TWI247515B - End-to-end encryption system and method - Google Patents

Abstract

The present invention provides an end-to-end encryption system and method. The system comprises: a service end processing service-end format data to provide services and having decryption key and encryption key; a client end requesting the services; and a server providing an input interface. The server has a mapping rule and is coupled to the client end and the service end. The input interface is used to receive the related data of the service end. The client end obtains the encryption key and the mapping rule, and obtains the input interface from the server. The input interface receives the related data from the service end. The client end converts the related data from the service end into the data of service-end format, and then executes the encryption process to the data of service-end format to convert them into encrypted data.

Description

1247515 V. INSTRUCTIONS (1) [Technical field to which the invention pertains] and particularly related to the kind of end-of-line network security mechanism. [Prior Art] Using a web server to provide a web page At the same time, in order to maintain the web service, it is a universal application. The metropolitan area between the client uses an encryption ^ 钊 = full, the web server and the most common practice at present is on the web page; =: no discussion, the connection communication layer (Security Socket τ ° and user cake Utilize the security security mechanism. In the new application, Uyer, hereinafter referred to as SSL, is the real rh#. The integrated service on the Internet is the trend of the husband, that is, via a web page ^• “Life service”, no network service. Said that the server provided by different vendors, and the server provides multiple pages connected by the network as a user interface, the above-mentioned services are merged into the same-integrated network ^ ^ m ^ The above architecture is shown in Figure 1. When the network service of the server is received, the integrated webpage is obtained by the user device 61. Then, the user inputs the relevant page of the network service, and inputs the information to the integrated network through the SSI. $ ϋ饴 ϋ饴 ϋ饴 ϋ饴 ϋ饴 ϋ饴 整合 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 、 The page server 61 must first decrypt the encrypted data, and the data conversion rule 1 of the above data belongs to each service, j knife > material converted into the data format required by the corresponding server. Then 'utilize each server and web server Encryption between devices

1247515

The encryption key encrypts the converted data required by each server, and then combines the encrypted conversion data into a service message, such as a simple object access protocol (Simple Object Access Pr〇t〇c〇1, referred to as s〇Ap). ) messages are sent to each server separately. After receiving the encrypted converted data, the server 73-75 obtains the converted data from the encrypted converted data by using a decryption key that is separately owned by the server 73-75. In the conventional architecture, because the data received by the web page is converted, the information is decrypted after the relevant data is encrypted and sent. The SSL mechanism is peer-to-peer (p-serving mechanism, although it can meet the requirements of the user terminal 5, but if the above part of the network belongs to the confidential information required by each server, only the corresponding server can serve the server 6 1 It is not allowed to obtain the confidential information decrypted by the server 611 on the previous page. Therefore, during the process of sending from the client 51, the current system cannot be fully equipped with a confidential data solution for the client. In view of this, the purpose of the present invention is to satisfy the method of transmitting the server from the client. The user of the network must pass through the network. The above network service is expected to be in the above web server 6 1 int_to-P〇int. The security of the information stored in the web server between the server and the server is the confidential information, that is, when the above legal acquisition, the theoretical web page describes the confidential information, so there is a risk of being stolen through the network. Machine male, data to the server side 7 3 - 7 5 This is all the requirements of the woman. Therefore, the solution needs to be transmitted to the server in a confidential manner. The process of providing a kind of end-to-end encryption system confidential information to the server is provided.

