CN117675175A - Secret communication method and system for HTTP - Google Patents

Secret communication method and system for HTTP Download PDF

Info

Publication number
CN117675175A
CN117675175A CN202311705050.5A CN202311705050A CN117675175A CN 117675175 A CN117675175 A CN 117675175A CN 202311705050 A CN202311705050 A CN 202311705050A CN 117675175 A CN117675175 A CN 117675175A
Authority
CN
China
Prior art keywords
data
request
key
http
encrypted
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202311705050.5A
Other languages
Chinese (zh)
Inventor
徐景龙
吴佐平
古敬彬
甄宗
刘若怡
王斌
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing China Power Information Technology Co Ltd
Original Assignee
Beijing China Power Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing China Power Information Technology Co Ltd filed Critical Beijing China Power Information Technology Co Ltd
Priority to CN202311705050.5A priority Critical patent/CN117675175A/en
Publication of CN117675175A publication Critical patent/CN117675175A/en
Pending legal-status Critical Current

Links

Landscapes

  • Computer And Data Communications (AREA)

Abstract

The present disclosure provides a secure communication method and system for HTTP, where the scheme includes: when a data request is made, automatically generating a sm4 key, and encrypting plaintext data contained in the current request based on the sm4 key to obtain first encrypted request data; wherein, the plaintext data is an interface parameter; the sm4 key is adopted to encrypt the request time range, and second encryption request data is obtained; encrypting the sm4 key by adopting a prestored sm2 public key to obtain third encryption request data; acquiring the plaintext data and a data abstract of a request time range by adopting an sm3 algorithm; combining the first encryption request data, the second encryption request data, the third encryption request data and the data abstract, and sending the combination to a response end in a request message mode; receiving a response message corresponding to the request message from the response end, and obtaining the plaintext data of the request by decrypting the data in the response message.

