TWI549468B - Information transmission protection system and its signature key security transmission method and confidential data encryption transmission method - Google Patents

Description

Information transmission protection system and its signature key security transmission method and confidential data encryption transmission method

The invention relates to an information transmission protection system and method, in particular to an information transmission protection and a signature key security transmission method thereof and a confidential data encryption transmission method.

In recent years, the construction of the cloud has increased. Hundreds of devices in each enterprise use their own encryption protocols. However, the biggest obstacle to the inconvenience of encryption technology is that enterprises are afraid that the data encrypted by different protocols will be lost or difficult. Restore, so a set of key management system is needed for unified control. Key management is very important in the data management process, and the security and convenience of the key will directly affect the client's willingness to use.

The Key Management Interoperability Protocol (KMIP) is a corporate key management standard proposed in 2010. It defines the communication protocol for the client and the key management server. It hopes to simplify data encryption and protection through the same agreement. . In addition, as the self-awareness of personal protection is becoming more and more popular, how to trust the client to believe in the security of data transmission and then willing to use it is also a major issue today.

In view of the above problems of the prior art, the object of the present invention is to provide an information transmission protection system, a signature key transmission method thereof and a confidential data encryption transmission method, and use KMIP components to dominate the unified action of the key agreement. , including output, use and abolition, and transfer the confidential information before and after the signature through the Sign Gateway, and use the security device to encrypt and decrypt the confidential information and signature key, and sign the seal The key is stored in the KMIP database in cipher text, so that the client can execute the hardware security device (HSM) in addition to the main control right of the data and the key, which ensures the HSM. The security of the internal operation, the server and the database of the process are not known.

According to the purpose of the present invention, a method for secure transmission of a signature key is provided, which comprises the steps of: requesting a signature key to a signature communication gate via a client; and managing communication with a key via a signature communication gate The protocol server requires a corresponding signature key to be signed, so that the key management interworking protocol server obtains the encrypted signature key from a key management interworking agreement database; the key agreement is managed via the key management protocol. The server transmits the encrypted signature key to a key management interworking agreement security device; decrypts the encrypted signature key through the key management mutual agreement security device and encrypts it into a re-encrypted signature key And transmitting the re-encrypted signature key to the signature gateway through the key management interworking protocol server; and transmitting the re-encrypted signature key to a signature security device via the signature gateway The re-encrypted signature key is decrypted by the signature security device, and the request confirmation message is sent back to the client via the signature gateway.

Preferably, the signature key secure transmission method of the present invention further comprises the following steps: the signature gateway is authenticated by a dynamic password server.

Preferably, the key management interworking agreement security device encrypts the signature key with the primary key into an encrypted signature key, and then deposits it into the key management interworking protocol through the key management mutual agreement server. The database, and the key management interworking protocol server obtains the encrypted signature key from the key management interworking agreement database, and the key certificate is encrypted by the key management interoperability agreement security key with the primary key. Decrypt.

Preferably, after the key management mutual security protocol decrypts the encrypted signature key with the primary key, the signature key is encrypted again by the symmetric key to become the re-encrypted signature key.

Preferably, the signature security decrypts the re-encrypted signature key with a symmetric key.

According to the purpose of the present invention, a confidential data encryption transmission method is further provided, which comprises the following steps: after the client described in the above-mentioned signature key secure transmission method receives the demand confirmation message, the client initiates a The key encrypts a confidential data into one encrypted secret data, and encrypts the encrypted secret data with its own public key, encrypts it with the public key provided by the signature security device, and encrypts the secret confidential data. To the signature communication gate; the re-encrypted confidential information is transmitted to the signature security device via the signature communication gate, and all the public keys attached to the re-encrypted confidential information are decrypted according to the private key of the signature by the signature security device, and are retained once. Encrypt the confidential information, the signature security device then attaches the symmetric key to the encrypted confidential information, and encrypts the encrypted confidential information twice with the public key provided by the client into a second encrypted secret data; The security device transmits the secret data encrypted by the second encryption to the client through the signature communication gate, so that the client decrypts the confidential information of the second encryption with its own private key, and obtains the attached symmetric key, and then starts the gold. The key is unlocked and the identity of the signature is confirmed by the content of the confidential information; the activation key with the symmetric key is transmitted to the signature security device through the signature gateway through the client to pass the signature The security device obtains the activation key according to the symmetric key unlocking, and then unlocks the encrypted confidential information with the activation key to obtain the confidential information, and uses the signature key to sign the confidential information as a signed confidential information; And the signed confidential information is transmitted back to the client through the signature gateway via the signature security device.