1247515 V. Inventive Note (3) Compliance with Security and Confidentiality Requirements = Peer Encryption System, the server of the secret key and encryption key: Please have a solution * Provide a feeding device for the input interface. The second end of the above =, coupled to the user is used by the ^, +, < U service to have a mapping rule, the incoming interface of the server is used to receive the gold gun: mapping rules from:: = = = close face. The above input interface pile % pays the entrant to the media according to the above mapping rules ^, the relevant information of the terminal. The above-mentioned user is replaced with the server-side form data, and then the server-side data is transferred to the server-side data to perform the addition and the second-key key pair. The present invention provides one; m is = data. Including the server-side form; 〇;;== the server that encrypts the key, the server that requests the service, and has the decryption key and the interface. The client of the above servo, and the user terminal of the providing wheel and the server. The mapping rules are connected to the relevant information of the server. The interface is configured to receive the mapping rule and obtain the encryption key from the server 2 and the input interface to receive the input interface. The above mapping rules will have been received above:::. The above-mentioned user terminal performs the encryption process according to the above-mentioned data and then encrypts the above-mentioned encryption::=== terminal-type data to become the above-mentioned converted service terminal shape [Embodiment] $7page 0213-A40049TWF(Nl);A2B92610;J〇SEPH.ptd 1247515 V. Description of invention (4) This test is to provide a record of the remaining 办························· The system and the method for the confidential information must be cryptographic; in the process, the above-mentioned = 2 is an end-to-end diagram of a preferred embodiment of the present invention, which includes the user terminal 50, the web page, and the first And the silk network 跤 8 η,,, with the Beller server 60, the server 70-72, and the shoulder, material 8G. Between the Internet NET paste 50 and the server 70-72 can be translated from the service only, the user 钿 以 以 以 以 以 以 以 以 以 以 以 以 以 以 H H H 虽 虽 虽 虽 虽 虽 虽 虽 虽 虽 虽 虽 虽 虽 虽 虽 虽 虽 虽 虽 虽 虽The end 70-72, however, the web server uses the knowledge 50, the web server mode is coupled to the client 50 and the server 7〇_72, and the second domain network or the wireless telephone network can be used. The following describes the flow of the end-to-end encryption method of the domain network and the wireless zone. Figure and Figure 3 'The evaluation server 70-72 handles the server 7〇_72 respectively for different services' such as insurance services, payment ^^ (4) batch server 70-72 respectively configured with corresponding encryption and wealth management services . Each key) and the decryption key 'decryption key' are used to encrypt the encryption mechanism between ^nCryption. The web page feeder 60 provides the integration of the end user and the web page as the end user 70-72 of the user terminal. The above-mentioned enlightenment network 100 is used to prompt the appropriate input field and receive the relevant information required by the server 70 for oral administration. In the embodiment shown in FIG. 2, the input W00 of the integration = has the input field 'used to prompt the data required for the network service of the receiving end 70; the rounding area m has the input = bit for The phase required for prompting the user and receiving the network service of the server 71 is 0213-A40049TWF(N1); A2B92610; JOSEPH.ptd $8 page 1247515 V. Description of the invention (5) Information "· Input area 102 has an input block The information required to prompt the user and receive the network service of the server 72. In addition, in this implementation: each of the input areas 100, (1), and 1〇2 respectively include a hidden area 3 1 ° 1 & 1〇2a, respectively storing the corresponding server end 70-72 and two: A key. The mapping rule is used to represent the above input area, and the network service data and server received by Jin? 〇_72 can correctly read: the correspondence between:, for example, the data field is converted into the conversion rule of the extension H II i, so that the server 70-72 can correctly read the terminal, the service, the service Bessie. In addition, the encryption key is the service provider. The encryption key in the key pair. The road service shows that when the user f wants the server 7G-72 to provide the webpage integration page 2: Ϊ I 2 = first obtain the above web server 60 from the second = use display? Above =:; User 1 User's turn-in service I, page 1 〇. Next, the integrated web page 10 receives the step S4). 1 The relevant information required by the Internet service of the server 70-72 (after the completion of the dij 2, the client 50 is sent a plug-in in the \〇a of the above-mentioned server 7〇-72 5 〇1) According to the received data, the server 7 and n彳 convert the input module 〇〇〇〇102 to the plug-in program 5〇b, respectively, in the form of Ββ〇~72 (step %). Then, the above 70-72 form data is executed, and the encryption key of the terminal 7 〇 _72 is used for the above-mentioned server material 11 and the service total 71 = the encryption program is made into the encrypted data 111 of the server 70 (10). End 72 encrypted data 0213-A40049TW (N1); A2B92610; J〇seph.

Ptd Page 9 1247515 V. Inventive Note (6) 112, and the encrypted data 11 of the server 70-72 is overwritten with the data 11 (step S8). Next, the client 50 transmits the reply data ^ to the encrypted data 110-112 of 7=7" 2 and returns it to the web server.

