designated for data types for encryption and decryption, wherein the plurality of target algorithms correspond to the plurality of algorithm types and are encryption and decryption algorithms supported by both the target application and the second security domain; and executing the initialization operation of the secure channel according to the encryption strategy.
In some embodiments, the plurality of algorithm types includes at least a symmetric encryption algorithm and a cryptographic hash function; and the executing of the secure channel initialization operation according to the encryption policy comprises: acquiring the equipment characteristic information of the terminal equipment and the equipment characteristic information of the equipment where the second security domain is located; and for a data type corresponding to a first target algorithm in the multiple target algorithms, generating an encryption key corresponding to the data type by using a target key generation algorithm corresponding to the data type according to the acquired feature information of each piece of equipment, wherein the first target algorithm belongs to a symmetric encryption algorithm or a cryptographic hash function, and the second security domain generates a decryption key which is the same as the encryption key for the data type.
In some embodiments, the multiple algorithm types further include an asymmetric encryption algorithm, the terminal device is preset with a public and private key pair corresponding to a second target algorithm, the second security domain holds a first public key in the public and private key pair, and the second target algorithm belongs to the asymmetric encryption algorithm; and the executing the initialization operation of the secure channel according to the encryption policy further comprises: and for the data type corresponding to the second target algorithm, determining a first private key in the public and private key pair as an encryption key corresponding to the data type, wherein the second security domain determines the first public key as a decryption key corresponding to the data type.
In some embodiments, prior to said sending algorithm information to the second security domain, the method further comprises: sending first identity information to the second security domain, wherein the first identity information comprises device feature information of the terminal device; and receiving second identity information from the second security domain, wherein the second identity information comprises equipment characteristic information of equipment where the second security domain is located.
In some embodiments, the first identity information further comprises information to be checked; and said receiving second identity information from said second security domain, comprising: receiving second identity information returned from the second security domain in response to the information to be verified being authenticated.
In some embodiments, the information to be verified comprises a public key of the first security domain or a device certificate.
In some embodiments, the respective data types in the encryption policy include: a first data type used for characterizing service data, a second data type used for characterizing transmitted messages and a third data type used for characterizing encrypted messages; and after the secure channel initialization operation is performed according to the encryption policy, the method further comprises: in response to obtaining target service data of the target application, encrypting the target service data by using a target algorithm corresponding to the first data type according to an encryption key corresponding to the first data type to obtain encrypted data, wherein a target receiving party of the target service data is the second security domain; generating a transmission message including the encrypted data; encrypting the transmission message by using a target algorithm corresponding to the second data type according to an encryption key corresponding to the second data type to obtain an encrypted message; generating a signature of the encrypted message according to an encryption key corresponding to the third data type by using a target algorithm corresponding to the third data type; sending the encrypted message and the signature to the second security domain.
In some embodiments, after the receiving a secure channel establishment request from a target application on the terminal device and before the acquiring target service data of the target application in response, the method further includes: receiving a data transmission request from the target application, wherein the data transmission request comprises the target service data and the domain identifier.
In some embodiments, after said generating a signature of said encrypted message, said method further comprises: and regenerating an encryption key corresponding to the third data type according to the characteristic information of each piece of equipment by using a target key generation algorithm corresponding to the third data type.
In a second aspect, an embodiment of the present specification provides an information processing method for secure communication, applied to a second security domain, including: receiving algorithm information from a first security domain, wherein the algorithm information comprises algorithm identifications of a plurality of encryption and decryption algorithms supported by a target application on a terminal device where the first security domain is located, and the plurality of encryption and decryption algorithms correspond to a plurality of algorithm types required by a security channel; determining a plurality of target algorithms according to the encryption and decryption algorithms supported by the target application and the algorithm information, wherein the target algorithms are the encryption and decryption algorithms supported by the target application and the second security domain; determining data types which are respectively used for encryption and decryption by the target algorithms in a plurality of data types required by the secure channel; generating an encryption strategy, wherein the encryption strategy shows algorithm identifications of the target algorithms and data types corresponding to the target algorithms; sending the encryption policy to the first security domain; and executing the initialization operation of the secure channel according to the encryption strategy.
In some embodiments, the determining a plurality of target algorithms according to the encryption and decryption algorithms supported by the target algorithms and the algorithm information includes: determining each encryption and decryption algorithm supported by the target application and the second security domain according to the encryption and decryption algorithm supported by the target application and the algorithm information; and selecting one encryption and decryption algorithm from at least one encryption and decryption algorithm belonging to the algorithm type in the encryption and decryption algorithms as a target algorithm for each algorithm type in the multiple algorithm types.
In some embodiments, the plurality of algorithm types includes a symmetric encryption algorithm, an asymmetric encryption algorithm, and a cryptographic hash function; and selecting one encryption and decryption algorithm from at least one encryption and decryption algorithm belonging to the algorithm type in the encryption and decryption algorithms as a target algorithm, wherein the method comprises the following steps: when the algorithm type is a symmetric encryption algorithm or a password hash function, selecting one encryption and decryption algorithm from the at least one encryption and decryption algorithm as a target algorithm; when the algorithm type is an asymmetric encryption algorithm, selecting one encryption and decryption algorithm as a target algorithm from the encryption and decryption algorithms which meet a selection condition in the at least one encryption and decryption algorithm, wherein the selection condition comprises the following steps: the terminal device is preset with a public and private key pair corresponding to an encryption and decryption algorithm, and the second security domain is stored with a first public key in the public and private key pair.
In some embodiments, the second security domain stores an algorithm selection policy corresponding to a service party to which the target application belongs; and determining a plurality of target algorithms according to the encryption and decryption algorithms supported by the target algorithms and the algorithm information, wherein the method comprises the following steps: and determining the target algorithms according to the encryption and decryption algorithms supported by the target algorithms, the algorithm information and the algorithm selection strategy.
In some embodiments, the plurality of data types includes: a first data type for characterizing traffic data, a second data type for characterizing transmitted messages, a third data type for characterizing encrypted messages; and the determining the data types respectively used for encryption and decryption by the plurality of target algorithms comprises: when the plurality of algorithm types are respectively a symmetric encryption algorithm and a password hash function, allocating a target algorithm belonging to the symmetric encryption algorithm to the first data type and the second data type, and allocating a target algorithm belonging to the password hash function to the third data type; when the plurality of algorithm types are a symmetric encryption algorithm, an asymmetric encryption algorithm, and a cryptographic hash function, respectively, a target algorithm belonging to one of the symmetric encryption algorithm and the asymmetric encryption algorithm is assigned to the first data type, a target algorithm belonging to the other of the symmetric encryption algorithm and the asymmetric encryption algorithm is assigned to the second data type, and a target algorithm belonging to the cryptographic hash function is assigned to the third data type.
In some embodiments, the plurality of algorithm types includes at least a symmetric encryption algorithm and a cryptographic hash function; and the executing of the secure channel initialization operation according to the encryption policy comprises: acquiring the equipment characteristic information of the terminal equipment and the equipment characteristic information of the equipment where the second security domain is located; for a data type corresponding to a first target algorithm in the multiple target algorithms, generating a decryption key corresponding to the data type by using a target key generation algorithm corresponding to the data type according to the acquired feature information of each piece of equipment, where the first target algorithm belongs to a symmetric encryption algorithm or a cryptographic hash function, and the first security domain generates an encryption key that is the same as the decryption key for the data type.
In some embodiments, the multiple algorithm types further include an asymmetric encryption algorithm, the terminal device is preset with a public and private key pair corresponding to a second target algorithm, the second security domain holds a first public key in the public and private key pair, and the second target algorithm belongs to the asymmetric encryption algorithm; and the executing the initialization operation of the secure channel according to the encryption policy further comprises: and for the data type corresponding to the second target algorithm, determining the first public key as a decryption key corresponding to the data type, wherein the first security domain determines a first private key in the public and private key pair as an encryption key corresponding to the data type.
In some embodiments, prior to said receiving algorithm information from the first security domain, the method further comprises: receiving first identity information from the first security domain, the first identity information comprising device feature information of the terminal device; and sending second identity information to the first security domain, wherein the second identity information comprises equipment characteristic information of equipment where the second security domain is located.
In some embodiments, the first identity information further comprises information to be verified; and after said receiving first identity information from said first security domain, said method further comprising: carrying out validity verification on the information to be verified; and in response to the information to be verified passing the verification, executing the sending of the second identity information to the first security domain.
In some embodiments, the information to be verified comprises a public key of the first security domain or a device certificate.