Description

Secret communication method and system for HTTP
Technical Field
The disclosure belongs to the technical field of communication, and particularly relates to a secret communication method and system for HTTP.
Background
The statements in this section merely provide background information related to the present disclosure and may not necessarily constitute prior art.
In the current I T technology, whether the APP, the WeChat applet or the webpage is accessed through a mobile phone or a PC, the background service is finally accessed. Whereas access to the background services is typically in units of an http interface. The inventors found that using the traditional http interface for the received and returned data, the following security issues exist:
eavesdropping risk: since HTTP is a plaintext transmission protocol, data is not encrypted in the transmission process, so that an attacker may eavesdrop and acquire sensitive information, such as a user name, a password, a bank card number, and the like;
man-in-the-middle attack: an attacker can intercept the data packet in the transmission process and tamper or inject malicious content, thereby implementing the attack;
CSRF (cross station request forgery) attack: an attacker can forge a request authenticated by a user, and execute malicious operations such as malicious form submission, request initiation and the like with the identity of the user;
data tampering: an attacker can intercept the data and modify it, thereby attacking the Web application.
Currently, although there are some simple solutions, such as encapsulating HTTP as HTTPs, HTTPs still presents a risk, which is expressed in:
certificates are hijacked or forged: an attacker may hijack or forge certificates in man-in-the-middle attacks, resulting in users accessing fake websites or being attacked by man-in-the-middle; using weak encryption algorithms or old versions: if weak encryption algorithms or old versions of SSL/TLS protocols are used, HTTPS connections may be broken or eavesdropped, revealing sensitive information;
misconfiguration or improper setting: when HTTPS is set, incorrect configuration or improper setting may occur, such as improper use of HTTP Str ict Transport Secur ity (HSTS) or improper configuration of a certificate chain, etc., resulting in a security hole or error.
Disclosure of Invention
In order to solve the problems, the disclosure provides a secret communication method and a secret communication system for HTTP, wherein the scheme adopts an autonomous EDFP (EncryptDataFi lterPay load) format to carry out HTTP communication, and adopts a sm2-sm3-sm4 cryptographic algorithm to encrypt and decrypt HTTP transmission data and extract and integrate the data, so that the data is encrypted and transmitted, and in the HTTP communication process, the data is transmitted in a ciphertext form, so that the data cannot be intercepted or cracked, and the complete confidentiality in the data transmission process is ensured; meanwhile, the scheme effectively prevents the replay attack problem in the http communication process by adopting the encryption transmission of the request or return time range.
According to a first aspect of the embodiments of the present disclosure, there is provided a secure communication method for HTTP, which is applied to a requesting end, including:
when a data request is made, automatically generating a sm4 key, and encrypting plaintext data contained in the current request based on the sm4 key to obtain first encrypted request data; wherein, the plaintext data is an interface parameter;
the sm4 key is adopted to encrypt the request time range, and second encryption request data is obtained; encrypting the sm4 key by adopting a prestored sm2 public key to obtain third encryption request data; acquiring the plaintext data and a data abstract of a request time range by adopting an sm3 algorithm;
combining the first encryption request data, the second encryption request data, the third encryption request data and the data abstract, and sending the combination to a response end in a request message mode;
receiving a response message corresponding to the request message from the response end, and obtaining the plaintext data of the request by decrypting the data in the response message.
Further, the obtaining the plaintext data of the request by decrypting the data in the response message specifically includes:
receiving a response message returned by a response terminal;
decrypting the third encrypted return data in the response message based on the pre-stored sm2 private key to obtain a decrypted sm4 key;
decrypting the first encrypted return data in the response message based on the sm4 key to obtain plaintext data;
and extracting a data abstract of the plaintext data based on the sm3 algorithm, comparing the data abstract with the data abstract in the response message, and if the comparison is consistent, performing page display based on the obtained plaintext data.
Further, when the comparison results are inconsistent, performing error prompt; and decrypting the second encrypted return data in the response message based on the sm4 key to obtain a return time range, and terminating the data request if the current time exceeds the return time range.
Further, the request terminal automatically generates a new sm4 key each time a data request is made.
According to a second aspect of the embodiments of the present disclosure, there is provided a secure communication method for HTTP, which is applied to a responding side, including:
receiving a data request message from a request end;
decrypting the third encrypted request data in the request message based on a pre-stored sm2 private key to obtain a decrypted sm4 key;
decrypting the first encrypted request data in the request message based on the sm4 key to obtain plaintext data;
and extracting a data abstract of the plaintext data based on an sm3 algorithm, comparing the data abstract with the data abstract in the request message, and if the comparison is consistent, encrypting the data requested by the request terminal based on the parameter information in the plaintext data and then sending the data to the request terminal.
Further, when the comparison results are inconsistent, the data request is terminated; and decrypting the second encrypted request data in the request message based on the sm4 key to obtain a request time range, and terminating the data request if the current time exceeds the request time range.
Further, the data requested by the request end is encrypted and then sent to the request end, specifically:
when data is returned, automatically generating a sm4 key, and encrypting returned plaintext data based on the sm4 key to obtain first encrypted returned data;
encrypting the return time range by adopting the sm4 key to obtain second encrypted return data; encrypting the sm4 key by adopting a pre-stored sm2 public key to obtain third encrypted return data; acquiring returned plaintext data and a data abstract of a return time range by adopting an sm3 algorithm;