According to the purpose of the present invention, an information transmission protection system is further provided, comprising: a key management mutual agreement security device, which encrypts a signature key into an encrypted signature key or the encrypted signature The key is decrypted as the signature key, and the signature key is encrypted into a re-encrypted signature key; a key management interworking agreement database is used to store the encrypted signature key; a secret security device for decrypting the re-encrypted signature key; a key management interworking protocol server, a connection key management mutual agreement database and a key management interworking agreement security device; and a signature communication The gate is connected to the signature security device and the key management interworking protocol server. When the signature communication gate receives the request of the signature key issued by the client, it requests a corresponding signature from the key management interworking protocol server. When the key is signed, the key management mutual agreement server obtains the encrypted signature key from the key management mutual agreement database, and transmits the obtained encrypted signature key to the key management. Interoperability The security device is decrypted by the key management secret security device, and then the encrypted signature key is decrypted and then encrypted into a re-encrypted signature key, and the re-encrypted signature key is communicated through the key management. The agreement server is transmitted back to the signature communication gate, and then the re-encrypted signature key is transmitted to the signature security device by the signature communication gate to decrypt the re-encrypted signature key through the signature security device, and then The request confirmation message is sent back to the client via the signature gateway.

Preferably, in the information transmission protection system of the present invention, after the client receives the demand confirmation message, the client encrypts a confidential data according to a startup key to encrypt the confidential information, and attaches the public key. The public key encryption provided by the signature security device is added Confidential confidential information, and then re-encrypted confidential information is transmitted to the signature security device through the signature gateway, to unlock all public keys attached to the re-encrypted confidential information according to the private key of the signature, and retain After encrypting the confidential information once, the signature security device then attaches the symmetric key to the encrypted secret data, and encrypts the encrypted confidential information twice with the public key provided by the client into the secondary encrypted secret data. The signature communication gate transmits the secret data encrypted by the second encryption to the client, so that the client unlocks the secret data of the second encryption with its own private key, and obtains the attached symmetric key, and then unlocks the activation key. Encrypt confidential information once to obtain confidential information, and then confirm the identity of the signature security device with the contents of the confidential information, and then use the signature gateway to encrypt the activation key with the symmetric key and pass it to the signature security device to pass the signature. The chapter security device obtains the activation key according to the symmetric key unlocking, and then unlocks the confidential information with the activation key, and signs the confidential information with the signature key, and then signs the communication. The signature by the confidential information back to the client.

Preferably, the information transmission protection system of the present invention further comprises a dynamic password server, which is connected to the signature communication gate, so that the signature communication gate can be authenticated through the dynamic password server.

According to the above description, the information transmission protection system and the signature key transmission method thereof and the confidential data encryption transmission method according to the invention have one or more of the following characteristics:

1. The encrypted data transmission of the present invention is sent in the first time by means of two layers of encryption, and the decrypted activation key is encrypted and sent by the second session with a symmetric key, and the important information is transmitted separately. Can reduce the chances that the message will be restored.

2. The signature key secure transmission of the present invention is mainly composed of a key management interworking agreement, and is characterized in that it can perform unified management of keys for encryption devices of different protocols, and leads the life cycle and transmission process of the key.

3. The signature key secure transmission system of the present invention uses two security devices to perform the conversion and decryption of the encryption key of the signature key, and the plaintext of the signature key is only restored in the security device. Both the database and the transfer process exist in ciphertext. The use of a security device ensures that confidential information and signature keys are not unauthorizedly removed during encryption and decryption and subsequent signatures.