In some embodiments, the plurality of data types includes: a first data type for characterizing traffic data, a second data type for characterizing transmitted messages, a third data type for characterizing encrypted messages; and after the secure channel initialization operation is performed according to the encryption policy, the method further comprises: receiving an encrypted message and a signature of the encrypted message from the first security domain, wherein the encrypted message is generated by encrypting a transfer message, the transfer message including encrypted data, the encrypted data being generated by encrypting target traffic data of a target application; performing validity verification on the signature according to a decryption key corresponding to the third data type by using a target algorithm corresponding to the third data type; in response to the signature passing the verification, decrypting the encrypted message by using a target algorithm corresponding to the second data type according to a decryption key corresponding to the second data type to obtain the transmission message; and decrypting the encrypted data according to a decryption key corresponding to the first data type by using a target algorithm corresponding to the first data type to obtain the target service data.
In some embodiments, after said legality verifying said signature, said method further comprises: and regenerating a decryption key corresponding to the third data type according to the characteristic information of each piece of equipment by using a target key generation algorithm corresponding to the third data type.
In a third aspect, an embodiment of the present specification provides an information processing apparatus for secure communication, applied to a first security domain in a terminal device, including: a first receiving unit configured to receive a secure channel establishment request from a target application on the terminal device, the establishment request including a domain identification of a second secure domain; a sending unit configured to send algorithm information to the second security domain in response to the establishment request, the algorithm information including algorithm identifications of a plurality of encryption and decryption algorithms supported by the target application, the plurality of encryption and decryption algorithms corresponding to a plurality of algorithm types required by a secure channel; a second receiving unit configured to receive an encryption policy from the second security domain, the encryption policy showing algorithm identifications of a plurality of target algorithms, and the plurality of target algorithms being respectively specified with data types for encryption and decryption, wherein the plurality of target algorithms correspond to the plurality of algorithm types and are encryption and decryption algorithms supported by both the target application and the second security domain; a secure channel initialization unit configured to perform a secure channel initialization operation according to the encryption policy.
In a fourth aspect, an embodiment of the present specification provides an information processing apparatus for secure communication, applied to a second security domain, including: the terminal equipment comprises a receiving unit and a processing unit, wherein the receiving unit is configured to receive algorithm information from a first security domain, the algorithm information comprises algorithm identifications of a plurality of encryption and decryption algorithms supported by a target application on the terminal equipment where the first security domain is located, and the encryption and decryption algorithms correspond to a plurality of algorithm types required by a security channel; a first determining unit configured to determine a plurality of target algorithms according to the encryption and decryption algorithms supported by the second security domain and the algorithm information, wherein the plurality of target algorithms are encryption and decryption algorithms supported by the target application and the second security domain; a second determining unit configured to determine, among a plurality of data types required for a secure channel, data types respectively used for encryption and decryption by the plurality of target algorithms; an encryption policy generation unit configured to generate an encryption policy showing algorithm identifications of the plurality of target algorithms and data types corresponding to the plurality of target algorithms; a sending unit configured to send the encryption policy to the first security domain; a secure channel initialization unit configured to perform a secure channel initialization operation according to the encryption policy.
In a fifth aspect, the present specification provides a computer-readable storage medium on which a computer program is stored, wherein when the computer program is executed in a computer, the computer is caused to execute the method described in any implementation manner of the first aspect and the second aspect.
In a sixth aspect, the present specification provides a computing device, including a memory and a processor, where the memory stores executable code, and the processor executes the executable code to implement the method described in any one of the implementation manners of the first aspect and the second aspect.
The information processing method and apparatus for secure communication provided by the above embodiments of the present specification receive the aforementioned secure channel establishment request from the target application on the terminal device via the first security domain, and send the aforementioned algorithm information to the second security domain in response to the establishment request. The encryption policy as described above is then returned to the first security domain by the second security domain in response to the algorithm information. And then, executing the initialization operation of the secure channel through the first secure domain and the second secure domain according to the encryption strategies respectively. Therefore, the solution provided by the above embodiments of the present specification may enable the first security domain and the second security domain to agree on the encryption policy, and initialize the secure channel according to the encryption policy. The scheme can be applied to the equipment of the second security domain, no matter the equipment is terminal equipment or a server. Therefore, the scheme can not only realize the secure communication between the first security domain and the second security domain, but also meet the uniform requirements of the interactive services between the client and the client, and between the client and the server.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments disclosed in the present specification, the drawings needed to be used in the description of the embodiments will be briefly introduced below, it is obvious that the drawings in the following description are only embodiments disclosed in the present specification, and it is obvious for those skilled in the art to obtain other drawings based on the drawings without creative efforts.
FIG. 1 is an exemplary system architecture diagram to which some embodiments of the present description may be applied;
FIG. 2 is a timing diagram of one embodiment of an information processing method for secure communications according to the present description;
FIG. 3 is a timing diagram for one embodiment of a process for performing a secure channel initialization operation in accordance with the present description;
FIG. 4 is a timing diagram for one embodiment of a message processing flow relating to targeted business data in accordance with the present description;
fig. 5 is a schematic configuration diagram of an information processing apparatus for secure communication according to the present specification;
fig. 6 is a schematic diagram of one configuration of an information processing apparatus for secure communication according to the present specification.
Detailed Description
The present specification will be described in further detail with reference to the accompanying drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the relevant invention and not restrictive of the invention. The described embodiments are only some of the embodiments of the present specification, and not all of the embodiments. All other embodiments obtained by a person skilled in the art based on the embodiments in the present specification without any inventive step are within the scope of the present application.
It should be noted that, for convenience of description, only the portions related to the related invention are shown in the drawings. The embodiments and features of the embodiments in the present description may be combined with each other without conflict. In addition, the terms "first", "second", "third", and the like in the present specification are used only for information distinction and do not play any limiting role.
As described above, the terminal environment is implemented based on various different chip platforms, and has different algorithm capabilities and encryption capabilities, and the owned secure channel protocols are not matched with each other, and if one set of encryption algorithm protocol is used, the unified requirements of the interactive services between the client and the client, and between the client and the server cannot be satisfied.
Based on this, some embodiments of the present specification provide an information processing method for secure communication, by which not only secure communication between a first security domain and a second security domain can be achieved, but also unified requirements of interactive services between a client and a client, and between the client and a server can be satisfied. In particular, FIG. 1 illustrates an exemplary system architecture diagram suitable for use with these embodiments.
As shown in fig. 1, a target application, a first security domain and a second security domain are shown. The target application is any client application installed on the terminal device and having a secure communication requirement, and may include, for example and without limitation, a payment-type application and the like. The first security domain is a security domain configured in the terminal device, such as a TEE or the like. The first security domain may receive various requests of the target application, such as a secure channel establishment request, a data transmission request, and the like.
The second security domain is a security domain corresponding to an application on a server or other terminal device that can communicate with the target application. As an example, when the target application is a payment-type application, the server may be a background server of the payment-type application, and the application on the other terminal device may be an application with a cash register function. The server may be a cloud server or a physical server, and is not limited herein.
It should be understood that the device of the second security domain may be a terminal device, or may be a server. It should be noted that, when the device in which the second security domain is located is a terminal device, the first security domain and the second security domain may communicate in an offline scenario or in an online scenario, which is not specifically limited herein.
Taking the secure channel establishment request as an example, the first secure domain may receive the secure channel establishment request from the target application, where the establishment request includes the domain identification of the second secure domain. The first security domain may then send algorithm information relating to the target application to the second security domain in response to the establishment request. The first security domain may then receive, from the second security domain, an encryption policy returned in response to the algorithm information. Then, the first security domain and the second security domain can respectively execute the secure channel initialization operation according to the encryption policy.
The following describes specific implementation steps of the above method with reference to specific examples.
Referring to FIG. 2, a timing diagram of one embodiment of an information processing method for secure communications is shown. The method comprises the following steps:
step 201, a first security domain receives a security channel establishment request from a target application on a terminal device where the first security domain is located, and the establishment request includes a domain identifier of a second security domain;
step 205, the first security domain sends algorithm information to the second security domain, where the algorithm information includes algorithm identifiers of multiple encryption and decryption algorithms supported by the target application, and the multiple encryption and decryption algorithms correspond to multiple algorithm types required by the secure channel;
step 206, the second security domain determines a plurality of target algorithms according to the encryption and decryption algorithms and the algorithm information supported by the second security domain, wherein the target algorithms are encryption and decryption algorithms supported by both the target application and the second security domain;
step 207, the second security domain determines, in the multiple data types required by the secure channel, data types that are respectively used for encryption and decryption by the multiple target algorithms;
step 208, the second security domain generates an encryption policy, wherein the encryption policy shows algorithm identifications of the plurality of target algorithms and data types corresponding to the plurality of target algorithms;
step 209, the second security domain sends the encryption policy to the first security domain;
step 210, the second security domain executes the initialization operation of the security channel according to the encryption policy;
in step 211, the first security domain performs a security channel initialization operation according to the encryption policy.