and combining the first encrypted return data, the second encrypted return data, the third encrypted return data and the data abstract, and sending the first encrypted return data, the second encrypted return data, the third encrypted return data and the data abstract to the request end in a return message mode.
Further, the response end automatically generates a new sm4 key every time data return is carried out.
According to a third aspect of the embodiments of the present disclosure, there is provided a secure communication method for HTTP, including the above secure communication method for HTTP applied to a request terminal, and the above secure communication method for HTTP applied to a response terminal.
According to a fourth aspect of embodiments of the present disclosure, there is provided a secure communication system for HTTP, comprising:
a request terminal for executing a secret communication method for HTTP applied to the request terminal;
and the response end is used for executing the secret communication method for HTTP, which is applied to the response end.
Compared with the prior art, the beneficial effects of the present disclosure are:
the scheme adopts an autonomous EDFP format to carry out HTTP communication, adopts a sm2-sm3-sm4 cryptographic algorithm to encrypt and decrypt HTTP transmission data and integrates data extraction, realizes encrypted transmission of the data, and can effectively ensure that the data cannot be intercepted or cracked in the HTTP communication process and ensure the complete confidentiality in the data transmission process; meanwhile, the scheme effectively prevents the replay attack problem in the http communication process by adopting the encryption transmission of the request or return time range.
Additional aspects of the disclosure will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the disclosure.
Drawings
The accompanying drawings, which are included to provide a further understanding of the disclosure, illustrate and explain the exemplary embodiments of the disclosure and together with the description serve to explain the disclosure, and do not constitute an undue limitation on the disclosure.
Fig. 1 is a flowchart of a secure communication method for HTTP according to an embodiment of the present disclosure.
Detailed Description
The disclosure is further described below with reference to the drawings and examples.
It should be noted that the following detailed description is illustrative and is intended to provide further explanation of the present disclosure. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs.
It is noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of exemplary embodiments in accordance with the present disclosure. As used herein, the singular is also intended to include the plural unless the context clearly indicates otherwise, and furthermore, it is to be understood that the terms "comprises" and/or "comprising" when used in this specification are taken to specify the presence of stated features, steps, operations, devices, components, and/or combinations thereof.
Embodiments of the present disclosure and features of embodiments may be combined with each other without conflict.
Embodiment one:
an object of the present embodiment is to provide a secure communication method for HTTP.
A secure communication method for HTTP, applied to a requesting end, comprising:
when a data request is made, automatically generating a sm4 key, and encrypting plaintext data contained in the current request based on the sm4 key to obtain first encrypted request data; wherein, the plaintext data is an interface parameter;
the sm4 key is adopted to encrypt the request time range, and second encryption request data is obtained; encrypting the sm4 key by adopting a prestored sm2 public key to obtain third encryption request data; acquiring the plaintext data and a data abstract of a request time range by adopting an sm3 algorithm;
combining the first encryption request data, the second encryption request data, the third encryption request data and the data abstract, and sending the combination to a response end in a request message mode;
receiving a response message corresponding to the request message from the response end, and obtaining the plaintext data of the request by decrypting the data in the response message.
In a specific implementation, the obtaining the plaintext data of the request by decrypting the data in the response message specifically includes:
receiving a response message returned by a response terminal;
decrypting the third encrypted return data in the response message based on the pre-stored sm2 private key to obtain a decrypted sm4 key;
decrypting the first encrypted return data in the response message based on the sm4 key to obtain plaintext data;
and extracting a data abstract of the plaintext data based on the sm3 algorithm, comparing the data abstract with the data abstract in the response message, and if the comparison is consistent, performing page display based on the obtained plaintext data.
In the specific implementation, when the comparison results are inconsistent, performing error prompt; and decrypting the second encrypted return data in the response message based on the sm4 key to obtain a return time range, and terminating the data request if the current time exceeds the return time range.
In a specific implementation, the request end automatically generates a new sm4 key each time a data request is made.
Further, the detailed technical details of the present embodiment will be described in detail in embodiment three.
Embodiment two:
an object of the present embodiment is to provide a secure communication method for HTTP.
A secure communication method for HTTP, applied to a responding side, comprising:
receiving a data request message from a request end;
decrypting the third encrypted request data in the request message based on a pre-stored sm2 private key to obtain a decrypted sm4 key;
decrypting the first encrypted request data in the request message based on the sm4 key to obtain plaintext data;
and extracting a data abstract of the plaintext data based on an sm3 algorithm, comparing the data abstract with the data abstract in the request message, and if the comparison is consistent, encrypting the data requested by the request terminal based on the parameter information in the plaintext data and then sending the data to the request terminal.
In the specific implementation, when the comparison results are inconsistent, terminating the data request; and decrypting the second encrypted request data in the request message based on the sm4 key to obtain a request time range, and terminating the data request if the current time exceeds the request time range.
In a specific implementation, the data requested by the request end is encrypted and then sent to the request end, specifically:
when data is returned, automatically generating a sm4 key, and encrypting returned plaintext data based on the sm4 key to obtain first encrypted returned data;
encrypting the return time range by adopting the sm4 key to obtain second encrypted return data; encrypting the sm4 key by adopting a pre-stored sm2 public key to obtain third encrypted return data; acquiring returned plaintext data and a data abstract of a return time range by adopting an sm3 algorithm;
