CN115801388B - Message transmission method, device and storage medium - Google Patents

Abstract

The application discloses a message transmission method, a message transmission device and a storage medium, which relate to the technical field of communication and are used for ensuring the safety of data between a safety system and a special server. The method comprises the following steps: establishing a transmission channel between a secure access terminal module and a secure access gateway; the security access gateway is an access gateway in an enterprise intranet accessed by the user terminal; the transmission channel is connected with the secure access terminal module and the secure access gateway through the secure chip and the second system; negotiating a key with a security access gateway through a transmission channel to determine a session master key; encrypting a data message to be transmitted according to a session master key, and determining a first encrypted message; and sending the first encrypted message to the security access gateway through the transmission channel. The embodiment of the application is applied to the message transmission process.

Description

Message transmission method, device and storage medium

Technical Field

The present application relates to the field of communications, and in particular to a message transmission method, device and storage medium.

Background technique

The dual-system terminal includes a security system and a non-security system. The security system is used to connect to a proprietary enterprise server to improve the security of transmitted information; the non-security system is an open system used to meet the user's daily life and entertainment needs for user terminals. A security chip is set between the security system and the non-security system in the dual-system terminal, so that the non-security system can be prevented from illegally obtaining information in the security system.

However, in the process of communication between the security system and the proprietary enterprise server, the messages sent by the security system need to pass through the non-security system and the public network. This poses a risk of illegal theft of messages by the non-security system and the public network, which poses a security risk to the communication between the security system and the proprietary enterprise server. Therefore, how to ensure the security of data between the security system and the proprietary server is a problem that still needs to be solved.

Summary of the invention

The present application provides a message transmission method, device and storage medium for ensuring the security of data between a security system and a dedicated server.

In order to achieve the above objectives, this application adopts the following technical solutions:

In a first aspect, the present application provides a message transmission method, which is applied to a security access terminal module, the security access terminal module is a module in a first system of a user terminal, the user terminal includes a first system and a second system; the first system is a system encrypted according to the security access terminal module, the second system is an unencrypted system, and the first system and the second system are connected through a security chip; the method includes: the security access terminal module establishes a transmission channel between the security access terminal module and the security access gateway; wherein the security access gateway is an access gateway in an enterprise intranet accessed by the user terminal; the transmission channel connects the security access terminal module and the security access gateway through the security chip and the second system; the security access terminal module negotiates a key with the security access gateway through the transmission channel to determine a session master key; the security access terminal module encrypts a data message to be transmitted according to the session master key to determine a first encrypted message; the security access terminal module sends the first encrypted message to the security access gateway through the transmission channel.

In combination with the above-mentioned first aspect, in a possible implementation method, the method also includes: obtaining a data message to be transmitted; sending a first indication information to an external encryption module; the first indication information is used to instruct the external encryption module to report a session master key; and receiving a session master key from the external encryption module.

In combination with the first aspect above, in a possible implementation manner, the method further includes: the external encryption module is an encryption module externally connected to the user terminal, and the external encryption module communicates with the user terminal through the national encryption OpenVPN.

In combination with the above-mentioned first aspect, in a possible implementation, the method also includes: sending second indication information to an external encryption module, the second indication information being used to instruct the external encryption module to generate a session master key based on a premade certificate and a premaster key; wherein the premaster key is generated by the external encryption module, and the external encryption module stores a premade certificate.

In combination with the above-mentioned first aspect, in a possible implementation method, the method also includes: in the handshake phase, determining the security parameters selected by the secure access gateway; the security parameters include at least one of the following: session identifier, pre-made certificate, compression algorithm, encryption specification, session master key, reuse identifier; encrypting the data message to be transmitted according to the security parameters to determine the first encrypted message.

In a second aspect, an embodiment of the present application provides a message transmission device, which includes: a communication unit and a processing unit: the processing unit is used to establish a transmission channel between a security access terminal module and a security access gateway; wherein the security access gateway is an access gateway in an enterprise intranet accessed by a user terminal; the transmission channel connects the security access terminal module and the security access gateway through a security chip and a second system; the processing unit is also used to negotiate a key with the security access gateway through the transmission channel to determine a session master key; the processing unit is also used to encrypt a data message to be transmitted according to the session master key to determine a first encrypted message; the communication unit is used to send the first encrypted message to the security access gateway through the transmission channel.