Steps 205-209 embody a process in which a first security domain and a second security domain agree on an encryption policy.
The above steps will be further explained below.
In step 201, the first security domain may receive a secure channel establishment request from the target application in real time. The establishment request may be triggered manually or automatically, and is not limited herein.
In step 205, the first security domain may send algorithm information to the second security domain in response to the establishment request. The algorithm information may include, but is not limited to, algorithm identifications of a plurality of encryption and decryption algorithms supported by the target application, and the like. The plurality of encryption and decryption algorithms correspond to a plurality of algorithm types required by the secure channel. It is noted that there may be encryption and decryption algorithms of the plurality of encryption and decryption algorithms corresponding to the same algorithm type.
In practice, the above-mentioned plurality of algorithm types includes at least a symmetric encryption algorithm and a cryptographic hash function. Optionally, the plurality of algorithm types may further include an asymmetric encryption algorithm. The Encryption and decryption algorithm under the symmetric Encryption algorithm may include, but is not limited to, SM4, AES (Advanced Encryption Standard), 3DES, and the like. The encryption and decryption algorithms under the asymmetric encryption algorithm may include, but are not limited to, SM2, RSA, and the like, for example. The encryption/decryption algorithm under the cryptographic hash function may be an algorithm based on a key algorithm and a hash function, and may include, but is not limited to, an algorithm composed of SM2 and SM3 (a hash algorithm), an algorithm composed of RSA and SHA256 (a hash algorithm), an algorithm composed of SM4 and SM3, and an algorithm composed of AES and SHA256, for example, and is not particularly limited herein. It should be noted that the key algorithm may belong to a symmetric encryption algorithm or an asymmetric encryption algorithm, and is not limited herein.
It should be noted that 3DES (or called Triple DES) is a generic term of Triple Data Encryption Algorithm (TDEA) block cipher, and it is equivalent to applying Triple DES (Data Encryption Standard) Encryption Algorithm to each Data block. The RSA public key cryptosystem is a cryptosystem that uses different encryption and decryption keys, and it is computationally infeasible to derive a decryption key from a known encryption key. The hash value used by the SHA256 algorithm is 256 bits in length and is an abstract class. SM2, SM3, SM4 are all cryptographic algorithms, namely, the domestic cryptographic algorithms identified by the national crypto-authority. Since the above listed algorithms are well known technologies that are widely researched and applied at present, they are not described herein again.
Optionally, the algorithm information may further include at least one of: a first mark and a second mark. The first flag may be used to indicate whether an encryption algorithm supported by the encryption algorithm acceleration engine exists in the plurality of encryption and decryption algorithms. The second mark may be used to indicate whether there is an encryption/decryption algorithm with a public/private key pair in the plurality of encryption/decryption algorithms.
The first flag in the algorithm information is helpful for the second security domain to determine whether the encryption/decryption algorithm supported by the encryption algorithm acceleration engine exists in the plurality of encryption/decryption algorithms supported by the target application. The encryption algorithm acceleration engine may be an independent IP (Internet Protocol ) module, integrated on a chip, and may provide a specific algorithm hardware implementation interface. It should be noted that, compared with an encryption and decryption algorithm implemented by software, an encryption and decryption algorithm implemented by hardware is safer and more efficient.
In addition, under the condition that the multiple algorithm types include asymmetric encryption algorithms, the second mark in the algorithm information is helpful for the second security domain to judge whether the encryption and decryption algorithms provided with public and private key pairs exist in the multiple encryption and decryption algorithms supported by the target application.
Optionally, before step 205, the first security domain and the second security domain may send respective identity information to each other. For example, the first security domain may send the first identity information to the second security domain by performing step 202. The first identity information may include, but is not limited to, device feature information of the terminal device where the first security domain is located. Optionally, the first identity information may further include version information. The second security domain may send second identity information to the first security domain by performing step 204 in response to receiving the first identity information, which may include, but is not limited to, device feature information of a device in which the second security domain is located. In practice, the device feature information may include, but is not limited to, a MAC (Media Access Control) address, etc., for example.
Optionally, before step 205, the first security domain and the second security domain may perform an identity identification procedure to prove that the terminal device where the first security domain is located is a legal device (e.g. an official authorized device), an unforeseen/virtual device.
As an implementation manner of identity recognition, the first security domain may add information to be verified for identity verification to the first identity information as described above, where the information to be verified may include, but is not limited to, a public key of the first security domain or a device certificate, for example. Based on this, before step 204, the second security domain may perform validity verification on the information to be verified by executing step 203 in response to the first identity information including the information to be verified. The second security domain may then perform step 204 in response to the information to be verified being authenticated. In practice, the second security domain may adopt an authentication method agreed with the first security domain in advance to perform validity authentication on the information to be verified, and the specification does not specifically limit the authentication method.
As another implementation manner of identity recognition, the first security domain may also encrypt the first identity information in an encryption manner agreed in advance with the second security domain. Thus, further, in step 202, the first security domain may send the encrypted first identity information to the second security domain. Based on this, the second security domain may decrypt the first identity information in a decryption manner agreed with the first security domain before step 204. After decryption is successful, step 204 may be performed.
It should be understood that, in the solutions provided in the present specification, various methods may be used to identify the first security domain, and the present specification does not specifically limit the identification method.
In step 206, the second security domain may determine a plurality of target algorithms according to the encryption and decryption algorithms supported by the second security domain and the received algorithm information. Wherein the plurality of target algorithms are cryptographic algorithms supported by both the target application and the second security domain. It should be understood that the plurality of target algorithms correspond to the plurality of algorithm types described above.
In this specification, the plurality of data types required for the secure channel include: a first data type characterizing traffic data, a second data type characterizing a transmitted message, and a third data type characterizing an encrypted message. The data of the first data type and the data of the second data type are encrypted and decrypted by using a corresponding encryption and decryption algorithm and a corresponding key respectively. And the data of the third data type needs to be signed and checked by using a corresponding encryption and decryption algorithm and a corresponding secret key. The "signature" herein may represent a "signature".
For the data of the first data type and the second data type, both the data can be encrypted and decrypted by using a symmetric/asymmetric encryption and decryption algorithm. The Key type corresponding to the Key for encrypting and decrypting the Data of the first Data type may be referred to as a Data Encryption Key (DEK). The key type corresponding to the key used for encrypting and decrypting the data of the second data type may be referred to as an application cryptogram master key, abbreviated as ENC. And for the data of the third data type, the signature can be added and checked by using an encryption and decryption algorithm belonging to a password hash function. The type of the key corresponding to the key used for signing and checking the data may be referred to as a Message Authentication key (MAC).
In general, the plurality of algorithm types and the plurality of data types are equal in number, and the plurality of target algorithms and the plurality of algorithm types have a one-to-one correspondence relationship.
As an implementation, step 206 may further include:
s1, determining each encryption and decryption algorithm supported by both the target application and the second security domain according to the encryption and decryption algorithm supported by the second security domain and the algorithm information;
and S2, for each algorithm type in the multiple algorithm types, selecting one encryption and decryption algorithm from at least one encryption and decryption algorithm belonging to the algorithm type in each encryption and decryption algorithm as a target algorithm.
Optionally, when the plurality of algorithm types include a symmetric encryption algorithm, an asymmetric encryption algorithm, and a cryptographic hash function, step S2 may further include:
for each algorithm type in the multiple algorithm types, when the algorithm type is a symmetric encryption algorithm or a cryptographic hash function, selecting one encryption and decryption algorithm from at least one encryption and decryption algorithm belonging to the algorithm type in the encryption and decryption algorithms as a target algorithm; when the algorithm type is an asymmetric encryption algorithm, selecting one encryption and decryption algorithm as a target algorithm from the encryption and decryption algorithms which meet a selection condition in the at least one encryption and decryption algorithm, wherein the selection condition comprises the following steps: the terminal device is preset with a public and private key pair corresponding to an encryption and decryption algorithm, and the second security domain stores a first public key in the public and private key pair.
Optionally, the second security domain may store an algorithm selection policy corresponding to a service party to which the target application belongs. The algorithm selection policy may include, but is not limited to, performance requirement prioritization, and the like, for example, and is not limited herein. Based on this, step 206 may further include:
and S3, determining the target algorithms according to the encryption and decryption algorithms supported by the target algorithms, the algorithm information and the algorithm selection strategy.
Taking the example that the algorithm selection policy includes a performance requirement priority, the step S3 may further include the step S1 and the following step S31:
s31, for each algorithm type in the multiple algorithm types and at least one encryption and decryption algorithm belonging to the algorithm type in each encryption and decryption algorithm, if a hardware implementation algorithm supported by an encryption algorithm acceleration engine exists in the at least one encryption and decryption algorithm, selecting one hardware implementation algorithm from each hardware implementation algorithm in the at least one encryption and decryption algorithm as a target algorithm; and if the at least one encryption and decryption algorithm does not have a hardware implementation algorithm, selecting one encryption and decryption algorithm from the at least one encryption and decryption algorithm as a target algorithm.
In step S31, the specific algorithm selection method can refer to the related description of step S2.
It should be noted that, through the execution of step S3, the above target algorithms can be made to better meet the requirements of the target application. In addition, step S3 may enable the solution provided in this embodiment to contribute to exerting platform capability with various feature encryption capabilities (e.g., high-performance encryption algorithm capability, etc.).