and combining the first encrypted return data, the second encrypted return data, the third encrypted return data and the data abstract, and sending the first encrypted return data, the second encrypted return data, the third encrypted return data and the data abstract to the request end in a return message mode.
In a specific implementation, the response end automatically generates a new sm4 key every time data return is performed.
Further, the detailed technical details of the present embodiment will be described in detail in embodiment three.
Embodiment III:
an object of the present embodiment is to provide a secure communication method for HTTP.
A secure communication method for HTTP, which includes a secure communication method for HTTP applied to a requesting terminal as described in the first embodiment, and a secure communication method for HTTP applied to a responding terminal as described in the second embodiment.
In particular, for easy understanding, the following detailed description of the embodiments will be given with reference to the accompanying drawings:
as shown in fig. 1, the present embodiment provides a secure communication method for HTTP, which specifically includes the following processing procedures:
step 1: and pre-generating a public and private key pair of sm2, wherein the public and private key pair is respectively stored in a secret manner by a request end and a response end.
Step 2: for the requesting end, a new sm4 key is generated each time it requests. Encrypting plaintext data (e.g., interface parameters) using the sm4 key to obtain encrypted data (i.e., first encryption request data): encryptData;
step 3: encryption of the request time range (i.e., the second encryption request data) using the sm4 key: encryptTime;
step 4: encrypting the sm4 key using the public key of sm2 results in an encrypted sm4 key (i.e., third encryption request data): encryptekey;
step 5: summarizing the plaintext data and the time range using sm3 to obtain a data summary: d igest
Step 6: four parts encryptData, encryptKey, encryptTime and d igest are used as parameters of the interface to access. The four parts are combined into a whole encryption regular chain carrier EncryptDataFi lterPay load, which is called EDFP for short.
Step 7: after receiving the EDFP, the response end decrypts the encrypteKey by using the private key of sm2 to obtain a decrypted key of sm4, decrypts encryptedata by using the key of sm4 to obtain a decrypted data plaintext, compares the plaintext by using sm3 abstract and d igest, if the data plaintext is identical, the data plaintext is not tampered and continues to be executed, and if the data plaintext is different, the data plaintext is tampered, and prompts and terminates the program. If the current time is outside the encryptTime time range, the procedure is terminated. Unrestricted replay attacks are prevented.
Step 8: the existing httpservlet does not support encryption requests, and in order to enable the httpservlet to meet the receiving of encrypted request data and execute decryption of the encrypted data, the following strategy is specifically executed: the response end rewrites the httpServ, the newly added parameters process the unified entry, accepts the encryption parameters, and repackages the encryption parameters into new input stream in post mode and repartition parameters in get mode.
Step 9: generating a new sm4 key by the response end every time the response end returns a message, and encrypting the returned data by using the key to obtain encrypted data (namely first encrypted returned data): encryptData; encrypting the sm4 key using the sm2 public key to obtain an encrypted sm4 key (i.e. third encrypted return data): encryptekey; and sm4 encrypt return time range (second encrypted return data): encryptTime; the returned data is summarized using sm 3: d igest. A new EDFP is formed.
Step 10: the existing httpservlet does not support encrypted return, and in order to enable the httpservlet to meet the return of encrypted data, the following strategy is specifically implemented: the response end rewrites the httpServ, the new return result processes the unified export, generates a new encrypted output stream and returns the new encrypted output stream to the request end.
Step 11: after the request receives the new EDFP, it is decrypted using the sm2 private key. The sm4 key is decrypted, then the returned data is parsed by the sm4 key, and whether the data is tampered is determined by digest comparison. If falsification is prompted, reporting errors. If not tampered, the page data is normally displayed. If the current time is outside the encryptT time range, the program is terminated. Unrestricted replay attacks are prevented.
Step 12: and transmitting the data in the EDFP format by using an http request. And capturing EDFP data in the http data stream, and performing encryption and decryption processing in the step 11. Forming a complete closed encryption and decryption chain: data chain encryption is abbreviated as EDF.
The scheme of the embodiment designs a series of security enhancement measures such as asymmetric encryption, hash digest and the like, thereby enhancing the security in the http communication process and avoiding the conditions of cracking, tampering, replay and the like of data caused by key leakage after the interception of the data packet; according to the scheme, the EDFP format is adopted for http communication, encryption and decryption are carried out through a series of algorithms, encryption and decryption keys which are randomly generated are used for carrying out encryption processing on data for multiple times, in the http communication process, the data is transmitted in a ciphertext mode, the fact that the data cannot be intercepted or cracked can be effectively guaranteed, the scheme can ensure the complete confidentiality in the data transmission process, and therefore the safety and the integrity of the data are guaranteed, and meanwhile, replay attack in the http communication process is effectively prevented through encryption transmission in a request or return time range.
Embodiment four:
it is an object of the present embodiment to provide a secure communication system for HTTP.
A secure communication system for HTTP, comprising:
a request terminal for executing a secret communication method for HTTP applied to the request terminal;
and the response end is used for executing the secret communication method for HTTP, which is applied to the response end.
Further, the system in this embodiment corresponds to the method in the first embodiment, and the technical details thereof are described in the first embodiment, so that they will not be described herein.
The secret communication method and the secret communication system for HTTP provided by the embodiment can be realized, and have wide application prospects.
The foregoing description of the preferred embodiments of the present disclosure is provided only and not intended to limit the disclosure so that various modifications and changes may be made to the present disclosure by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure should be included in the protection scope of the present disclosure.