In combination with the above-mentioned second aspect, in a possible implementation method, the processing unit is also used to obtain a data message to be transmitted; the communication unit is also used to send a first indication message to an external encryption module; the first indication message is used to instruct the external encryption module to report a session master key; and the communication unit is also used to receive a session master key from the external encryption module.

In combination with the above second aspect, in a possible implementation, the external encryption module is an encryption module externally connected to the user terminal, and the external encryption module communicates with the user terminal through the national encryption OpenVPN.

In combination with the above-mentioned second aspect, in a possible implementation method, the communication unit is also used to send second indication information to the external encryption module, and the second indication information is used to instruct the external encryption module to generate a session master key based on a premade certificate and a premaster key; wherein the premaster key is generated by the external encryption module, and the external encryption module stores the premade certificate.

In combination with the above-mentioned second aspect, in a possible implementation method, the processing unit is also used to determine the security parameters selected by the secure access gateway during the handshake phase; the security parameters include at least one of the following: session identifier, pre-made certificate, compression algorithm, encryption specification, session master key, reuse identifier; the processing unit is also used to encrypt the data message to be transmitted according to the security parameters to determine the first encrypted message.

In a third aspect, an embodiment of the present application provides a message transmission device, which includes: a processor and a memory; wherein the memory is used to store computer execution instructions, and when the message transmission device is running, the processor executes the computer execution instructions stored in the memory to enable the message transmission device to perform the message transmission method described in any possible implementation method of the first aspect.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions in the computer-readable storage medium are executed by a processor of a message transmission device, the message transmission device is enabled to execute the message transmission method described in any possible implementation of the first aspect.

These and other aspects of the present application will become more apparent from the following description.

The above scheme brings at least the following beneficial effects: In the embodiment of the present application, during the communication between the security access terminal module and the security access gateway, the security access terminal module negotiates a key with the security access gateway through a transmission channel to determine the session master key. The security access terminal can encrypt the message through the session master key to obtain a first encrypted message. Since the session master key is obtained through negotiation between the security access terminal module and the security access gateway, the security access terminal module and the security access gateway use the same session master key. In this way, the security access gateway can decrypt the received first encrypted message. Even if the second system (non-security system) and the public network obtain the first encrypted message, they cannot obtain the information in the first encrypted message because they cannot obtain the session master key. Therefore, the present application can ensure the security of data between the first system (security system) and the dedicated server.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

FIG1 is a schematic diagram of the structure of a message transmission device provided in an embodiment of the present application;

FIG2 is a schematic diagram of the structure of a message transmission device provided in an embodiment of the present application;

FIG3 is a flow chart of a message transmission method provided in an embodiment of the present application;

FIG4 is a flow chart of another message transmission method provided in an embodiment of the present application;

FIG5 is a schematic diagram showing a comparison between a dedicated virtual network card and a physical network card provided in an embodiment of the present application;

FIG6 is a schematic diagram of the structure of a message transmission device provided in an embodiment of the present application;

FIG7 is a flow chart of a message transmission method provided in an embodiment of the present application;

FIG8 is a flow chart of another message transmission method provided in an embodiment of the present application;

FIG9 is a schematic diagram of the structure of another message transmission device provided in an embodiment of the present application.

Detailed ways

The term "and/or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and/or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

In the description of the present application, unless otherwise specified, “plurality” means two or more.

The technical solution of the embodiments of the present application can be used in various communication systems, which may be a third generation partnership project (3GPP) communication system, such as a long term evolution (LTE) system, or a 5G mobile communication system, an NR system, a vehicle to everything (NR V2X) system, or a system with a hybrid LTE and 5G network, or a device-to-device (D2D) communication system, a machine-to-machine (M2M) communication system, an Internet of Things (IoT), and other next generation communication systems, or a non-3GPP communication system without limitation.

The technical solutions of the embodiments of the present application can be applied to various communication scenarios, for example, one or more of the following communication scenarios: enhanced mobile broadband (eMBB), ultra-reliable low latency communication (URLLC), machine type communication (MTC), massive machine type communications (mMTC), SA, D2D, V2X, and IoT and other communication scenarios.

Among them, the above-mentioned communication systems and communication scenarios applicable to the present application are only examples, and the communication systems and communication scenarios applicable to the present application are not limited to these. They are uniformly described here and will not be repeated below.