The above describes only one method of determining a target algorithm for each data type. In the case that the plurality of algorithm types are respectively a symmetric encryption algorithm and a cryptographic hash function, and the number of the plurality of algorithm types is smaller than the number of the plurality of data types, for the symmetric encryption algorithm, the second security domain may determine at least one target algorithm for the symmetric encryption algorithm. Wherein the number of the at least one target algorithm is less than the number of the plurality of data types. For example, if the plurality of data types are the three data types listed above, the number of the at least one target algorithm may be 1 or 2.
In step 207, the second security domain may determine, among the plurality of data types, data types respectively used for encryption and decryption by the plurality of target algorithms.
Assuming that the plurality of data types include the first data type, the second data type and the third data type as described above, step 207 may further include:
s4, when the algorithm types are respectively a symmetric encryption algorithm and a password hash function, distributing a target algorithm belonging to the symmetric encryption algorithm to the first data type and the second data type, and distributing a target algorithm belonging to the password hash function to the third data type;
and S5, when the algorithm types are respectively a symmetric encryption algorithm, an asymmetric encryption algorithm and a password hash function, allocating a target algorithm belonging to one of the symmetric encryption algorithm and the asymmetric encryption algorithm to the first data type, allocating a target algorithm belonging to the other of the symmetric encryption algorithm and the asymmetric encryption algorithm to the second data type, and allocating a target algorithm belonging to the password hash function to the third data type.
Specifically, in step S4, when the plurality of algorithm types are a symmetric encryption algorithm and a cryptographic hash function, respectively, if the plurality of target algorithms include 1 target algorithm belonging to the symmetric encryption algorithm, the second security domain may assign the 1 target algorithm to the first data type and the second data type simultaneously. If the plurality of target algorithms includes 2 target algorithms belonging to symmetric encryption algorithms, the second security domain may assign any one of the 2 target algorithms to the first data type and another one of the 2 target algorithms to the second data type.
In step 208, the second security domain may generate an encryption policy. The encryption policy may show algorithm identifications of the target algorithms and data types corresponding to the target algorithms respectively. In the encryption policy, the data type may be represented by a type name or a type number, and is not specifically limited herein.
In step 209, the second security domain may send the encryption policy to the first security domain. The first and second security domains may then initialize the secure channel by performing steps 210, 211, and process the message by performing the steps shown in fig. 4.
In this embodiment, the steps 205-209 are performed such that the first security domain and the second security domain agree on an encryption policy. Because the encryption policy includes the algorithm identifiers of the target algorithms, and the target algorithms are encryption and decryption algorithms supported by both the target application and the second security domain, both the first security domain and the second security domain can initialize the security channel and process the message according to the encryption policy in an offline scene or an online scene.
It should be noted that, in this specification, the plurality of algorithm types as described above may correspond to a plurality of first-level algorithm types. The plurality of first-level algorithm types may include, for example, a national cryptographic algorithm and an international universal algorithm. The algorithms listed in the foregoing text, except for the cryptographic algorithm, may all belong to the international general algorithm. Typically, the plurality of target algorithms determined by the second security domain may be categorized into a national cryptographic algorithm or an international common algorithm.
In the following, the beneficial effects of the agreement encryption strategy in different scenarios are briefly introduced.
Scene 1: the user terminal A and the user terminal B have the national cryptographic algorithm (SM 2/3/4) at the same time, and the user terminal C and the user terminal D have the international general algorithms (RSA, AES, SHA256 and 3 DES) at the same time. By agreeing on the encryption policy, both user terminals A, B may choose to use the cryptographic algorithm to establish a secure channel and process the message. Both user terminals C, D may choose to use the international universal algorithm to establish a secure channel and process messages. Therefore, user experience can be improved, and the business safety requirements can be met.
Scene 2: the user terminal A has a national cryptographic algorithm (SM 2/3/4) acceleration engine, the user terminal B has an international general algorithm (RSA, AES, SHA256 and 3 DES) acceleration engine, and the service server side has an acceleration engine which simultaneously supports the national cryptographic algorithm and the international general algorithm. By agreement on the encryption strategy, the user terminal A can establish a secure channel with the service server by using a national cryptographic algorithm, and the user terminal B can establish a secure channel with the service server by using an international general algorithm. Therefore, the algorithm advantages of the user terminal A and the user terminal B can be brought into play at the same time, and the performance and the user experience are greatly improved.
Therefore, by agreement on the encryption strategy, the unified requirements of interactive services between the client and between the client and the server can be met, the platform capability with various characteristic encryption capabilities is exerted, and the fragmentation problem of service processing logic is reduced.
In step 210, the second security domain may perform a secure channel initialization operation according to the encryption policy. Specifically, step 210 may further include steps 2101-2102 as shown in FIG. 3. Optionally, step 210 may also include step 2103 as shown in fig. 3.
In step 211, the first security domain may perform a secure channel initialization operation according to an encryption policy. Specifically, step 211 may further include steps 2111-2112 as shown in FIG. 3. Optionally, step 211 may also include step 2113 as shown in fig. 3.
As shown in fig. 3, a timing diagram illustrating one embodiment of a process for performing a secure channel initialization operation is shown. In the case where the plurality of algorithm types include a symmetric encryption algorithm and a cryptographic hash function, the performing comprises the steps of:
step 2101, the second security domain obtains device characteristic information of the terminal device where the first security domain is located and device characteristic information of the device where the second security domain is located;
step 2102, for a data type corresponding to a first target algorithm in the multiple target algorithms, generating, by a second security domain, a decryption key corresponding to the data type according to the obtained feature information of each piece of equipment by using a target key generation algorithm corresponding to the data type, where the first target algorithm belongs to a symmetric encryption algorithm or a cryptographic hash function;
step 2111, the first security domain acquires the equipment characteristic information of the terminal equipment in which the first security domain is located and the equipment characteristic information of the equipment in which the second security domain is located;
step 2112, for the data type corresponding to the first target algorithm in the multiple target algorithms, the first security domain generates an encryption key corresponding to the data type according to the acquired feature information of each piece of equipment by using a target key generation algorithm corresponding to the data type, and the first target algorithm belongs to a symmetric encryption algorithm or a cryptographic hash function.
The above steps in this embodiment will be further explained below.
In step 2101 and step 2111, if the first security domain and the second security domain both store the pieces of device feature information, the pieces of device feature information may be acquired from respective storage areas.
Optionally, in the case of performing the above step 202 and the above step 204, the first security domain may obtain the device characteristic information of the terminal device where the first security domain is located from the local, and obtain the device characteristic information of the device where the second security domain is located from the received second identity information. The second security domain may locally obtain device feature information of a device in which the second security domain is located, and obtain device feature information of the terminal device in which the first security domain is located from the first identity information.
In steps 2102 and 2112, the target key generation algorithm may be a key generation algorithm pre-agreed by the first security domain and the second security domain. The data types corresponding to the first target algorithms may correspond to the same target key generation algorithm, or may correspond to different target key generation algorithms.
When the data types corresponding to the first target algorithms correspond to the same target key generation algorithm, the target key generation algorithm may include, for example, at least one sub-algorithm, and the number of the at least one sub-algorithm is the same as that of the first target algorithms. After the pieces of device feature information are input into the target key generation algorithm, the target key generation algorithm may be enabled to output a key corresponding to the data type, for example, an encryption key or a decryption key.
It should be appreciated that for each data type corresponding to the first target algorithm, the first security domain and the second security domain employ the same key generation algorithm and the same input parameters when generating the encryption key and the decryption key corresponding to that data type.
Note that in step 2102 and step 2112, for the target algorithm belonging to the cryptographic hash function, the key algorithm in the target algorithm usually belongs to a symmetric encryption algorithm.
Optionally, the plurality of algorithm types may further include an asymmetric encryption algorithm, and a second target algorithm belonging to the asymmetric encryption algorithm may further exist in the plurality of target algorithms. The terminal equipment where the first security domain is located is preset with a public and private key pair corresponding to the second target algorithm, and the second security domain stores a first public key in the public and private key pair. Based on this, the secure channel initialization operation performed by the second secure domain may further include: step 2103, for the data type corresponding to the second target algorithm, determining the first public key in the public and private key pair corresponding to the second target algorithm as the decryption key corresponding to the data type. In addition, the secure channel initialization operation performed by the first secure domain may further include: step 2113, for the data type corresponding to the second target algorithm, determining the first private key in the public and private key pair corresponding to the second target algorithm as the encryption key corresponding to the data type.
Because the first security domain and the second security domain initialize the security channel each time the security channel is established, the risks of identity forgery, encryption strategy leakage and the like can be effectively avoided, and the security of communication can be improved.
It should be noted that, in the embodiment corresponding to fig. 3, only the above-mentioned pieces of device characteristic information are described as input parameters of the target key generation algorithm. It should be understood that, in the embodiment corresponding to fig. 3, the above-mentioned pieces of device feature information may also be replaced by other information items that can be applied to the scheme provided in this specification, where the information items may include, but are not limited to, random numbers generated by the first security domain and the second security domain, respectively, and the like, and are not limited in detail herein. As an example, a first security domain may generate a first random number and send the first random number to a second security domain. The second security domain may generate a second random number in response to the first random number and return the second random number to the first security domain. Alternatively, in the case where the first security domain and the second security domain send identity information to each other, the first random number may be included in the first identity information as described above, and the second random number may be included in the second identity information as described above.
