WO2021120683A1

WO2021120683A1 - Method and apparatus for secure communication based on identity authentication

Info

Publication number: WO2021120683A1
Application number: PCT/CN2020/111938
Authority: WO
Inventors: 马青龙; 孙健; 张炳康; 夏繁; 丁健文
Original assignee: 苏宁云计算有限公司
Priority date: 2019-12-16
Filing date: 2020-08-28
Publication date: 2021-06-24
Also published as: CA3164765A1; CN110881048B; CN110881048A

Abstract

Disclosed in the present invention are a method and an apparatus for secure communication based on identity authentication; by means of mandatory authentication of an electronic seal of both parties, the identity information of both communicating parties can be flexibly and efficiently verified without needing to apply for a digital certificate from a CA, ensuring the security of the communication data. The method comprises: a request node and a response node each make a respective electronic seal; the request node and the response node mutually report fingerprint information in the electronic seal of the opposite party; the request node uses a random factor to encrypt plaintext data to generate ciphertext data, uses a public key of the electronic seal of the opposite party to encrypt the random factor to obtain a communication key, and then packages the ciphertext data, the communication key, and the fingerprint information and sends same to the response node; the response node compares the fingerprint information in the file packet with the reported fingerprint information and, once the comparison is successful, decrypts the encrypted private key of the electronic seal belonging to the response node, decrypts the communication key by means of the private key to restore the random factor, and then parses the ciphertext data to obtain the plaintext data.

Description

Safety communication method and device based on identity authentication

Technical field

The present invention relates to the technical field of communication security, in particular to a method and device for secure communication based on identity authentication.

Background technique

In order to ensure communication security, the two nodes of the business system need to carry out security design during data communication to identify and verify the identity of the other party. Traditional security solutions mostly use digital certificates + TLS (Transport Layer Security). Protocol) mechanism to meet the needs of identification and secure communication. In the aspect of identity recognition, the existing technology adopts the scheme of adding the initiator’s identity information (such as the identity code) in the message, and the receiver, after obtaining the identity information, verifies the legitimacy of the other party’s identity by checking the database; the existing technology in terms of security A scheme for exchanging and storing pre-appointed encryption and decryption algorithms, signature algorithms, and keys to support the encryption, decryption, and signature verification needs during message transmission.

In addition, when the digital certificate + TLS mechanism is adopted, it is necessary to apply for a digital certificate from a CA (Certificate Authority), which brings great inconvenience to the construction of secure data communication in fast application scenarios, and lacks application flexibility. The TLS communication protocol requires multi-step negotiation before sending the ciphertext. It is too cumbersome and unsuitable in general application scenarios. Instead, the encryption and decryption algorithms, signature algorithms, keys and other important information are exchanged and stored persistently. In both systems, there is a certain degree of management risk.

Summary of the invention

The purpose of the present invention is to provide a secure communication method and device based on identity authentication. By compulsory authentication of the electronic seals of both parties, it is possible to flexibly and efficiently verify the identity information of the communicating parties without applying for a digital certificate from the CA organization. , And then ensure the security of communication data.

In order to achieve the above objective, one aspect of the present invention provides a secure communication method based on identity authentication, including:

The requesting node and the responding node respectively make their own electronic seals, and the electronic seals include a verification area composed of a signature algorithm, signature information, encryption algorithm, fingerprint information, digest algorithm, public key, and encrypted private key;

The requesting node and the responding node report each other's fingerprint information in the electronic seal of the other party, which is used to compare each other's fingerprint information with the reported fingerprint information after the two parties exchange electronic seals to verify their identity;

After the two nodes pass the identity verification, the requesting node encrypts the plaintext data with a random factor to generate ciphertext data, and encrypts the random factor with the public key of the electronic seal of the responding node to obtain the communication key. Then, the ciphertext data, The communication key and the fingerprint information in the electronic seal of the requesting node are packaged and sent to the responding node;

The responding node compares the fingerprint information in the file package with the reported fingerprint information, and after the comparison is successful, decrypts the encrypted private key of the electronic seal to which the responding node belongs, and decrypts the communication key in the file package with the private key to restore the random factor, The random factor is then used to parse the ciphertext data to obtain plaintext data.

Preferably, the method of making respective electronic seals by the requesting node and the responding node respectively includes:

Design the partition of the electronic seal, which includes a header area, a seal information area, and a tail area in addition to the verification area;

The request node and the response node are based on the partition structure of the electronic seal, and the start tag, identification code and version number are filled into the header area correspondingly, and the chapter holder number, chapter holder name, issuing organization number, issuing organization name, and validity period are correspondingly filled. Fill in the seal information area, fill the description information and the end marker into the tail area correspondingly, and fill the signature algorithm, signature information, encryption algorithm, fingerprint information, digest algorithm, public key, and encryption private key into the verification area correspondingly.