In some embodiments, the terminal device involved in the present application may be a device for realizing a communication function. The terminal device may also be referred to as user equipment (UE), terminal, access terminal, user unit, user station, mobile station (MS), remote station, remote terminal, mobile terminal (MT), user terminal, wireless communication device, user agent or user device, etc. The terminal device may be, for example, a wireless terminal or a wired terminal in IoT, V2X, D2D, M2M, 5G network, or a future evolved public land mobile network (PLMN). A wireless terminal may refer to a device with wireless transceiver functions, which may be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; may also be deployed on water (such as ships, etc.); may also be deployed in the air (such as airplanes, balloons and satellites, etc.).

Exemplarily, the terminal device may be a drone, an IoT device (e.g., a sensor, an electric meter, a water meter, etc.), a V2X device, a station (ST) in a wireless local area network (WLAN), a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA) device, a handheld device with a wireless communication function, a computing device or other processing device connected to a wireless modem, an in-vehicle device, a wearable device (also referred to as a wearable smart device), a tablet computer or a computer with a wireless transceiver function, a virtual reality (VR) terminal, a wireless terminal in industrial control, a wireless terminal in self driving, a wireless terminal in remote medical, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a smart home, or a wireless terminal in a smart city. The terminal may be a wireless terminal in a home, a vehicle-mounted terminal, a vehicle with vehicle-to-vehicle (V2V) communication capability, an intelligent connected vehicle, a drone with UAV to UAV (U2U) communication capability, etc. The terminal may be mobile or fixed, and this application does not make specific restrictions on this.

In order to implement the message transmission method provided in the embodiment of the present application, the embodiment of the present application provides a message transmission device for executing the message transmission method provided in the embodiment of the present application, and FIG1 is a structural schematic diagram of a message transmission device provided in the embodiment of the present application. As shown in FIG1, the message transmission device 100 includes at least one processor 101, a communication line 102, and at least one communication interface 104, and may also include a memory 103. Among them, the processor 101, the memory 103 and the communication interface 104 can be connected through the communication line 102.

The processor 101 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application, such as one or more digital signal processors (DSP), or one or more field programmable gate arrays (FPGA).

The communication link 102 may include a pathway for transmitting information between the above-mentioned components.

The communication interface 104 is used to communicate with other devices or communication networks, and can use any transceiver-like device, such as Ethernet, radio access network (RAN), WLAN, etc.

The memory 103 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compressed optical disc, a laser disc, an optical disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to include or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

In one possible design, the memory 103 can exist independently of the processor 101, that is, the memory 103 can be a memory outside the processor 101. In this case, the memory 103 can be connected to the processor 101 through the communication line 102, and is used to store execution instructions or application code, and the processor 101 controls the execution to implement the message transmission method provided in the following embodiment of the present application. In another possible design, the memory 103 can also be integrated with the processor 101, that is, the memory 103 can be the internal memory of the processor 101, for example, the memory 103 is a high-speed cache, which can be used to temporarily store some data and instruction information.

As a possible implementation, the processor 101 may include one or more CPUs, such as CPU0 and CPU1 in FIG1. As another implementation, the message transmission apparatus 100 may include multiple processors, such as the processor 101 and the processor 107 in FIG1. As yet another implementation, the message transmission apparatus 100 may further include an output device 105 and an input device 106.

In the prior art, during the communication between the security system in the dual-system terminal and the proprietary enterprise server, since the messages sent by the security system need to pass through the non-security system and the public network in the dual-system terminal, there is a risk of the non-security system and the public network illegally stealing the messages, causing security risks to the communication between the security system and the proprietary enterprise server.

In order to solve the technical problems existing in the related art, in an embodiment of the present application, during the communication between the security access terminal module and the security access gateway, the security access terminal module negotiates a key with the security access gateway through a transmission channel to determine the session master key. In this way, the security access terminal can encrypt the message through the session master key to obtain the first encrypted message. Since the session master key is obtained through negotiation between the security access terminal module and the security access gateway, the security access terminal module and the security access gateway use the same session master key. In this way, the security access gateway can decrypt the received first encrypted message. Even if the non-secure system and the public network obtain the first encrypted message, they cannot obtain the information in the first encrypted message because they cannot obtain the session master key. Therefore, the present application ensures the security of data between the security system and the proprietary server.

