CN114417369A - File transmission method and device, electronic equipment and computer readable medium - Google Patents

Abstract

The invention discloses a file transmission method, an apparatus, an electronic device and a computer-readable medium, and relates to the technical field of big data privacy protection. A specific implementation of the method includes: receiving a key acquisition request sent by a client; generating a first SM2 public key and its corresponding first SM2 private key, and generating an SM4 symmetric key; encryption key and the SM4 symmetric key to obtain the first secret key ciphertext; send the first secret key ciphertext to the client; send a key acquisition request to the client; receive the user The second secret key ciphertext returned by the terminal; decrypt the second secret key ciphertext to obtain the second SM2 public key. This embodiment can solve the technical problem that the security requirements between the user system and the banking system cannot be met.

Description

File transfer method, apparatus, electronic device and computer readable medium

technical field

The present invention relates to the technical field of big data privacy protection, and in particular, to a file transmission method, apparatus, electronic device and computer-readable medium.

Background technique

With the rapid development of the Internet, the original non-direct cooperation between banks and enterprises, such as using the B/S mode of the bank's online banking system or processing corporate accounts through bank outlets, and then manually docking with the corporate financial system. The process will lead to incoherent business processing, low work efficiency, and there are risks in ensuring the consistency of accounts between the banking system and the enterprise financial system.

The bank-enterprise direct connection can completely solve the above drawbacks. At the same time, the bank-enterprise direct connection system uses mature business secret technology to provide users with uninterrupted banking services, and realizes the 7*24 continuity of business operations of enterprise ERP or financial systems, accounting consistency.

However, the current bank-enterprise direct connection system directly pushes data and lacks various security measures such as identity authentication, security encryption, and digital signature, so it cannot meet the security requirements between the user system and the bank system.

SUMMARY OF THE INVENTION

In view of this, embodiments of the present invention provide a file transmission method, apparatus, electronic device, and computer-readable medium to solve the technical problem that the security requirements between the user system and the banking system cannot be met.

In order to achieve the above object, according to an aspect of the embodiments of the present invention, a file transmission method is provided, which is applied to a bank, including:

Receive the key acquisition request sent by the client;

generating a first SM2 public key and its corresponding first SM2 private key, and generating an SM4 symmetric secret key;

Encrypting the first SM2 public key and the SM4 symmetric secret key to obtain a first secret key ciphertext;

sending the first secret key ciphertext to the client;

sending a key acquisition request to the client;

receiving the second secret key ciphertext returned by the client;

Decrypt the second secret key ciphertext to obtain the second SM2 public key.

Optionally, encrypt the first SM2 public key and the SM4 symmetric secret key to obtain a first secret key ciphertext, including:

According to the user identification and preset parameters of the user terminal, the first encryption parameter is assembled;

Based on the first encryption parameter and using a symmetric encryption algorithm, encrypt the first SM2 public key and the SM4 symmetric secret key to obtain a first secret key ciphertext.

Optionally, decrypt the second secret key ciphertext to obtain a second SM2 public key, including:

According to the user identification and preset parameters of the bank terminal, the first decryption parameter is assembled;

Based on the first decryption parameter and using a symmetric encryption algorithm, the second secret key ciphertext is decrypted to obtain a second SM2 public key.

Optionally, after decrypting the second secret key ciphertext to obtain the second SM2 public key, the method further includes:

Receive the file acquisition request sent by the client;

Perform signature verification and decryption on the file acquisition request to obtain the information of the file to be transmitted;

Encrypt the file to be transmitted by using the SM4 symmetric key to obtain a file ciphertext;

Using the first SM2 private key to digitally sign the file ciphertext to obtain a file signature;

Send the file signature to the client.

Optionally, performing signature verification and decryption on the file acquisition request, including:

Use the second SM2 public key to verify the signature of the file acquisition request;

If the signature verification is passed, the signature verification result is decrypted by using the SM4 symmetric key to obtain the information of the file to be transmitted.

In addition, according to another aspect of the embodiments of the present invention, a file transmission method is provided, applied to a client, including:

Send a key acquisition request to the bank;

receiving the first secret key ciphertext returned by the bank;

Decrypt the first secret key ciphertext to obtain the first SM2 public key and the SM4 symmetric secret key;

receiving a key acquisition request sent by the bank;

generating a second SM2 public key and its corresponding second SM2 private key;

Encrypting the second SM2 public key to obtain a second secret key ciphertext;

Send the second secret key ciphertext to the bank.

Optionally, decrypt the first secret key ciphertext to obtain the first SM2 public key and SM4 symmetric secret key, including:

According to the user identification and preset parameters of the user terminal, the second decryption parameter is assembled;

Based on the second decryption parameter and using a symmetric encryption algorithm, the first secret key ciphertext is decrypted to obtain the first SM2 public key and the SM4 symmetric secret key.

Optionally, encrypting the second SM2 public key to obtain a second secret key ciphertext, including:

According to the user identification and preset parameters of the bank end, the second encryption parameter is assembled;

Encrypting the second SM2 public key based on the second encryption parameter and using a symmetric encryption algorithm to obtain a second secret key ciphertext.

Optionally, after decrypting the first secret key ciphertext to obtain the first SM2 public key and SM4 symmetric secret key, the method further includes:

Generate a message according to the information of the file to be transmitted;

Encrypt the message by using the second SM2 private key to obtain a message ciphertext;

Using the SM4 symmetric key to perform digital signature verification on the message ciphertext to obtain a message signature;

A file acquisition request is sent to the bank, where the file acquisition request carries the message signature.