Preferably, the method for generating the public key and the encrypted private key includes:

Randomly generate a pair of public key and private key according to the signature algorithm in the electronic seal;

Based on the seal password PIN preset by the requesting node, encrypt the private key to generate the encrypted private key of the electronic seal of the requesting node; and,

Based on the seal password PIN preset by the responding node, encrypt the private key to generate the encrypted private key of the electronic seal of the responding node.

Optionally, the method for generating fingerprint information includes:

Perform string splicing on the number of the holder and the name of the holder in the electronic seal, and use the corresponding seal password PIN to encrypt the splicing result of the string to form a cipher text;

Digest the ciphertext using a digest algorithm to obtain a digest string;

The digest string is signed by the private key corresponding to the signature algorithm to obtain the fingerprint information of the electronic seal.

Optionally, the method for generating the signature information includes:

Define the key field bytes in the electronic seal, where the key field bytes are characteristic bytes of the electronic seal;

Digest the key field bytes through a digest algorithm to obtain a key field string;

The key domain character string is signed by the private key corresponding to the signature algorithm to form the signature information of the electronic seal.

Preferably, after the two parties exchange electronic seals, the method for comparing each other's fingerprint information with the reported fingerprint information to verify identity includes:

The requesting node sends the electronic seal to the responding node, so that the responding node can read the signature algorithm, public key, digest algorithm, and signature information of the electronic seal of the requesting node;

The response node reads the key field bytes in the electronic seal to which the requesting node belongs, performs a digest based on the digest algorithm to obtain a digest string, and uses the public key of the signature algorithm to perform verification on the key field bytes;

After the verification is passed, the responding node compares the fingerprint information of the electronic seal of the requesting node with the fingerprint information reported by the requesting node, and authorizes the requesting node to access when the comparison results are consistent;

The responding node sends the electronic seal to the requesting node so that the requesting node can read the signature algorithm, public key, digest algorithm, and signature information of the electronic seal to which the responding node belongs;

The requesting node reads the key field bytes in the electronic seal to which the responding node belongs, performs a digest based on the digest algorithm to obtain a digest string, and uses the public key of the signature algorithm to perform verification on the key field bytes;

After the verification is passed, the requesting node compares the fingerprint information of the electronic seal to which the responding node belongs with the fingerprint information reported by the responding node, and authorizes the responding node to access when the comparison results are consistent.

Preferably, the requesting node uses a random factor to encrypt the plaintext data to generate the ciphertext data, and the public key of the electronic seal of the responding node is used to encrypt the random factor to obtain the communication key, and then the ciphertext data and the communication encryption The method of packaging the key and the fingerprint information in the electronic seal of the requesting node and sending it to the responding node includes:

Request the node to generate a random factor for encrypting the plaintext data to obtain ciphertext data;

The requesting node uses the public key of the electronic seal to which the responding node belongs to encrypt the random factor to generate a communication key;

The requesting node packs and sends the communication key, the ciphertext data and the fingerprint information of the electronic seal to the responding node.

Further, the responding node compares the fingerprint information in the file package with the reported fingerprint information, and after the comparison is successful, decrypts the encrypted private key of the electronic seal to which the responding node belongs, and decrypts the communication key in the file package with the private key to restore the Random factor, and then using the random factor to parse the ciphertext data to obtain plaintext data includes:

The responding node reads the fingerprint information in the file package and compares it with the fingerprint information reported by the requesting node;

After the comparison is passed, the responding node reads the encryption algorithm, signature algorithm, encryption private key and the preset seal password PIN of the electronic seal to which the responding node belongs, and decrypts the private key of the electronic seal to which the responding node belongs;

The random factor is restored by parsing the communication key by the private key, and finally the ciphertext data is parsed by the random factor to obtain plaintext data.

