WO2016054905A1

WO2016054905A1 - Method for processing data

Info

Publication number: WO2016054905A1
Application number: PCT/CN2015/076945
Authority: WO
Inventors: 谈剑锋; 郑建华
Original assignee: 上海众人网络安全技术有限公司
Priority date: 2014-10-11
Filing date: 2015-04-20
Publication date: 2016-04-14
Also published as: CN104243494B; CN104243494A

Abstract

A method for processing data is disclosed in the present invention. The method includes the following steps: a client obtains data to be authenticated, and encrypts the data to be authenticated with a session key stored in the client by an inside public encryption algorithm to generate the first data; then the client encrypts the data to be authenticated by a first inside algorithm to generate the second data; finally the client sends the first data and the second data to a server; after receiving the first data and the second data, the server decrypts the first data by the same session key in the client and by a public decryption algorithm corresponding to the public encryption algorithm, in order to restore and obtain the data to be authenticated; then the data to be authenticated is encrypted by the first algorithm inside the server and the third data is generated; the server compares the generated third data with the received second data, and completes the authentication of the data to be authenticated. The present invention realizes the network identity authentication, data encryption transmission and data integrality verification, and has a better technology prospect.

Description

A data processing method

Technical field

The present invention relates to the field of network information security, and more particularly to a data processing method.

Background technique

With the continuous development of the Internet, more and more people are beginning to try online trading. However, malicious threats such as viruses, hackers, phishing, and phishing scams pose great challenges to the security of online transactions. The endless stream of cybercrime has caused people's trust crisis in network identity. How to authenticate real identity in online transactions, prevent identity fraud, and confidentiality of information transmitted in the network has once again become the focus of attention.

There are many insecurities in data interaction on the Internet, especially if some confidential data is more vulnerable to hackers. Therefore, the data needs to be authenticated before the network is transmitted to prevent impersonation. When data is transmitted, it needs to be encrypted with a secure encryption algorithm to ensure that the data will not be leaked even if it is intercepted by a hacker. At the same time, it is necessary to check the data when receiving data, check whether the data has been tampered with, and prevent the middleman from posing.

Summary of the invention

The object of the present invention is to propose a data processing method capable of implementing network identity authentication, data encryption, and data integrity verification.

The technical solution of the present invention includes the following steps:

A data processing method, after the client and the server respectively generate a session key required for the session process, the client encrypts the data to be authenticated using a public encryption algorithm and sends the certificate to the server for authentication. Specific steps are as follows:

Obtaining, by the S21 client, the to-be-authenticated data, and synthesizing the first data by using the built-in common encryption algorithm in combination with the session key stored in the client; subsequently, the client uses the built-in first algorithm Encrypting the data to be authenticated to generate second data; finally, the client sends the first data and the second data to the server;

After the server receives the first data and the second data, the server performs the first data by using the same session key as the client and a public decryption algorithm corresponding to the common encryption algorithm. Decrypting and restoring to obtain the data to be authenticated; then encrypting the data to be authenticated using the first algorithm built in the server to generate third data;

S23: The server compares the generated third data with the received second data, and completes the authentication of the data to be authenticated.

In the technical solution, the connection relationship is established between the client and the server through the generated session key, that is, each time the data to be authenticated in the client needs to be authenticated by the server, the session key is used for encryption protection, ensuring that the session is secured. While the authentication data is secure during transmission, the integrity of the data to be authenticated is verified. Here we also want to explain that the client and the server can communicate in both directions. After the server and the client have established a communication relationship, the server can also send an authentication request to the client to implement the above steps.

Preferably, the first algorithm is a hash algorithm.

Preferably, before the client encrypts the data to be authenticated and sends the data to the server for authentication, the client further includes:

The user registers in the server;

The user completes identity authentication in the server, and generates the session key required for the session in the client and the server, respectively, and stores the session key separately.