Optionally, after sending the file acquisition request to the bank, the method further includes:

receiving the document signature returned by the bank;

Verifying the file signature by using the first SM2 public key;

If the signature verification is passed, the signature verification result is decrypted using the SM4 symmetric key to obtain a file.

In addition, according to another aspect of the embodiments of the present invention, there is provided a file transmission device, which is set at the bank end, including:

a first receiving module, configured to receive a key acquisition request sent by the client; receive the second secret key ciphertext returned by the client;

a first key module for generating a first SM2 public key and its corresponding first SM2 private key, and generating an SM4 symmetric key;

a first encryption module, configured to encrypt the first SM2 public key and the SM4 symmetric secret key to obtain a first secret key ciphertext;

a first sending module, configured to send the first secret key ciphertext to the client; send a secret key acquisition request to the client;

The first decryption module is used for decrypting the second secret key ciphertext to obtain the second SM2 public key.

Optionally, the first encryption module is also used for:

According to the user identification and preset parameters of the user terminal, the first encryption parameter is assembled;

Based on the first encryption parameter and using a symmetric encryption algorithm, encrypt the first SM2 public key and the SM4 symmetric secret key to obtain a first secret key ciphertext.

Optionally, the first decryption module is also used for:

According to the user identification and preset parameters of the bank terminal, the first decryption parameter is assembled;

Based on the first decryption parameter and using a symmetric encryption algorithm, the second secret key ciphertext is decrypted to obtain a second SM2 public key.

Optionally, the first receiving module is further configured to receive a file acquisition request sent by the client;

The first decryption module is also used to perform signature verification and decryption on the file acquisition request to obtain the information of the file to be transmitted;

The first encryption module is further configured to encrypt the file to be transmitted by using the SM4 symmetric key to obtain a file ciphertext; use the first SM2 private key to digitally sign the file ciphertext to obtain a file sign;

The first sending module is further configured to send the file signature to the client.

Optionally, the first decryption module is also used for:

Use the second SM2 public key to verify the signature of the file acquisition request;

If the signature verification is passed, the signature verification result is decrypted by using the SM4 symmetric key to obtain the information of the file to be transmitted.

In addition, according to another aspect of the embodiments of the present invention, there is provided a file transmission device, which is set at the user end and includes:

The second sending module is used for sending a key acquisition request to the bank; sending the second key ciphertext to the bank;

The second receiving module is configured to receive the first secret key ciphertext returned by the bank; and receive the key acquisition request sent by the bank;

The second decryption module is used for decrypting the first secret key ciphertext to obtain the first SM2 public key and the SM4 symmetric secret key;

The second key module is used to generate a second SM2 public key and its corresponding second SM2 private key;

The second encryption module is configured to encrypt the second SM2 public key to obtain a second secret key ciphertext.

Optionally, the second decryption module is also used for:

According to the user identification and preset parameters of the user terminal, the second decryption parameter is assembled;

Based on the second decryption parameter and using a symmetric encryption algorithm, the first secret key ciphertext is decrypted to obtain the first SM2 public key and the SM4 symmetric secret key.

Optionally, the second encryption module is also used for:

According to the user identification and preset parameters of the bank end, the second encryption parameter is assembled;

Encrypting the second SM2 public key based on the second encryption parameter and using a symmetric encryption algorithm to obtain a second secret key ciphertext.

Optionally, the second encryption module is further configured to: generate a message according to the information of the file to be transmitted; use the second SM2 private key to encrypt the message to obtain a message ciphertext; use the SM4 The symmetric key performs digital signature verification on the ciphertext of the message to obtain a message signature;

The second sending module is further configured to send a file acquisition request to the bank, where the file acquisition request carries the message signature.

Optionally, the second receiving module is further configured to receive the file signature returned by the bank;

The second decryption module is further configured to: verify the signature of the file by using the first SM2 public key; if the signature is verified, decrypt the signature verification result using the SM4 symmetric secret key to obtain the file.

According to another aspect of the embodiments of the present invention, an electronic device is also provided, including:

one or more processors;

storage means for storing one or more programs,

When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any of the above embodiments.

According to another aspect of the embodiments of the present invention, there is also provided a computer-readable medium on which a computer program is stored, and when the program is executed by a processor, implements the method described in any of the foregoing embodiments.

According to another aspect of the embodiments of the present invention, a computer program product is also provided, including a computer program, which implements the method described in any of the foregoing embodiments when the computer program is executed by a processor.

An embodiment of the above invention has the following advantages or beneficial effects: because the generation of the first SM2 public key and the corresponding first SM2 private key and the generation of the SM4 symmetric secret key are adopted, and then the first SM2 public key and the SM4 symmetric secret key are generated. The technical means of encrypting to obtain the first secret key ciphertext, and then sending the first secret key ciphertext to the client, overcomes the technical problem that the prior art cannot meet the security requirements between the user system and the banking system. The embodiment of the present invention is based on the bank-enterprise direct connection system, and the bank end is based on the SM4 symmetric encryption and decryption and the SM2 digital signature algorithm to provide users with various security requirements such as identity authentication security, security encryption, and digital signatures, and satisfies the user system. Security requirements with the banking system.

