Data transmission method, system and device and storage medium

Abstract

The invention provides a data transmission method, system and device and a storage medium, and the method comprises the steps: a client sends an asymmetric public key and a subscription request to a server, the server generates a random number in response to the subscription request, generates a symmetric password according to the random number, carries out the encryption of the actual data of a target service through employing the symmetric password, and transmits the encrypted data to the server; the method comprises the following steps: acquiring a symmetric password, encrypting the symmetric password based on an asymmetric public key, combining encrypted data with the encrypted symmetric password to form a data packet, sending the data packet to a client, and after the client receives the data packet, decrypting the symmetric password by using a private key so as to decrypt actual data in the data packet; according to the method, secure transmission of the symmetric password is ensured through asymmetric encryption, leakage and tampering of the data in the transmission process are effectively prevented, confidentiality and integrity of the data are guaranteed, in addition, the client decrypts the symmetric password through a private key, it is ensured that only a legal user can access the data of the target service, and the security of data transmission is improved.

Description

Technical Field

[0001] The present application relates to the technical field of data transmission, and in particular to a data transmission method, system, device and storage medium. Background Art

[0002] In modern automotive electronic systems, Automotive Open System Architecture (AutoSAR) is widely used as a standardized software architecture, which aims to promote communication and collaboration between different automotive electronic devices by defining a series of standard interfaces and protocols. With the increasing complexity and networking of automotive electronic systems, data security has become a key issue. To meet this challenge, data encryption technology has become an important means to ensure that data is not illegally accessed or tampered with.

[0003] However, the current AutoSAR Adaptive Platform (AP) development standard does not explicitly stipulate that data transmitted through the ara::com interface must be encrypted. Although the AP specification includes an encryption module, it is not actually used in the ara::com data exchange process, resulting in all data transmitted through ara::com being in plain text, which is vulnerable to attacks by data capture tools, increasing the risk of information leakage. Summary of the invention

[0004] In view of the above-mentioned shortcomings of the prior art, the present invention provides a data transmission method, system, device and storage medium to solve the above-mentioned technical problems.

[0005] The present invention provides a data transmission method, which includes: obtaining an asymmetric public key and a subscription request issued by a client, and determining a target service of the client based on the subscription request; generating one or more one-time random numbers in response to the subscription request, and generating a symmetric password based on the random numbers; encrypting actual data of the target service based on the symmetric password and encrypting the symmetric password based on the asymmetric public key, combining the encrypted actual data with the encrypted symmetric password to form a data packet; sending the data packet to the client, so that the client decrypts the symmetric password based on its own private key, and decrypts the actual data based on the decrypted symmetric password to obtain the data of the target service.

[0006] In one embodiment of the present invention, when the client decides to stop receiving data from the target service, the method further includes: receiving a close subscription request instruction issued by the client, the close subscription request instruction indicating that the client terminates receiving data from the target service; in response to the close subscription request instruction, terminating data transmission activities related to the client, and deleting the asymmetric public key associated with the client stored on the server; updating the status information of the server, marking that the client no longer receives data from the target service, and sending a confirmation message to the client.

[0007] In one embodiment of the present invention, before generating a random number, it also includes: verifying the validity of the subscription request, and the validity verification at least includes checking whether the subscription request comes from a known or trusted client, and checking whether the information contained in the subscription request meets preset security conditions; if the subscription request passes the validity verification, a random number is generated, and a symmetric password is generated based on the random number; if the subscription request fails to pass the validity verification, the subscription request is rejected, and a specific error message is returned to the client.

[0008] In one embodiment of the present invention, the encrypted actual data and the encrypted symmetric password are combined to form a data packet, including: encapsulating the encrypted actual data and the symmetric password encrypted by the client's asymmetric public key into a data packet based on a preset format, and adding additional information to the data packet during the encapsulation process, wherein the additional information includes at least one of the version number, timestamp, and serial number of the data packet.