Preferably, the user registers in the server, and the specific steps are as follows:

S01, the client obtains the user identifier and the password for uniquely identifying a user, and encrypts the identifier information and the password by using the built-in first algorithm to generate first information, and then the Sending the first information to the server;

S02 randomly generating a first key and a second key, and then combining the first key and a built-in encryption algorithm to generate an encryption function associated with the first key, combined with the second secret And a built-in decryption algorithm corresponding to the encryption algorithm generates a decryption function associated with the second key, and finally the server sends the encryption function and the decryption function to the client, and And storing the first key, the second key, the encryption algorithm, the decryption algorithm, the user identifier, and the first information;

S03, the client receives the encryption function and the decryption function and stores, and completes registration of the user in the server.

In the technical solution, the encryption function and the decryption function stored in the client are calculated by the server in combination with the randomly generated key information (the first key and the second key) and the corresponding encryption and decryption algorithm, so each The encryption and decryption functions corresponding to each client are different, and the client does not need to store the key information separately, which effectively solves the problem of key information storage in the client.

Preferably, after the user completes the registration in the server, the specific steps of the user completing the identity authentication in the server are as follows:

S04, the client obtains the user identifier, the password, and a first time, and then uses the stored encryption function to encrypt the first time to generate second information, and then the second The information and the stored first information are logically operated; finally, the logical operation result is encrypted by using the encryption function to generate third information, and the user identifier and the third information are sent to the server;

The server of S05 receives the user identifier and the third information, and searches for the user identifier in the server, and completes the authentication of the user identifier.

After the server completes the authentication of the user identifier, the server obtains the second time, and encrypts the second key according to the stored encryption algorithm to generate the fourth information; Decrypting the decryption algorithm and the first key to decrypt the received third information, and performing the logical operation on the decrypted information and the stored first information to obtain the second information; Decoding and restoring the second information by the server using the stored decryption algorithm and the first key to obtain the first time;

S07, the server compares the generated first time with the obtained second time, completes authentication of the client by the server, and sends the fourth information to the client.

S08, the client receives the fourth information, and decrypts and restores the fourth information by using the stored decryption function to obtain the second time;

S09, the client compares the generated second time with the obtained first time, and completes authentication of the server by the client, thereby completing mutual authentication between the server and the client.

In the technical solution, the authentication between the client and the server is performed by means of mutual authentication, which can effectively prevent the counterfeit attack.

Preferably, in steps S04 and S06, the logical operation is an exclusive OR operation.

Preferably, in step S07 and step S09, the time difference between the first time and the second time is respectively acquired, and when the time difference is within the preset value, the two-way authentication of the server and the client is completed.

Preferably, the preset value is 2 min to 10 min.

Preferably, after the user completes the identity authentication in the server, the specific steps of respectively generating the session key required for the session in the client and the server, and separately storing the content are as follows:

S10: The client inverts the second information to obtain fifth information, and splices the second information and the fifth information to generate sixth information, and then uses the stored encryption function to perform the sixth information. Encrypting the information to generate the session key;

S11: The server inverts the generated second information to obtain the fifth information, and splices the second information and the fifth information to generate the sixth information, and then uses the stored The encryption algorithm and the first key encrypt the sixth information to generate the same session key as in the client.

Preferably, in step S10 and step S11, the sixth information may also be obtained by splicing using the fifth information and the second information.

A data processing method provided by the present invention can bring at least one of the following beneficial effects:

1. In the present invention, when the identity authentication is performed, the encryption and decryption algorithm and the key are used together, and the algorithm and the key are not divided, and the security problem of the key storage is avoided.

2. The encryption and decryption function of the client in the present invention is obtained by the server side combined with the randomly generated key and the encryption and decryption algorithm, so the algorithm of each client is different, and the leakage of a client's security plug-in does not affect the overall security of the system. .

3. The client and the server in the present invention adopt two-way authentication, which can effectively prevent counterfeiting attacks.

4. When the data session process is performed, the client and the server respectively generate the same secret. The key, combined with the public encryption algorithm and the decryption algorithm for data encryption transmission, can prevent data leakage, and reduce the problem of key transmission, and can effectively ensure the security of the key.

5. The invention can verify whether the content of the data has been tampered with by checking the integrity of the data, which can prevent repudiation and prevent man-in-the-middle attacks.

DRAWINGS

The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

1 is a schematic diagram showing the steps of an embodiment of a data processing method in the present invention.

detailed description

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive effort.

FIG. 1 is a flowchart of a data processing method provided by the present invention. Specifically, the data processing method provided herein is mainly used by a server to perform authentication on a data to be authenticated in a client while performing integrity on a data to be authenticated. Test. Before the authentication, the user first registers in the server and stores the relevant information of the user in the server; then if the data to be authenticated needs to be authenticated, the user first logs in to the client, and the client and the server perform two-way. After the identity authentication, the same session key is generated in the client and the server respectively to establish a communication between the client and the server, which ensures the security and integrity of the data to be authenticated in the authentication process.

First, we describe the process of registering users in the server in detail. The specific steps are as follows:

S01 The client acquires a user ID uniquely identifies the user and uid pw password, and the password identification information uid and pw built by a first encryption algorithm to generate a first information H M _1, then sends the information to the first server. Specifically, the user first inputs (eg, through a keyboard, a touch screen, etc. in the client) the user identification uid and its one-to-one corresponding password pw to the server, each user having a unique user identification uid and The password pw corresponding to the user identifier; the client then uses the first algorithm H to calculate the password pw to generate the first information M ₁ =H(pw), and the first algorithm H used in the present invention is a hash algorithm, such as the sha1 algorithm; The client sends the user identification uid and the first information M ₁ to the server. In the present invention, the user identification uid includes information for uniquely identifying the user. Here, we do not limit the specific form of the first algorithm, as long as it is a single-phase hash function, which is included in the content of the present invention.

The first key K and the second key K′ are randomly generated in the S02 server, and then the first key K and the built-in encryption algorithm E are used to generate an encryption function E _K associated with the first key, combined with the second key. K' and the built-in decryption algorithm D corresponding to the encryption algorithm generate a decryption function D _K' associated with the second key, and finally the server sends the encryption function E _K and the decryption function D _{K '} to the client, and will a key K, a second key K ', the encryption algorithms E, decryption algorithms D, and a first user identification information uid M ₁ is stored. In a specific embodiment, here we use a symmetric encryption technique to encrypt the first key K and the second key K' respectively. We do not limit the specific forms of the decryption algorithm E and the decryption algorithm D, such as can be used. National secret symmetric algorithm 3DES implementation.

The S03 client receives the encryption function E _K and the decryption function D _{K '} and stores it to complete the registration of the user in the server.

It can be seen from the above steps S01 to S03 that the registration process of the user in the server is realized. In this process, only the encryption function E _K and the decryption function D _{K '} are stored in the client, and the encryption algorithm E and the decryption algorithm are used. D is stored separately from the first key K and the second key K', effectively solving the storage problem of the key information in the client.

Subsequently, we will detail the user's login authentication process, the specific steps are as follows:

The S04 client obtains the user identifier uid, the password pw, and the first time T _ui , and then encrypts the first time T _ui using the stored encryption function E to generate the second information M ₂ =E _K (T _ui ), and then The generated second information M ₁ and the stored first information M ₁ perform a logical operation; finally, the logical operation result is encrypted using the encryption function E to generate the third information M ₃ , and the user identifier uid and the third information M _{3 are} sent to server. Specifically, the logical operation here is an exclusive OR operation, and the result of the logical operation of the first information M ₁ and the second information M ₂ is M ₁ ⊕ M ₂ , and then the client uses the encryption function E logical operation result M again. ₁ ⊕ M ₂ performs encryption to generate third information M ₃ = E _k (M ₁ ⊕ M ₂ ) = E _k (E _K (T _ui ) ⊕ H (pw)). Of course, we do not define specific forms of logic operations, as long as it is ₂ then the same logical operation with the first information through said M ₁ M ₁ ⊕M logical operation can be reduced to give the M ₂ of the second information logic The operations are all included in the content of the present invention, and theoretically, the same OR operation can also be used.