Compared with the prior art, the secure communication method based on identity authentication provided by the present invention has the following beneficial effects:

In the secure communication method based on identity authentication provided by the present invention, the request node and the response section first make their own electronic seal in advance. The electronic seal includes signature algorithm, signature information, encryption algorithm, fingerprint information, digest algorithm, and publicity. After the electronic seal is made, the requesting node and the responding node report each other’s fingerprint information in the other’s electronic seal, which is used for identity verification during the exchange of electronic seals. Only those who have passed both nodes Only by identity verification can data communication be carried out securely. The specific process is as follows: the requesting node uses a random factor to encrypt the plaintext data to generate ciphertext data, and then uses the public key of the responding node’s electronic seal to encrypt the random factor to obtain the communication key. The ciphertext data, the communication key and the fingerprint information used to identify the requesting node are packaged and sent to the responding node. After receiving the file package, the responding node reads the fingerprint information and compares it with the fingerprint information reported by the requesting node , Only after the comparison is passed, can the requesting node be authorized to access the responding node, and then the responding node will call the corresponding encrypted private key, decrypt the encrypted private key and use the plaintext private key to decrypt the communication key to restore the random factor, and finally use Random factors analyze the ciphertext data to obtain plaintext data, and complete the ciphertext transmission of the requesting node to the responding node.

In summary, the present invention is compared with the solutions in the prior art. The two parties negotiate to make an electronic seal, no need to apply for a digital certificate from the CA, which increases the flexibility of application, and can ensure communication through a compulsory electronic seal exchange authentication strategy. The ciphertext will not be stolen by a third person, which improves the security of the communication between the two parties. In addition, the negotiation process of the two parties' keys is cancelled before the data is sent, which increases the convenience of the application.

Another aspect of the present invention provides a secure communication device based on identity authentication, which applies the secure communication method based on identity authentication mentioned in the above technical solution, and the device includes:

The seal making unit is used for making respective electronic seals by the requesting node and the responding node. The electronic seal includes a signature algorithm, signature information, encryption algorithm, fingerprint information, digest algorithm, public key, and encrypted private key. Inspection area

The fingerprint registration unit is used for requesting nodes and responding nodes to report each other's fingerprint information in the electronic seal of the other party, and for comparing each other's fingerprint information with the reported fingerprint information after the two parties exchange electronic seals to verify identity;

The file encryption unit is configured to store the compressed logistics box code message in a storage system, and complete the archiving of the original logistics box code message;

The file decryption unit is used for the responding node to compare the fingerprint information in the file package with the reported fingerprint information, decrypt the encrypted private key of the electronic seal to which the responding node belongs after the comparison is successful, and decrypt the communication key in the file package with the private key Restore the random factor, and then use the random factor to parse the ciphertext data to obtain plaintext data.

Compared with the prior art, the beneficial effects of the security communication device based on identity authentication provided by the present invention are the same as the beneficial effects of the security communication method based on identity authentication provided by the above technical solutions, and will not be repeated here.

A third aspect of the present invention provides a computer-readable storage medium on which a computer program is stored, and the computer program executes the steps of the above-mentioned identity authentication-based secure communication method when the computer program is run by a processor.

Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present invention are the same as those of the secure communication method based on identity authentication provided by the above technical solutions, and will not be repeated here.

Description of the drawings

The drawings described here are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and the description thereof are used to explain the present invention, and do not constitute an improper limitation of the present invention. In the attached picture:

Fig. 1 is a schematic flow chart of a secure communication method based on identity authentication in the first embodiment;

2 is a schematic diagram of the interaction process of the secure communication method based on identity authentication in the first embodiment;

Fig. 3 is a diagram showing an example of the structure of an electronic seal in the first embodiment.

Detailed ways

In order to make the above objectives, features, and advantages of the present invention more obvious and understandable, the technical solutions in the embodiments of the present invention will be described clearly and completely in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

Example one

Referring to Figures 1 to 3, this embodiment provides a secure communication method based on identity authentication, including:

The requesting node and the responding node respectively make their own electronic seals. The electronic seal includes a verification area composed of signature algorithm, signature information, encryption algorithm, fingerprint information, digest algorithm, public key and encrypted private key; request node and response node The fingerprint information in the electronic seal of the other party is reported to each other. After the two parties exchange the electronic seal, the fingerprint information of the other party is extracted and compared with the fingerprint information reported to verify the identity; the node of both parties will be used by the requesting node after the identity verification is passed. The random factor encrypts the plaintext data to generate ciphertext data, and uses the public key of the electronic seal of the responding node to encrypt the random factor to obtain the communication key, and then package the ciphertext data, the communication key and the fingerprint information in the electronic seal of the requesting node to the response Node; the responding node compares the fingerprint information in the file package with the reported fingerprint information, and after the comparison is successful, decrypts the encrypted private key of the electronic seal to which the responding node belongs, and uses the private key to decrypt the communication key in the file package to restore the random factor. Then use random factors to parse the ciphertext data to obtain plaintext data.