1‧‧‧Signature communication gate

2‧‧‧Signature Security

3‧‧‧Key Management Interworking Agreement Server

4‧‧‧Key Management Interoperability Agreement Database

5‧‧‧Key Management Interoperability Agreement Security

6‧‧‧Dynamic password server

100‧‧‧Client

S11~S15, S21~S25‧‧‧ steps

Figure 1 is a schematic diagram of the information transmission protection system of the present invention.

Figure 2 is a flow chart of the method for securely transmitting a signature key of the present invention.

Figure 3 is a flow chart of the method for encrypting and transmitting confidential data of the present invention.

The technical features, contents, and advantages of the present invention, as well as the advantages thereof, can be understood by the present inventors, and the present invention will be described in detail with reference to the accompanying drawings. The subject matter is only for the purpose of illustration and description. It is not intended to be a true proportion and precise configuration after the implementation of the present invention. Therefore, the scope and configuration relationship of the attached drawings should not be interpreted or limited. First described.

Please refer to FIG. 1 , which is a schematic diagram of the information transmission protection system of the present invention. In the figure, the information transmission protection system of the present invention comprises a signature gateway (Sign Gateway) 1, a signature security (Sign HSM) 2, a key management interworking protocol server (KMIP Server) 3, a key. Management Interchange Agreement Database (KMIP Database) 4, a Key Management Interworking Agreement Security (KMIP HSM) 5 and a One-Time Password Server (OTP Server) 6, Signature Communication Gate 1 Connection Sign The chapter security device 2, the key management interworking protocol server 3 and the dynamic cryptographic server 6, the key management interworking protocol server 3 is connected to the key management interworking agreement database 4 and the key management interworking agreement security device 5.

The information transmission protection system can execute two parts, one is the signature key security transmission part: when the signature communication gate 1 receives the request of the signature key issued by the client 100, the signature communication gate 1 transmits The dynamic cryptographic server 6 performs authentication to request a key signature to the key management interworking server 3 for signature, and the key management interworking protocol server 3 manages the interworking agreement data from the key management protocol. The encrypted signature key is obtained in the library 4, and the obtained encrypted signature key is transmitted to the key management interworking agreement security device 5, and then the encrypted signature is issued by the key management interworking agreement security device 5. The key is decrypted and then encrypted to become a re-encrypted signature key, and the re-encrypted signature key is transmitted back to the signature communication gate 1 through the key management interworking protocol server 3, and then the signature communication gate 1 transmitting the re-encrypted signature key to the signature security device 2, decrypting the re-encrypted signature key through the signature security device 2, and transmitting the request confirmation message via the signature communication gate 1 to Client 100. The key management interworking agreement security device 5 encrypts the signature key with the master key in advance to become the encrypted signature key. Then, the key agreement management server 3 is stored in the key management interworking protocol database 4, and the key management interworking agreement server 3 obtains the encrypted signature key from the key management interworking agreement database 4. The key management key 5 is used to decrypt the encrypted signature key with the primary key, and then the signature key is encrypted again by the symmetric key to become the re-encrypted signature. Key. The signature security device 2 decrypts the re-encrypted signature key with a symmetric key.

The second is the confidential data encryption transmission part: when the security execution part of the signature key is completed, and the client 100 receives the demand confirmation message, the client 100 will perform a confidential data according to an activation key (Activation Key). Encryption encrypts the confidential information once, and encrypts the encrypted confidential information with its own public key, encrypts it with the public key provided by the signature security device, and then encrypts the encrypted confidential information through the signature communication gate 1. To the signature security device 2, through the signature security device 2, according to its private key, unlock all public keys attached to the re-encrypted confidential information, and retain the encrypted confidential information once, and the signature security device 2 attaches the symmetric key. The encrypted secret data is encrypted once, and the encrypted secret data is secondarily encrypted into the secondary encrypted secret data by the public key provided by the client 100, and then the secondary encrypted secret data is transmitted back through the signature communication gate 1. To the client 100, so that the client 100 unlocks the secret data of the second encryption with its own private key, and obtains the attached symmetric key, and then unlocks the secret data with the activation key, and then The content of the confidential information confirms the identity of the signature security device 2, and then transmits the activation key with the symmetric key to the signature security device 2 through the signature communication gate 1 to solve the symmetric key by the signature security device 2 Open the activation key, and then use the activation key to unlock the encrypted confidential information to obtain the confidential information, and sign the confidential information with the signature key as the signed confidential information, and then pass the signature communication gate 1 The signed confidential information is transmitted back to the client 100.

