CN114844716B - Digital signature message processing method, device, equipment and computer medium - Google Patents

Abstract

The application provides a digital signature message processing method, a device, equipment and a computer medium, wherein the method comprises the following steps: receiving a digital signature message forwarded by access equipment and a destination address thereof; storing the digital signature message, the equipment information of the access equipment and the user identification information of the first host connected with the access equipment, and transmitting the digital signature message to a second host based on the destination address; if a digital signature message negotiation verification request sent by a second host is received, the digital signature message and the user identification information are sent to the access equipment based on the equipment information, so that the access equipment carries out fake message detection on the first host sending the digital signature message based on the user identification information. The method and the device can efficiently identify the forged digital signature message without introducing an authoritative Certification Authority (CA) mechanism, effectively improve the safety and reliability of a network system and reduce the operation cost of overall business.

Description

Digital signature message processing method, device, equipment and computer medium

technical field

The present application relates to the field of computer information transmission and security, in particular to a digital signature message processing method, device, equipment and computer media.

Background technique

A digital signature is an encryption mechanism and a proof mechanism for network information transmission. It is a digital string that only the sender of the message or message can generate and cannot be forged by others. This digital string is also an effective proof of the authenticity of the information sent by the sender of the message or message.

But the difficulty of the digital signature algorithm is that it is difficult to ensure that the message is signed by the sender A, because although the digital signature is produced by the owner of the private key, only the owner knows what the private key is. If a third party uses the private key of sender A to generate a digital signature and sends it to receiver B through the Internet, then B cannot determine whether the digital signature is completed by A.

Contents of the invention

In view of the above problems, this application provides a digital signature message processing method, device, equipment and computer media to solve the problem that a third party uses the real sender's private key to generate a digital signature, resulting in the recipient of the message being unable to identify the forged digital signature message.

In order to achieve the above object, the application provides the following technical solutions:

In a first aspect, the present application provides a method for processing a digitally signed message, which is applied to a forwarding device, and the method includes:

Receiving the digitally signed message and its destination address forwarded by the access device, the digitally signed message and its destination address are received by the access device from the first host connected to it and forwarded to the forwarding device, and the digitally signed message carries a public key, a file, and a digital signature;

storing the digitally signed message, the device information of the access device and the user identification information of the connected first host, and sending the digitally signed message to a second host based on the destination address;

If the digital signature message negotiation verification request sent by the second host is received, the digital signature message and the user identification information are sent to the access device based on the device information, so that the access device detects forged messages based on the user identification information on the first host that sends the digital signature message.

In an implementation manner, the digital signature packet negotiation verification request is sent by the second host to the forwarding device when different digital signatures are recognized.

In an implementation manner, after receiving the digitally signed message forwarded by the access device, and before storing the digitally signed message, the device information of the access device, and the user identification information of the connected first host, the method further includes:

Identifying based on the destination address whether the second host to receive the digitally signed message is a host connected to its own device, and if so, perform the step of storing the digitally signed message, the device information of the access device, and the user identification information of the connected first host.

In one embodiment, the digitally signed message is forwarded after the access device receives the digital signature from the first host it is connected to and writes the first tag of the access device into the first specific field of the digitally signed message.

In an implementation manner, after receiving the digitally signed message forwarded by the access device, and before storing the digitally signed message, the device information of the access device, and the user identification information of the connected first host, the method further includes:

If the digitally signed message does not carry the second label of the own device, write the second label of the own device in the second specific field of the digitally signed message.

In the second aspect, the present application provides another digital signature message processing method, which is applied to an access device, and the method includes:

Receive a digitally signed message and its destination address sent by the first host connected to its own device, where the digitally signed message carries a public key, a file, and a digital signature;

Forwarding the digitally signed message to the forwarding device based on the destination address, so that the forwarding device stores the digitally signed message, the device information of the access device, and the user identification information of the connected first host, and sends the digitally signed message to a second host based on the destination address, and sends the digitally signed message to the access device based on the device information and the user identification information when receiving a digital signature message negotiation verification request sent by the second host;

Based on the user identification information, a forged message detection is performed on the first host that sends the digitally signed message.

In an implementation manner, the digital signature packet negotiation verification request is sent by the second host to the forwarding device when different digital signatures are recognized.

In an implementation manner, after receiving the digitally signed message sent by the first host connected to the self-device, and before forwarding the digitally signed message to the forwarding device based on the destination address, the method further includes:

Writing the first label of the own device in the first specific field of the digital signature message.

In an implementation manner, the forged message detection is performed on the first host that sends the digitally signed message based on the user identification information, including:

Judging whether there is a session between the first host and the second host in the historical session record of the first host, if so, then determining that the first host sending the digitally signed message is a valid host, and the digitally signed message is a valid message.