In the secure communication method based on identity authentication provided in this embodiment, the requesting node and the response section first make their own electronic seal in advance, and the electronic seal includes signature algorithm, signature information, encryption algorithm, fingerprint information, digest algorithm, The verification area composed of the public key and the encrypted private key. After the electronic seal is made, the requesting node and the responding node report each other's fingerprint information in the other's electronic seal, which is used for identity verification during the exchange of electronic seals. Only when the two nodes pass Data communication can be carried out safely. The specific process is as follows: the requesting node uses the random factor to encrypt the plaintext data to generate ciphertext data, and then uses the public key of the responding node’s electronic seal to encrypt the random factor to obtain the communication key. The ciphertext data, communication key, and fingerprint information used to identify the requesting node are packaged and sent to the responding node. After receiving the file package, the responding node reads the fingerprint information and compares it with the fingerprint information reported by the requesting node Yes, the requesting node can be authorized to access the responding node only after the comparison is passed, and then the responding node will call the corresponding encrypted private key, decrypt the encrypted private key and use the plaintext private key to decrypt the communication key to restore the random factor. Use random factors to parse the ciphertext data to obtain plaintext data, and complete the ciphertext transmission of the requesting node to the responding node.

In summary, this embodiment is compared with the solution in the prior art. The two parties negotiate to make an electronic seal, and there is no need to apply for a digital certificate from the CA, which increases the flexibility of application. The mandatory electronic seal exchange authentication strategy can ensure The communication ciphertext will not be stolen by a third party, which improves the security of the communication between the two parties. In addition, the negotiation process of the two parties' keys is cancelled before the data is sent, which improves the convenience of the application.

Please refer to Figure 3. The methods for requesting and responding nodes to make their own electronic seals include:

Design the partition of the electronic seal. In addition to the verification area, the partition also includes the head area, the seal information area and the tail area; the request node and the response node are based on the partition structure of the electronic seal, and the start tag, identification code and version number are filled correspondingly Enter the header area, fill in the seal information area with the chapter holder number, chapter holder name, issuing organization number, issuing organization name, and validity period correspondingly, fill in the description information and ending tag in the tail area, and fill in the signature algorithm and signature The information, encryption algorithm, fingerprint information, digest algorithm, public key and encryption private key are filled in the verification area correspondingly.

As shown in Figure 3, the start tag of the header area is 2 bytes, the identification code is 3 bytes, the version number is 1 byte, the signature algorithm of the verification area is 8 bytes, and the signature information is 32 bytes. The encryption algorithm is 8 bytes, the fingerprint information is 32 bytes, the digest algorithm is 8 bytes, the public key is 32 bytes, the encryption private key is 32 bytes, and the holder number in the seal information area is 32 bytes, The name of the holder is 32 bytes, the number of the issuing authority is 32 bytes, the name of the issuing authority is 32 bytes, the validity period information is 16 bytes, the description information in the tail area is 62 bytes, and the end tag is 2 bytes . It is understandable that the signature algorithm is an asymmetric algorithm for signing or verifying information, such as RSA, SM1, the encryption algorithm is a symmetric algorithm for encrypting or decrypting information, such as AES, SM2, and the digest algorithm is for information Algorithm for digesting, such as MD5, SM3.

In addition, in this embodiment, the encrypted private key is stored in the electronic seal, which can properly store and manage the private key, and reduces the management risk caused by the persistent storage of the private key in the systems of both parties.

The method for generating a public key and an encrypted private key in the foregoing embodiment includes: randomly generating a pair of public key and private key according to the signature algorithm in the electronic seal; and encrypting the private key to generate the requesting node based on the seal password PIN preset by the requesting node The encrypted private key of the electronic seal; and, based on the seal password PIN preset by the responding node, encrypt the private key to generate the encrypted private key of the electronic seal of the responding node.

In specific implementation, suppose that the electronic seal of the requesting node is A, the signature algorithm of the corresponding electronic seal A is SA, the electronic seal of the responding node is B, the signature algorithm of the corresponding electronic seal B is SB, and the requesting node generates according to the signature algorithm SA The public key SA.PublicKey and the private key SA.PrivateKey, the responding node generates the public key SB.PublicKey and the private key SB.PrivateKey according to the signature algorithm SB, and then fills the public key SA.PublicKey into the public key area of the electronic seal A. The public key SB.PublicKey is correspondingly filled into the public key area of the electronic seal B, and then the private key SA.PrivateKey and the private key SB.PrivateKey are encrypted. Specifically, the private key SA.PrivateKey is encrypted with the seal password PIN preset by the requesting node Obtain the encrypted private key of electronic seal A, and use the seal password PIN preset by the responding node to encrypt the private key SB.PrivateKey to obtain the encrypted private key of electronic seal B. The formula can be expressed as: private key=EA.Encrypt(SA.PrivateKey, PIN), then SA.PrivateKey is filled into the private key area of electronic seal A, and SB.PrivateKey is filled into the private key area of electronic seal B correspondingly, to complete the filling of the verification area of electronic seal A and electronic seal B.