Claims (10)

1. A secure communication method for HTTP, applied to a requesting end, comprising:
when a data request is made, automatically generating a sm4 key, and encrypting plaintext data contained in the current request based on the sm4 key to obtain first encrypted request data; wherein, the plaintext data is an interface parameter;
the sm4 key is adopted to encrypt the request time range, and second encryption request data is obtained; encrypting the sm4 key by adopting a prestored sm2 public key to obtain third encryption request data; acquiring the plaintext data and a data abstract of a request time range by adopting an sm3 algorithm;
combining the first encryption request data, the second encryption request data, the third encryption request data and the data abstract, and sending the combination to a response end in a request message mode;
receiving a response message corresponding to the request message from the response end, and obtaining the plaintext data of the request by decrypting the data in the response message.
2. The secret communication method for HTTP according to claim 1, wherein the obtaining the requested plaintext data by decrypting the data in the response message, specifically is:
receiving a response message returned by a response terminal;
decrypting the third encrypted return data in the response message based on the pre-stored sm2 private key to obtain a decrypted sm4 key;
decrypting the first encrypted return data in the response message based on the sm4 key to obtain plaintext data;
and extracting a data abstract of the plaintext data based on the sm3 algorithm, comparing the data abstract with the data abstract in the response message, and if the comparison is consistent, performing page display based on the obtained plaintext data.
3. A secure communication method for HTTP as claimed in claim 2, wherein when the comparison result is inconsistent, an error prompt is made; and decrypting the second encrypted return data in the response message based on the sm4 key to obtain a return time range, and terminating the data request if the current time exceeds the return time range.
4. A secure communication method for HTTP according to claim 1, wherein the requesting end automatically generates a new sm4 key each time a data request is made.
5. A secure communication method for HTTP, applied to a responding side, comprising:
receiving a data request message from a request end;
decrypting the third encrypted request data in the request message based on a pre-stored sm2 private key to obtain a decrypted sm4 key;
decrypting the first encrypted request data in the request message based on the sm4 key to obtain plaintext data;
and extracting a data abstract of the plaintext data based on an sm3 algorithm, comparing the data abstract with the data abstract in the request message, and if the comparison is consistent, encrypting the data requested by the request terminal based on the parameter information in the plaintext data and then sending the data to the request terminal.
6. The secret communication method for HTTP as claimed in claim 5, wherein when the comparison result is inconsistent, the data request is terminated; and decrypting the second encrypted request data in the request message based on the sm4 key to obtain a request time range, and terminating the data request if the current time exceeds the request time range.
7. The secret communication method for HTTP according to claim 5, wherein the data requested by the requesting end is encrypted and sent to the requesting end, specifically:
when data is returned, automatically generating a sm4 key, and encrypting returned plaintext data based on the sm4 key to obtain first encrypted returned data;
encrypting the return time range by adopting the sm4 key to obtain second encrypted return data; encrypting the sm4 key by adopting a pre-stored sm2 public key to obtain third encrypted return data; acquiring returned plaintext data and a data abstract of a return time range by adopting an sm3 algorithm;
and combining the first encrypted return data, the second encrypted return data, the third encrypted return data and the data abstract, and sending the first encrypted return data, the second encrypted return data, the third encrypted return data and the data abstract to the request end in a return message mode.
8. A secure communication method for HTTP as in claim 5, wherein said response end automatically generates a new sm4 key each time data is returned.
9. A secure communication method for HTTP, comprising a secure communication method for HTTP according to any one of claims 1-4 applied to a requesting end, and a secure communication method for HTTP according to any one of claims 5-8 applied to a responding end.
10. A secure communication system for HTTP, comprising:
a requesting end for performing a secure communication method for HTTP as applied to the requesting end according to any one of claims 1-4;
a response side for executing a secure communication method for HTTP as applied to the response side according to any one of claims 1-4.
CN202311705050.5A 2023-12-12 2023-12-12 Secret communication method and system for HTTP Pending CN117675175A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202311705050.5A CN117675175A (en) 2023-12-12 2023-12-12 Secret communication method and system for HTTP