In an implementation manner, the forged message detection is performed on the first host that sends the digitally signed message based on the user identification information, including:

Sending counterfeit messages of other services to the first host, and judging whether the first host uses other user identification information to process the counterfeit messages after receiving the counterfeit messages;

In a third aspect, the present application provides a digital signature message processing device, which is applied to forwarding equipment, including:

The first receiving module is configured to receive a digitally signed message and its destination address forwarded by the access device, the digitally signed message and its destination address are received by the access device from the first host connected to it and forwarded to the forwarding device, and the digitally signed message carries a public key, a file, and a digital signature;

A storage module configured to store the digitally signed message, the device information of the access device and the user identification information of the connected first host, and send the digitally signed message to a second host based on the destination address;

A sending detection module, which is configured to send the digital signature message and the user identification information to the access device based on the device information if the digital signature message negotiation verification request sent by the second host is received, so that the access device detects forged messages based on the user identification information on the first host that sends the digital signature message.

In a fourth aspect, the present application provides a digital signature message processing device, which is applied to an access device, and the device includes:

The second receiving module is configured to receive a digitally signed message and its destination address sent by the first host connected to its own equipment, and the digitally signed message carries a public key, a file, and a digital signature;

A forwarding module, configured to forward the digitally signed message to a forwarding device based on the destination address, so that the forwarding device stores the digitally signed message, the device information of the access device, and the user identification information of the connected first host, and sends the digitally signed message to a second host based on the destination address, and sends the digitally signed message to the access device based on the device information and the user identification information when receiving a digital signature message negotiation verification request sent by the second host;

A detection module, configured to detect a forged message on the first host sending the digitally signed message based on the user identification information.

In a fifth aspect, a forwarding device is provided, including: a processor and a memory;

the memory stores computer-executable instructions;

The processor executes the computer-executable instructions stored in the memory, so that the forwarding device executes the above-mentioned digital signature message processing method.

In a sixth aspect, an access device is provided, including: a processor and a memory;

the memory stores computer-executable instructions;

The processor executes the computer-executable instructions stored in the memory, so that the access device executes the other digital signature message processing method.

In a seventh aspect, a computer-readable storage medium is provided, wherein computer-executable instructions are stored in the computer-readable storage medium, and when executed by a processor, the computer-readable instructions are used to implement the above-mentioned method for processing a digital signature message, or the above-mentioned another method for processing a digital signature message.

According to the digital signature message processing method, device, equipment and computer medium provided by this application, through the negotiation and decision-making mechanism of the intermediate device---the access device and the forwarding device, when the digitally signed message is transmitted between the sender and the receiver, the access device and the forwarding device are used to access and forward the digitally signed message, by recording and storing the digitally signed message and the device information of the corresponding access device and the user identification information of the first host connected to it, and using the detection function of the intermediate device to detect forged digitally signed messages. Identify forged digital signature messages, effectively improve the security and reliability of the network system, and reduce the operating costs of the overall business.

Description of drawings

FIG. 1 is a schematic diagram of a network architecture for digitally signed message transmission in the related art;

FIG. 2 is a schematic diagram of a network architecture for digitally signed message transmission with forged messages in the related art;

FIG. 3 is a schematic diagram of a possible network architecture according to an embodiment of the present application;

FIG. 4 is a schematic flowchart of a method for processing a digitally signed message provided in an embodiment of the present application;

FIG. 5 is a schematic flowchart of another digital signature message processing method provided by the embodiment of the present application;

FIG. 6 is a schematic structural diagram of a digital signature message processing device provided in an embodiment of the present application;

FIG. 7 is a schematic structural diagram of another digital signature message processing device provided in the embodiment of the present application;

FIG. 8 is a schematic structural diagram of a forwarding device provided in an embodiment of the present application;

FIG. 9 is a schematic structural diagram of an access device provided in an embodiment of the present application;

FIG. 10 is a schematic structural diagram of a digital signature message processing system provided by an embodiment of the present application.

Detailed ways

In order to facilitate the understanding of the embodiment of the present application, the digital signature mechanism is explained firstly: the description of the digital signature mechanism can be compared to a person signing his own name on a document. When he signs on paper, we can verify (for example, by handwriting) that the signature is indeed from this person. When a person digitally signs a document, how to verify that the digital signature is from this person? The mechanism of digital signature is to solve this problem. Combined with Figure 1, the specific mechanism is as follows:

1) Suppose the communication is between A (sender) and B (receiver).

2) A generates a public key and a private key according to the RSA encryption algorithm;

3) Perform a hash operation on the file to be transferred to obtain the file hash value H;

4) Use the private key to encrypt the hash value of the file to obtain the digital signature S;

5) A sends the public key, file and digital signature to B via the Internet;

6) After receiving the above information, B starts to verify whether the digital signature is completed by A. The specific steps are as follows;

7) B uses the public key to decrypt S to obtain the file hash value G (this is the characteristic of the RSA encryption algorithm, that is, the decryption can be completed based on the public key);

8) B performs a hash operation on the received file to obtain G';

9) B compares G and G', if G=G', then draws the conclusion that the signature is established, otherwise, draws a negative conclusion.

The above are the overall steps of digital signature. This process can ensure that the file has not been tampered with during transmission through the Internet, otherwise, G=G' cannot be obtained, because the hash value will change after the file is tampered with.

The above process involves two important concepts, namely RSA encryption algorithm and hash algorithm. RSA is a symmetric encryption algorithm, the encryption and decryption process can be bidirectional. Specifically, the encryption party produces a pair of public key and private key, encrypts the file with the private key, and discloses the public key at the same time. The characteristics of RSA determine that the decrypting party only needs to obtain the public key information to decrypt the encrypted file without obtaining the private key information of the encrypting party; hash is a one-way encryption algorithm (open source algorithm). The common message digest algorithm (Message-Digest Algorithm, MD5) belongs to the hash algorithm. The hash algorithm can encrypt any type of file and obtain a fixed-length number. This number is compared with the encrypted file, but the original file cannot be recovered through this number.

But the difficulty of the digital signature algorithm is that it is difficult to ensure that the file is signed by A, because the digital signature can only be produced by the owner of the private key, but only the owner himself knows what the private key is. If a third party generates a digital signature with its own private key and sends it to B through the Internet, then B cannot judge whether the digital signature was completed by A, as shown in Figure 2.

Since the public key and the private key are always produced in pairs, the owner of a certain private key is also the generator of the corresponding public key, and since the public key is unspoofable (because it is always published on the Internet), it is only necessary to prove that the public key was generated by A. In view of the above problems, in order to ensure the authenticity of digital signatures in related technologies, the commonly used method is in the form of digital certificates, using a digital certificate authority (Certificate Authority, CA) to issue digital certificates to A. Specifically, A sends personal information and public key information to CA, and CA issues a certificate for it. The certificate records A's personal information and its public key, and then A also puts the certificate on the Internet. In this way, B can determine whether the public key belongs to A.

But the shortcoming of this mechanism is, 1) the digital certificate authority that relies heavily on. If the CA makes a mistake, it will bring serious consequences; 2) This mechanism will bring high operating costs, and all parties to the communication must pay a high service fee for obtaining the signed certificate, even if the network communication is normal. As the number of users grows, the operating cost of this mechanism will become higher and higher.

In view of this, the embodiment of the present application provides a digitally signed message processing solution, which adopts the forwarding device negotiation decision-making mechanism, and uses the access device and the forwarding device to access and forward the digitally signed message when transmitting the digitally signed message between the sender and the receiver, and records the forwarding process, and uses the negotiation and judgment functions between the access device and the forwarding device to detect forged digitally signed messages. It can help the communication network to effectively use digital signatures without introducing an authoritative certification CA organization, reduce the success rate of digital signature forged messages, effectively improve the security and reliability of the network system, and reduce the operating costs of the overall business.

In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described in more detail below in conjunction with the drawings in the embodiments of the present application. In the drawings, the same or similar reference numerals denote the same or similar components or components having the same or similar functions throughout. The described embodiments are some, but not all, embodiments of the application. The embodiments described below by referring to the figures are exemplary, and are intended to explain the present application, and should not be construed as limiting the present application. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

FIG. 3 is a possible network architecture diagram provided by the embodiment of the present application. As shown in FIG. 3 , it includes a first access device X, a second access device Z, and a forwarding device Y, wherein the first access device X, the second access device Z, and the forwarding device Y can be connected to each other through a wired or wireless network. Exemplarily, the data transmission link between the first access device X, the second access device Z, and the forwarding device Y may also include other communication devices, wherein the first access device X is connected to host A, the second access device Z is connected to host C, and the forwarding device is connected to host B. Host A and host C correspond to the sender of the message, and host B corresponds to the receiver of the message.

Among them, the first access device X, the second access device Z, and the forwarding device Y are terminal devices capable of receiving and forwarding digitally signed messages, which may include, but are not limited to, computers, smart phones, tablet computers, e-book readers, Moving Picture experts group audio layer III (MP3 for short) players, and Moving Picture experts group audio layer IV (MP4 for short) players , portable computers, car computers, wearable devices, desktop computers, set-top boxes, smart TVs, and more.

Optionally, in other examples, the number of access devices may be more or less, which is not limited in this embodiment of the present application.

The mainframe refers to the main body part of the computer except the input and output devices, and it is also the control box (container Mainframe) for placing the motherboard and other main components. Usually includes CPU, memory, motherboard, hard disk, optical drive, power supply, chassis, cooling system, and other input and output controllers and interfaces. In this embodiment it is about terminal equipment that sends and receives information.

The above is a brief description of the schematic diagram of the scenario of this application. The following uses the access device X and forwarding device Y in FIG. 1 as examples to describe the digital signature message processing method provided by the embodiment of this application in detail.

Please refer to FIG. 4 . FIG. 4 is a schematic flowchart of a digitally signed message processing method provided by an embodiment of the present application, which is applied to a forwarding device Y, and the method includes steps S401-S403.

Step S401. Receive the digitally signed message and its destination address forwarded by the access device. The digitally signed message and its destination address are received by the access device from the first host it is connected to and forwarded to the forwarding device. The digitally signed message carries a public key, a file, and a digital signature.

It can be understood that a digitally signed message is a message that verifies the identity of the information transmitter in the form of a digital signature, and does not specifically limit the type and content of the message.

In this embodiment, the first host is host A, and the second host is host B, which replaces the direct message transmission mode between host A and host B in the prior art. When host A needs to transmit a digitally signed message to host B, an intermediate device---access device X and forwarding device Y is used to forward the digitally signed message. Specifically, host A first sends the digitally signed message containing the public key, file and digital signature to the access device X, and sets the destination address of the message to the destination address of B. After receiving the message, the access device X recognizes that it is a digitally signed message, and enters the subsequent message forwarding step.

Step S402, storing the digitally signed message, the device information of the access device and the user identification information of the connected first host, and sending the digitally signed message to a second host based on the destination address.

In this embodiment, after receiving the digitally signed message, the forwarding device records and stores the digitally signed message information, the device information of the access device X, and the user identification ID information of the host A, and forwards the digitally signed message to the host B. By storing the above information, when the host B recognizes a different digital signature, the access device and the host corresponding to the possibly forged digitally signed message can be quickly located according to the stored information, and then the possibly forged digitally signed message is verified.

It should be noted that the forwarding device Y in this embodiment serves as the last hop of the digitally signed message in the network. In some embodiments, if the recipient host B is not the host connected to the forwarding device Y, the forwarding device Y continues to forward the digitally signed message to the forwarding device of the next hop until it is forwarded to the forwarding device connected to the host B, wherein only the forwarding device of the last hop or any other hop stores the digitally signed message, the device information of the access device and the user identification information of the first host connected to it, or the forwarding device of each hop stores the above information , which is not limited in this embodiment.

Step S403: If the digital signature packet negotiation verification request sent by the second host is received, send the digital signature packet and the user identification information to the access device based on the device information, so that the access device detects forged packets based on the user identification information on the first host that sent the digital signature packet.

Wherein, the digital signature packet negotiation verification request is sent by the second host to the forwarding device when different digital signatures are recognized.

Specifically, if host B receives only one type of digital signature information within a specific time range, it means that the message is a digital signature sent by host A (assuming that host A is the real identity), and the digital signature sending process ends; if host B receives more than one type of digital signature information within a specific time range, it is determined that there is a forger targeting the digital signature in the network. At this time, host B sends a digitally signed packet negotiation verification request packet to forwarding device Y. It can be understood that the specific time range can be set in combination with practical applications, for example, a time period for packet transmission between A and B.

After receiving the digital signature message negotiation verification request from the host B, the forwarding device Y sends the digital signature message and the user identification information to the corresponding access device X (if the device information of the access device Z is stored) based on the stored device information, so that the access device X (and the access device Z) detects forged messages based on the user identification information on the first host that sends the digital signature message.

Further, the forged message detection process may be that, after the access device X (and the access device Z) receives the message, it initiates a check to the host A (the host C connected to the access device Z) respectively, and simultaneously starts the negotiation process with the other party (between the access device X and the access device Z). Exemplarily, take the inspection process of X as an example: Example 1, the access device X checks the previous session record of host A, and if it is determined that the session is carried out between A and B, then it is determined that A is a valid host; Example 2, the access device X initiates a counterfeit message of another service to host A, and if host A adopts another user ID (often its real user ID), then it is determined that host A is a valid host. The access device X and the access device Z can respectively identify the real user through the above methods, that is, A is the real user. As an optimization, access device X and access device Z initiate a negotiation interaction message, and access device Z blacklists the address of host C, thereby excluding subsequent operations of host C forging messages.

In the above process, only the negotiation and interaction between the access device and the forwarding device can be used to realize the authenticity authentication of the digitally signed message, without the need to introduce an authoritative certification CA organization as in related technologies, which can effectively help the communication network to effectively use digital signatures, reduce the success rate of forged messages with digital signatures, improve the security and reliability of the network system, and reduce the operating costs of the overall business.

In one embodiment, after receiving the digitally signed message forwarded by the access device (step S401), and before storing the digitally signed message, the device information of the access device, and the user identification information of the connected first host (step S402), the following steps are further included:

Identifying based on the destination address whether the second host to receive the digitally signed message is a host connected to its own device, and if so, perform the step of storing the digitally signed message, the device information of the access device, and the user identification information of the connected first host.

In this embodiment, considering that the forwarding device Y may serve as an intermediate route in the transmission network or that the host connected to it is not the receiver device, in order to avoid storage and forwarding of useless information, the forwarding device Y stores and sends the above information only when it is recognized that the receiver device is the host connected to the forwarding device Y.

In an implementation manner, in order to record information such as the network device through which the digitally signed message is transmitted, so as to facilitate the detection of forged messages, the digitally signed message in this embodiment is forwarded after the access device receives the digital signature from the first host connected to it and writes the first label of the access device in the first specific field of the digitally signed message.

It should be noted that the first label and the second label are only used to distinguish different label information and have no other meaning. The first label of the access device may be the egress IP address and MAC address of the access device; correspondingly, the second label of the forwarding device may be the egress IP address and MAC address of the forwarding device.

Further, the forwarding device Y also writes the label information of its own device in the digitally signed message to record the network device through which the digitally signed message is transmitted. Specifically, after receiving the digitally signed message forwarded by the access device (step S401), and before storing the digitally signed message, the device information of the access device, and the user identification information of the first host connected to it (step S402), the following steps are further included:

If the digitally signed message does not carry the second label of the own device, write the second label of the own device in the second specific field of the digitally signed message.

In some embodiments, the forwarding device Y, the access device X or other forwarding devices may have marked the forwarding device Y's label information in the digital signature message, and at this time, the forwarding device Y does not need to mark its label information again.

Please refer to FIG. 5 . FIG. 5 is a schematic flowchart of another digitally signed message processing method provided by the embodiment of the present application, which is applied to an access device X, and the method includes steps S501-S503.

Step S501, receiving a digitally signed message and its destination address sent by the first host connected to its own device, the digitally signed message carrying a public key, a file, and a digital signature;

Step S502, forwarding the digitally signed message to the forwarding device based on the destination address, so that the forwarding device stores the digitally signed message, the device information of the access device, and the user identification information of the connected first host, and sends the digitally signed message to the second host based on the destination address, and sends the digitally signed message to the access device based on the device information and the user identification information when receiving a digital signature message negotiation verification request sent by the second host;

Step S503 , based on the user identification information, detects a forged message on the first host sending the digitally signed message.

In an implementation manner, the digital signature packet negotiation verification request is sent by the second host to the forwarding device when different digital signatures are identified.

In an implementation manner, after receiving the digitally signed message sent by the first host connected to the self-device, and before forwarding the digitally signed message to the forwarding device based on the destination address, the method further includes:

Writing the first label of the own device in the first specific field of the digital signature message.

In one embodiment, the counterfeit message is judged by detecting historical sessions, specifically, based on the user identification information, the first host that sends the digitally signed message is subjected to forged message detection (step S503), including the following steps:

Judging whether there is a session between the first host and the second host in the historical session record of the first host, if so, then determining that the first host sending the digitally signed message is a valid host, and the digitally signed message is a valid message.

In one embodiment, the identity of the host is identified in the form of sending a counterfeit message, and based on the user identification information, the first host that sends the digitally signed message is subjected to forged message detection (step S503), including the following steps:

Send counterfeit messages of other services to the first host, and determine whether the first host uses other user identification information to process the counterfeit messages after receiving the counterfeit messages;

It should be noted that, the principles of the above steps have been described in detail in the above embodiments, and will not be repeated in this embodiment.

In an exemplary embodiment, combined with the network architecture diagram provided by this application---as shown in Figure 3, the flow of the digital signature message processing method provided by this application is as follows:

1) A sends the public key, file and digital signature to the access device X, and sets the destination address of the message as the address of B;

2) X identifies the digitally signed message, and puts a label of the device on the message. The content of the label is the egress IP address and MAC address of the device, and forwards the message;

3) The forwarding device in the message forwarding link recognizes the message, and no longer fills in the label of its own device when seeing the label information of the forwarding device in a specific field;

4) When the forwarding device Y recognizes that the destination address of the message is the host device it is connected to, the forwarding device can determine that it is the last hop of the message in the network;

5) The forwarding device Y records the digital signature message information, the address information of the access device X and the user ID of the sender A, and forwards the message to B;

6) If B receives only one type of digital signature information within a specific time range, it is judged that the message is a digital signature sent by A, and the sending process of the digital signature ends;

7) If B receives more than one type of digital signature information within a specific time range, it is judged that there is a forger for the digital signature in the network. At this time, B sends a digitally signed message negotiation request message to Y;

8) At this point, Y has recorded different public key information and access device information of the same user ID (that is, A's user ID), that is, A_ID:X and A_ID:Z. Y sends relevant messages and address information of X and Z to X and Z respectively;

9) After receiving the message, X and Z initiate checks to hosts A and C respectively, and start the negotiation process with the other party (between X and Z). The specific inspection process can be divided into two types, taking the inspection process of X as an example: the first one is that the access device X checks the previous session record of host A, and if it is determined that the session is carried out between A and B, then it is determined that A is a valid host; X and Z can identify the real user, namely A, through the above methods respectively;

10) X and Z initiate a negotiation exchange message, and Z puts C's host address in the blacklist, thereby excluding C's subsequent operation of forging the message.

Through the above process, without referencing an authoritative certification authority, the success rate of forging messages with digital signatures can be effectively reduced, the reliability of the network system can be effectively improved, and the operating cost of the overall business can be reduced.

Correspondingly, the embodiment of the present application provides a digital signature message processing device, as shown in FIG. 6 , applied to forwarding equipment, including a first receiving module 61, a storage module 62 and a sending detection module, wherein,

The first receiving module 61 is configured to receive a digitally signed message and its destination address forwarded by the access device, the digitally signed message and its destination address are received by the access device from the first host connected to it and forwarded to the forwarding device, and the digitally signed message carries a public key, a file, and a digital signature;

A storage module 62 configured to store the digitally signed message, the device information of the access device and the user identification information of the connected first host, and send the digitally signed message to a second host based on the destination address;

The sending detection module 63 is configured to send the digital signature message and the user identification information to the access device based on the device information if the digital signature message negotiation verification request sent by the second host is received, so that the access device detects forged messages based on the user identification information on the first host that sends the digital signature message.

In an implementation manner, the digital signature packet negotiation verification request is sent by the second host to the forwarding device when different digital signatures are identified.

In one embodiment, the device also includes:

An identification module, configured to identify based on the destination address whether the second host to receive the digitally signed message is a host connected to its own device;

The storage module 62 is also configured as a step of storing the digitally signed message, the device information of the access device and the user identification information of the connected first host when the identification module recognizes that it is the host connected to its own device.

In one embodiment, the digitally signed message is forwarded after the access device receives the digital signature from the first host it is connected to and writes the first tag of the access device into the first specific field of the digitally signed message.

In one embodiment, the device also includes:

The first writing module is configured to write the second tag of the own device in the second specific field of the digitally signed message if the digitally signed message does not carry the second tag of the own device.

The embodiment of the present application correspondingly provides a digital signature message processing device, which is applied to an access device. As shown in FIG. 7, the device includes a second receiving module 71, a forwarding module 72, and a detection module 73, wherein,

The second receiving module 71 is configured to receive a digitally signed message and its destination address sent by the first host connected to its own equipment, and the digitally signed message carries a public key, a file, and a digital signature;

The forwarding module 72 is configured to forward the digitally signed message to a forwarding device based on the destination address, so that the forwarding device stores the digitally signed message, the device information of the access device, and the user identification information of the connected first host, and sends the digitally signed message to a second host based on the destination address, and sends the digitally signed message to the access device based on the device information and the user identification information when receiving a digital signature message negotiation verification request sent by the second host;

A detection module 73 configured to detect a forged message on the first host sending the digitally signed message based on the user identification information.

In an implementation manner, the digital signature packet negotiation verification request is sent by the second host to the forwarding device when different digital signatures are identified.

In one embodiment, the device also includes:

The second writing module is configured to write the first label of its own device in the first specific field of the digitally signed message.

In one embodiment, the detection module 73 is specifically configured to determine whether there is a session between the first host and the second host in the historical session record of the first host, and if so, determine that the first host sending the digitally signed message is a valid host, and the digitally signed message is a valid message.