The information transmission process of the present invention will be briefly described below through an embodiment. First, the secure transfer of the signature key (set to Pvk) is performed, and the client 100 proposes the signature key Pvk to the signature gateway 1. Next, the signature gateway 1 verifies the identity through the dynamic password server 6. The signature communication gate 1 then requests a corresponding signature key Pvk to sign the certificate to the key management interworking protocol server 3. Then, the key management interworking agreement server 3 extracts the corresponding encrypted signature key (set to {(Pvk) MK...}) to the key management interworking agreement database 4. Among them, the signature key Pvk has been encrypted by the key management key security device 5 with the main key (set to MK). Put it in the Key Management Interoperability Agreement Database 4. Next, the key management interworking agreement database 4 transmits the encrypted signature key {(Pvk) MK...} to the key management interworking agreement security device 5 through the key management interworking agreement server 3, by the key The management interworking agreement security device 5 uses the primary key MK to unlock the encrypted signature key {(Pvk) MK...}, and then uses the symmetric key (set to SK2) to encrypt the signature key into {( Pvk)SK2...} (re-encrypted signature key), and then passed back to the signature communication gate 1 through the key management interworking protocol server 3. Among them, the symmetric key SK2 key management interworking agreement security device 5 and the signature security device 2 are agreed in advance. Then, the signature key 1 (Pvk) SK2...} which is re-encrypted is transmitted to the signature security device 2 by the signature communication gate 1, and is unlocked by the signature security device 2 with the symmetric key SK2. The encrypted signature key {(Pvk)SK2...}, and then obtain the plaintext of the signature key Pvk, and the signature security device 2 will notify the client 100 that the request is confirmed by the signature communication gate 1 Good signature key Pvk. After the signature security device 2 and the key management interworking agreement database 4 complete the transmission of the signature key Pvk, the signature security device 2 obtains the plaintext of the signature key Pvk, and can notify the client through the signature communication gate 1. 100 is ready to transmit the data to be signed, and thus, the encrypted transmission of the confidential data (set to Secret Data) can be performed, and the client 100 encrypts the confidential data Secret Data with the activation key (set to AK) into {(Secret Data) AK. ...} (ie encrypting confidential information once), and attaching the client's own public key (set to Cpub), and then attaching itself with the public key provided by the signature security 2 (set to Kpub) The public key's encrypted data (Secret Data) AK, Cpub...) is packaged into {((Secret Data)AK, Cpub...)Kpub} (that is, the re-encrypted confidential information) and transmitted to the signature communication. Gate 1. Next, the signature communication gate 1 transmits the re-encrypted confidential information {((Secret Data) AK, Cpub...) Kpub} to the signature security device 2 to pass the signature security device 2 according to its private key (set Unlock {((Secret Data)AK, Cpub...)Kpub} for Kpvk) (re-encrypted confidential information attached to its own public key), and retain confidential information encrypted only by the activation key AK {(Secret) Data) AK...} (that is, encrypting confidential information once), and the signature security device 2 attaches the symmetric key (set to SK1) to the encrypted secret data {(Secret Data) AK...}, and then uses the client. The public key Cpub of the terminal 100 re-encrypts the confidential data Secret Data to become {((Secret Data) AK, SK1...) Cpub} (ie, the secret information of the secondary encryption). Then, the signature security device 2 transmits the secondary encrypted secret information {((Secret Data) AK, SK1...) Cpub} to the client 100 through the signature communication gate 1, and the client 100 takes its own privacy. The key (set to Cpvk) unlocks the secondary encrypted secret data {((Secret Data) AK, SK1...) Cpub} to obtain the symmetric key SK1, and the client 100 uses the activation key AK to unlock the secret data. Secret Data, the comparison After the confidential information of Secret Data, the identity of the signature security device 2 can be determined. Furthermore, the client 100 transmits the activation key {(AK)SK1} with the symmetric key SK1 to the signature security device 2 via the signature communication gate 1, and the signature security device 2 transmits the symmetric key SK1. Unlock {(AK)SK1} to get the start key AK. Subsequently, the signature security device 2 can unlock the encrypted secret information {(Secret Data) AK} through the activation key AK, and obtain the value of the confidential data Secret Data, and then use the signature key Pvk to secret data Secret Data Make a signature as a confidential information that has been signed. Finally, the signature security device 2 transmits the signed confidential data Secret Data to the client 100 through the signature gateway 1 and ends all process work.