When the web server 60 receives the reply data and its 110-11 2, since there is no decryption of the server 70-72, the current round τ^A is decrypted, so the server 70 is directly encrypted. The resource 110 forms a service message 12〇 and transmits it to the server 7〇 (step S1, the encrypted data of the server 71, constitutes the service message 21 and transmits it to the server 71 (step S14), and the server 72 The encrypted data 112 constitutes a service message, and is transmitted to the server 7 2 (step s 1 6 ). ~ When the server 70 receives the encrypted data 11 金, the 牛牛枪二密资,: execute the decryption program 伽幡诚7Ί裕t Γη 枓1 executes the decryption process to become the service=1 form data (step S15); #服务端2 receives the addition==^ is decrypted by the server 72 to perform the encryption data 112 as the server 72 form data (Step S17). The server 7〇_72 is further divided into one location to describe the server 70-72 form data to provide a corresponding service. Min Min _ Bai 3 Ming preferred embodiment of the end-to-end encryption system, although To use the segmentation encryption between the client and the server to pass the message key and mapping rules, but To limit the invention, also can obtain the required encryption keys and mapping rules through other channels in real-L ir 'end user, through the integration of acquired pages without 1〇.

0213-A40049TWF(N1); A2B92610; J OSEPH.ptd Page 10 1247515 V. Inventive Description (7) In addition, the end-to-end encryption system of the preferred embodiment of the present invention is applied to the service, the end and the user end. The encryption/decryption key pair may be a non-symmetric encryption system (a public resource mechanism (publlc key infrastructure, hereinafter referred to as ρκΙ), a symmetric key (^ymmetric key), or a combination of the two. In the case of ρκι, the encryption key of the server 7〇_72 is the public key (puM1C key), and the decryption key is the private key (private. In the case of applying the symmetric key, the server The above-mentioned encryption and decryption keys of “72” are the private keys of the server 7〇—72. In this case, the port and the page 1 are not suitable as a way to pass the encryption key. The user=5.0 must pass other security. The way to obtain the private key of the server 7〇72 is: in the case of the combination of the above two, the public key of the server 7-72 of the server 70-72, the upper end of the server 70-72 \ ϊϊί's private key. And on The user server 70-72 form data becomes the server 7 2 ^ The server 7G-72 public key encryption The above symmetry Λ The encrypted data of the server 70 and the symmetric key of the server are used to form the encrypted data. Π η 4 gold input encryption. ΒΒ ^ In Bellow 11 0. The above-mentioned server 71 adds the fast 2 " the symmetric key of the terminal 71 is encrypted to form the encryption key ', sister 111. The above service The encrypted data of the terminal 72 and the symmetric golden record encrypted in the bead material constitute the public key of the encryption service heart. In the above decryption procedure, the server 7〇_72 has its own private 1247515. 5. The invention description (8) After the golden wheel is encrypted, 70-72 decrypts the obtained key to obtain the symmetric key. The service end material f. The above-mentioned encryption resource of the key decryption server 70-72 is Ϊ=!5 2π: The page server 60 can utilize SSL to have the webpage server 60. In this case, the above-mentioned webpage will be used to decrypt the key, and the above-mentioned user will be decrypted. The end 3 secret data is transmitted to the above-mentioned webpage server 70-72 of the above The second page = page / server device encryption gold, the encryption server page server 60 receives, uploads the message for re-encryption. When the above network uses the web server to write and re-encrypt the data, the above-mentioned web server 60 data 110-112" The key decrypts the above-mentioned re-encrypted data into the above-mentioned encrypted end, and the application can also be added to the side of the sign, so that the service can be injured by the stab. For example, in the user end, the user can sign the signature. : ί ^ ΡΚΐΛ private key to the network service related resources, order 'and the signature data combined in the encrypted data can be 訇 1f. After decrypting the relevant information of the network service, the server: 2 uses the user's public account to verify, in order to confirm that the user is in the service of the banker 70-72 is not limited to providing web services, can mention Two in the mussel λ service' or application. The web server 60 is configured to output data to the client and transmit the data to the server 7 to 72. The web server is not limited to the web server 'may be other feeding devices. The above input is not limited to the web page. . The above mapping rules and encryption of the server 70-72

1247515 V. Description of the invention (9) The key does not have to be provided by the web page 10, and can be obtained by the client terminal 50 at different times. While the present invention has been described above by way of a preferred embodiment, it is not intended to limit the invention, and the present invention may be modified and modified without departing from the spirit and scope of the invention. The scope of protection is subject to the definition of the scope of the patent application.