In one embodiment, the detection module 73 is specifically configured to send counterfeit messages of other services to the first host, and determine whether the first host uses other user identification information to process the counterfeit messages after receiving the counterfeit messages;

Correspondingly, the embodiment of the present application provides a forwarding device, as shown in FIG. 8 , including: a processor 81 and a memory 82;

The memory 82 stores computer-executable instructions;

The processor 81 executes the computer-executed instructions stored in the memory 82, so that the forwarding device executes the aforementioned digital signature message processing method.

Correspondingly, the embodiment of the present application provides an access device, as shown in FIG. 9 , including: a processor 91 and a memory 92;

The memory 92 stores computer-executable instructions;

The processor 91 executes the computer-executed instructions stored in the memory 92, so that the access device executes another digital signature message processing method.

Correspondingly, the present application also provides a digital signature message processing system. As shown in FIG. 10 , the system includes an access device 100, a first host 200, a forwarding device 300, and a second host 400, wherein the access device is electrically connected to the first host and the forwarding device, and the forwarding device is electrically connected to the access device and the second host.

Correspondingly, an embodiment of the present application provides a computer-readable storage medium, where computer-executable instructions are stored in the computer-readable storage medium, and when the computer-executable instructions are executed by a processor, they are used to implement the above-mentioned method for processing a digital signature message, or the above-mentioned another method for processing a digital signature message.

The embodiment of the present application provides a person of ordinary skill in the art who can understand that all or some of the steps in the method disclosed above, the functional modules/units in the system, and the device can be implemented as software, firmware, hardware, and an appropriate combination thereof. In a hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be executed cooperatively by several physical components. Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on computer readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media).

As is well known to those of ordinary skill in the art, the term computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and that can be accessed by a computer.

In addition, communication media typically embody computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism, and can include any information delivery media, as is known to those of ordinary skill in the art.

In the description of the embodiment of the present application, the term "and/or" only means an association relationship describing associated objects, and means that there may be three kinds of relationships, for example, A and/or B may mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the term "at least one" means any combination of any one or more of at least two of the plurality, for example, including at least one of A, B, and may mean any one or more elements selected from the set consisting of A, B, and C.

In the description of the embodiments of the present application, the terms "first", "second", "third", "fourth" and so on (if any) are used to distinguish similar objects, and not necessarily used to describe a specific sequence or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances such that the embodiments of the application described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or elements is not necessarily limited to those steps or elements explicitly listed, but may include other steps or elements not expressly listed or inherent to the process, method, product or device.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements to some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions depart from the scope of the technical solutions of the embodiments of the present application.

Claims (13)

1. A method for processing a digitally signed message, the method being applied to a forwarding device, the method comprising:

receiving a digital signature message and a destination address thereof forwarded by an access device, wherein the digital signature message and the destination address thereof are received by the access device from a first host connected with the access device and forwarded to the forwarding device, and the digital signature message carries a public key, a file and a digital signature;

storing the digital signature message, the equipment information of the access equipment and the user identification information of the first host connected with the access equipment, and transmitting the digital signature message to a second host based on the destination address;

If a digital signature message negotiation verification request sent by a second host is received, sending the digital signature message and the user identification information to the access equipment based on the equipment information, so that the access equipment carries out fake message detection on a first host sending the digital signature message based on the user identification information;

the access device performs fake message detection on the first host sending the digital signature message based on the user identification information, and the fake message detection includes:

the access device judges whether a session between a first host and a second host exists in a history session record of the first host, if so, the first host sending the digital signature message is judged to be an effective host, and the digital signature message is judged to be an effective message;

or,

the access device sends imitation messages of other services to the first host, judges whether the first host adopts other user identification information to process the imitation messages after receiving the imitation messages, if so, judges that the first host sending the digital signature messages is an effective host, and the digital signature messages are effective messages.

2. The method of claim 1, wherein the digitally signed message negotiation validation request is issued by the second host to the forwarding device upon identification of a different digital signature.

3. The method of claim 1, further comprising, after receiving the digital signature message forwarded by the access device and before storing the digital signature message, device information of the access device, and user identification information of a first host to which the access device is connected:

and identifying whether a second host to be received with the digital signature message is a host connected with the forwarding device or not based on the destination address, and if so, executing the step of storing the digital signature message, the device information of the access device and the user identification information of the connected first host.

4. The method of claim 1, wherein the digitally signed message is forwarded after the access device receives a digital signature from a first host to which it is connected and writes a first tag of the access device in a first particular field of the digitally signed message.

5. The method according to claim 1 or 4, further comprising, after receiving the digital signature packet forwarded by the access device and before storing the digital signature packet, device information of the access device and user identification information of a first host to which the access device is connected:

If the digital signature message does not carry the second label of the forwarding device, the second label of the forwarding device is written in a second specific field of the digital signature message.