Further effects of the above non-conventional alternatives will be described below in conjunction with specific embodiments.

Description of drawings

The accompanying drawings are used for better understanding of the present invention and do not constitute an improper limitation of the present invention. in:

1 is a schematic diagram of the main flow of a file transmission method according to a first embodiment of the present invention;

2 is a schematic diagram of the key interaction between a bank terminal and a user terminal according to the present invention;

3 is a schematic diagram of a main flow of a file transmission method according to a second embodiment of the present invention;

4 is a schematic diagram of a main flow of a file transmission method according to a fourth embodiment of the present invention;

5 is a schematic diagram of a main flow of a file transmission method according to a fifth embodiment of the present invention;

6 is a schematic diagram of the main modules of the file transmission device according to the first embodiment of the present invention;

FIG. 7 is a schematic diagram of the main modules of the file transmission device according to the second embodiment of the present invention;

FIG. 8 is an exemplary system architecture diagram to which an embodiment of the present invention may be applied;

FIG. 9 is a schematic structural diagram of a computer system suitable for implementing a terminal device or a server according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present invention are described below with reference to the accompanying drawings, which include various details of the embodiments of the present invention to facilitate understanding and should be considered as exemplary only. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. Also, descriptions of well-known functions and constructions are omitted from the following description for clarity and conciseness.

The acquisition, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations.

FIG. 1 is a schematic diagram of the main flow of the file transmission method according to the first embodiment of the present invention. As an embodiment of the present invention, as shown in FIG. 1 , the file transfer method is applied to the bank, and may include:

Step 101: Receive a key acquisition request sent by a client.

In order to verify and decrypt the data sent by the bank, the client needs to obtain the secret key from the bank. Therefore, the client sends a key acquisition request to the bank, and the bank receives the key acquisition request sent by the client.

Step 102, generating a first SM2 public key and its corresponding first SM2 private key, and generating an SM4 symmetric key.

After the bank terminal receives the key acquisition request sent by the user terminal, it generates a first SM2 public key, its corresponding first SM2 private key, and an SM4 symmetric key.

The full name of SM2 algorithm is SM2 elliptic curve public key encryption algorithm, including SM2-1 elliptic curve digital signature algorithm, SM2-2 elliptic curve key exchange protocol, and SM2-3 elliptic curve public key encryption algorithm, which are respectively used to realize digital signature encryption. key agreement and data encryption. The difference between the SM2 algorithm and the RSA algorithm is that the SM2 algorithm is based on the point group discrete logarithm problem on the elliptic curve. Compared with the RSA algorithm, the 256-bit SM2 password is stronger than the 2048-bit RSA password.

The full name of the SM4 algorithm is the SM4 block symmetric cipher algorithm, which is used to implement data encryption/decryption operations to ensure the confidentiality of data and information. The SM4 algorithm has the same key length as the AES algorithm, and the block length is 128 bits, so it is higher in security than the 3DES algorithm.

Step 103: Encrypt the first SM2 public key and the SM4 symmetric secret key to obtain a first secret key ciphertext.

In order to securely transmit the first SM2 public key and the SM4 symmetric key, the bank needs to encrypt the generated first SM2 public key and the SM4 symmetric key to obtain the first key ciphertext.

Optionally, step 103 may include: assembling a first encryption parameter according to the user identifier of the user terminal and preset parameters; The SM4 symmetric key is encrypted to obtain the first key ciphertext. In the embodiment of the present invention, the bank terminal and the user terminal have agreed on the user identification and parameter generation rules of the user terminal in advance, so preset parameters can be generated according to the pre-agreed parameter generation rules, so that the user identification of the user terminal and the preset parameters can be generated. The parameters are assembled into a first encryption parameter, and then based on the generated first encryption parameter and a symmetric encryption algorithm (such as a DES algorithm), the first SM2 public key and the SM4 symmetric key are encrypted to obtain the first key ciphertext.

It should be noted that the first SM2 public key and the SM4 symmetric secret key may be encrypted together, or the first SM2 public key and the SM4 symmetric secret key may be encrypted separately (the encryption method is the same), which is not limited in this embodiment of the present invention .

Step 104: Send the first secret key ciphertext to the client.

As shown in Figure 2, the server sends the encrypted first secret key ciphertext to the client, and after the client decrypts it, the client can obtain the first SM2 public key and SM4 symmetric key of the bank.

Step 105: Send a key acquisition request to the client.

In order to verify and decrypt the data sent by the client, the bank needs to obtain the secret key from the client. Therefore, the bank terminal sends a key acquisition request to the user terminal, and the user terminal receives the key acquisition request sent by the bank terminal.

Step 106: Receive the second secret key ciphertext returned by the user terminal.

The user end generates the second secret key ciphertext, and then returns the second secret key ciphertext to the bank end, and the bank end receives the second secret key ciphertext returned by the user end.

Step 107: Decrypt the second secret key ciphertext to obtain a second SM2 public key.

In order to ensure the security of the key transmission, the client will soon encrypt the secret key. Therefore, after the bank receives the ciphertext of the second secret key returned by the client, it needs to decrypt the ciphertext of the second secret key, thereby obtaining Second SM2 public key.

Optionally, step 107 may include: assembling a first decryption parameter according to the user identifier and preset parameters of the bank; Decryption is performed to obtain the second SM2 public key. In the embodiment of the present invention, the bank end and the user end have agreed on the bank end's user ID and parameter generation rules in advance, so the preset parameters can be generated according to the pre-agreed parameter generation rules, so that the bank end user ID and preset parameters can be generated. The parameters are assembled into a first decryption parameter, and then based on the generated first decryption parameter and a symmetric encryption algorithm (such as the DES algorithm), the second secret key ciphertext is decrypted to obtain a second SM2 public key, as shown in Figure 2.

According to the various embodiments described above, it can be seen that the embodiment of the present invention generates a first SM2 public key and its corresponding first SM2 private key and generates an SM4 symmetric secret key, and then symmetric to the first SM2 public key and SM4 The technical means of encrypting the secret key to obtain the first secret key ciphertext and then sending the first secret key ciphertext to the user end solves the technical problem that the prior art cannot meet the security requirements between the user system and the banking system. The embodiment of the present invention is based on the bank-enterprise direct connection system, and the bank end is based on the SM4 symmetrical encryption and decryption and the SM2 digital signature algorithm to provide users with identity authentication security and meet the security requirements between the user system and the bank system.

FIG. 3 is a schematic diagram of a main flow of a file transmission method according to a second embodiment of the present invention. As another embodiment of the present invention, as shown in FIG. 3 , the file transfer method is applied to the bank, and may include:

Step 301: Receive a file acquisition request sent by a client.

When the client needs to obtain a file from the bank, it can send a file obtaining request to the bank, and the bank receives the file obtaining request sent by the client.

Step 302: Perform signature verification and decryption on the file acquisition request to obtain information of the file to be transmitted.

The bank terminal verifies and decrypts the file acquisition request sent by the user terminal, so as to obtain the information of the to-be-transmitted file, such as the name of the to-be-transmitted file.

Optionally, step 302 may include: using the second SM2 public key to perform signature verification on the file acquisition request; if the signature verification is passed, decrypting the signature verification result using the SM4 symmetric secret key to obtain the signature of the file to be transmitted. information. Since the client uses the SM2 algorithm to digitally sign the file and uses the SM4 algorithm to encrypt the message, the bank first uses the second SM2 public key to verify the signature of the file acquisition request sent by the client. Use the SM4 symmetric key to decrypt the signature verification result to obtain the information of the file to be transmitted, such as the name of the file to be transmitted, etc.; if the signature verification fails, the result that the signature verification fails can be returned to the client.

It should be pointed out that the bank can also transfer files to the client by means of push. The client pre-subscribes to the relevant topic. Once the relevant file is generated, the file is the file to be transmitted, such as the receipt file and the account arrival notification. and so on, these files can be transmitted to the client by means of active push.

Step 303: Encrypt the to-be-transmitted file by using the SM4 symmetric key to obtain a file ciphertext.

In order to ensure the security of file transmission, the bank uses the SM4 symmetric key to encrypt the file to be transmitted to obtain the ciphertext of the file.

Step 304, using the first SM2 private key to digitally sign the file ciphertext to obtain a file signature.

For identity verification, the bank also needs to use the first SM2 private key to digitally sign the ciphertext of the file to obtain the file signature.

Step 305: Send the file signature to the client.

Finally, the bank side sends the file signature to the client side.

Therefore, the embodiment of the present invention is based on the bank-enterprise direct connection system, and the bank end is based on the SM4 symmetric encryption and decryption and the SM2 digital signature algorithm to provide users with various security requirements such as identity authentication security, security encryption, and digital signature, which satisfies the requirements. Security requirements between the user system and the banking system.

FIG. 4 is a schematic diagram of a main flow of a file transmission method according to a third embodiment of the present invention. As yet another embodiment of the present invention, as shown in FIG. 4 , the file transfer method is applied to the client, and may include:

In step 401, a request for obtaining a secret key is sent to the bank.

In order to verify and decrypt the data sent by the bank, the client needs to obtain the secret key from the bank. Therefore, the client sends a key acquisition request to the bank, and the bank receives the key acquisition request sent by the client.

Step 402: Receive the first secret key ciphertext returned by the bank.

After receiving the key acquisition request sent by the client, the bank generates a first SM2 public key, its corresponding first SM2 private key, and an SM4 symmetric key, and then symmetric to the first SM2 public key and the SM4 The secret key is encrypted to obtain the first secret key ciphertext, and finally the first secret key ciphertext is returned to the client. The client terminal receives the first secret key ciphertext returned by the bank terminal.

Step 403: Decrypt the first secret key ciphertext to obtain the first SM2 public key and the SM4 symmetric secret key.

The user terminal decrypts the first secret key ciphertext returned by the bank terminal to obtain the first SM2 public key and the SM4 symmetric secret key. Optionally, step 403 may include: assembling a second decryption parameter according to the user identifier of the user terminal and preset parameters; decrypting the secret key ciphertext based on the second decryption parameter and using a symmetric encryption algorithm , and obtain the first SM2 public key and SM4 symmetric key. In the embodiment of the present invention, the bank terminal and the user terminal have agreed on the user identification and parameter generation rules of the user terminal in advance, so the preset parameters can be generated according to the pre-agreed parameter generation rules, so as to combine the user identification of the user terminal with the preset parameters. The parameters are assembled into second decryption parameters, and then based on the generated second decryption parameters and a symmetric encryption algorithm (such as the DES algorithm), the first secret key ciphertext is decrypted to obtain the first SM2 public key and SM4 symmetric secret key, such as shown in Figure 2.

Step 404: Receive a key acquisition request sent by the bank.

In order to verify and decrypt the data sent by the client, the bank needs to obtain the secret key from the client. Therefore, the bank terminal sends a key acquisition request to the user terminal, and the user terminal receives the key acquisition request sent by the bank terminal.

Step 405, generate a second SM2 public key and its corresponding second SM2 private key.

After receiving the key acquisition request sent by the bank, the client generates a second SM2 public key and its corresponding second SM2 private key.

Step 406: Encrypt the second SM2 public key to obtain a second secret key ciphertext.

In order to securely transmit the second SM2 public key, the client needs to encrypt the generated second SM2 public key to obtain the second secret key ciphertext.

Optionally, step 406 may include: assembling a second encryption parameter according to the user identifier and preset parameters of the bank; Encrypt to get the second key ciphertext. In the embodiment of the present invention, the bank end and the user end have agreed on the bank end's user ID and parameter generation rules in advance, so the preset parameters can be generated according to the pre-agreed parameter generation rules, so that the bank end user ID and preset parameters can be generated. The parameters are assembled into second encryption parameters, and then based on the generated second encryption parameters and using a symmetric encryption algorithm (such as a DES algorithm), the second SM2 public key is encrypted to obtain a second secret key ciphertext.

Step 407: Send the second secret key ciphertext to the bank.

As shown in Figure 2, the client sends the encrypted second secret key ciphertext to the client, and after the bank decrypts it, the client's second SM2 public key can be obtained.

Therefore, the embodiment of the present invention is based on the bank-enterprise direct connection system, and the bank end is based on the SM4 symmetric encryption and decryption and the SM2 digital signature algorithm to provide users with various security requirements such as identity authentication security, security encryption, and digital signature, which satisfies the requirements. Security requirements between the user system and the banking system. FIG. 5 is a schematic diagram of a main flow of a file transmission method according to a fourth embodiment of the present invention. As another embodiment of the present invention, as shown in FIG. 5 , the file transfer method is applied to the user terminal, and may include:

Step 501: Generate a message according to the information of the file to be transmitted.

When the client needs to obtain a file from the bank, it can generate a message according to the information of the file to be transferred (such as the name of the file to be transferred).

Step 502: Encrypt the message by using the second SM2 private key to obtain a message ciphertext.

To ensure security, the client uses the second SM2 private key to encrypt the message to obtain the ciphertext of the message.

Step 503: Digitally verify the ciphertext of the message by using the SM4 symmetric key to obtain a message signature.

In order to perform identity verification, the client also needs to use the SM4 symmetric key to digitally verify the ciphertext of the message to obtain the message signature.

Step 504: Send a file acquisition request to the bank, where the file acquisition request carries the message signature.

Step 505: Receive the file signature returned by the bank.

Step 506, using the first SM2 public key to verify the file signature.

Step 507, if the signature verification is passed, use the SM4 symmetric key to decrypt the signature verification result to obtain a file.

FIG. 6 is a schematic diagram of the main modules of the file transmission apparatus according to the first embodiment of the present invention. As shown in FIG. 6, the file transmission device 600 is set at the bank end, and includes a first receiving module 601, a first secret key module 602, a first encryption module 603, a first sending module 604 and a first decryption module 605; wherein , the first receiving module 601 is used to receive the key acquisition request sent by the client; receive the second secret key ciphertext returned by the client; the first secret key module 602 is used to generate the first SM2 public key and its corresponding The first SM2 private key, and the SM4 symmetric secret key; the first encryption module 603 is used for encrypting the first SM2 public key and the SM4 symmetric secret key to obtain the first secret key ciphertext; the first The sending module 604 is configured to send the first secret key ciphertext to the client; send a secret key acquisition request to the client; the first decryption module 605 is configured to decrypt the second secret key ciphertext , get the second SM2 public key.

Optionally, the first encryption module 603 is also used for:

According to the user identification and preset parameters of the user terminal, the first encryption parameter is assembled;

Based on the first encryption parameter and using a symmetric encryption algorithm, encrypt the first SM2 public key and the SM4 symmetric secret key to obtain a first secret key ciphertext.

Optionally, the first decryption module 605 is also used for:

According to the user identification and preset parameters of the bank terminal, the first decryption parameter is assembled;

Based on the first decryption parameter and using a symmetric encryption algorithm, the second secret key ciphertext is decrypted to obtain a second SM2 public key.

Optionally, the first receiving module 601 is further configured to receive a file acquisition request sent by the client;

The first decryption module is also used to perform signature verification and decryption on the file acquisition request to obtain the information of the file to be transmitted;

The first encryption module 603 is further configured to encrypt the file to be transmitted by using the SM4 symmetric key to obtain a file ciphertext; use the first SM2 private key to digitally sign the file ciphertext to obtain document signature;

The first sending module 604 is further configured to send the file signature to the client.

Optionally, the first decryption module is also used for:

Use the second SM2 public key to verify the signature of the file acquisition request;

If the signature verification is passed, the signature verification result is decrypted by using the SM4 symmetric key to obtain the information of the file to be transmitted.

It should be noted that the specific implementation content of the file transmission device of the present invention has been described in detail in the above-mentioned file transmission method, so the repeated content will not be described here.

FIG. 7 is a schematic diagram of the main modules of the file transmission apparatus according to the first embodiment of the present invention. As shown in FIG. 7 , the file transmission device 700 is set at the user end, and includes a second sending module 701, a second receiving module 702, a second decrypting module 703, a second secret key module 704, and a second encryption module 705; Wherein, the second sending module 701 is configured to send a key acquisition request to the bank; send the second secret key ciphertext to the bank; and the second receiving module 702 is configured to receive the first returned by the bank secret key ciphertext; receive the secret key acquisition request sent by the bank; the second decryption module 703 is used to decrypt the first secret key ciphertext to obtain the first SM2 public key and the SM4 symmetric secret key; the second The secret key module 704 is used for generating the second SM2 public key and the corresponding second SM2 private key; the second encryption module 705 is used for encrypting the second SM2 public key to obtain the second secret key ciphertext.

Optionally, the second decryption module 703 is also used for:

According to the user identification and preset parameters of the user terminal, the second decryption parameter is assembled;

Based on the second decryption parameter and using a symmetric encryption algorithm, the first secret key ciphertext is decrypted to obtain the first SM2 public key and the SM4 symmetric secret key.

Optionally, the second encryption module 705 is also used for:

According to the user identification and preset parameters of the bank end, the second encryption parameter is assembled;

Encrypting the second SM2 public key based on the second encryption parameter and using a symmetric encryption algorithm to obtain a second secret key ciphertext.

Optionally, the second encryption module 705 is further configured to: generate a message according to the information of the file to be transmitted; use the second SM2 private key to encrypt the message to obtain a message ciphertext; use the The SM4 symmetric key performs digital signature verification on the ciphertext of the message to obtain a message signature;

The second sending module 701 is further configured to send a file acquisition request to the bank, where the file acquisition request carries the message signature.

Optionally, the second receiving module 702 is further configured to receive the file signature returned by the bank;

The second decryption module 703 is further configured to: verify the signature of the file by using the first SM2 public key; if the signature is verified, decrypt the verification result by using the SM4 symmetric secret key to obtain the file .

It should be noted that the specific implementation content of the file transmission device of the present invention has been described in detail in the above-mentioned file transmission method, so the repeated content will not be described here.

FIG. 8 shows an exemplary system architecture 800 to which a file transfer method or a file transfer apparatus according to an embodiment of the present invention may be applied.

As shown in FIG. 8 , the system architecture 800 may include terminal devices 801 , 802 , and 803 , a network 804 and a server 805 . The network 804 is a medium used to provide a communication link between the terminal devices 801 , 802 , 803 and the server 805 . Network 804 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

The user can use the terminal devices 801, 802, 803 to interact with the server 805 through the network 804 to receive or send messages and the like. Various communication client applications may be installed on the terminal devices 801 , 802 and 803 , such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

The terminal devices 801, 802, 803 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

The server 805 may be a server that provides various services, for example, a background management server that provides support for shopping websites browsed by the terminal devices 801, 802, and 803 (just an example). The background management server can analyze and process the received item information query request and other data, and feed back the processing result to the terminal device.

It should be noted that the file transmission method provided in the embodiment of the present invention is generally executed by the server 805 , and accordingly, the file transmission apparatus is generally set in the server 805 .

It should be understood that the numbers of terminal devices, networks and servers in FIG. 8 are merely illustrative. There can be any number of terminal devices, networks and servers according to implementation needs.

Referring next to FIG. 9 , it shows a schematic structural diagram of a computer system 900 suitable for implementing a terminal device according to an embodiment of the present invention. The terminal device shown in FIG. 9 is only an example, and should not impose any limitations on the functions and scope of use of the embodiments of the present invention.

As shown in FIG. 9, a computer system 900 includes a central processing unit (CPU) 901, which can be loaded into a random access memory (RAM) 903 according to a program stored in a read only memory (ROM) 902 or a program from a storage section 908 Instead, various appropriate actions and processes are performed. In the RAM 903, various programs and data necessary for the operation of the system 900 are also stored. The CPU 901 , the ROM 902 , and the RAM 903 are connected to each other through a bus 904 . An input/output (I/O) interface 905 is also connected to bus 904 .

The following components are connected to the I/O interface 905: an input section 906 including a keyboard, a mouse, etc.; an output section 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc. ; and a communication section 909 including a network interface card such as a LAN card, a modem, and the like. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I/O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is mounted on the drive 910 as needed so that a computer program read therefrom is installed into the storage section 908 as needed.

In particular, the processes described above with reference to the flowcharts may be implemented as computer software programs in accordance with the disclosed embodiments of the present invention. For example, embodiments disclosed herein include a computer program comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the method illustrated in the flowchart. In such an embodiment, the computer program may be downloaded and installed from the network through the communication section 909 and/or installed from the removable medium 911 . When the computer program is executed by the central processing unit (CPU) 901, the above-described functions defined in the system of the present invention are performed.

It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above. More specific examples of computer readable storage media may include, but are not limited to, electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Programmable read only memory (EPROM or flash memory), fiber optics, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. In the present invention, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, however, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code therein. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device . Program code embodied on a computer readable medium may be transmitted using any suitable medium including, but not limited to, wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer programs according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code that contains one or more logical functions for implementing the specified functions executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams or flowchart illustrations, and combinations of blocks in the block diagrams or flowchart illustrations, can be implemented in special purpose hardware-based systems that perform the specified functions or operations, or can be implemented using A combination of dedicated hardware and computer instructions is implemented.

The modules involved in the embodiments of the present invention may be implemented in a software manner, and may also be implemented in a hardware manner. The described module can also be set in the processor, for example, it can be described as: a processor includes a first receiving module, a first key module, a first encryption module and a first sending module, wherein the names of these modules are In some cases, it does not constitute a limitation of the module itself.

The modules involved in the embodiments of the present invention may be implemented in a software manner, and may also be implemented in a hardware manner. The described modules can also be provided in the processor, for example, it can be described as: a processor includes a second sending module, a second receiving module and a second decrypting module, wherein the names of these modules are in some cases the same It does not constitute a limitation on the module itself.

As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or may exist alone without being assembled into the device. The above-mentioned computer-readable medium carries one or more programs, and when the above-mentioned one or more programs are executed by a device, the device implements the following methods: receiving a key acquisition request sent by a user terminal; generating a first SM2 public key and Its corresponding first SM2 private key, and generating an SM4 symmetric key; encrypting the first SM2 public key and the SM4 symmetric key to obtain a first key ciphertext; The ciphertext is sent to the client.

As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or may exist alone without being assembled into the device. The above-mentioned computer-readable medium carries one or more programs, and when the above-mentioned one or more programs are executed by a device, the device implements the following methods: sending a key acquisition request to the bank; a secret key ciphertext; decrypt the first secret key ciphertext to obtain the first SM2 public key and the SM4 symmetric secret key.

As another aspect, an embodiment of the present invention further provides a computer program product, including a computer program, which implements the method described in any of the foregoing embodiments when the computer program is executed by a processor.

According to the technical solution of the embodiment of the present invention, because the generation of the first SM2 public key and the corresponding first SM2 private key and the generation of the SM4 symmetric secret key are adopted, and then the first SM2 public key and the SM4 symmetric secret key are encrypted, the first SM2 public key and the SM4 symmetric secret key are encrypted. The technical means of sending the first secret key ciphertext to the user end after one secret key ciphertext, thus overcomes the technical problem that the prior art cannot meet the security requirements between the user system and the banking system. The embodiment of the present invention is based on the bank-enterprise direct connection system, and the bank end is based on the SM4 symmetric encryption and decryption and the SM2 digital signature algorithm to provide users with various security requirements such as identity authentication security, security encryption, and digital signatures, and satisfies the user system. Security requirements with the banking system.

The above-mentioned specific embodiments do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims (23)

1. A file transmission method is applied to a bank end and comprises the following steps:

receiving a secret key acquisition request sent by a user side;

generating a first SM2 public key and a corresponding first SM2 private key thereof, and generating an SM4 symmetric key;

encrypting the first SM2 public key and the SM4 symmetric secret key to obtain a first secret key ciphertext;

sending the first secret key ciphertext to the user side;

sending a key acquisition request to the user side;

receiving a second secret key ciphertext returned by the user side;

and decrypting the second secret key ciphertext to obtain a second SM2 public key.

2. The method of claim 1, wherein encrypting the first SM2 public key and the SM4 symmetric key to obtain a first secret key ciphertext comprises:

assembling a first encryption parameter according to the user identifier of the user side and a preset parameter;

and based on the first encryption parameter and by adopting a symmetric encryption algorithm, encrypting the first SM2 public key and the SM4 symmetric secret key to obtain a first secret key ciphertext.

3. The method of claim 1, wherein decrypting the second secret key ciphertext to obtain a second SM2 public key comprises:

assembling a first decryption parameter according to the user identification and the preset parameter of the bank end;

and decrypting the second secret key ciphertext by adopting a symmetric encryption algorithm based on the first decryption parameter to obtain a second SM2 public key.

4. The method of claim 1, wherein after decrypting the second secret key ciphertext to obtain a second SM2 public key, further comprising:

receiving a file acquisition request sent by a user side;

performing signature verification and decryption on the file acquisition request to obtain information of the file to be transmitted;

encrypting the file to be transmitted by using the SM4 symmetric key to obtain a file ciphertext;

performing digital signature on the file ciphertext by using the first SM2 private key to obtain a file signature;

and sending the file signature to the user side.

5. The method of claim 4, wherein signing and decrypting the file retrieval request comprises:

adopting a second SM2 public key to check the file acquisition request;

and if the signature passes the verification, decrypting the signature verification result by using the SM4 symmetric key to obtain the information of the file to be transmitted.

6. A file transmission method is applied to a user side and comprises the following steps:

sending a secret key acquisition request to a bank end;

receiving a first secret key ciphertext returned by the bank end;

decrypting the first secret key ciphertext to obtain a first SM2 public key and an SM4 symmetric secret key;

receiving a secret key acquisition request sent by the bank end;

generating a second SM2 public key and its corresponding second SM2 private key;

encrypting the second SM2 public key to obtain a second secret key ciphertext;

and sending the second secret key ciphertext to the bank end.

7. The method of claim 6, wherein decrypting the first secret key ciphertext to obtain a first SM2 public key and an SM4 symmetric key comprises:

assembling into a second decryption parameter according to the user identifier of the user side and a preset parameter;

and decrypting the first secret key ciphertext by adopting a symmetric encryption algorithm based on the second decryption parameter to obtain a first SM2 public key and an SM4 symmetric secret key.

8. The method of claim 6, wherein encrypting the second SM2 public key to obtain a second secret key ciphertext comprises:

assembling a second encryption parameter according to the user identification and the preset parameter of the bank end;

and encrypting the second SM2 public key based on the second encryption parameter by adopting a symmetric encryption algorithm to obtain a second secret key ciphertext.

9. The method of claim 6, wherein after decrypting the first secret key ciphertext to obtain the first SM2 public key and the SM4 symmetric key, further comprising:

generating a message according to the information of the file to be transmitted;

encrypting the message by using the second SM2 private key to obtain a message ciphertext;

performing digital signature verification on the message ciphertext by using the SM4 symmetric key to obtain a message signature;

and sending a file acquisition request to the bank terminal, wherein the file acquisition request carries the message signature.

10. The method according to claim 9, after sending the file acquisition request to the bank terminal, further comprising:

receiving a file signature returned by the bank end;

verifying the file signature by using the first SM2 public key;

and if the signature passes the verification, decrypting the signature verification result by using the SM4 symmetric key to obtain the file.

11. The utility model provides a file transmission device which characterized in that sets up in bank end, includes:

the first receiving module is used for receiving a secret key obtaining request sent by a user side; receiving a second secret key ciphertext returned by the user side;

the first secret key module is used for generating a first SM2 public key and a corresponding first SM2 private key thereof, and generating an SM4 symmetric secret key;

the first encryption module is configured to encrypt the first SM2 public key and the SM4 symmetric key to obtain a first secret key ciphertext;

the first sending module is used for sending the first secret key ciphertext to the user side; sending a key acquisition request to the user side;

and the first decryption module is used for decrypting the second secret key ciphertext to obtain a second SM2 public key.

12. The apparatus of claim 11, wherein the first encryption module is further configured to:

assembling a first encryption parameter according to the user identifier of the user side and a preset parameter;

and based on the first encryption parameter and by adopting a symmetric encryption algorithm, encrypting the first SM2 public key and the SM4 symmetric secret key to obtain a first secret key ciphertext.

13. The apparatus of claim 11, wherein the first decryption module is further configured to:

assembling a first decryption parameter according to the user identification and the preset parameter of the bank end;

and decrypting the second secret key ciphertext by adopting a symmetric encryption algorithm based on the first decryption parameter to obtain a second SM2 public key.

14. The apparatus according to claim 11, wherein the first receiving module is further configured to receive a file obtaining request sent by a user side;

the first decryption module is further used for carrying out signature verification and decryption on the file acquisition request to obtain information of the file to be transmitted;

the first encryption module is further configured to encrypt the file to be transmitted by using the SM4 symmetric key to obtain a file ciphertext; performing digital signature on the file ciphertext by using the first SM2 private key to obtain a file signature;

the first sending module is further configured to send the file signature to the user side.

15. The apparatus of claim 14, wherein the first decryption module is further configured to:

adopting a second SM2 public key to check the file acquisition request;

and if the signature passes the verification, decrypting the signature verification result by using the SM4 symmetric key to obtain the information of the file to be transmitted.

16. The utility model provides a file transmission device which characterized in that sets up in the user side, includes:

the second sending module is used for sending a secret key obtaining request to the bank end; sending the second secret key ciphertext to the bank end;

the second receiving module is used for receiving a first secret key ciphertext returned by the bank end; receiving a secret key acquisition request sent by the bank end;

the second decryption module is used for decrypting the first secret key ciphertext to obtain a first SM2 public key and an SM4 symmetric secret key;

the second secret key module is used for generating a second SM2 public key and a corresponding second SM2 private key;

and the second encryption module is used for encrypting the second SM2 public key to obtain a second secret key ciphertext.

17. The apparatus of claim 16, wherein the second decryption module is further configured to:

assembling into a second decryption parameter according to the user identifier of the user side and a preset parameter;

and decrypting the first secret key ciphertext by adopting a symmetric encryption algorithm based on the second decryption parameter to obtain a first SM2 public key and an SM4 symmetric secret key.

18. The apparatus of claim 16, wherein the second encryption module is further configured to:

assembling a second encryption parameter according to the user identification and the preset parameter of the bank end;

and encrypting the second SM2 public key based on the second encryption parameter by adopting a symmetric encryption algorithm to obtain a second secret key ciphertext.

19. The apparatus of claim 16, wherein the second encryption module is further configured to: generating a message according to the information of the file to be transmitted; encrypting the message by using the second SM2 private key to obtain a message ciphertext; performing digital signature verification on the message ciphertext by using the SM4 symmetric key to obtain a message signature;

the second sending module is further configured to send a file obtaining request to the bank end, where the file obtaining request carries the message signature.

20. The apparatus according to claim 19, wherein the second receiving module is further configured to receive a file signature returned by the bank end;

the second decryption module is further configured to: verifying the file signature by using the first SM2 public key; and if the signature passes the verification, decrypting the signature verification result by using the SM4 symmetric key to obtain the file.

21. An electronic device, comprising:

one or more processors;

a storage device for storing one or more programs,

the one or more programs, when executed by the one or more processors, implement the method of any of claims 1-10.

22. A computer-readable medium, on which a computer program is stored, which, when being executed by a processor, carries out the method according to any one of claims 1-10.

23. A computer program product comprising a computer program, characterized in that the computer program realizes the method according to any of claims 1-10 when executed by a processor.

Images