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202311705050.5A CN117675175A (en) 2023-12-12 2023-12-12 Secret communication method and system for HTTP

Publications (1)

Publication Number Publication Date
CN117675175A true CN117675175A (en) 2024-03-08

Family

ID=90080596

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202311705050.5A Pending CN117675175A (en) 2023-12-12 2023-12-12 Secret communication method and system for HTTP

Country Status (1)

Country Link
CN (1) CN117675175A (en)

Similar Documents

Publication Publication Date Title
US20220312208A1 (en) Access method and system of internet of things equipment based on 5g, and storage medium
US8904178B2 (en) System and method for secure remote access
CN110535868A (en) Data transmission method and system based on Hybrid Encryption algorithm
CN110336788B (en) Data security interaction method for Internet of things equipment and mobile terminal
CN111918284B (en) Safe communication method and system based on safe communication module
CN113806772A (en) Information encryption transmission method and device based on block chain
US8099602B2 (en) Methods for integrating security in network communications and systems thereof
CN110519304A (en) HTTPS mutual authentication method based on TEE
CN110971616B (en) Connection establishing method based on secure transport layer protocol, client and server
CN114553430A (en) SDP-based novel power service terminal safe access system
CN110855561A (en) Intelligent gateway of Internet of things
CN110035035B (en) Secondary authentication method and system for single sign-on
CN113904767A (en) System for establishing communication based on SSL
CN112995140B (en) Safety management system and method
CN115333779A (en) Method and device for verifying data and electronic equipment
CN114707158A (en) Network communication authentication method and network communication authentication system based on TEE
CN117675175A (en) Secret communication method and system for HTTP
CN111935164A (en) Https interface request method
CN112069487A (en) Intelligent equipment network communication safety implementation method based on Internet of things
CN116647415B (en) Terminal bidirectional authentication method, device and cross-network and cross-domain data exchange system
CN114218555B (en) Method and device for enhancing password security strength of password management APP (application) password and storage medium
CN115208696B (en) Remote communication method and device for substation telecontrol device
CN115835194B (en) NB-IOT terminal safety access system and access method
CN112751858B (en) Data encryption communication terminal method, device, terminal, server and storage medium
CN116346505B (en) Internet of things data security communication method, system and computer readable storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination