CN115514549A - Secure interaction method and system based on SSL (secure sockets layer) protocol - Google Patents

Abstract

The application discloses a secure interaction method, system, and device based on the SSL protocol, mainly related to the technical field of secure interaction, and used to solve the problems of heavy workload of repeated development of provincial-side services in the existing secure interaction. Including: the gateway SDK encrypts the transmission data of the mobile application and uploads it to the first access gateway; conducts identity authentication of the mobile application; establishes a national secret channel after passing the identity authentication; Decrypt the encrypted data; obtain the demand command issued by the preset headquarters platform through the preset provincial platform; encrypt and transmit the decrypted data corresponding to the demand command to the second access gateway of the preset headquarters platform; perform identity authentication; The uploaded data that has passed the identity authentication is sent to the preset data security access service, and then the second decryption data is obtained; the second decryption data is sent to the mobile terminal in demand. This application reduces the repetitive development workload of the provincial side business through the above method.

Description

A secure interaction method and system based on SSL protocol

technical field

The present application relates to the technical field of secure interaction, in particular to an SSL protocol-based secure interaction method and system.

Background technique

With the development of power business, data has become a key element to support the construction of new power systems. As a key information infrastructure operating unit, the company manages a large amount of important production data and highly sensitive electricity customer information data. Once business data is lost, leaked, or destroyed, it may cause the company’s daily business decisions and production operation information to leak. Therefore, it is necessary to provide sufficient Advanced security protection ensures information security.

The existing security protection is mainly based on traditional network security protection, through (1) partition protection: strictly authenticate and control user access rights through network partitions; (2) boundary isolation: use physical isolation devices to ensure data transmission security; (3) Data encryption: Data encryption ensures that the meaning of the data cannot be understood after it is intercepted, and other measures to ensure the security of traditional data storage, transmission and other links.

However, when the mobile application on the mobile terminal corresponding to the traditional network security protection method interacts with the background of the company's internal business system, it needs to open an access to the Internet service port, and the exposure of the Internet port will bring certain security risks; Pushed to the headquarters company, each mobile application needs to be customized and developed for the headquarters data security access components separately, and the repetitive development workload of the provincial side business is relatively large; in addition, with the power distribution automation system, unified video With the continuous development of terminals, a security access gateway that only supports a single terminal access cannot meet the existing needs.

Contents of the invention

Aiming at the above-mentioned deficiencies of the prior art, the present invention provides an SSL protocol-based secure interaction method and system to solve the above-mentioned technical problems.

In the first aspect, the present application provides a secure interaction method based on the SSL protocol. The method includes: according to the national secret algorithm, the gateway SDK encrypts the transmission data of the mobile application, and uploads the encrypted data to the preset province-side platform. An access gateway; based on the identity information in the encrypted data, the first access gateway performs identity authentication for the mobile application; after the identity authentication is qualified, a national secret channel is established through the first access gateway and the gateway SDK, and the national secret channel adopts The HTTPS protocol based on the national secret algorithm; decrypt the received encrypted data through the first access gateway to obtain the decrypted data; obtain the requirements issued by the preset headquarters platform through the data push proxy service deployed on the preset provincial platform command; based on the national secret algorithm, encrypt and transmit the decrypted data corresponding to the demand command to the second access gateway of the preset headquarters platform; perform identity authentication based on the provincial identity information in the uploaded data; send the uploaded data that passes the identity authentication To the preset data security access service, and then obtain the secondary decryption data; determine the required mobile terminal through the preset headquarters platform, and send the secondary decryption data to the required mobile terminal through message push or data pull.

Further, according to the national secret algorithm, the gateway SDK encrypts the transmission data of the mobile application, specifically including: generating a random sm4key, using the sm4key to perform national secret encryption on the transmission data, and obtaining the first encrypted data; among them, the first encrypted data Contains the timestamp; use the sm3 in the national secret algorithm to verify the encryption integrity of the first encrypted data and the timestamp; use the sm2 and sm2 public keys in the national secret algorithm to encrypt the random sm4key to obtain the sm4key encrypted data; use the national secret The sm2 in the algorithm encrypts the timestamp + sm4key encrypted data + encrypted transmission data to obtain encrypted data.

Further, before the gateway SDK encrypts the transmission data of the mobile application according to the national secret algorithm, and uploads the encrypted data to the first access gateway of the preset provincial side platform, the method also includes: when the mobile application initializes the gateway SDK , providing configuration information in the form of parameters; wherein, the configuration information includes at least gateway connection information, business service information, and proxy port information; establish a secure connection API through the gateway SDK to access the first access gateway, and send the first access gateway Upload identity information, complete identity authentication, key negotiation, and establish an encrypted transmission channel; enable the gateway to set access control permissions based on identity information, and generate a local proxy port; enable the mobile application to send transmission data to the gateway SDK through the local proxy port.

Further, decrypting the received encrypted data through the first access gateway to obtain the decrypted data, specifically includes: using the private key of sm2 in the national secret algorithm to decrypt the encrypted data, and obtaining encrypted transmission data and sm4key encrypted data; Use sm3 in the national secret algorithm to check the consistency between the encrypted data and the preset message digest; if they are consistent, decrypt the sm4key encrypted data to obtain sm4key; then use sm4key to decrypt the encrypted data to obtain decrypted data.

Further, the method further includes: triggering an instruction through the editing interface to enter the gateway SDK configuration file editing interface; obtaining an instance of the SSAGClient class through the configuration file editing interface, and initializing the instance so that the gateway SDK supports the proxy mode corresponding to the instance.

Further, the method further includes: obfuscating the class file in the corresponding code of the gateway SDK, so as to replace the class name, variable name and method name in the class file with preset meaningless short variables.

In the second aspect, the present application provides a secure interaction system based on the SSL protocol. The system includes: an upload module, which is used to encrypt the transmission data of the mobile application by the gateway SDK according to the national secret algorithm, and upload the encrypted data to the preset The first access gateway of the provincial side platform; the obtaining module is used for the first access gateway to perform the identity authentication of the mobile application based on the identity information in the encrypted data; after the identity authentication is qualified, pass the first access gateway and the gateway SDK Establish a national secret channel, and the national secret channel adopts the HTTPS protocol based on the national secret algorithm; decrypt the received encrypted data through the first access gateway to obtain the decrypted data; the transmission module is used for deployment through the preset provincial side platform The data push proxy service of the preset headquarters platform obtains the demand instructions issued by the preset headquarters platform; based on the national secret algorithm, the decrypted data corresponding to the demand instructions is encrypted and transmitted to the second access gateway of the preset headquarters platform; the sending module is used for uploading based on The province-side identity information in the data is used for identity authentication; the uploaded data that has passed the identity authentication is sent to the preset data security access service, and then the second decryption data is obtained; the demand mobile terminal is determined through the preset headquarters platform, and pushed through the message Or the way of data pulling, and send the secondary decryption data to the mobile terminal in demand.

In a third aspect, the present application provides a secure interaction device based on the SSL protocol. The device includes: a processor; and a memory on which executable code is stored. When the executable code is executed, the processor performs any A secure interaction method based on the SSL protocol.

Those skilled in the art can appreciate that the present invention has at least the following beneficial effects:

(1) Mobile application access can be configured uniformly. The mobile application establishes a secure tunnel with the provincial side security access gateway (the first access gateway) by calling the secure access gateway SDK API, and generates a local proxy port. The mobile application Data interaction can be realized by interacting with the local agent port. This interaction method improves the convenience of secure access to mobile applications, reduces the exposure of Internet ports, and improves security.

(2) This application uses the preset data push agency service on the network province side and the preset data security access service on the headquarters side to realize the transmission of several network province side data to the headquarters side; unify the data push proxy service and uniformly process the network province side The problem of data fusion with the headquarters side reduces the workload of repeated development on the provincial side, decouples data fusion from data transmission security and business, and the national secret sm2 and sm4 mixed encryption and decryption ensures transmission security.

(3) There is an interface for editing gateway SDK configuration files in this application. By editing the instance of the SSAGClient class of the gateway SDK, various terminal access can be supported, which reduces the amount of modification of terminal access.

Description of drawings

Some embodiments of the present disclosure are described below with reference to the accompanying drawings, in which:

FIG. 1 is a flow chart of an SSL protocol-based secure interaction method provided by an embodiment of the present application.

FIG. 2 is a schematic diagram of the internal structure of an SSL protocol-based secure interaction system provided by an embodiment of the present application.

FIG. 3 is a schematic diagram of the internal structure of an SSL protocol-based secure interaction system provided by an embodiment of the present application.

detailed description

It should be understood by those skilled in the art that the embodiments described below are only preferred embodiments of the present disclosure, and it does not mean that the present disclosure can only be realized through the preferred embodiments, and the preferred embodiments are only used to explain the present disclosure Technical principles are not intended to limit the protection scope of the present disclosure. Based on the preferred embodiments provided in the present disclosure, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts should still fall within the protection scope of the present disclosure.

It should also be noted that the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes Other elements not expressly listed, or elements inherent in the process, method, commodity, or apparatus are also included. Without further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

The technical solutions proposed in the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

The embodiment of the present application also provides a secure interaction method based on the SSL protocol. As shown in FIG. 1, the method provided in the embodiment of the present application mainly includes the following steps:

Step 110, according to the national secret algorithm, the gateway SDK encrypts the transmission data of the mobile application, and uploads the encrypted data to the first access gateway of the preset provincial platform.

Before the gateway SDK encrypts the transmission data of the mobile application according to the national secret algorithm, and uploads the encrypted data to the first access gateway of the preset provincial platform, this application can also generate a local proxy port on the mobile application side to Realize data interaction by interacting with the local proxy port, improve the convenience of secure access to mobile applications, reduce Internet port exposure, and improve security.

Specifically: when the mobile application initializes the gateway SDK, configuration information is provided in the form of parameters; wherein, the configuration information includes at least gateway connection information, business service information, and agent port information; a secure connection API is established through the gateway SDK to access the first interface access gateway, and upload identity information to the first access gateway to complete identity authentication, key negotiation, and establish an encrypted transmission channel; enable the gateway to set access control permissions based on identity information, and generate a local proxy port; enable mobile applications to pass through the local proxy The port sends transmission data to the gateway SDK. Among them, the key negotiation is: before encrypting and decrypting communication data, the mobile application end and the server end negotiate a session key, and the session key can only be known by the server end and a specific mobile application end. In order to ensure that it is not leaked, this can be solved by using a key agreement algorithm. The session key is that the key does not need to be stored. Once the connection between the mobile application and the server is closed, the key will disappear, that is to say, the key is stored in the memory of the mobile application and the server. Since the key does not need to be stored, Safety is greatly guaranteed. Establishing an encrypted transmission channel is: establishing a secure connection based on the session key generated through the above key negotiation.

Among them, according to the national secret algorithm, the gateway SDK encrypts the transmission data of the mobile application, which can be specifically: generate a random sm4key, use the sm4key to perform national secret encryption on the transmission data, and obtain the first encrypted data; among them, the first encrypted data Contains the timestamp; use the sm3 in the national secret algorithm to verify the encryption integrity of the first encrypted data and the timestamp; use the sm2 and sm2 public keys in the national secret algorithm to encrypt the random sm4key to obtain the sm4key encrypted data; use the national secret The sm2 in the algorithm encrypts the timestamp + sm4key encrypted data + encrypted transmission data to obtain encrypted data.

Step 120: Based on the identity information in the encrypted data, the first access gateway performs identity authentication of the mobile application; after the identity authentication is qualified, a national secret channel is established through the first access gateway and the gateway SDK, and the national secret channel adopts a national The encrypted HTTPS protocol; through the first access gateway, the received encrypted data is decrypted to obtain the decrypted data.

It should be noted that the first access gateway stores the identity authentication information, and can perform identity authentication on the received identity information.

Wherein, the encrypted data received is decrypted by the first access gateway to obtain the decrypted data, which may specifically be: use the private key of sm2 in the national secret algorithm to decrypt the encrypted data, and obtain encrypted transmission data and sm4key encrypted data; Use sm3 in the national secret algorithm to check the consistency between the encrypted data and the preset message digest; if they are consistent, decrypt the sm4key encrypted data to obtain sm4key; then use sm4key to decrypt the encrypted data to obtain decrypted data.

Step 130: Obtain the demand command issued by the preset headquarters platform through the data push proxy service deployed by the preset provincial platform; based on the national secret algorithm, encrypt and transmit the decrypted data corresponding to the demand command to the second interface of the preset headquarters platform ingress gateway.

It should be noted that the data push proxy service: the data push proxy service deployed on the provincial side is used to connect with the data security access service of the headquarters, realize the encrypted and secure transmission of the push data on the provincial side, and ensure the unified access of the provincial side applications.

The data push proxy service is used to push provincial-side data to the headquarters. In order to ensure data security and simplify provincial-side business development work, the data push proxy service is deployed on the provincial side, and the data that interacts with the headquarters' data security access service is uniformly encrypted with national secrets . The provincial-side business system calls the data push agent service to push data, and encrypts and transmits it to the data security access service through national secret encryption. The data security access service decrypts the data and submits it to the mobile application support platform, and the mobile application support platform will pass message push or data pull The method of fetching is pushed to the mobile terminal, and the headquarters application can also see the corresponding data of each network province.

Step 140: Perform identity authentication based on the provincial identity information in the uploaded data; send the uploaded data that passes the identity authentication to the preset data security access service, and then obtain the secondary decryption data; determine the required mobile terminal through the preset headquarters platform , to send the secondary decryption data to the mobile terminal in demand by means of message push or data pull.

It should be noted that the provincial-side identity information is stored in the second access gateway, and it is possible to verify whether the uploaded provincial-side identity information is consistent, and if it is consistent, it is qualified. Preset data security access service: Deployed at the headquarters, it is used to connect with the data push agency services of provincial companies, and supports the national secret communication access of the data that provincial companies need to aggregate to the headquarters.

In addition, this application can switch the proxy mode of the gateway SDK according to the needs of the scene, so that it can adapt to multiple scenarios and multiple terminals. Among them, the method of adding the proxy mode to the gateway SDK can be specifically: trigger the command through the editing interface to enter the editing interface of the gateway SDK configuration file; obtain an instance of the SSAGClient class through the editing interface of the configuration file, and initialize the instance so that the gateway SDK The proxy mode corresponding to the instance is supported.

In addition, Java code is very easy to reverse code, this application is to protect the Java source code in the gateway SDK. This application can: obfuscate the class file in the gateway SDK corresponding code, so as to replace the class name, variable name and method name in the class file with preset meaningless short variables.

In addition, FIG. 2 is a secure interaction system based on the SSL protocol provided by the embodiment of the present application. As shown in Figure 2, the system provided by the embodiment of the present application mainly includes:

The upload module 210 is used to encrypt the transmission data of the mobile application by the gateway SDK according to the national secret algorithm, and upload the encrypted data to the first access gateway of the preset provincial side platform;

The obtaining module 220 is used to perform identity authentication of the mobile application by the first access gateway based on the identity information in the encrypted data; after the identity authentication is qualified, a national secret channel is established through the first access gateway and the gateway SDK, and the national secret channel Adopt the HTTPS protocol based on the national secret algorithm; decrypt the received encrypted data through the first access gateway to obtain the decrypted data;

The transmission module 230 is used to obtain the demand command issued by the preset headquarters platform through the data push agency service deployed by the preset provincial platform; based on the national secret algorithm, encrypt and transmit the decrypted data corresponding to the demand command to the preset headquarters platform. the second access gateway;

The sending module 240 is used to perform identity authentication based on the provincial identity information in the uploaded data; send the uploaded data that passes the identity authentication to the preset data security access service, and then obtain secondary decryption data; determine through the preset headquarters platform The demanded mobile terminal sends the secondary decryption data to the demanded mobile terminal by means of message push or data pull.

In addition, the embodiment of the present application also provides a secure interaction device based on the SSL protocol, as shown in Figure 3, on which executable instructions are stored, and when the executable instructions are executed, the above-mentioned one A secure interaction method based on the SSL protocol. Specifically, the server sends an execution instruction to the memory through the bus, and when the memory receives the execution instruction, it sends an execution signal to the processor through the bus to activate the processor.

It should be noted that the processor is used to encrypt the transmission data of the mobile application by the gateway SDK according to the national secret algorithm, and upload the encrypted data to the first access gateway of the preset provincial platform; based on the identity information in the encrypted data, The first access gateway performs the identity authentication of the mobile application; after the identity authentication is qualified, the national secret channel is established through the first access gateway and the gateway SDK, and the national secret channel adopts the HTTPS protocol based on the national secret algorithm; through the first access The gateway decrypts the received encrypted data to obtain the decrypted data; through the data push proxy service deployed on the preset provincial platform, obtains the demand instructions issued by the preset headquarters platform; based on the national secret algorithm, decrypts the corresponding demand instructions The data is encrypted and transmitted to the second access gateway of the preset headquarters platform; identity authentication is performed based on the provincial identity information in the uploaded data; the uploaded data that passes the identity authentication is sent to the preset data security access service, and then the secondary Decrypt the data; determine the required mobile terminal through the preset headquarters platform, and send the secondary decrypted data to the required mobile terminal by means of message push or data pull.

So far, the technical solutions of the present disclosure have been described in conjunction with the foregoing embodiments, but those skilled in the art can easily understand that the protection scope of the present disclosure is not limited to these specific embodiments. Without departing from the technical principles of the present disclosure, those skilled in the art can split and combine the technical solutions in the above-mentioned embodiments, and can also make equivalent changes or replacements to the relevant technical features. Any changes, equivalent replacements, improvements, etc. made within the concept and/or technical principles will fall within the protection scope of the present disclosure.

Claims (8)

1. A secure interaction method based on an SSL protocol, characterized in that the method comprises:

according to the state secret algorithm, the gateway SDK encrypts transmission data of the mobile application and uploads the encrypted data to a first access gateway of a preset provincial side platform;

based on the identity information in the encrypted data, the first access gateway performs identity authentication of the mobile application; after the identity authentication is qualified, a national secret channel is established through a first access gateway and a gateway SDK, and the national secret channel adopts an HTTPS protocol based on a national secret algorithm; decrypting the received encrypted data through the first access gateway to obtain decrypted data;

acquiring a demand instruction issued by a preset headquarter platform through a data push proxy service deployed by a preset provincial side platform; based on a national cryptographic algorithm, transmitting the decrypted data corresponding to the demand instruction to a second access gateway of a preset headquarters platform in an encrypted manner;

performing identity authentication based on the provincial identity information in the uploaded data; sending the uploaded data qualified in identity authentication to a preset data security access service, and further obtaining secondary decrypted data; and determining the required mobile terminal through a preset headquarters platform, and sending the secondary decrypted data to the required mobile terminal in a message pushing or data pulling mode.

2. The secure interaction method based on the SSL protocol as recited in claim 1, wherein the gateway SDK encrypts the transmission data of the mobile application according to a cryptographic algorithm, and specifically includes:

generating a random sm4key, and carrying out national encryption processing on the transmission data by using the sm4key to obtain first encryption data; wherein the first encrypted data contains a timestamp;

using sm3 in the cryptographic algorithm to check the cryptographic integrity of the first cryptographic data and the timestamp;

encrypting the random sm4key by using sm2 and sm2 public keys in the national cryptographic algorithm to obtain sm4key encrypted data;

and encrypting the timestamp + sm4key encrypted data + encrypted transmission data by using sm2 in the national cryptographic algorithm to obtain encrypted data.

3. The secure interaction method based on the SSL protocol as recited in claim 1, wherein before the gateway SDK encrypts the transmission data of the mobile application according to a cryptographic algorithm and uploads the encrypted data to the first access gateway of the default province-side platform, the method further comprises:

when the mobile application initializes the gateway SDK, the configuration information is provided in a parameter form; the configuration information at least comprises gateway connection information, service information and agent port information;

establishing a secure connection API through a gateway SDK to access a first access gateway, uploading identity information to the first access gateway, completing identity authentication, key agreement and establishing an encryption transmission channel;

enabling the gateway to set access control authority according to the identity information and generating a local proxy port; so that the mobile application sends the transport data to the gateway SDK through the home agent port.

4. The SSL protocol-based secure interaction method as recited in claim 1, wherein the decrypting the received encrypted data through the first access gateway to obtain decrypted data specifically includes:

decrypting the encrypted data by using a private key of sm2 in the national cryptographic algorithm to obtain encrypted transmission data and sm4key encrypted data;

using sm3 in the cryptographic algorithm to check the consistency of the encrypted data and the preset message digest;

if the encrypted data are consistent, decrypting the sm4key encrypted data to obtain sm4key; and then decrypting the encrypted data by using sm4key to obtain decrypted data.

5. The SSL protocol-based secure interaction method of claim 1, wherein the method further comprises:

triggering an instruction through an editing interface, and entering a gateway SDK configuration file editing interface;

and acquiring an instance of the SSAGclient class through a configuration file editing interface, and initializing the instance so that the gateway SDK supports an agent mode corresponding to the instance.

6. The SSL protocol-based secure interaction method of claim 1, wherein the method further comprises:

and performing confusion processing on the class file in the code corresponding to the SDK of the gateway so as to replace the class name, the variable name and the method name in the class file with preset meaningless short variables.

7. A secure interactive system based on SSL, the system comprising:

the uploading module is used for encrypting the transmission data of the mobile application by the gateway SDK according to a national secret algorithm and uploading the encrypted data to a first access gateway of a preset provincial side platform;

the obtaining module is used for carrying out identity authentication of the mobile application by the first access gateway based on the identity information in the encrypted data; after the identity authentication is qualified, a national password channel is established through the first access gateway and the gateway SDK, and the national password channel adopts an HTTPS protocol based on a national password algorithm; decrypting the received encrypted data through the first access gateway to obtain decrypted data;

the transmission module is used for acquiring a demand instruction issued by a preset headquarter platform through a data push proxy service deployed by a preset provincial side platform; based on a national cryptographic algorithm, transmitting the decrypted data corresponding to the demand instruction to a second access gateway of a preset headquarters platform in an encrypted manner;

the sending module is used for carrying out identity authentication based on the province and side identity information in the uploaded data; sending the uploaded data qualified in identity authentication to a preset data security access service, and further obtaining secondary decrypted data; and determining the required mobile terminal through a preset headquarters platform, and sending the secondary decrypted data to the required mobile terminal in a message pushing or data pulling mode.

8. A secure interactive device based on SSL, the device comprising:

a processor;

and a memory having executable code stored thereon, which when executed, causes the processor to perform a secure interaction method based on SSL protocol as recited in any one of claims 1-6.

Images