[0009] The present application provides a data transmission method, which includes: obtaining an initial key pair generated by an asymmetric encryption algorithm, the initial key pair including an asymmetric public key and a private key; querying service information of at least one server to determine a target server that provides a required target service, and sending the asymmetric public key to the target server to subscribe to the target service; issuing a data request to the target server, instructing the target server to generate one or more random numbers, and generating a symmetric password based on the random numbers; triggering the server to encrypt actual data of the target service based on the symmetric password, and encrypt the symmetric password based on the asymmetric public key, combining the encrypted actual data with the encrypted symmetric password to form a data packet; receiving a data packet issued by the target server in response to the data request, decrypting the symmetric password in the data packet based on the private key, and decrypting the original data in the data packet based on the decrypted symmetric password to obtain the data of the target service.

[0010] In one embodiment of the present invention, when the client decides to stop receiving data from the target service, the method further includes: issuing a close subscription request instruction to the target server, the close subscription request instruction indicating that the client terminates receiving data from the target service; receiving confirmation information sent by the target server in response to the close subscription request instruction, the confirmation information indicating that the server has terminated the data transmission activity related to the client and has deleted the asymmetric public key associated with the client stored on the server; updating the client status information and recording the status of no longer receiving data from the target service.

[0011] In one embodiment of the present invention, the data transmission method also includes: implementing data transmission between the client and the server based on a secure communication protocol, the secure communication protocol including transport layer security or secure socket layer security; authenticating the data source before data transmission, the identity authentication being implemented based on any one or more of digital certificates, asymmetric public key infrastructure or two-factor authentication.

[0012] The present application provides a data transmission system, which includes: a client, which is used to issue an asymmetric public key and a subscription request, and the subscription request is used to determine the target service of the client; a server, which is used to receive the subscription request and determine the target server that provides the target service based on the asymmetric public key in the request, and the server includes one or more; the target server generates one or more random numbers in response to the subscription request, and generates a symmetric password based on the random numbers; encrypts the actual data of the target service based on the symmetric password, and combines the encrypted actual data with the symmetric password to form a data packet; sends the data packet to the client; the client is used to receive the data packet sent by the target server in response to the data request, decrypt the symmetric password in the data packet based on the private key, and decrypt the original data in the data packet based on the decrypted symmetric password to obtain the data of the target service.

[0013] The present application provides an electronic device, comprising a processor, a memory and a communication bus; the communication bus is used to connect the processor and the memory; the processor is used to execute a computer program stored in the memory to implement the data transmission method as described above.

[0014] The present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is used to enable a computer to execute the data transmission method as described above.

[0015] Beneficial effects of the present invention: In the data transmission method of the present invention, the client sends an asymmetric public key and a subscription request to the server. The server generates a one-time random number in response to the request and generates a symmetric password based on the one-time random number, and uses the symmetric password to encrypt the actual data of the target service. The encrypted data is combined with the symmetric password into a data packet and sent to the client. After receiving the data packet, the client uses its own private key to decrypt the symmetric password, and then decrypts the actual data in the data packet to finally obtain the data of the target service. This method ensures the secure transmission of the symmetric password through asymmetric encryption, and enhances the encryption strength by using a one-time random number, effectively preventing the data from being directly captured and parsed, and reducing the risk of information leakage. In addition, the client can only decrypt the actual data after decrypting the symmetric password with the private key, thereby ensuring the confidentiality and integrity of the data during transmission, and effectively improving the data security in the data transmission system.

[0016] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0018] Figure 1 is a structural schematic diagram of a data transmission system shown in an exemplary embodiment of the present application;

[0019] Figure 2 is a flowchart of a data transmission method based on a server, shown in an exemplary embodiment of the present application;

[0020] Figure 3 is a schematic diagram of a data packet encryption process shown in an exemplary embodiment of the present application;

[0021] Figure 4 is a schematic diagram of a data packet decryption process shown in an exemplary embodiment of the present application;

[0022] Figure 5 is a schematic diagram of the entire data transmission process shown in an exemplary embodiment of the present application;

[0023] Figure 6 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0024] The following will describe the embodiments of the present invention with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention, not for limiting the scope of protection of the present invention.

[0025] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0026] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it is obvious to those skilled in the art that the embodiments of the present invention can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present invention difficult to understand.