Hereinafter, a message transmission system provided in an embodiment of the present application will be described in detail in conjunction with FIG2 . As shown in FIG2 , the message transmission system includes: a first system 201 , a second system 202 , a security chip 203 , and an enterprise intranet 204 .

The first system 201 is a system encrypted according to the secure access terminal module, and is used to establish an encrypted connection with the enterprise intranet 204; the second system 202 is an unencrypted system, and is used to meet the user's daily life and entertainment needs for user terminals; the enterprise intranet 204 is used to ensure communication between enterprise employees.

The first system 201 includes: an application module 2011 , a dedicated virtual network card module 2012 , a secure access terminal module 2013 , a password daemon module 2014 , an external encryption module 2015 and a transmission service module 2016 .

The application module 2011 is configured to: receive the user's operation instruction, generate the third indication information according to the user's operation instruction, and the third indication information is used to instruct the dedicated virtual network card module 2012 to generate a data message to be transmitted. The application module 2011 includes World Wide Web (WEB) applications and industry applications; the third indication information includes an Internet Packet Groper (PING) instruction.

The dedicated virtual network card module 2012 is configured to: receive the third indication information of the application module 2011, and generate the data message to be transmitted according to the third indication information. The dedicated virtual network card module 2012 is used to achieve seamless connection between the first system 201 and the application module 2011, without modifying the application module 2011, the kernel of the first system 201 and the network protocol stack, thereby reducing the work of the staff.

The secure access terminal module 2013 is configured to: encrypt the data message to be transmitted according to the received session master key to determine a first encrypted message; and send the first encrypted message to the transmission service module 2016 .

The password daemon module 2014 is configured to connect to the security access terminal module 2013 and the external encryption module 2015 .

The external encryption module 2015 is configured to receive the second indication information sent by the secure access terminal module 2013, wherein the second indication information is used to instruct the external encryption module to generate a session master key according to the pre-made certificate and the pre-master key. The external encryption module 2015 includes a national encryption SD card.

The second system 202 includes: a transmission service module 2021 .

The transmission service module 2021 is configured to: receive the first encrypted message sent by the transmission service module 2016 in the first system 201 through the security chip 203 , and forward the first encrypted message to the enterprise intranet 204 .

The security chip 203 is configured to be disposed between the first system 201 and the second system 202 to isolate communication data between the first system 201 and the second system 202 .

The enterprise intranet 204 includes: a secure access gateway 2041 .

The secure access gateway 2041 is configured to: establish a transmission channel with the secure access terminal module 2013, and negotiate and calculate a session master key; and receive and decrypt the first encrypted message.

The enterprise intranet 204 also includes: an enterprise address book module 2042, an enterprise internal video and conference module 2043, a remote mobile office application 2044, and other network applications 2045. Among them, the enterprise address book module 2042 is used to save the contact information of each enterprise employee; the enterprise internal video and conference module 2043 is used to meet the needs of enterprise employees to transmit internal video information and hold network conferences in the intranet; the remote mobile office application 2044 is used to meet the needs of enterprise employees to establish a remote wireless connection with the secure access gateway 2041 through a terminal; and other network applications 2045 are used to meet other network needs of enterprise employees.

The embodiment of the present application provides a message transmission method, which can be applied to the message transmission system shown in Figure 2. As shown in Figure 3, the message transmission method includes:

S301: The security access terminal module establishes a transmission channel between the security access terminal module and the security access gateway.

Among them, the security access terminal module is a module in the first system of the user terminal, and the user terminal includes the first system and the second system; the first system is a system encrypted according to the security access terminal module, and the second system is an unencrypted system. The first system and the second system are connected through a security chip.

Optionally, the second system is an open system.

Exemplarily, the second system is an Android system.

S302: The secure access terminal module negotiates a key with the secure access gateway through a transmission channel to determine a session master key.

Optionally, before S302, the secure access terminal module and the secure access gateway may first perform identity authentication on each other, and negotiate to determine a session master key after the identity authentication is passed.

The process in which the security access terminal module and the security access gateway can perform mutual identity authentication includes: the security access terminal module sends the security access terminal module's certificate to the security access gateway, and the security access gateway verifies the identity of the security access terminal module. The security access gateway sends the security access gateway's certificate to the security access terminal module, and the security access terminal module verifies the identity of the security access gateway.