6. A method for processing a digitally signed message, the method being applied to an access device, the method comprising:

receiving a digital signature message and a destination address thereof sent by a first host connected with the access equipment, wherein the digital signature message carries a public key, a file and a digital signature;

forwarding the digital signature message to forwarding equipment based on the destination address so that the forwarding equipment stores the digital signature message, equipment information of the access equipment and user identification information of a first host connected with the equipment information, sends the digital signature message to a second host based on the destination address, and sends the digital signature message to the access equipment based on the equipment information and the user identification information when receiving a digital signature message negotiation verification request sent by the second host;

detecting a fake message of a first host sending the digital signature message based on the user identification information;

wherein, based on the user identification information, performing fake message detection on the first host sending the digital signature message, including:

Judging whether a session between a first host and a second host exists in a history session record of the first host, if so, judging that the first host which sends the digital signature message is an effective host, wherein the digital signature message is an effective message;

or,

and sending imitation messages of other services to the first host, judging whether the first host processes the imitation messages by adopting other user identification information after receiving the imitation messages, if so, judging that the first host sending the digital signature messages is an effective host, and judging that the digital signature messages are effective messages.

7. The method of claim 6, wherein the digitally signed message negotiation validation request is issued by the second host to the forwarding device upon identification of a different digital signature.

8. The method of claim 6, further comprising, after receiving the digitally signed message sent by the first host to which the access device is connected and before forwarding the digitally signed message to a forwarding device based on the destination address:

writing a first tag of the access device in a first specific field of the digital signature message.

9. A digitally signed message processing device, for use with a forwarding device, comprising:

the first receiving module is configured to receive a digital signature message and a destination address thereof forwarded by the access device, wherein the digital signature message and the destination address thereof are received by the access device from a first host connected with the access device and forwarded to the forwarding device, and the digital signature message carries a public key, a file and a digital signature;

the storage module is used for storing the digital signature message, the equipment information of the access equipment and the user identification information of the first host connected with the access equipment, and sending the digital signature message to the second host based on the destination address;

the sending detection module is configured to send the digital signature message and the user identification information to the access device based on the device information if a digital signature message negotiation verification request sent by the second host is received, so that the access device detects a fake message of the first host sending the digital signature message based on the user identification information;

the access device performs fake message detection on the first host sending the digital signature message based on the user identification information, and the fake message detection includes:

The access device judges whether a session between a first host and a second host exists in a history session record of the first host, if so, the first host sending the digital signature message is judged to be an effective host, and the digital signature message is judged to be an effective message;

or,

the access device sends imitation messages of other services to the first host, judges whether the first host adopts other user identification information to process the imitation messages after receiving the imitation messages, if so, judges that the first host sending the digital signature messages is an effective host, and the digital signature messages are effective messages.

10. A digitally signed message processing device for use with an access device, said device comprising:

the second receiving module is used for receiving a digital signature message and a destination address thereof sent by a first host connected with the access equipment, wherein the digital signature message carries a public key, a file and a digital signature;

the forwarding module is configured to forward the digital signature message to forwarding equipment based on the destination address, so that the forwarding equipment stores the digital signature message, equipment information of the access equipment and user identification information of a first host connected with the digital signature message, send the digital signature message to a second host based on the destination address, and send the digital signature message to the access equipment based on the equipment information and the user identification information when receiving a digital signature message negotiation verification request sent by the second host;

The detection module is used for detecting fake messages of the first host computer which sends out the digital signature messages based on the user identification information;

the detection module is specifically configured to determine whether a session between the first host and the second host exists in a history session record of the first host, if so, determine that the first host sending the digital signature message is an effective host, and determine that the digital signature message is an effective message;

or,

and sending imitation messages of other services to the first host, judging whether the first host processes the imitation messages by adopting other user identification information after receiving the imitation messages, if so, judging that the first host sending the digital signature messages is an effective host, and judging that the digital signature messages are effective messages.

11. A forwarding device, comprising: a processor and a memory;

the memory stores computer-executable instructions;

the processor executing computer-executable instructions stored in the memory to cause the forwarding device to perform the digital signature message processing method of any of claims 1-5.

12. An access device, comprising: a processor and a memory;

The memory stores computer-executable instructions;

the processor executing computer-executable instructions stored in the memory to cause the access device to perform the digital signature message processing method of any one of claims 6-8.

13. A computer readable storage medium having stored therein computer executable instructions which when executed by a processor are adapted to implement the digital signature message processing method of any of claims 1-5 or the digital signature message processing method of any of claims 6-8.