[0027] First of all, it should be noted that in the AutoSAR Adaptive Platform (AP) environment, the configuration tool and communication framework support secure data transmission. The system consists of two parts: the client and the server. The client is responsible for sending subscription requests and receiving data, and the server is responsible for publishing services and responding to client requests.

[0028] Figure 1 It is a structural diagram of a data transmission system shown in an exemplary embodiment of the present application.

[0029] like Figure 1 As shown, the data transmission system proposed in this application includes two parts: a server and a client. Among them, the client is used to send an asymmetric public key and a subscription request to the server, and the subscription request is used to determine the target service required by the client. The server is responsible for receiving the subscription request from the client and determining one or more target servers that provide the target service based on the asymmetric public key in the request.

[0030] After receiving the subscription request, the target server generates one or more one-time random numbers and generates a symmetric password based on these random numbers. Then, the symmetric password is used to encrypt the actual data of the target service, and the encrypted actual data is combined with the symmetric password (encrypted by the client's asymmetric public key) to form a data packet. Subsequently, the target server sends the data packet to the client.

[0031] After receiving the data packet from the target server, the client uses its own private key to decrypt the symmetric password, and then decrypts the actual data in the data packet based on the decrypted symmetric password, and finally obtains the data of the target service. The client can also actively initiate a data request to prompt the target server to respond and send a data packet. The client also decrypts the symmetric password in the data packet based on the private key, and further decrypts the original data in the data packet to obtain the data of the target service.

[0032] Figure 2 It is a flowchart of the steps of a data transmission method based on a server, which is shown in an exemplary embodiment of the present application.

[0033] like Figure 2 As shown, in an exemplary embodiment, the data transmission method at least includes steps S210 to S240, which are described in detail as follows:

[0034] Step S210: acquiring an asymmetric public key and a subscription request sent by the client, and determining a target service of the client based on the subscription request.

[0035] In one embodiment of the present application, the AutoSAR AP software platform is taken as an example. First, a key generation module is added to the AutoSAR AP configuration tool. The module uses the RSA algorithm to generate an asymmetric key pair (asymmetric public key and private key), and the generated asymmetric public key and private key will be saved in the client's configuration file. The server publishes the required services in accordance with the AutoSAR AP specification, and after the client process is started, it searches for the required services through the service discovery mechanism. Once the target service is found, the client initiates a subscription request. It should be noted that the subscription request contains the asymmetric public key generated by the client, so that after the server receives the subscription request, it parses the asymmetric public key information in the request and saves it for use in subsequent encryption operations.

[0036] Figure 3 It is a schematic diagram of a data packet encryption process shown in an exemplary embodiment of the present application.

[0037] like Figure 3As shown, in the data transmission method proposed in the present application, a symmetric key is first generated using a random number, and then the symmetric key is encrypted using an asymmetric public key in an asymmetric encryption algorithm to ensure its security. Next, the generated symmetric key is used to perform an encryption operation on the original message to generate an encrypted message. Finally, the encrypted symmetric key and the encrypted message are encapsulated into a data packet to complete the entire encryption process. This method combines the efficiency of symmetric encryption and the security of asymmetric encryption, providing strong protection for data transmission.

[0038] Step S220, in response to the subscription request, generating one or more one-time random numbers, and generating a symmetric password based on the random numbers.

[0039] In one embodiment of the present application, before generating a random number, it also includes: verifying the validity of the subscription request, and the validity verification at least includes checking whether the subscription request comes from a known or trusted client, and checking whether the information contained in the subscription request meets the preset security conditions; if the subscription request passes the validity verification, a random number is generated, and a symmetric password is generated based on the random number; if the subscription request fails to pass the validity verification, the subscription request is rejected, and a specific error message is returned to the client.

[0040] In a specific implementation of the present application, in order to ensure the security and reliability of data transmission, the server needs to verify the validity of the subscription request issued by the client before generating a random number. Therefore, after the client is started, it finds the required target service through the service discovery mechanism and sends an asymmetric public key and a subscription request to the server. The subscription request also includes other necessary information (such as client identification, timestamp, etc.); then, after the server receives the subscription request, it first performs the validity verification step, which is as follows:

[0041] Check source credibility: The server checks whether the subscription request comes from a known or trusted client. This check can be implemented through a pre-configured client whitelist or by verifying the client's identity certificate;

[0042] Check security conditions: The server checks whether the information contained in the subscription request meets the preset security conditions. For example, verifying timestamps to prevent replay attacks, checking message integrity to prevent tampering, and other possible security policies.