S303: The secure access terminal module encrypts the data message to be transmitted according to the session master key to determine a first encrypted message.

In a possible implementation, the secure access terminal module encrypts the data message to be transmitted according to the session master key and the cryptographic specification (cryptographic algorithm) negotiated with the secure access gateway to determine the first encrypted message.

S304: The secure access terminal module sends a first encrypted message to the secure access gateway through a transmission channel.

In a possible implementation manner, the secure access terminal module sends a first encrypted message to a secure access gateway through a transmission channel, so that the secure access gateway decrypts the first encrypted message according to a session master key.

The above scheme brings at least the following beneficial effects: In the embodiment of the present application, during the communication between the security access terminal module and the security access gateway, the security access terminal module negotiates a key with the security access gateway through a transmission channel to determine the session master key. In this way, the security access terminal can encrypt the message through the session master key to obtain the first encrypted message. Since the session master key is obtained through negotiation between the security access terminal module and the security access gateway, the security access terminal module and the security access gateway use the same session master key. In this way, the security access gateway can decrypt the received first encrypted message. Even if the second system and the public network obtain the first encrypted message, they cannot obtain the information in the first encrypted message because they cannot obtain the session master key. Therefore, the present application can ensure the security of data between the first system and the dedicated server.

In a possible implementation, before S303, the secure access terminal module obtains the data message to be transmitted and the session master key. The following describes the process of the secure access terminal module obtaining the data message to be transmitted and the session master key.

In combination with FIG. 3 , as shown in FIG. 4 , the process in which the security access terminal module obtains the data message to be transmitted and the session master key can be specifically implemented through the following S401 - S403 .

S401: The secure access terminal module obtains a data message to be transmitted.

In a possible implementation, the secure access terminal module obtains the data message to be transmitted from the dedicated virtual network card.

Optionally, the dedicated virtual network card is a kernel-mode program in the first system, which is used to connect the application (Application, APP) in the terminal and the secure access terminal module in the first system, so that the user sends the data message to be transmitted to the secure access terminal module in the first system through the APP. Since the first system includes a virtual network card, the APP in the terminal can directly communicate with the secure access gateway through the virtual network card in the first system terminal, without the need to make adaptive modifications to the APP on the user terminal and the underlying communication module of the first system, thus saving resources.

It should be noted that, in combination with Figure 4, as shown in Figure 5, the physical network card in kernel state receives the third indication information of the APP in user state through the network protocol stack (NetworkProtocol Stack), generates a data message to be transmitted according to the third indication information, and forwards the data message to be transmitted to the physical network. The virtual network card in kernel state receives the third indication information of the APP in user state through the network protocol stack, generates a data message to be transmitted according to the third indication information, and forwards the data message to be transmitted to the application. Since there is no physical network card in the first system, a virtual network card is set in the first system to realize the function of the physical network card. Exemplarily, the virtual network card drives the application to communicate with the network protocol.

S402: The secure access terminal module sends first indication information to the external encryption module.

The first indication information is used to instruct the external encryption module to report the session master key. The external encryption module is an encryption module externally connected to the user terminal, and the external encryption module communicates with the user terminal through a national virtual private channel (OpenVPN, OPN).

Optionally, the external encryption module is a national secure digital memory card (Secure Digital Memory Card, SD), and the external encryption module can provide password-related capabilities for the secure access terminal module.

In a possible implementation, the security access terminal module sends first indication information to the external encryption module through the password daemon module, so that the external encryption module calculates the session master key according to the relevant information.

Optionally, the password daemon module is an interface for interfacing with an external encryption module. S403: The secure access terminal module receives a session master key from the external encryption module.

In a possible implementation, the secure access terminal module stores the session master key so as to encrypt subsequent data messages to be transmitted.

In another possible implementation, in combination with Figure 4, as shown in Figure 6, the security access module includes a national secret SSL protocol module and a communication module. The national secret SSL protocol is used to establish a transmission channel and negotiate a session master key. The security access module receives the data message to be transmitted sent by the virtual network card; the security access module receives the session master key of the national secret SD card through the password daemon module. Thereby, the security access module encrypts the data message to be transmitted according to the session master key, determines the first encrypted message, and sends the first encrypted message to the transmission service module through the communication module. The transmission service module is used to transmit information between the security access module and the security access gateway.