After the secure channel initialization operation is finished, the first secure domain and the second secure domain may further execute a message processing flow. Specifically, the establishment request may further include target service data. Alternatively, after step 201, the first security domain may further receive a data transmission request from the target application, where the data transmission request includes the target service data and the domain identifier of the second security domain. The first security domain may obtain the target service data from the establishment request or the data sending request. Subsequently, the first security domain and the second security domain may perform a message processing procedure related to the target business data.
Next, a message processing flow related to the target service data is described.
As shown in fig. 4, a timing diagram of one embodiment of a message processing flow relating to targeted traffic data is shown. In this embodiment, the plurality of data types include the first data type, the second data type, and the third data type as described above. The message processing flow comprises the following steps:
step 212, in response to acquiring target service data of the target application, the first security domain encrypts the target service data according to an encryption key corresponding to the first data type by using a target algorithm corresponding to the first data type to obtain encrypted data, wherein a target receiver of the target service data is a second security domain;
step 213, the first security domain generating a transmission message comprising encrypted data;
step 214, the first security domain encrypts the transmission message according to the encryption key corresponding to the second data type by using the target algorithm corresponding to the second data type, so as to obtain an encrypted message;
step 215, the first security domain generates a signature of the encrypted message according to the encryption key corresponding to the third data type by using a target algorithm corresponding to the third data type;
step 216, the first security domain sends the encrypted message and the signature to the second security domain;
step 218, the second security domain performs validity verification on the signature according to the decryption key corresponding to the third data type by using the target algorithm corresponding to the third data type;
step 220, in response to the signature passing the verification, decrypting the encrypted message by using a target algorithm corresponding to the second data type according to the decryption key corresponding to the second data type to obtain a transmission message;
step 221, decrypting the encrypted data in the transmission message according to the decryption key corresponding to the first data type by using the target algorithm corresponding to the first data type, so as to obtain the target service data.
In this embodiment, the first security domain specifically performs an encryption process related to the target business data, which includes steps 212-216. The second security domain performs in particular a decryption process related to the target service data, which comprises steps 218, 220, 221.
The above steps in this embodiment will be further explained below.
In step 212, the first security domain may, for example, input the target service data and an encryption key corresponding to the first data type into a target algorithm corresponding to the first data type, so that the target algorithm encrypts the target service data, and output the encrypted data. It should be understood that the encrypted data is the encrypted target service data.
In step 213, the first security domain may generate a transfer message including encrypted data according to a message format agreed upon with the second security domain. The message format may include, but is not limited to, JSON (JavaScript Object Notation) format, for example.
In step 214, the first security domain may, for example, input the transmission message and an encryption key corresponding to the second data type into a target algorithm corresponding to the second data type, so that the target algorithm encrypts the transmission message, and output the encrypted message. It should be understood that the encrypted message is an encrypted transmission message.
In step 215, the first security domain may input the encrypted message and an encryption key corresponding to the third data type into a target algorithm corresponding to the third data type, so that the target algorithm generates and outputs a signature of the encrypted message.
In step 216, the first security domain may send the encrypted message and the signature to the second security domain.
In step 218, the second security domain may verify the validity of the signature according to the decryption key corresponding to the third data type using the target algorithm corresponding to the third data type in response to receiving the encrypted message and the signature.
For example, the second security domain may input the signature and a decryption key corresponding to the third data type into a target algorithm corresponding to the third data type, so that the target algorithm decrypts the signature to obtain a decrypted message. Then, if the decrypted message is an encrypted message, the decrypted message and the received encrypted message can be compared; if the two are consistent, the signature can be determined to be legal; otherwise, the signature may be determined to be illegal. Optionally, if the decrypted message is a digest of an encrypted message, the hash function in the target algorithm may be used to calculate the digest of the received encrypted message, and then the decrypted message and the calculated digest may be compared; if the two are consistent, the signature can be determined to be legal; otherwise, the signature may be determined to be illegal.
Wherein, when the signature is determined to be legitimate, the signature can be considered to be verified, and the process can continue to step 220.
In step 220, in case that the signature passes the verification, the second security domain may, for example, input the encrypted message and a decryption key corresponding to the second data type into a target algorithm corresponding to the second data type, so that the target algorithm decrypts the encrypted message, and outputs a decrypted transmission message.
In step 221, for the encrypted data in the decrypted transmission message, the second security domain may input the encrypted data and the decryption key corresponding to the first data type into the target algorithm corresponding to the first data type, so that the target algorithm decrypts the encrypted data, and outputs the decrypted target service data.
Thereafter, the second security domain may send the target service data to a corresponding client application or server, for example, so that the client application or server processes the target service data. When the second security domain obtains the first processing result corresponding to the target service data and the first processing result needs to be encrypted and signed, the second security domain may regard the decryption keys corresponding to the multiple data types as encryption keys, perform encryption and signing on the first processing result by using a process similar to the encryption process, obtain a second processing result, and send the second processing result to the first security domain. After receiving the second processing result, the first security domain may regard the encryption keys corresponding to the multiple data types as decryption keys, and perform signature verification and decryption on the second processing result by using a process similar to the decryption process.
Optionally, after step 215, the method may further include: step 217, the first security domain regenerates the encryption key corresponding to the third data type according to the above-mentioned feature information of each piece of equipment by using a target key generation algorithm corresponding to the third data type. Further, step 217 may be performed before or after step 216, or step 217 may be performed simultaneously with step 216, which is not specifically limited herein. Accordingly, after step 218, the method may further include: in step 219, the second security domain regenerates the decryption key corresponding to the third data type according to the above-mentioned feature information of each device by using a target key generation algorithm corresponding to the third data type. Wherein the decryption key is the same as the encryption key in step 217.
In the embodiment corresponding to fig. 4, the first security domain and the second security domain may encrypt and decrypt data and sign and check a signature according to an encryption and decryption key of the initialized secure channel and a target algorithm specified by an agreed encryption policy. Therefore, confidentiality, authenticity and integrity of data can be ensured, replay attack and out-of-order attack can be prevented, and the first security domain and the second security domain can realize secure communication.
With further reference to fig. 5, as an implementation of the methods illustrated in some of the above figures, the present specification provides one embodiment of an information processing apparatus for secure communication, which may be applied to a first security domain as illustrated in fig. 1.
As shown in fig. 5, the information processing apparatus 500 for secure communication of the present embodiment includes: a first receiving unit 501, a sending unit 502, a second receiving unit 503, and a secure channel initializing unit 504. The first receiving unit 501 is configured to receive a secure channel establishment request from a target application on a terminal device, where the establishment request includes a domain identifier of a second secure domain; the sending unit 502 is configured to send algorithm information to the second security domain in response to the establishment request, the algorithm information including algorithm identifications of a plurality of encryption and decryption algorithms supported by the target application, the plurality of encryption and decryption algorithms corresponding to a plurality of algorithm types required by the secure channel; the second receiving unit 503 is configured to receive an encryption policy from the second security domain, the encryption policy showing algorithm identifications of a plurality of target algorithms, and the plurality of target algorithms being respectively specified with data types for encryption and decryption, wherein the plurality of target algorithms correspond to the plurality of algorithm types and are encryption and decryption algorithms supported by both the target application and the second security domain; the secure channel initialization unit 504 is configured to perform a secure channel initialization operation according to an encryption policy.
Optionally, the plurality of algorithm types at least include a symmetric encryption algorithm and a cryptographic hash function; and the secure channel initialization unit 504 may be further configured to: acquiring the equipment characteristic information of the terminal equipment and the equipment characteristic information of the equipment where the second security domain is located; and for a data type corresponding to a first target algorithm in the multiple target algorithms, generating an encryption key corresponding to the data type by using a target key generation algorithm corresponding to the data type according to the acquired feature information of each piece of equipment, wherein the first target algorithm belongs to a symmetric encryption algorithm or a cryptographic hash function, and the second security domain generates a decryption key which is the same as the encryption key thereof for the data type.
Optionally, the multiple algorithm types further include an asymmetric encryption algorithm, the terminal device is preset with a public and private key pair corresponding to a second target algorithm, a second security domain stores a first public key in the public and private key pair, and the second target algorithm belongs to the asymmetric encryption algorithm; and the secure channel initialization unit 504 may be further configured to: and for the data type corresponding to the second target algorithm, determining a first private key in the public and private key pair as an encryption key corresponding to the data type, wherein the second security domain determines the first public key as a decryption key corresponding to the data type.
Optionally, the sending unit 502 may be further configured to: before sending algorithm information to a second security domain, sending first identity information to the second security domain, wherein the first identity information comprises equipment characteristic information of the terminal equipment; the second receiving unit 503 may also be configured to: and receiving second identity information from the second security domain, wherein the second identity information comprises equipment characteristic information of the equipment where the second security domain is located.
Optionally, the first identity information further includes information to be verified; and the second receiving unit 503 may be further configured to: and receiving second identity information returned in response to the information to be verified passing the verification from the second security domain. The information to be verified may include, but is not limited to, a public key of the first security domain or a device certificate.