The S05 server receives the user identifier uid and the third information M ₃ , and searches for a user identifier in the server to complete the authentication of the user identifier. Specifically, the server side stores a user identification file (denoted as a List), which is a list storing all legal client user identifiers uid. After receiving the user identifier uid sent by the client, the server first receives the uid. A judgment is made to determine whether the user identifier uid exists in the user identification file list stored by the server. If it exists, that is, uid∈List, it is determined that the user is a legitimate user, and the initial authentication of the user identity is successful; if the user identity authentication fails in the process, that is, the user identifier uid is not found in the user identification file list, then If the user is an illegal user, the user immediately terminates the call with the client and reminds the user. Here, the security of network identity authentication is improved by adding preliminary identity authentication.

After the S06 server completes the authentication of the user identifier uid, it acquires the second time _Tsi and encrypts it with the stored encryption algorithm E in combination with the second key K' to generate the fourth information M ₄ =E _K' (T _si Then, the received third information M ₃ =E _k (E _K (T _ui )⊕H(pw)) is decrypted using the stored decryption algorithm D and the first key K, and the decrypted information E _K ( T _ui )⊕H(pw) is logically restored with the stored first information M ₁ =H(pw) to obtain the second information M ₂ ; finally the server uses the stored decryption algorithm D and the first key K to the second information M ₂ performs decryption and restoration to obtain the first time T _ui . Specifically, the logical operation here is also an exclusive OR operation, and the decryption information E _K (T _ui )⊕H(pw) is further H(pw) to obtain the second information M ₂ = as in step S04. E _K (T _ui ), and then decrypting the second information M ₂ =E _K (T _ui ) to obtain the first time T _ui .

The S07 server compares the generated first time T _ui with the obtained second time T _si , completes the server-to-client authentication, and sends the fourth information M ₄ to the client. Specifically, the process of comparing the first time T _ui and the second time T _si is mainly the time difference between the first time T _ui and the second time T _si obtained by the server, that is, T _si -T _ui , if the time difference is smaller than The preset value, T _si -T _ui <10min (the preset value selected in the present invention is 10 min (minutes), which is only a preferred preset value of the present invention, and the specific preset value should be determined according to the network delay). Then the server authenticates to the client successfully. In other embodiments, the preset value of the time difference can also be selected by 2 min, 5 min, etc., and the preset value of the time difference is not specifically limited. The specific preset value should be determined according to the network delay.

The S08 client receives the fourth information M ₄ and decrypts and restores the fourth information M ₄ using the stored decryption function D _K to obtain a second time T _si ; that is, D _K (M ₄ )=D _K (E _K' (T _Si )), get the second time T _si .

The S09 client compares the generated second time T _si with the obtained first time T _ui to complete the client-to-server authentication, thereby completing the mutual authentication between the server and the client. Specifically, the client determines a second time to give the time T _si and the first time difference T _ui, i.e. T _si -T _ui, if the time difference is smaller than a preset value, such as, T _si -T _ui <10min (according to the present invention, The preset value is 10 min, which is only a preferred preset value of the present invention, and the specific preset value should be determined according to the network delay. Then, the client successfully authenticates the server, and the following steps are continued. Similar to the step S07, in other embodiments, the preset value of the time difference can also be selected 2 min, 5 min, etc., and the preset value of the time difference is not specifically limited, and the specific preset value should be determined according to the network delay.

In the above steps S04 to S09, the two-way authentication between the client and the server is completed, and the counterfeit attack of the criminals is effectively prevented.