Further, the method for generating fingerprint information in the foregoing embodiment includes: string splicing the seal holder number and the seal holder name in the electronic seal, and encrypting the splicing result of the string using the corresponding seal password PIN to form a secret Text; Digest the ciphertext using the digest algorithm to obtain the digest string; use the private key corresponding to the signature algorithm to sign the digest string to obtain the fingerprint information of the electronic seal.

In specific implementation, take the generation of fingerprint information in electronic seal A as an example, which can be expressed by the formula: fingerprint information=SA.Sign(DA(EA(ID+Name,PIN)),SA.PrivateKey), where ID It means the number of the holder of the seal, Name means the name of the holder, EA means the encryption algorithm, DA means the digest algorithm, fingerprint information refers to the result obtained after signing the key domain information in the electronic seal. The above formula can be understood as: The serial number of the holder and the name of the holder in the electronic seal are spliced, and then the seal password PIN is used as the key of the encryption algorithm (symmetric algorithm) to encrypt the splicing result of the string to form a cipher text, and then pass the abstract The algorithm digests the ciphertext to obtain the digest string, and finally signs the digest string with the private key of the signature algorithm (asymmetric algorithm) to form fingerprint information. In the same way, the generation of fingerprint information in the electronic seal B is the same as that in the electronic seal A, which is not repeated in this embodiment. Exemplarily, the chapter holder number may be an ID card number, a social credit uniform identification number, or an organization number.

Further, the method for generating signature information in the foregoing embodiment includes: defining key field bytes in the electronic seal, where the key field bytes are characteristic bytes of the electronic seal; and digesting the key field bytes through a digest algorithm to obtain the key field String: The key field string is signed by the private key corresponding to the signature algorithm to form the signature information of the electronic seal.

In specific implementation, take the generation of signature information in electronic seal A as an example, expressed by the formula: signature information=SA.Sign(DA(content), SA.PrivateKey), where content represents the key field byte, as shown in Figure 3. As shown, that is, all fields from the "encryption algorithm" area to the "end tag" area in the electronic seal (the content after the 46 bytes in the electronic seal), the key field bytes are summarized by the abstract algorithm to obtain the key field Then use the private key corresponding to the signature algorithm to sign the key domain string to form the signature information of the electronic seal A. In the same way, the generation of the signature information in the electronic seal B is the same as that of the electronic seal A, which is not repeated in this embodiment.

At this point, the signature construction phase is completed, and an electronic seal A and electronic seal B that can be used for identification and secure data communication are generated, and then the verification phase of the signature begins.

Specifically, in the above-mentioned embodiment, after the two parties exchange electronic seals, the method of mutually extracting each other's fingerprint information and comparing the reported fingerprint information to verify identity includes:

The requesting node sends the electronic seal to the responding node, so that the responding node can read the signature algorithm, public key, digest algorithm, and signature information of the electronic seal of the requesting node; the responding node reads the key domain words in the electronic seal of the requesting node Section, digest the digest string based on the digest algorithm, and use the public key of the signature algorithm to verify the key field bytes; after the verification is passed, the responding node will send the fingerprint information of the electronic seal of the requesting node to the information reported by the requesting node. Fingerprint information comparison, when the comparison results are consistent, the requesting node is authorized to access; the responding node sends the electronic seal to the requesting node, so that the requesting node can read the signature algorithm, public key, digest algorithm and signature information of the electronic seal of the responding node ; The requesting node reads the key field bytes in the electronic seal to which the responding node belongs, digests the digest string based on the digest algorithm, and uses the public key of the signature algorithm to perform verification on the key field bytes; after the verification is passed, the request The node compares the fingerprint information of the electronic seal to which the responding node belongs with the fingerprint information reported by the responding node, and authorizes the responding node to access when the comparison results are consistent.

Referring to Figure 3, the above embodiment can be understood as the process of exchanging electronic seals and identity verification between the two nodes. First, the requesting node sends the electronic seal A to the responding node, and the responding node performs the verification operation on the electronic seal A after receiving it. Then read the fingerprint information in the electronic seal A and compare it with the fingerprint information reported by the electronic seal A in the response node. When the comparison results are consistent, the identity of the electronic seal A is considered legal, and the requesting node is authorized to access the response node. After the responding node has verified the identity of the requesting node, the requesting node must continue to verify the identity of the responding node, that is, the responding node sends the electronic seal B to the requesting node, and the requesting node performs the verification operation after receiving the electronic seal B. Then read the fingerprint information in the electronic seal B and compare it with the fingerprint information reported by the electronic seal B in the requesting node. When the comparison results are consistent, the identity of the electronic seal B is considered legal, and the responding node is authorized to access the requesting node. .