Optionally, the respective data types in the encryption policy include: a first data type for characterizing traffic data, a second data type for characterizing transmitted messages, a third data type for characterizing encrypted messages; and the apparatus 500 may further include: the message processing unit (not shown in the figure) is configured to, in response to the acquired target service data of the target application, encrypt the target service data according to an encryption key corresponding to the first data type by using a target algorithm corresponding to the first data type to obtain encrypted data, wherein a target receiver of the target service data is a second security domain; generating a transmission message including the encrypted data; encrypting the transmission message by using a target algorithm corresponding to the second data type according to an encryption key corresponding to the second data type to obtain an encrypted message; generating a signature of the encrypted message according to the encryption key corresponding to the third data type by using a target algorithm corresponding to the third data type; and the sending unit 502 may be further configured to: the encrypted message and the signature are sent to the second security domain.
Optionally, the first receiving unit 501 may be further configured to: and receiving a data sending request from the target application, wherein the data sending request comprises the target service data and the domain identifier of the second security domain.
Optionally, the message processing unit may be further configured to: and after the signature of the encrypted message is generated, regenerating the encrypted key corresponding to the third data type according to the characteristic information of each piece of equipment by using a target key generation algorithm corresponding to the third data type.
With further reference to fig. 6, as an implementation of the methods illustrated in some of the above figures, the present specification provides one embodiment of an information processing apparatus for secure communication, which may be applied to a second security domain as illustrated in fig. 1.
As shown in fig. 6, the information processing apparatus 600 for secure communication of the present embodiment includes: a receiving unit 601, a first determining unit 602, a second determining unit 603, an encryption policy generating unit 604, a transmitting unit 605 and a secure channel initializing unit 606. The receiving unit 601 is configured to receive algorithm information from the first security domain, where the algorithm information includes algorithm identifiers of a plurality of encryption and decryption algorithms supported by a target application on a terminal device where the first security domain is located, and the plurality of encryption and decryption algorithms correspond to a plurality of algorithm types required by the secure channel; the first determining unit 602 is configured to determine, according to the encryption and decryption algorithms supported by the second security domain itself and the algorithm information, a plurality of target algorithms, which are encryption and decryption algorithms supported by both the target application and the second security domain; the second determining unit 603 is configured to determine, among a plurality of data types required for the secure channel, data types respectively used for encryption and decryption by a plurality of target algorithms; the encryption policy generating unit 604 is configured to generate an encryption policy, where the encryption policy shows algorithm identifications of the target algorithms and data types corresponding to the target algorithms; the sending unit 605 is configured to send the encryption policy to the first security domain; the secure channel initialization unit 606 is configured to perform a secure channel initialization operation according to an encryption policy.
Optionally, the first determining unit 602 may be further configured to: determining each encryption and decryption algorithm supported by the target application and the second security domain according to the encryption and decryption algorithm supported by the second security domain and the algorithm information; and for each algorithm type in the multiple algorithm types, selecting one encryption and decryption algorithm from at least one encryption and decryption algorithm belonging to the algorithm type in each encryption and decryption algorithm as a target algorithm.
Optionally, the plurality of algorithm types include a symmetric encryption algorithm, an asymmetric encryption algorithm, and a cryptographic hash function; and the first determining unit 602 may be further configured to: for each algorithm type in the multiple algorithm types, when the algorithm type is a symmetric encryption algorithm or a cryptographic hash function, selecting one encryption and decryption algorithm from at least one encryption and decryption algorithm belonging to the algorithm type in the encryption and decryption algorithms as a target algorithm; when the algorithm type is an asymmetric encryption algorithm, selecting one encryption and decryption algorithm as a target algorithm from the encryption and decryption algorithms which meet a selection condition in the at least one encryption and decryption algorithm, wherein the selection condition comprises the following steps: the terminal device is preset with a public and private key pair corresponding to an encryption and decryption algorithm, and the second security domain stores a first public key in the public and private key pair.
Optionally, the second security domain stores an algorithm selection policy corresponding to a service party to which the target application belongs; and the first determining unit 602 may be further configured to: and determining the target algorithms according to the encryption and decryption algorithm supported by the second security domain, the algorithm information and the algorithm selection strategy. The algorithm selection policy may include, but is not limited to, priority of performance requirements, and the like.
Optionally, the plurality of data types include: a first data type used for characterizing service data, a second data type used for characterizing transmitted messages and a third data type used for characterizing encrypted messages; and the second determining unit 603 may be further configured to: when the algorithm types are respectively a symmetric encryption algorithm and a password hash function, allocating a target algorithm belonging to the symmetric encryption algorithm to a first data type and a second data type, and allocating the target algorithm belonging to the password hash function to a third data type; when the plurality of algorithm types are a symmetric encryption algorithm, an asymmetric encryption algorithm, and a cryptographic hash function, respectively, a target algorithm belonging to one of the symmetric encryption algorithm and the asymmetric encryption algorithm is assigned to the first data type, a target algorithm belonging to the other of the symmetric encryption algorithm and the asymmetric encryption algorithm is assigned to the second data type, and a target algorithm belonging to the cryptographic hash function is assigned to the third data type.
Optionally, the plurality of algorithm types at least include a symmetric encryption algorithm and a cryptographic hash function; and the secure channel initiating unit 606 may be further configured to: acquiring the equipment characteristic information of the terminal equipment and the equipment characteristic information of the equipment where the second security domain is located; for a data type corresponding to a first target algorithm in the multiple target algorithms, generating a decryption key corresponding to the data type by using a target key generation algorithm corresponding to the data type according to the acquired feature information of each piece of equipment, wherein the first target algorithm belongs to a symmetric encryption algorithm or a cryptographic hash function, and the first security domain generates an encryption key which is the same as the decryption key of the first target algorithm for the data type.
Optionally, the multiple algorithm types further include an asymmetric encryption algorithm, the terminal device is preset with a public and private key pair corresponding to a second target algorithm, a second security domain stores a first public key in the public and private key pair, and the second target algorithm belongs to the asymmetric encryption algorithm; and the secure channel initiating unit 606 may be further configured to: and for the data type corresponding to the second target algorithm, determining the first public key as a decryption key corresponding to the data type, wherein the first security domain determines a first private key in the public and private key pair as an encryption key corresponding to the data type.
Optionally, the receiving unit 601 may be further configured to: receiving first identity information from the first security domain before receiving algorithm information from the first security domain, the first identity information including device characteristic information of the terminal device; the sending unit 605 may be further configured to send second identity information to the first security domain, where the second identity information includes device feature information of a device in which the second security domain is located.
Optionally, the first identity information further includes information to be verified; and the apparatus 600 may further include: an identity recognition unit (not shown in the figure) configured to perform validity verification on the information to be verified; and the sending unit 605 may be further configured to: and responding to the verification that the information to be verified passes the verification, and executing sending the second identity information to the first security domain. The information to be verified may include, but is not limited to, a public key of the first security domain or a device certificate.
Optionally, the plurality of data types include: a first data type for characterizing traffic data, a second data type for characterizing transmitted messages, a third data type for characterizing encrypted messages; and the apparatus 600 may further include: a message processing unit (not shown in the figure) configured to receive an encrypted message and a signature of the encrypted message from the first security domain, wherein the encrypted message is generated by encrypting a transmission message, the transmission message comprises encrypted data, and the encrypted data is generated by encrypting target service data of a target application; verifying the validity of the signature by using a target algorithm corresponding to the third data type according to a decryption key corresponding to the third data type; in response to the signature passing the verification, decrypting the encrypted message by using a target algorithm corresponding to the second data type according to a decryption key corresponding to the second data type to obtain a transmission message; and decrypting the encrypted data by using a target algorithm corresponding to the first data type according to a decryption key corresponding to the first data type to obtain target service data.
Optionally, the message processing unit may be further configured to: and after the legality of the signature is verified, regenerating a decryption key corresponding to the third data type according to the characteristic information of each piece of equipment by using a target key generation algorithm corresponding to the third data type.
In the embodiments respectively corresponding to fig. 5 and fig. 6, the detailed processing of each unit and the technical effect thereof can refer to the related descriptions in the embodiments respectively corresponding to fig. 2, fig. 3, and fig. 4, and are not repeated herein.
The present specification also provides a computer readable storage medium, on which a computer program is stored, wherein when the computer program is executed in a computer, the computer is caused to execute the methods respectively shown in the above method embodiments.
The present specification further provides a computing device, including a memory and a processor, where the memory stores executable codes, and the processor executes the executable codes to implement the methods respectively shown in the above method embodiments.
Embodiments of the present specification also provide a computer program product, which, when executed on a data processing apparatus, causes the data processing apparatus to implement the methods respectively shown in the above method embodiments.
Those skilled in the art will recognize that, in one or more of the examples described above, the functions described in the embodiments disclosed herein may be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.
The above-mentioned embodiments, objects, technical solutions and advantages of the embodiments disclosed in the present specification are further described in detail, it should be understood that the above-mentioned embodiments are only specific embodiments of the embodiments disclosed in the present specification, and are not intended to limit the scope of the embodiments disclosed in the present specification, and any modifications, equivalent substitutions, improvements and the like made on the basis of the technical solutions of the embodiments disclosed in the present specification should be included in the scope of the embodiments disclosed in the present specification.