After the user completes the identity authentication in the server, the session key K _i required for the session is generated in the client and the server respectively, and is separately stored. The specific steps are as follows:

The S10 client inverts the second information M ₂ to obtain the fifth information M ₅ =M ₂ '=E _K '(T _ui ), and the second information M ₂ =E _K (T _ui ) and the fifth information M ₅ splicing generates a sixth information M ₆ =M ₂ +M ₅ , and then encrypts the sixth information M ₆ using the stored encryption function E _K to generate a session key K _i =E _K (M ₂ +M ₅ )=E _K (E _K (T _ui )+E _K '(T _ui )). Here, we will explain that the splicing using the second information M ₂ and the fifth information M ₅ to generate M ₆ is to expand the 8 bytes (64 bits) of the second information M ₂ and the fifth information M ₅ into The 16-byte (128-bit) information is extended to meet the needs of symmetric algorithms such as 3DES (key bytes 14-21 bytes) during the operation. Specifically, if the second information M ₂ is 12345678 and the fifth information M ₅ is 87654321, the spliced sixth information M ₆ is 1234567887654321. Of course, in other embodiments, the fifth information M ₅ and the second information M ₂ may be used for splicing, so that the spliced sixth information M ₆ is 8765432112345678, as long as the same splicing method is used in the client and the server. To ensure that the session key K _i used in the client and server is the same during the same authentication process.

The S11 server inverts the second information M ₂ to obtain the fifth information M ₅ =M ₂ '=E _K '(T _ui ), and the second information M ₂ =E _K (T _ui ) and the fifth information M ₅ The splicing is performed to generate a sixth information M ₆ = M ₂ + M ₅ , and then the sixth information M ₆ is encrypted using the stored encryption algorithm E and the first key K to generate the same session key K _i = E in the client. _K (E _K (T _ui )+E _K '(T _ui )). Here, we will explain that the purpose of splicing and generating M ₆ using the second information M ₂ and the fifth information M ₅ is the same as that in step S10, and the splicing method is also the same. We will not repeat here to ensure the session generated in the server. The key K _i may be the same as the session key K _i generated in the client.

Through the above steps, the same session key K _i is generated in the client and the server, and the data encryption transmission is combined with the public encryption algorithm and the decryption algorithm, which can prevent data leakage and reduce the problem of key transmission, and can effectively guarantee the key. Safety. The client encrypts the data to be authenticated using the public encryption algorithm e and sends it to the server for authentication. The client and the server encrypt the authentication data (recorded as M) through the public encryption algorithm e and the session key K _i respectively. And decrypting the encrypted data to be authenticated M by the public decryption algorithm d and the session key K _i , the specific steps are as follows:

The data to be authenticated M is specifically encrypted: the data to be authenticated M sent by the client. First, the client encrypts the data to be authenticated M using the session key K _i and the public encryption algorithm e to generate first data, that is, e _Ki (M). The client uses the first algorithm (ie, the hash algorithm) to calculate the authentication data M to generate the second data, that is, the second data is H(M). The client sends the first data and the second data to the server, ie e _Ki (M) + H (M).

The decryption of the data to be authenticated M is specifically as follows: the server receives the first data and the second data, ie, e _Ki (M)+H(M). The server decrypts the first data e _Ki (M), ie, d _Ki (e _Ki (M)), by using the public decryption algorithm d and the session key K _{i to} obtain a data to be authenticated S (the original data to be authenticated sent by the client M) Make a distinction).

The integrity of the data to be authenticated is verified by the first algorithm (ie, the hash algorithm), and the data to be authenticated obtained by the decryption is calculated, that is, H(S). The server compares H(S) with the received second data H(M). If H(S)=H(M) is the same, it indicates that the data to be authenticated received by the server is the one to be authenticated sent by the client. Data M, the data to be authenticated has integrity, otherwise the data to be authenticated S is incomplete and is illegal.

The specific embodiments of the present invention have been described in detail above, but the invention is not limited to the specific embodiments described above. Any equivalent modifications and substitutions to the invention are also within the scope of the invention. Accordingly, equivalent changes and modifications may be made without departing from the spirit and scope of the invention.