Taking the verification operation of the electronic seal A by the response node as an example, it can be expressed by the formula: verification=SA.Verify(DA(content),SA.PublicKey,SI), where SI represents the signature information in the electronic seal A, The above formula is understood as: the signature verification operation is performed through the public key of the signature algorithm (asymmetric algorithm) and the signature information (SI) of the electronic seal A signature file structure. If the verification is successful, it means that the signature file has not been tampered with. Unsuccessful signing means that the signature file has been tampered with.

Taking the verification of the identity legality of electronic seal A by the responding node as an example, it can be expressed by the formula: identity=If(Equal(A.DS. fingerprint information, registered electronic seal A. fingerprint information)), the above formula is understood as: Take out the signature file of electronic seal A, and compare the fingerprint information with the fingerprint information reported in the responding node. If the comparison result is consistent, the requesting node is authorized to access.

In addition, the signature verification operation and the identity legality verification operation of the requesting node on the electronic seal B are the same as the above-mentioned response node verification operation and the identity legality verification operation on the electronic seal A, which will not be repeated in this embodiment.

At this point, the signature verification phase of both parties is completed, and then the encryption and decryption communication phase of both parties begins.

In the above embodiment, the requesting node uses the random factor to encrypt the plaintext data to generate the ciphertext data, and the public key of the responding node’s electronic seal is used to encrypt the random factor to obtain the communication key, and then the ciphertext data, the communication key and the requesting node’s electronic seal The method of packaging and sending the fingerprint information to the responding node includes:

The requesting node generates a random factor, which is used to encrypt the plaintext data to obtain the ciphertext data; the requesting node uses the public key of the electronic seal to which the responding node belongs to encrypt the random factor to generate a communication key; the requesting node encrypts the communication key, ciphertext data, and belonging The fingerprint information of the electronic seal is packaged and sent to the responding node.

In specific implementation, the scheme for requesting nodes to encrypt plaintext data to obtain ciphertext data can be expressed by the formula: ciphertext data=B.EA(A.plainText, Key), where plainText is plaintext data, and Key is a randomly generated encryption factor , And the Key can be either a fixed string or a random number generated during each encryption. The above formula can be understood as using the encryption factor Key as the key of the encryption algorithm (symmetric algorithm) and using the signature of the other party The required encryption algorithm (symmetric algorithm) encrypts plaintext data (plainText) to generate ciphertext data. The scheme of requesting the node to encrypt the random factor to generate the communication key can be expressed by the formula: communication key=B.SA.Encrypt(Key, B.SA.PublicKey), which can be understood as the signature algorithm required by the other party's signature ( The public key of the asymmetric algorithm encrypts the encryption factor (Key) generated by our party to form the communication key.

Further, in the above-mentioned embodiment, the responding node compares the fingerprint information in the file package with the reported fingerprint information, and after the comparison is successful, decrypts the encrypted private key of the electronic seal to which the responding node belongs, and decrypts the communication secret in the file package through the private key. The key to restore the random factor, and then use the random factor to parse the ciphertext data to obtain the plaintext data includes:

The responding node reads the fingerprint information in the file package and compares it with the fingerprint information reported by the requesting node; after the comparison is passed, the responding node reads the encryption algorithm, signature algorithm, encryption private key and preset of the electronic seal. The seal password PIN decrypts the private key of the electronic seal to which the responding node belongs; analyzes the communication key through the private key to restore the random factor, and finally uses the random factor to parse the ciphertext data to obtain the plaintext data.

In specific implementation, after receiving the file package, the responding node first reads the fingerprint information in the file package, and compares it with the fingerprint information reported by the requesting node, so that one school at a time ensures the security of data transmission. After passing, read the encrypted private key (SB.PrivateKey) from the electronic seal B.

If you want to use the plaintext private key, you need to decrypt the encrypted private key. The decryption formula is: B.SA.PrivateKey=B.EA.Decrypt(B.SecureKey, PIN), that is, it is preferred to read the encryption algorithm in the signature, and Use PIN as the key of the encryption algorithm (symmetric algorithm) to decrypt the encrypted private key, and the decrypted plaintext is the plaintext private key.

If you want to get the random factor, you need to continue to decrypt the communication key. The decryption formula is: A.Key=B.SA.Decrypt (communication key, B.SA.PrivateKey), that is, first read out the signature algorithm in the signature , And use the plaintext private key of the solved signature algorithm (asymmetric algorithm) to decrypt the communication key in the file package, and obtain the random factor (Key) of the requesting node after decryption.