Claims (25)

1. An information processing method for secure communication, applied to a first security domain in a terminal device, includes:
receiving a secure channel establishment request from a target application on the terminal device, wherein the establishment request comprises a domain identifier of a second secure domain;
sending algorithm information to the second security domain in response to the establishment request, wherein the algorithm information comprises algorithm identifications of a plurality of encryption and decryption algorithms supported by the target application, and the plurality of encryption and decryption algorithms correspond to a plurality of algorithm types required by a secure channel;
receiving an encryption policy from the second security domain, the encryption policy showing algorithm identifications of a plurality of target algorithms, and the plurality of target algorithms being respectively designated for data types for encryption and decryption, wherein the plurality of target algorithms correspond to the plurality of algorithm types and are encryption and decryption algorithms supported by both the target application and the second security domain;
and executing the initialization operation of the secure channel according to the encryption strategy.
2. The method of claim 1, wherein the plurality of algorithm types includes at least a symmetric encryption algorithm and a cryptographic hash function; and
the executing of the secure channel initialization operation according to the encryption policy includes:
acquiring the equipment characteristic information of the terminal equipment and the equipment characteristic information of the equipment where the second security domain is located;
and for a data type corresponding to a first target algorithm in the multiple target algorithms, generating an encryption key corresponding to the data type by using a target key generation algorithm corresponding to the data type according to the acquired feature information of each piece of equipment, wherein the first target algorithm belongs to a symmetric encryption algorithm or a cryptographic hash function, and the second security domain generates a decryption key which is the same as the encryption key for the data type.
3. The method according to claim 2, wherein the plurality of algorithm types further include an asymmetric cryptographic algorithm, the terminal device is preset with a public and private key pair corresponding to a second target algorithm, the second security domain holds the first public key in the public and private key pair, and the second target algorithm belongs to the asymmetric cryptographic algorithm; and
the executing the secure channel initialization operation according to the encryption policy further comprises:
and for the data type corresponding to the second target algorithm, determining a first private key in the public and private key pair as an encryption key corresponding to the data type, wherein the second security domain determines the first public key as a decryption key corresponding to the data type.
4. The method according to one of claims 1-3, wherein prior to said sending algorithm information to the second security domain, the method further comprises:
sending first identity information to the second security domain, wherein the first identity information comprises device feature information of the terminal device;
and receiving second identity information from the second security domain, wherein the second identity information comprises equipment characteristic information of equipment where the second security domain is located.
5. The method of claim 4, wherein the first identity information further comprises information to be verified; and
the receiving second identity information from the second security domain comprises:
receiving second identity information returned from the second security domain in response to the information to be verified being authenticated.
6. The method of claim 5, wherein the information to be verified comprises a public key of the first security domain or a device certificate.
7. The method of claim 2 or 3, wherein the respective data types in the encryption policy comprise: a first data type used for characterizing service data, a second data type used for characterizing transmitted messages and a third data type used for characterizing encrypted messages; and
after the performing a secure channel initialization operation according to the encryption policy, the method further comprises:
in response to the target service data of the target application being obtained, encrypting the target service data according to an encryption key corresponding to the first data type by using a target algorithm corresponding to the first data type to obtain encrypted data, wherein a target receiver of the target service data is the second security domain;
generating a transmission message including the encrypted data;
encrypting the transmission message by using a target algorithm corresponding to the second data type according to an encryption key corresponding to the second data type to obtain an encrypted message;
generating a signature of the encrypted message according to an encryption key corresponding to the third data type by using a target algorithm corresponding to the third data type;
sending the encrypted message and the signature to the second security domain.
8. The method of claim 7, wherein after the receiving a secure channel establishment request from a target application on the terminal device and before the obtaining target traffic data for the target application in response, the method further comprises:
receiving a data transmission request from the target application, wherein the data transmission request comprises the target service data and the domain identifier.
9. The method of claim 7, wherein after the generating a signature of the encrypted message, the method further comprises:
and regenerating an encryption key corresponding to the third data type according to the characteristic information of each piece of equipment by using a target key generation algorithm corresponding to the third data type.
10. An information processing method for secure communication, applied to a second security domain, includes:
receiving algorithm information from a first security domain, wherein the algorithm information includes algorithm identifiers of a plurality of encryption and decryption algorithms supported by a target application on a terminal device where the first security domain is located, and the plurality of encryption and decryption algorithms correspond to a plurality of algorithm types required by a security channel;
determining a plurality of target algorithms according to the encryption and decryption algorithms supported by the target application and the algorithm information, wherein the target algorithms are the encryption and decryption algorithms supported by the target application and the second security domain;
determining data types which are respectively used for encryption and decryption by the target algorithms in a plurality of data types required by the secure channel;
generating an encryption strategy, wherein the encryption strategy shows algorithm identifications of the target algorithms and data types corresponding to the target algorithms;
sending the encryption policy to the first security domain;
and executing the initialization operation of the secure channel according to the encryption strategy.
11. The method of claim 10, wherein the determining a plurality of target algorithms according to the encryption and decryption algorithms supported by the target algorithms and the algorithm information comprises:
determining each encryption and decryption algorithm supported by the target application and the second security domain according to the encryption and decryption algorithm supported by the target application and the algorithm information;
and selecting one encryption and decryption algorithm from at least one encryption and decryption algorithm belonging to the algorithm type in the encryption and decryption algorithms as a target algorithm for each algorithm type in the multiple algorithm types.
12. The method of claim 11, wherein the plurality of algorithm types include a symmetric encryption algorithm, an asymmetric encryption algorithm, and a cryptographic hash function; and
the selecting one encryption and decryption algorithm from at least one encryption and decryption algorithm belonging to the algorithm type in the encryption and decryption algorithms as a target algorithm comprises the following steps:
when the algorithm type is a symmetric encryption algorithm or a password hash function, selecting one encryption and decryption algorithm from the at least one encryption and decryption algorithm as a target algorithm;
when the algorithm type is an asymmetric encryption algorithm, selecting one encryption and decryption algorithm as a target algorithm from the encryption and decryption algorithms which meet a selection condition in the at least one encryption and decryption algorithm, wherein the selection condition comprises the following steps: the terminal device is preset with a public and private key pair corresponding to an encryption and decryption algorithm, and the second security domain stores a first public key in the public and private key pair.
13. The method according to claim 10, wherein the second security domain holds an algorithm selection policy corresponding to a service party to which the target application belongs; and
the determining a plurality of target algorithms according to the encryption and decryption algorithms supported by the target algorithms and the algorithm information comprises the following steps:
and determining the target algorithms according to the encryption and decryption algorithms supported by the target algorithms, the algorithm information and the algorithm selection strategy.
14. The method of claim 10, wherein the plurality of data types comprises: a first data type for characterizing traffic data, a second data type for characterizing transmitted messages, a third data type for characterizing encrypted messages; and
the determining the data types respectively used for encryption and decryption by the multiple target algorithms includes:
when the plurality of algorithm types are respectively a symmetric encryption algorithm and a password hash function, allocating a target algorithm belonging to the symmetric encryption algorithm to the first data type and the second data type, and allocating a target algorithm belonging to the password hash function to the third data type;
when the plurality of algorithm types are a symmetric encryption algorithm, an asymmetric encryption algorithm, and a cryptographic hash function, respectively, a target algorithm belonging to one of the symmetric encryption algorithm and the asymmetric encryption algorithm is assigned to the first data type, a target algorithm belonging to the other of the symmetric encryption algorithm and the asymmetric encryption algorithm is assigned to the second data type, and a target algorithm belonging to the cryptographic hash function is assigned to the third data type.
15. The method of claim 10, wherein the plurality of algorithm types includes at least a symmetric encryption algorithm and a cryptographic hash function; and
the executing of the secure channel initialization operation according to the encryption policy includes:
acquiring the equipment characteristic information of the terminal equipment and the equipment characteristic information of the equipment where the second security domain is located;
for a data type corresponding to a first target algorithm in the multiple target algorithms, generating a decryption key corresponding to the data type by using a target key generation algorithm corresponding to the data type according to the acquired feature information of each piece of equipment, where the first target algorithm belongs to a symmetric encryption algorithm or a cryptographic hash function, and the first security domain generates an encryption key that is the same as the decryption key for the data type.
16. The method of claim 15, wherein the plurality of algorithm types further include an asymmetric cryptographic algorithm, the terminal device is pre-provisioned with a public-private key pair corresponding to a second target algorithm, the second security domain holds a first public key of the public-private key pair, and the second target algorithm belongs to the asymmetric cryptographic algorithm; and
the executing the secure channel initialization operation according to the encryption policy further comprises:
and for the data type corresponding to the second target algorithm, determining the first public key as a decryption key corresponding to the data type, wherein the first security domain determines a first private key in the public and private key pair as an encryption key corresponding to the data type.
17. The method according to one of claims 10-16, wherein prior to said receiving algorithm information from the first security domain, the method further comprises:
receiving first identity information from the first security domain, the first identity information comprising device feature information of the terminal device;
and sending second identity information to the first security domain, wherein the second identity information comprises equipment characteristic information of equipment where the second security domain is located.
18. The method of claim 17, wherein the first identity information further comprises information to be verified; and
after the receiving first identity information from the first security domain, the method further comprises:
carrying out validity verification on the information to be verified;
and in response to the information to be verified passing verification, executing the sending of the second identity information to the first security domain.
19. The method of claim 18, wherein the information to be verified comprises a public key of the first security domain or a device certificate.
20. The method of claim 15 or 16, wherein the plurality of data types comprises: a first data type for characterizing traffic data, a second data type for characterizing transmitted messages, a third data type for characterizing encrypted messages; and
after the performing a secure channel initialization operation according to the encryption policy, the method further comprises:
receiving an encrypted message and a signature of the encrypted message from the first security domain, wherein the encrypted message is generated by encrypting a transfer message, the transfer message including encrypted data, the encrypted data being generated by encrypting target traffic data of a target application;
performing validity verification on the signature according to a decryption key corresponding to the third data type by using a target algorithm corresponding to the third data type;
in response to the signature passing the verification, decrypting the encrypted message by using a target algorithm corresponding to the second data type according to a decryption key corresponding to the second data type to obtain the transmission message;
and decrypting the encrypted data according to a decryption key corresponding to the first data type by using a target algorithm corresponding to the first data type to obtain the target service data.
21. The method of claim 20, wherein after said legality verifying said signature, said method further comprises:
and regenerating a decryption key corresponding to the third data type according to the characteristic information of each piece of equipment by using a target key generation algorithm corresponding to the third data type.
22. An information processing apparatus for secure communication, applied to a first security domain in a terminal device, comprising:
a first receiving unit configured to receive a secure channel establishment request from a target application on the terminal device, the establishment request including a domain identification of a second secure domain;
a sending unit configured to send algorithm information to the second security domain in response to the establishment request, the algorithm information including algorithm identifications of a plurality of encryption and decryption algorithms supported by the target application, the plurality of encryption and decryption algorithms corresponding to a plurality of algorithm types required by a secure channel;
a second receiving unit configured to receive an encryption policy from the second security domain, the encryption policy showing algorithm identifications of a plurality of target algorithms, and the plurality of target algorithms being respectively specified with data types for encryption and decryption, wherein the plurality of target algorithms correspond to the plurality of algorithm types and are encryption and decryption algorithms supported by both the target application and the second security domain;
a secure channel initialization unit configured to perform a secure channel initialization operation according to the encryption policy.
23. An information processing apparatus for secure communication, applied to a second security domain, comprising:
the terminal equipment comprises a receiving unit and a processing unit, wherein the receiving unit is configured to receive algorithm information from a first security domain, the algorithm information comprises algorithm identifications of a plurality of encryption and decryption algorithms supported by a target application on the terminal equipment where the first security domain is located, and the encryption and decryption algorithms correspond to a plurality of algorithm types required by a security channel;
a first determining unit configured to determine a plurality of target algorithms according to the encryption and decryption algorithms supported by the second security domain and the algorithm information, wherein the plurality of target algorithms are encryption and decryption algorithms supported by the target application and the second security domain;
a second determining unit configured to determine, among a plurality of data types required for a secure channel, data types respectively used for encryption and decryption by the plurality of target algorithms;
an encryption policy generation unit configured to generate an encryption policy showing algorithm identifications of the plurality of target algorithms and data types corresponding to the plurality of target algorithms;
a sending unit configured to send the encryption policy to the first security domain;
and the secure channel initialization unit is configured to execute secure channel initialization operation according to the encryption strategy.
24. A computer-readable storage medium, on which a computer program is stored, wherein the computer program causes a computer to carry out the method of any one of claims 1-21, when the computer program is carried out in the computer.
25. A computing device comprising a memory and a processor, wherein the memory has stored therein executable code that when executed by the processor implements the method of any of claims 1-21.
CN202011233403.2A 2020-11-06 2020-11-06 Information processing method and device for secure communication Active CN112351037B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202011233403.2A CN112351037B (en) 2020-11-06 2020-11-06 Information processing method and device for secure communication