0213-A40049TWF(N1);A2B92610;JOSEPH.ptd Page 13 1247515 BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a block diagram showing an integrated service system architecture in a prior art; FIG. 2 is a cross-sectional view showing a preferred embodiment of the present invention. A block diagram of an encryption system architecture, and FIG. 3 is a flow chart showing an end-to-end encryption method in accordance with a preferred embodiment of the present invention. [Symbol description] I 0~page; 11~ reply data; 50, 51~user; 50a~browser; 5 0 b~ plugin; 6 0,6 1~web server; 7 0 - 7 5~ service 8 0~Internet; 100-102~ input area; 100a-102a~Hidden area; 110~ encrypted data of server 70; II 1~ encrypted data of server 71; 11 2~ encryption of server 72 Information; 1 2 0 - 1 2 2~ Service Message.

0213-A40049TWF(N1);A2B92610;JOSEPH.ptd第14页

Claims (1)

1247515 System, including at least one plus one for one input and one input channel service, for the data to be above and from the above related information, a server secret key and the terminal, using the server, lightly to the above The related information indicates that the above-mentioned user 4 server uses the above-mentioned input to convert the user into an encryption system for requesting a decryption μ request to connect to at least the input interface of the upper user terminal to obtain the interface interface according to the server end. Providing a network service, and configuring a pair of records; the above-mentioned network user, the above-mentioned road service; and the terminal and the server, and providing an input interface having receiving the input area of the network, and having a mapping plane received Corresponding relationship of the above-mentioned network service related information; the above-mentioned encryption key and the above mapping rule, input interface; receiving relevant information of the above network service; the above mapping rule will be the form information of the above network service; and wherein the above-mentioned user terminal The above encryption key performs an encryption process on the server-side form data. Data encryption. 2. The end-to-end encryption system according to claim 1, wherein the client transmits the encrypted data to the server. 3. The end-to-end encryption system according to claim 2, wherein the server transmits the encrypted data to the server when the server receives the encrypted data. 4: The end-to-end encryption system according to claim 3, wherein when the server receives the encrypted data, the server performs a decryption process on the encrypted data by using the decryption key. 1247515 VI. Patent Application Scope In the network, the end-to-end encryption system page described in 5. The server is a web server, and the input interface is 6 $7, and the above-mentioned service of the above-mentioned server is added to the above-mentioned "golden key" system, wherein, the upper, the = Γ ί profit range is 5 The end-to-end encryption system described in the item, a is configured to display the webpage via a browser via a browser, and to convert the data and the encryption process in the above-mentioned encryption process, the above: The peer encryption system transmits the encrypted data to the above I:: the secret is re-encrypted data, and the key is added to the encrypted data, Γ when the server receives the re-encrypted data and decrypts into the encryption data. The key re-encrypts the above-mentioned re-encrypted data to perform the end-to-end encryption system described in the above description. The public key and the private key are separately disclosed as a public accounting mechanism. 〇· An end-to-end encryption method , pumping y a person ^ person end, a use of the furnace deduction one # Ββ law is bound to include at least one service - network services and integration: on: ^ 罔 road system, the above server provides the above use? End == input interface, * key is determined by the above server = and a solution ", gold correction, which decryption page 16 0213-A40049TWF (N1); A2B92610; JOSEPH.ptd 1247515 VI, the scope of patent application $ = The server provides the above input interface to the above network service. The above input mask has a mapping rule for referring to the input interface. u ^___. ^ Ha ^ ^ The above input interface of Dan A There is a mapping rule, which is used to indicate: (2) the correspondence between the related information of the above-mentioned network service received by the two rains to the form information of the above-mentioned service knowledge; ΐ ΐ : : : : : : : : : : : : : : : : 上述 上述 上述The network service t 5 ί: in the terminal, the above mapping rule is used to convert the above-mentioned network service to a server-side data; and ##资i ^, in the terminal, using the above-mentioned encryption key, The above server form is encrypted as an encrypted data. The end-to-end encryption method described in the first paragraph of the patent scope of the patent, the end of the transmission method, after the encryption program, the encrypted data is transported from the user to