Claims

A data processing method, characterized in that after the session key required for the session process is respectively generated in the client and the server, the client encrypts the data to be authenticated using a public encryption algorithm and sends the data to the server. To carry out the certification, the specific steps are as follows:

Obtaining, by the S21 client, the to-be-authenticated data, and synthesizing the first data by using the built-in common encryption algorithm in combination with the session key stored in the client; subsequently, the client uses the built-in first algorithm Encrypting the data to be authenticated to generate second data; finally, the client sends the first data and the second data to the server;

After the server receives the first data and the second data, the server performs the first data by using the same session key as the client and a public decryption algorithm corresponding to the common encryption algorithm. Decrypting and restoring to obtain the data to be authenticated; then encrypting the data to be authenticated using the first algorithm built in the server to generate third data;

S23: The server compares the generated third data with the received second data, and completes the authentication of the data to be authenticated.
The data processing method according to claim 1, wherein said first algorithm is a hash algorithm.
The data processing method according to claim 1 or 2, wherein the client encrypts the data to be authenticated and sends the data to the server for authentication, and further includes: the user is in the server. Registering;

The user completes identity authentication in the server, and generates the session key required for the session in the client and the server, respectively, and stores the session key separately.
The data processing method according to claim 3, wherein the user registers in the server, and the specific steps are as follows:

S01, the client obtains the user identifier and the password for uniquely identifying a user, and encrypts the identifier information and the password by using the built-in first algorithm to generate first information, And transmitting the first information to the server;

S02 randomly generating a first key and a second key, and then combining the first key and a built-in encryption algorithm to generate an encryption function associated with the first key, combined with the second secret And a built-in decryption algorithm corresponding to the encryption algorithm generates a decryption function associated with the second key, and finally the server sends the encryption function and the decryption function to the client, and And storing the first key, the second key, the encryption algorithm, the decryption algorithm, the user identifier, and the first information;

S03, the client receives the encryption function and the decryption function and stores, and completes registration of the user in the server.
The data processing method according to claim 4, wherein the specific steps of the user completing identity authentication in the server after the user completes registration in the server are as follows:

S04, the client obtains the user identifier, the password, and a first time, and then uses the stored encryption function to encrypt the first time to generate second information, and then the second The information and the stored first information are logically operated; finally, the logical operation result is encrypted by using the encryption function to generate third information, and the user identifier and the third information are sent to the server;

The server of S05 receives the user identifier and the third information, and searches for the user identifier in the server, and completes the authentication of the user identifier.

After the server completes the authentication of the user identifier, the server obtains the second time, and encrypts the second key according to the stored encryption algorithm to generate the fourth information; Decrypting the decryption algorithm and the first key to decrypt the received third information, and performing the logical operation on the decrypted information and the stored first information to obtain the second information; Decoding and restoring the second information by the server using the stored decryption algorithm and the first key to obtain the first time;

S07, the server compares the generated first time with the obtained second time, completes authentication of the client by the server, and sends the fourth information to the client.

S08, the client receives the fourth information, and decrypts and restores the fourth information by using the stored decryption function to obtain the second time;

S09, the client compares the generated second time with the obtained first time, and completes authentication of the server by the client, thereby completing mutual authentication between the server and the client.
The data processing method according to claim 5, wherein in the step S04 and the step S06, the logical operation is an exclusive OR operation.
The data processing method according to claim 5, wherein in step S07 and step S09, the time difference between the first time and the second time is respectively acquired, and when the time difference is within a preset value, the time difference is completed. Two-way authentication between the server and the client.
The data processing method according to claim 7, wherein said preset value is 2 min to 10 min.
The data processing method according to claim 5 or 6 or 7 or 8, wherein after the user completes the identity authentication in the server, the user and the server respectively generate the The specific steps of the session key and storage separately are as follows:

S10: The client inverts the second information to obtain fifth information, and splices the second information and the fifth information to generate sixth information, and then uses the stored encryption function to perform the sixth information. Encrypting the information to generate the session key;

S11: The server inverts the generated second information to obtain the fifth information, and splices the second information and the fifth information to generate the sixth information, and then uses the stored The encryption algorithm and the first key encrypt the sixth information to generate the same session key as in the client.
The data processing method according to claim 9, wherein in step S10 and step S11, the sixth information is further spliced using the fifth information and the second information.