The above scheme brings at least the following beneficial effects: In the embodiment of the present application, the secure access terminal module calls the session master key from the external encryption module, avoiding the waste of resources caused by the need to calculate the session master key by the secure access terminal module. In addition, in the embodiment of the present application, the external encryption module is modified, the modification is simple, and the disassembly is convenient, without the need to modify the terminal internally.

In combination with FIG. 3 , as shown in FIG. 7 , the process in which the security access terminal module negotiates a key with the security access gateway through a transmission channel and determines the session master key can be specifically implemented through the following S701 .

S701. The security access terminal module sends second indication information to the external encryption module.

The second indication information is used to instruct the external encryption module to generate a session master key based on the pre-made certificate and the pre-master key.

The pre-master key is generated by an external encryption module, and the external encryption module stores a pre-made certificate.

It should be noted that after the security access terminal module receives the Server KeyExchange message sent by the security access gateway, it sends a request message to the external encryption module. The request message is used to request the pre-master key and the pre-made certificate, and the Server Key Exchange message is used to request the pre-master key. The security access terminal module sends the pre-master key and the pre-made certificate to the security access gateway so that the security access gateway generates a decryption session master key based on the pre-made certificate and the pre-master key. Since the security access gateway and the external encryption module use the same parameters (pre-made certificate, pre-master key), the session master key generated by the external encryption module is the same as the decryption session master key generated by the security access gateway, so that the security access gateway can decrypt the first encrypted message based on the decryption session master key. Optionally, the pre-made certificate includes a certification authority (CA). The external encryption module downloads the CA certificate from the CA system.

It should be noted that after the external encryption module generates the session master key according to the second indication information, it can report the session master key to the security access terminal module in response to the first indication information of the security access terminal module; the external encryption module can also actively report the session master key to the security access terminal module.

The above scheme brings at least the following beneficial effects: in the embodiment of the present application, since the security access terminal module sends the second indication information to the external encryption module, the external encryption module can generate a session master key according to the second indication information, thereby avoiding the waste of computing resources caused by the security access terminal module itself calculating the session master key.

In combination with FIG. 3 , as shown in FIG. 8 , the above process of encrypting the data message to be transmitted according to the session master key and determining the first encrypted message can be specifically implemented through the following S801 - S802 .

S801. In the handshake phase, the secure access terminal module determines the security parameters selected by the secure access gateway.

The security parameters include at least one of the following: a session identifier, a pre-made certificate, a compression algorithm, a password specification, a session master key, and a reuse identifier.

It should be noted that the session identifier is an arbitrary byte sequence selected by the secure access gateway to identify active or resumable sessions; the reuse identifier is an identifier used to indicate whether a new connection can be initiated using the session.

Optionally, during the handshake phase, the secure access terminal module sends a Client Hello message to the secure access gateway. The Client Hello message includes: session identifier, compression algorithm, and password specification. The secure access gateway replies to the secure access terminal module with a Server Hello message, which includes: session identifier, compression algorithm, and password specification.

In one possible implementation, the security access terminal module sends at least one compression algorithm and/or at least one cryptographic specification to the security access gateway; the security access gateway selects a first target compression algorithm and/or a first target cryptographic specification from the at least one compression algorithm and/or at least one cryptographic specification according to a selection algorithm supported by itself, and sends a first response message to the security access terminal module, the first response message including the first target algorithm and/or the first target cryptographic specification.

Exemplarily, the first target algorithm is a compression algorithm in a Server Hello message, and the first target cryptographic specification is a cryptographic specification in a Server Hello message.

In another possible implementation, the security access terminal module sends at least one compression algorithm and/or at least one cryptographic specification to the security access gateway, and the at least one compression algorithm and/or at least one cryptographic specification are arranged in order of priority; the security access gateway selects a second target compression algorithm with the highest priority from at least one compression algorithm according to a selection algorithm supported by itself, selects a second target cryptographic specification with the highest priority from at least one cryptographic specification, and sends a second response message to the security access terminal module, the second response message including the second target algorithm and/or the second target cryptographic specification.

Exemplarily, the second target algorithm is a compression algorithm in a Server Hello message, and the second target cryptographic specification is a cryptographic specification in a Server Hello message.