If you want to get the plaintext data, you need to decrypt the ciphertext data. The decryption formula is: A.plainText=B.EA.Decrypt (ciphertext, A.Key), that is, it is preferred to read out the encryption algorithm in the signature and use the The solved random factor is used as the key of the encryption algorithm (symmetric algorithm) to decrypt the ciphertext data, and the plaintext data is decrypted.

So far, the responding node has completed the data encryption communication of the requesting node. Similarly, the requesting node's data encryption communication to the requesting node is the inverse process of the above implementation process. Please refer to Figure 2. When the responding node sends ciphertext data to the requesting node , The corresponding node is responsible for generating the encryption factor, and uses the electronic seal A of the requesting node to generate the communication key and ciphertext data. After the requesting node receives the ciphertext data, the communication key and the fingerprint information of the electronic seal B, it uses its own The electronic seal A is decrypted to obtain plaintext data.

It should be noted that the verification area of the electronic seal is designed in this embodiment, and the seal holder can reduce the security defects of known algorithms as much as possible and improve the overall algorithm strength by formulating symmetric and asymmetric encryption algorithms. At the same time, this embodiment provides a secure communication solution at the service data (non-protocol) level to realize independent and controllable data security for both parties in communication.

Example two

This embodiment provides a secure communication device based on identity authentication, including:

Compared with the prior art, the beneficial effects of the secure communication device based on identity authentication provided in this embodiment are the same as those of the secure communication method based on identity authentication provided in the foregoing embodiments, and will not be repeated here.

Example three

This embodiment provides a computer-readable storage medium on which a computer program is stored. When the computer program is run by a processor, the steps of the above-mentioned identity authentication-based secure communication method are executed.

Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this embodiment are the same as those of the secure communication method based on identity authentication provided by the above technical solutions, and will not be repeated here.

A person of ordinary skill in the art can understand that all or part of the steps in the above-mentioned inventive method can be implemented by a program instructing relevant hardware. The above-mentioned program can be stored in a computer readable storage medium. When the program is executed, it includes For each step of the method in the foregoing embodiment, the foregoing storage medium may be: ROM/RAM, magnetic disk, optical disk, memory card, and so on.

The above are only specific implementations of the present invention, but the protection scope of the present invention is not limited to this. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, and they should all be covered. Within the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

A secure communication method based on identity authentication, which is characterized in that it includes:

The requesting node and the responding node respectively make their own electronic seals, and the electronic seals include a verification area composed of a signature algorithm, signature information, encryption algorithm, fingerprint information, digest algorithm, public key, and encrypted private key;

The requesting node and the responding node report each other's fingerprint information in the electronic seal of the other party, which is used to compare each other's fingerprint information with the reported fingerprint information after the two parties exchange electronic seals to verify their identity;

After the two nodes pass the identity verification, the requesting node encrypts the plaintext data with a random factor to generate ciphertext data, and encrypts the random factor with the public key of the electronic seal of the responding node to obtain the communication key. Then, the ciphertext data, The communication key and the fingerprint information in the electronic seal of the requesting node are packaged and sent to the responding node;

The responding node compares the fingerprint information in the file package with the reported fingerprint information, and after the comparison is successful, decrypts the encrypted private key of the electronic seal to which the responding node belongs, and decrypts the communication key in the file package with the private key to restore the random factor, The random factor is then used to parse the ciphertext data to obtain plaintext data.
The method according to claim 1, wherein the method for the requesting node and the responding node to make their own electronic seals respectively comprises:

Design the partition of the electronic seal, which includes a header area, a seal information area, and a tail area in addition to the verification area;

The request node and the response node are based on the partition structure of the electronic seal, and the start tag, identification code and version number are filled into the header area correspondingly, and the chapter holder number, chapter holder name, issuing organization number, issuing organization name, and validity period are correspondingly filled. Fill in the seal information area, fill the description information and the end marker into the tail area correspondingly, and fill the signature algorithm, signature information, encryption algorithm, fingerprint information, digest algorithm, public key, and encryption private key into the verification area correspondingly.
The method according to claim 2, wherein the method for generating the public key and the encrypted private key comprises:

Randomly generate a pair of public key and private key according to the signature algorithm in the electronic seal;

Based on the seal password PIN preset by the requesting node, encrypt the private key to generate the encrypted private key of the electronic seal of the requesting node; and,

Based on the seal password PIN preset by the responding node, encrypt the private key to generate the encrypted private key of the electronic seal of the responding node.
The method according to claim 3, wherein the method for generating fingerprint information comprises:

Perform string splicing on the number of the holder and the name of the holder in the electronic seal, and use the corresponding seal password PIN to encrypt the splicing result of the string to form a cipher text;

Digest the ciphertext using a digest algorithm to obtain a digest string;

The digest string is signed by the private key corresponding to the signature algorithm to obtain the fingerprint information of the electronic seal.
The method according to claim 3, wherein the method for generating the signature information comprises:

Define the key field bytes in the electronic seal, where the key field bytes are characteristic bytes of the electronic seal;

Digest the key field bytes through a digest algorithm to obtain a key field string;

The key domain character string is signed by the private key corresponding to the signature algorithm to form the signature information of the electronic seal.
The method according to claim 2, wherein after the two parties exchange electronic seals, the method of extracting each other's fingerprint information and comparing the reported fingerprint information to verify identity comprises:

The requesting node sends the electronic seal to the responding node, so that the responding node can read the signature algorithm, public key, digest algorithm, and signature information of the electronic seal of the requesting node;

The response node reads the key field bytes in the electronic seal to which the requesting node belongs, performs a digest based on the digest algorithm to obtain a digest string, and uses the public key of the signature algorithm to perform verification on the key field bytes;

After the verification is passed, the responding node compares the fingerprint information of the electronic seal of the requesting node with the fingerprint information reported by the requesting node, and authorizes the requesting node to access when the comparison results are consistent;

The responding node sends the electronic seal to the requesting node so that the requesting node can read the signature algorithm, public key, digest algorithm, and signature information of the electronic seal to which the responding node belongs;

The requesting node reads the key field bytes in the electronic seal to which the responding node belongs, performs a digest based on the digest algorithm to obtain a digest string, and uses the public key of the signature algorithm to perform verification on the key field bytes;

After the verification is passed, the requesting node compares the fingerprint information of the electronic seal to which the responding node belongs with the fingerprint information reported by the responding node, and authorizes the responding node to access when the comparison results are consistent.
The method according to claim 6, characterized in that the requesting node uses a random factor to encrypt the plaintext data to generate the ciphertext data, and the public key of the electronic seal of the responding node is used to encrypt the random factor to obtain the communication key, and then the all The method for packaging and sending the ciphertext data, the communication key, and the fingerprint information in the electronic seal of the requesting node to the responding node includes:

Request the node to generate a random factor for encrypting the plaintext data to obtain ciphertext data;

The requesting node uses the public key of the electronic seal to which the responding node belongs to encrypt the random factor to generate a communication key;

The requesting node packs and sends the communication key, the ciphertext data and the fingerprint information of the electronic seal to the responding node.
The method according to claim 7, wherein the responding node compares the fingerprint information in the file package with the reported fingerprint information, and after the comparison is successful, the encrypted private key of the electronic seal to which the responding node belongs is decrypted, and the private key is used to decrypt The method of restoring the random factor by the communication key in the file package, and then using the random factor to parse the ciphertext data to obtain plaintext data includes:

The responding node reads the fingerprint information in the file package and compares it with the fingerprint information reported by the requesting node;

After the comparison is passed, the responding node reads the encryption algorithm, signature algorithm, encryption private key and the preset seal password PIN of the electronic seal to which the responding node belongs, and decrypts the private key of the electronic seal to which the responding node belongs;

The random factor is restored by parsing the communication key by the private key, and finally the ciphertext data is parsed by the random factor to obtain plaintext data.
A secure communication device based on identity authentication, characterized in that it comprises:

The seal making unit is used for making respective electronic seals by the requesting node and the responding node. The electronic seal includes a signature algorithm, signature information, encryption algorithm, fingerprint information, digest algorithm, public key, and encrypted private key. Inspection area

The fingerprint registration unit is used for requesting nodes and responding nodes to report each other's fingerprint information in the electronic seal of the other party, and for comparing each other's fingerprint information with the reported fingerprint information after the two parties exchange electronic seals to verify identity;

The file encryption unit is configured to store the compressed logistics box code message in a storage system, and complete the archiving of the original logistics box code message;

The file decryption unit is used for the responding node to compare the fingerprint information in the file package with the reported fingerprint information, decrypt the encrypted private key of the electronic seal to which the responding node belongs after the comparison is successful, and decrypt the communication key in the file package with the private key Restore the random factor, and then use the random factor to parse the ciphertext data to obtain plaintext data.
A computer-readable storage medium with a computer program stored on the computer-readable storage medium, wherein the computer program executes the steps of the method according to any one of claims 1 to 8 when the computer program is run by a processor.