Please refer to FIG. 2, which is a flowchart of the method for securely transmitting a signature key of the present invention, and the process steps are as follows:

Step S11: requesting a signature key to a signature communication gate via a client.

Step S12: requesting a signature key to the signature management gateway through a signature gateway to obtain a signature key, so that the key management interworking protocol server obtains from a key management interworking agreement database Encrypted signature key. Wherein, before the signature communication gate requests the signature key from the key management mutual agreement server, the signature communication gate first authenticates through a dynamic password server.

Step S13: The encrypted signature key is transmitted to a key management interworking agreement security device via the key management interworking protocol server.

Step S14: decrypting the encrypted signature key through the key management interworking secret security device and then encrypting it into a re-encrypted signature key, and passing the re-encrypted signature key through the key management interworking agreement The server is passed to the signature gateway.

Step S15: transmitting the re-encrypted signature key to a signature security device via the signature communication gate to decrypt the re-encrypted signature key through the signature security device, and then returning the request through the signature communication gate Confirm the message to the client.

In the above, the key management mutual agreement security device encrypts the signature key with the primary key to become the encrypted signature key, and then deposits the information to the key management agreement through the key management mutual agreement server. The library, and the key management interworking protocol server obtains the encrypted signature key from the key management interworking agreement database, and is managed by the key management interworking agreement security device. The encrypted signature key is decrypted with the primary key, and the signature key is again encrypted with the symmetric key to become the re-encrypted signature key. The signature security decrypts the re-encrypted signature key with a symmetric key.

Please refer to FIG. 3 , which is a flowchart of a method for encrypting and transmitting confidential data according to the present invention. The process steps are as follows:

Step S21: After receiving the requirement confirmation message, the client described in the above-mentioned signature key secure transmission method encrypts a confidential data into a encrypted confidential data according to a startup key, and encrypts once. The confidential information is encrypted with the public key provided by the signature security device and then encrypted with the public key provided by the signature security device, and the encrypted information is transmitted to the signature communication gate.

Step S22: transmitting the re-encrypted confidential information to the signature security device via the signature communication gate, so as to unlock all the public keys attached to the re-encrypted confidential information according to the private key of the signature, and retain the encrypted confidential information once. The signature security device then attaches the symmetric key to the encrypted secret data, and encrypts the encrypted confidential information to the secondary encrypted secret data by using the public key provided by the client.

Step S23: The secondary encrypted secret data is transmitted back to the client through the signature gateway via the signature security device, so that the client unlocks the second encrypted confidential information with its own private key and obtains the attached symmetric key. Then, use the activation key to unlock the confidential information, and then confirm the identity of the signature security device with the contents of the confidential information.

Step S24: The activation key with the symmetric key is transmitted to the signature security device through the signature gateway through the client, and the activation key is obtained by the signature security device according to the symmetric key, and then the activation key is obtained. The key unlocks the encrypted confidential information to obtain the confidential information, and uses the signature key to sign the confidential information as the signed confidential information.

Step S25: The signed confidential information is transmitted back to the client through the signature gateway via the signature security device.