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202011233403.2A CN112351037B (en) 2020-11-06 2020-11-06 Information processing method and device for secure communication

Publications (2)

Publication Number Publication Date
CN112351037A CN112351037A (en) 2021-02-09
CN112351037B true CN112351037B (en) 2022-12-30

Family

ID=74429338

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202011233403.2A Active CN112351037B (en) 2020-11-06 2020-11-06 Information processing method and device for secure communication

Country Status (1)

Country Link
CN (1) CN112351037B (en)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113556735B (en) * 2021-07-09 2024-05-03 深圳市高德信通信股份有限公司 Data encryption method
US20230099755A1 (en) * 2021-09-24 2023-03-30 Sap Se Sql extension to key transfer system with authenticity, confidentiality, and integrity
CN113806725B (en) * 2021-11-17 2022-02-25 北京翰凌科技有限公司 Financial business data cloud interaction method
CN115118419B (en) * 2022-08-25 2022-12-20 广州万协通信息技术有限公司 Data transmission method of security chip, security chip device, equipment and medium
CN116827691B (en) * 2023-08-29 2024-02-02 紫光同芯微电子有限公司 Method and system for data transmission

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7277542B2 (en) * 2000-09-25 2007-10-02 Broadcom Corporation Stream cipher encryption application accelerator and methods thereof
US20020078342A1 (en) * 2000-09-25 2002-06-20 Broadcom Corporation E-commerce security processor alignment logic
CN105515757B (en) * 2014-09-22 2018-09-21 中国银联股份有限公司 Security information exchange device based on credible performing environment
CN104579627B (en) * 2014-12-06 2018-06-05 上海移远通信技术股份有限公司 A kind of data ciphering method and system
CN104486352A (en) * 2014-12-24 2015-04-01 大唐移动通信设备有限公司 Security algorithm sending method, security authorization method and security authorization device
CN105069362B (en) * 2015-06-30 2018-04-20 广东轩辕网络科技股份有限公司 A kind of storage method and device
CN106452776A (en) * 2015-08-12 2017-02-22 航天信息股份有限公司 Data encryption method
CN105790938B (en) * 2016-05-23 2019-02-19 中国银联股份有限公司 Safe unit key generation system and method based on credible performing environment
WO2018113130A1 (en) * 2016-12-22 2018-06-28 华为技术有限公司 Application program authorization method, terminal, and server
CN108242997B (en) * 2016-12-26 2020-12-22 联芯科技有限公司 Method and apparatus for secure communication
CN107426174B (en) * 2017-06-09 2019-12-24 武汉果核科技有限公司 Access control method of trusted execution environment
CN110768787B (en) * 2018-07-27 2022-12-13 中国移动通信集团吉林有限公司 Data encryption and decryption method and device
CN111586345B (en) * 2019-02-19 2022-04-05 杭州海康威视数字技术股份有限公司 Characteristic data protection method and device applied to monitoring camera
CN110912920A (en) * 2019-12-03 2020-03-24 望海康信(北京)科技股份公司 Data processing method, apparatus and medium
CN110995414B (en) * 2019-12-23 2023-08-11 中金金融认证中心有限公司 Method for establishing channel in TLS1_3 protocol based on cryptographic algorithm

Also Published As

Publication number Publication date
CN112351037A (en) 2021-02-09

Similar Documents

Publication Publication Date Title
US11757662B2 (en) Confidential authentication and provisioning
CN109309565B (en) Security authentication method and device
CN107040369B (en) Data transmission method, device and system
CN112351037B (en) Information processing method and device for secure communication
CN101090316B (en) Identify authorization method between storage card and terminal equipment at off-line state
CN110519046B (en) Quantum communication service station key negotiation method and system based on one-time asymmetric key pair and QKD
US20060195402A1 (en) Secure data transmission using undiscoverable or black data
CN111614621B (en) Internet of things communication method and system
CN108809633B (en) Identity authentication method, device and system
KR101531662B1 (en) Method and system for mutual authentication between client and server
CN110380859B (en) Quantum communication service station identity authentication method and system based on asymmetric key pool pair and DH protocol
CN110784305B (en) Single sign-on authentication method based on careless pseudorandom function and signcryption
CN116388995A (en) Lightweight smart grid authentication method based on PUF
US11570008B2 (en) Pseudonym credential configuration method and apparatus
CN116633530A (en) Quantum key transmission method, device and system
CN110572257B (en) Identity-based data source identification method and system
KR100883442B1 (en) Method of delivering direct proof private keys to devices using an on-line service
EP3185504A1 (en) Security management system for securing a communication between a remote server and an electronic device
CN113592484A (en) Account cubing method, system and device
EP3361670B1 (en) Multi-ttp-based method and device for verifying validity of identity of entity
CN117278330B (en) Lightweight networking and secure communication method for electric power Internet of things equipment network
CN110225011B (en) Authentication method and device for user node and computer readable storage medium
CN114567425A (en) Internet of things communication method and system, SoC Sim and Internet of things terminal

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
REG Reference to a national code

Ref country code: HK

Ref legal event code: DE

Ref document number: 40045503

Country of ref document: HK

GR01 Patent grant
GR01 Patent grant