the server. Lizhong 12. In the end-to-end encryption method described in item wu of the patent application scope, after the step of encrypting data, the encrypted data is transmitted from the above to the server. a, in the end-to-end encryption method described in Item 12 of |IL 81, i: service = confidential data to the step of the above server, in the program. And decrypting the encrypted data by using the above decryption key. 14. The end-to-end encryption method described in item 10 of the scope of the specification, the network; 4, the server is a web server' and the above-mentioned wheeling interface is one. As described in claim 14, the end field encryption method is 0213 -A40049TWF(Ν1);Α2Β92610;J OSEPH.p t d Page 17 1247515 Patent Application Scope The above web page contains the above-mentioned encryption key of the above server. The end-to-end encryption method as described in claim 4, wherein the user terminal displays the webpage via a browser, and the browser performs conversion of the data and the encryption program via a plug-in. The end-to-end encryption method as described in claim 2, wherein the server has a server encryption key and a server decryption f. The client transmits the encrypted data to the above. Before the server, the client encrypts the encrypted data with the server encryption key to re-encrypt and add data; when the server receives the re-encrypted data, the server decrypts the key by using the server. The re-encrypted data is decrypted to become the encrypted data. The method of claim 20, wherein the encryption key and the decryption key are a public key and a private key of a public key mechanism.幵1 9 · An end-to-end encryption method, which is executed on a server, the server is coupled to a server for providing a network service and a client requesting the network service through a network, including The following steps: providing an input interface to the user terminal, the input interface includes an input area for receiving related information of the network service; - blowing receiving a reply data from one of the user terminals, which includes at least one twisting material The encrypted data is generated by encrypting the related data of the network service by using a plus key, and the decryption key corresponding to the encrypted key is stored in the server, wherein the encrypted data includes the network service. The relevant data is in accordance with the reading format of the above server; 0213-A40049TWF(N1); A2B92610; JOSEPH.ptd Page 18 !247515 VI. Application for Patent Scope The above-mentioned encrypted data in the above-mentioned reply data is extracted; and the above-mentioned server corresponding to the encrypted data extracted and sent out is transmitted. Complex 2 〇 · As described in the end-to-end encryption method described in claim 19, " The above input interface further includes the above encryption key. 21 · The end-to-end encryption method described in item 19 of the patent application scope, the Jinlun transmission and decryption* are the end of the public disclosure of the public payment mechanism 2 2 2 patent application scope For the peer encryption method, the input interface of 〆 and τ is a web page. The end-to-end encryption method described in item 丨g of the patent application scope, force: confidential, is the encryption mechanism between the server and the client, and includes before the extraction step One step: the encryption mechanism between the data server and the client performs the above reply to the above-mentioned reply. 4 · An end-to-end encryption method is performed on the above, and the following steps are included: , the input interface of the device's input interface contains one of the input areas of the ί Ϊ 2 Ϊ road service; data; the input "face, the corresponding connection to the above network service is obtained: ΐΐ::☆ The data related to the network service is converted into a character encryption. 21 Τ: ΐ: The affiliation of the above-mentioned network service is carried out. The decryption key corresponding to the above-mentioned encryption key is the 19 I 〇 213.A40049TO ( Nl);^B9261〇;J〇SEpH>ptd 1247515 6. The patent application scope is placed on the above server; and a reply data containing one of the above encrypted data is transmitted to the above server. The end-to-end encryption method according to claim 24, wherein the input interface further comprises the above encryption key. The end-to-end encryption method as described in claim 24, wherein the encryption key and the decryption key are a public key and a private key of a public key mechanism. The end-to-end encryption method as described in claim 24, wherein the input interface is a web page. 28. The end-to-end encryption method as described in claim 24, further comprising the step of: prior to the transmitting step, encrypting the reply data by using an encryption mechanism between the server and the client. The end-to-end encryption method according to claim 24, wherein the input interface includes the above mapping rule. 0213-A40049TWF(N1); A2B92610; JOSEPH.ptd Page 20