In summary, the present invention is in the secure transmission portion of the signature key, which allows the client to request that the signature key be securely transferred from the backend repository to the signature security. The two keys (HSMs) are used to store the primary key and the symmetric key of the protection signature key, and the two HSMs are the signature security device and the key management interworking agreement security device. The signature security device is signed Controlled by the gatekeeper; the Key Management Interoperability Agreement is controlled by the Key Management Interworking Agreement Server, and the signature key is restored only in the HSM. The other transmission processes and storage are respectively symmetric keys and The main key is encrypted. Therefore, during the transmission process, the signature gateway and the key management interworking protocol server dominate the key transfer action, but they cannot unlock the signature key. The signature key in the database is also stored in the ciphertext type encrypted by the main key, which improves the security of the signature key in the server and the database. In addition, through the operation of the key management interworking agreement master key, the encryption devices of various protocols can be uniformly controlled, thus simplifying the encryption process without affecting the security of the key. In the encrypted transmission part of the confidential data of the present invention, the client can safely transmit the confidential information to the signature security device for signature and postback. The confidential information to be signed is encrypted by the client's activation key, and then encrypted with the public key of the signature security. The activation key can be encrypted back to the signature by the symmetric key transmitted by the signature security. To unlock the secret data. Double-layer encryption is used to distribute the data. Therefore, even if the confidential information is transmitted through the signature gateway, the signature communication gate cannot know the contents of the confidential information. At the same time, after the data enters the security device, the security device also ensures the security of the data operation.

The above is intended to be illustrative only and not limiting. Any equivalent modifications or alterations to the spirit and scope of the invention are intended to be included in the scope of the appended claims.

1‧‧‧Signature communication gate

2‧‧‧Signature Security

3‧‧‧Key Management Interworking Agreement Server

4‧‧‧Key Management Interoperability Agreement Database

5‧‧‧Key Management Interoperability Agreement Security

6‧‧‧Dynamic password server

100‧‧‧Client

Claims (12)

A signature key secure transmission method includes the following steps: a request for a signature key to a signature gate via a client; and a request for a key management interworking protocol server via the signature gateway Signing the corresponding signature key to enable the key management interworking protocol server to obtain an encrypted signature key from a key management interworking agreement database; the interworking protocol server will be managed via the key The encrypted signature key is transmitted to a key management interworking agreement security device; the encrypted signature key is decrypted by the key management interworking secret security device and then encrypted to become a re-encrypted signature gold Key, and transmitting the re-encrypted signature key to the signature gateway through the key management interworking protocol server; and transmitting the re-encrypted signature key to a sign via the signature gateway The security device decrypts the re-encrypted signature key through the signature security device, and then sends a request confirmation message to the client via the signature gateway. For example, the method for securely transmitting a signature key according to claim 1 of the patent scope further includes the following steps: the signature gateway is authenticated by a dynamic password server. The method for securely transmitting a signature key according to claim 1, wherein the key management interworking agreement security device encrypts the signature key with a primary key to become the encrypted signature key. And storing, by the key management interworking protocol server, the key management mutual agreement database, and the key management interworking agreement server obtains the encrypted signature key from the key management interworking agreement database And decrypting the encrypted signature key with the primary key by the key management interworking agreement security. For example, the method for securely transmitting a signature key according to item 3 of the patent application scope, wherein the key management interworking agreement security device decrypts the encrypted signature key with the primary key, and then uses a symmetric key to The signature key is encrypted to become the re-encrypted signature key. For example, the signature key secure transmission method of claim 4, wherein the signature security decrypts the re-encrypted signature key with the symmetric key. A confidential data encryption transmission method, comprising the following steps: when the client receives the requirement confirmation message as described in the signature key secure transmission method of claim 1 of the patent application, the client initiates the activation according to the client The key will be a confidential data Encrypting is to encrypt the confidential information once, and attaching the encrypted secret data to its own public key and encrypting it with the public key provided by the signature security device into the encrypted data, and then transmitting the re-encrypted confidential information to the Signing a communication gate; transmitting the re-encrypted confidential information to the signature security device via the signature gateway to decrypt all the public information attached to the re-encrypted confidential information by the signature security device according to a private key Key, and retaining the encrypted confidential information once, the signature security device then attaches a symmetric key to the one-time encrypted confidential data, and performs secondary encryption on the encrypted encrypted secret data with the public key provided by the client. a confidential information that is encrypted twice; the secret encrypted data is transmitted back to the client through the signature gateway via the signature security device, so that the client unlocks the second private key After encrypting the confidential information, obtaining the attached symmetric key, and then unlocking the confidential information by using the activation key, and confirming the identity of the signature security device by the content of the confidential information; Transmitting the activation key with the symmetric key to the signature security device through the signature gateway to obtain the activation key according to the signature key, and then starting the activation key The key unlocks the encrypted confidential information to obtain the confidential information, and uses the signature key to sign the confidential information as a signed confidential information; and the signature is signed by the signature security device. The confidential information is transmitted back to the client through the signature gateway. An information transmission protection system comprising: a key management mutual agreement security device, encrypting a signature key into an encrypted signature key or decrypting the encrypted signature key into the signature gold Key, and encrypting the signature key into a re-encrypted signature key; a key management interworking agreement database for storing the encrypted signature key; a signature security device for Decrypting the re-encrypted signature key; a key management interworking protocol server connecting the key management interworking agreement database and the key management interworking agreement security device; and a signature communication gate connecting the The signature security device and the key management interworking protocol server, when the signature communication gate receives a request for a signature key issued by the client, to request a corresponding signature to the key management interworking protocol server When the key is signed, the key management interworking protocol server obtains the encrypted signature key from the key management interworking agreement database, and The encrypted signature key obtained is transmitted to the key management interworking agreement security device, and then the encrypted transaction signature key is decrypted by the key management mutual agreement security device and then encrypted to be a re-encrypted signature. Key, and the re-encrypted signature key is transmitted back to the signature gateway through the key management interworking protocol server, and then the re-encrypted signature key is transmitted by the signature gateway to The signature security device decrypts the re-encrypted signature key through the signature security device, and transmits a demand confirmation message to the client via the signature communication gateway. The information transmission protection system of claim 7, wherein when the client receives the requirement confirmation message, the client encrypts a confidential data into an encrypted confidential information according to a startup key, and After attaching a self-public key, the public key provided by the signature security device is used to encrypt the encrypted data, and the re-encrypted confidential information is transmitted to the signature security device through the signature gateway to transmit the public key. The signature security device unlocks all the public keys attached to the re-encrypted confidential information according to a private key, and retains the encrypted confidential information, and the signature security device then attaches a symmetric key to the one-time encrypted confidential information. And encrypting the once encrypted secret data into a second encrypted secret data by using the public key provided by the client, and transmitting the second encrypted confidential information to the client through the signature gateway End, so that the client unlocks the secondary encrypted secret data with a self-private key, obtains the attached symmetric key, and then unlocks the encrypted confidential information by using the activation key. Obtaining the confidential information, and confirming the identity of the signature security device with the content of the confidential information, and then encrypting the activation key with the symmetric key through the signature communication gate and transmitting the activation key to the signature security device, The activation key is obtained by the signature security device according to the symmetry key, and the encrypted secret information is unlocked by the activation key, and the confidential information is signed and signed by the signature key. The signature communication gate returns the signed confidential information to the client. For example, the information transmission protection system of claim 7 further includes a dynamic password server, which is connected to the signature communication gate, so that the signature communication gate can be authenticated through the dynamic password server. For example, in the information transmission protection system of claim 7, wherein the key management interworking agreement security device encrypts the signature key with a primary key to become the encrypted signature key, and then transmits The key management interworking agreement server is stored in the key management interworking agreement database, and the key management interworking agreement server obtains the encrypted signature key from the key management interworking agreement database, The key management interworking agreement security device uses the primary key to The encrypted signature key is decrypted. For example, in the information transmission protection system of claim 10, wherein the key management mutual agreement security device decrypts the encrypted signature key with the primary key, and then signs the signature again with a symmetric key. The key is encrypted to become the re-encrypted signature key. The information transmission protection system of claim 11, wherein the signature security decrypts the re-encrypted signature key with the symmetric key.