Optionally, the security access terminal module sends security parameters to the external encryption module.

S802: The secure access terminal module encrypts the data message to be transmitted according to the security parameter and determines a first encrypted message.

In one possible implementation, the security access terminal module performs data segmentation processing on the data message to be transmitted to obtain multiple sub-messages; then uses a compression algorithm to compress each sub-message separately to obtain a compressed sub-message; compresses each compressed sub-message according to the password specification and the session master key to obtain a first encrypted message.

The above scheme brings at least the following beneficial effects: In the embodiment of the present application, the security access terminal module negotiates a key with the security access gateway to obtain security parameters. The security access terminal can encrypt the message through the security parameters to obtain the first encrypted message. Since the session master key is obtained by negotiation between the security access terminal module and the security access gateway, the security access terminal module and the security access gateway use the same security parameters. In this way, the security access gateway can decrypt the received first encrypted message. Even if the second system (non-security system) and the public network obtain the first encrypted message, they cannot obtain the information in the first encrypted message because they cannot obtain the security parameters. Therefore, the present application can ensure the security of data between the first system (security system) and the dedicated server.

It can be seen that the technical solution provided by the embodiment of the present application is introduced above mainly from the perspective of the method. In order to realize the above functions, it includes hardware structures and/or software modules corresponding to the execution of each function. Those skilled in the art should be easily aware that, in combination with the modules and algorithm steps of each example described in the embodiment disclosed herein, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

The embodiment of the present application can divide the functional modules of the message transmission device according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. Optionally, the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

As shown in FIG9 , it is a schematic diagram of the structure of a message transmission device 90 provided in an embodiment of the present application. The message transmission device 90 includes: a processing unit 901 and a communication unit 902 .

The processing unit 901 is used to establish a transmission channel between the security access terminal module and the security access gateway; wherein the security access gateway is an access gateway in the enterprise intranet accessed by the user terminal; the transmission channel connects the security access terminal module and the security access gateway through the security chip and the second system; the processing unit 901 is also used to negotiate a key with the security access gateway through the transmission channel to determine a session master key; the processing unit 901 is also used to encrypt a data message to be transmitted according to the session master key to determine a first encrypted message; the communication unit 902 is used to send the first encrypted message to the security access gateway through the transmission channel.

Optionally, the processing unit 901 is also used to obtain a data message to be transmitted; the communication unit 902 is also used to send a first indication message to an external encryption module; the first indication message is used to instruct the external encryption module to report a session master key; the communication unit 902 is also used to receive a session master key from an external encryption module.

Optionally, the external encryption module is an encryption module externally connected to the user terminal, and the external encryption module communicates with the user terminal through the national encryption OpenVPN.

Optionally, the communication unit 902 is also used to send a second indication message to the external encryption module, and the second indication message is used to instruct the external encryption module to generate a session master key based on a premade certificate and a premaster key; wherein the premaster key is generated by the external encryption module, and the external encryption module stores the premade certificate.

Optionally, processing unit 901 is also used to determine the security parameters selected by the secure access gateway during the handshake phase; the security parameters include at least one of the following: session identifier, pre-made certificate, compression algorithm, cipher specification, session master key, reuse identifier; processing unit 901 is also used to encrypt the data message to be transmitted according to the security parameters to determine the first encrypted message.

Among them, the processing unit 901 can be a processor or a controller. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of DSP and microprocessors, etc. The communication unit 902 can be a transceiver circuit or a communication interface, etc. The storage module can be a memory. When the processing unit 901 is a processor, the communication unit 902 is a communication interface, and the storage module is a memory, the message transmission device involved in the embodiment of the present application can be the message transmission device shown in Figure 1.

Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the network node is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, module and network node described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When a computer executes the instructions, the computer executes each step in the method flow shown in the above method embodiment.

An embodiment of the present application also provides a chip, which includes a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run a computer program or instruction to implement the message transmission method in the above method embodiment.

An embodiment of the present application provides a computer program product including instructions. When the instructions are executed on a computer, the computer executes the message transmission method in the above method embodiment.

Among them, the computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, and a hard disk. Random Access Memory (RAM), Read-Only Memory (ROM), Erasable Programmable Read Only Memory (EPROM), registers, hard disks, optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any other form of computer-readable storage medium in a suitable combination of the above, or numerical values in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an Application Specific Integrated Circuit (ASIC). In embodiments of the present invention, computer-readable storage media may be any tangible media that contains or stores a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

Since the apparatus, device, computer-readable storage medium, and computer program product in the embodiments of the present invention can be applied to the above-mentioned method, the technical effects that can be obtained can also refer to the above-mentioned method embodiments, and the embodiments of the present application will not be repeated here.

The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto, and any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims (6)

1. The message transmission method is characterized by being applied to a secure access terminal module, wherein the secure access terminal module is a module in a first system of a user terminal, and the user terminal comprises the first system and a second system; the first system is an encrypted system according to the secure access terminal module, the second system is an unencrypted system, and the first system and the second system are connected through a secure chip; the method comprises the following steps:

establishing a transmission channel between the secure access terminal module and a secure access gateway; the security access gateway is an access gateway in an enterprise intranet accessed by the user terminal; the transmission channel connects the secure access terminal module and the secure access gateway through the secure chip and the second system;

Negotiating a key with the security access gateway through the transmission channel to determine a session master key;

encrypting a data message to be transmitted according to the session master key, and determining a first encrypted message;

sending the first encrypted message to the security access gateway through the transmission channel;

before the data message is encrypted according to the session master key and the first encrypted message is determined, the method further comprises:

acquiring the data message to be transmitted;

sending first indication information to an external encryption module; the first indication information is used for indicating the external encryption module to report the session master key;

receiving the session master key from the external encryption module;

the external encryption module is an encryption module externally connected to the user terminal, and is communicated with the user terminal through a national secret virtual private channel OpenVPN;

the step of negotiating a key with the security access gateway through the transmission channel to determine a session master key includes:

sending second indication information to the external encryption module, wherein the second indication information is used for indicating the external encryption module to generate the session master key according to a pre-made certificate and a pre-master key; wherein the premaster secret is generated by the external encryption module, which stores the premade certificate.

2. The method of claim 1, wherein the encrypting the data message to be transmitted according to the session master key, and determining the first encrypted message, comprises:

in a handshake phase, determining security parameters selected by the security access gateway; the security parameters include at least one of: session identification, the prefabricated certificate, a compression algorithm, a password specification, a session master key and a reuse identification;

and encrypting the data message to be transmitted according to the security parameters, and determining the first encrypted message.

3. A message transmission device, characterized in that the device comprises a communication unit and a processing unit:

the processing unit is used for establishing a transmission channel between the secure access terminal module and the secure access gateway; the security access gateway is an access gateway in an enterprise intranet accessed by the user terminal; the transmission channel is connected with the secure access terminal module and the secure access gateway through a secure chip and a second system;

the processing unit is further configured to negotiate a key with the secure access gateway through the transmission channel, and determine a session master key;

the processing unit is further used for encrypting the data message to be transmitted according to the session master key and determining a first encrypted message;

The communication unit is used for sending the first encryption message to the security access gateway through the transmission channel;

the processing unit is further configured to obtain the data packet to be transmitted;

the communication unit is further used for sending first indication information to the external encryption module; the first indication information is used for indicating the external encryption module to report the session master key;

the communication unit is further configured to receive the session master key from the external encryption module;

the external encryption module is an encryption module externally connected to the user terminal, and is communicated with the user terminal through a national cipher OpenVPN;

the communication unit is further configured to send second indication information to the external encryption module, where the second indication information is used to instruct the external encryption module to generate the session master key according to a pre-made certificate and a pre-master key; wherein the premaster secret is generated by the external encryption module, which stores the premade certificate.

4. The apparatus of claim 3, wherein the device comprises a plurality of sensors,

the processing unit is further configured to determine, in a handshake phase, a security parameter selected by the security access gateway; the security parameters include at least one of: session identification, the prefabricated certificate, a compression algorithm, a password specification, a session master key and a reuse identification;

The processing unit is further configured to encrypt the data packet to be transmitted according to the security parameter, and determine the first encrypted packet.

5. A message transmission apparatus, comprising: a processor and a memory; wherein the memory is configured to store computer-executable instructions that, when executed by the message transmission device, cause the message transmission device to perform the message transmission method of any of claims 1-2.

6. A computer readable storage medium comprising instructions which, when executed by a message transmission apparatus, cause the computer to perform the message transmission method of any of claims 1-2.