[0043] If the subscription request fails any of the above verifications, the server will reject the subscription request and return specific error information to the client, such as "invalid client", "timestamp expired", "message tampered", etc.

[0044] If the subscription request passes the validity verification, the server continues to process the request. The server generates a one-time random number, and based on the generated random number, the server uses a symmetric encryption algorithm (such as AES) to generate a symmetric password.

[0045] Step S230, encrypting the actual data of the target service based on the symmetric cipher and encrypting the symmetric cipher based on the asymmetric public key, combining the encrypted actual data with the encrypted symmetric cipher to form a data packet.

[0046] In one embodiment of the present application, the encrypted actual data is combined with a symmetric password to form a data packet, including: encapsulating the encrypted actual data and the symmetric password encrypted by a client asymmetric public key into a data packet based on a preset format, and adding additional information to the data packet during the encapsulation process, the additional information including at least one of the version number, timestamp, and serial number of the data packet.

[0047] In a specific embodiment of the present application, in order to ensure the security and reliability of data transmission, after generating a random number and encrypting the actual data, the server needs to encapsulate the encrypted actual data and the symmetric password encrypted by the client's asymmetric public key into a complete data packet, and add additional information to enhance the security and traceability of the data packet. Therefore, the server generates a one-time random number, and based on the random number, after using a symmetric encryption algorithm (such as AES) to generate a symmetric password, the server uses the generated symmetric password to encrypt the actual data of the target service, and encrypts the generated symmetric password with the asymmetric public key provided by the client. In addition, the necessary information and at least one additional information are encapsulated into a data packet based on a preset format, and the necessary information includes the encrypted good driver new data and the symmetric password encrypted by the client's asymmetric public key, wherein the encrypted actual data is the data content after symmetric encryption, and the symmetric password encrypted by the client's asymmetric public key is a symmetric password used to decrypt the actual data, which has been encrypted by the client's asymmetric public key. Its additional information includes but is not limited to the following:

[0048] Version number: Identifies the format version of the data packet so that the client can correctly parse the data packet.

[0049] Timestamp: records the time when the data packet is generated, which is used to prevent replay attacks and provide a time reference.

[0050] Sequence Number: Each data packet is assigned a unique sequence number for data packet sorting and integrity checking.

[0051] Step S240, sending a data packet to the client, so that the client decrypts the symmetric password based on its own private key, and decrypts the actual data based on the decrypted symmetric password to obtain the data of the target service.

[0052] In one embodiment of the present application, in order to ensure the security and reliability of data transmission, the server encapsulates the encrypted actual data and the symmetric password encrypted by the client's asymmetric public key into a complete data packet, and sends it to the client through a secure channel. The client uses its own private key to decrypt the symmetric password and further decrypts the actual data to obtain the data of the target service. Specifically, the server encapsulates the encrypted actual data and the symmetric password encrypted by the client's asymmetric public key into a data packet based on a preset format, and adds additional information (such as version number, timestamp, sequence number) to the data packet during the encapsulation process to enhance the security and traceability of the data packet. Taking the data packet encapsulated in the following JSON format as an example, the server sends the encapsulated data packet to the client through a physical channel (such as a network connection), and uses the SSL / TLS protocol for protection during the entire transmission process to ensure the confidentiality and integrity of the data. Then, after the client receives the data packet sent by the server, it first parses the various fields in the data packet to extract the encrypted actual data and the encrypted symmetric password. Specifically, the client uses its private key to decrypt the encrypted_symmetric_key field in the data packet to obtain the symmetric password, and uses the decrypted symmetric password to decrypt the encrypted_data field in the data packet to obtain the original actual data. Finally, the client finally obtains the decrypted actual data, that is, the data of the target service. In addition, the client can further process this data, such as displaying it to the user or using it for other business logic.

[0053] It should be noted that the focus of this solution is to generate an asymmetric public key and a private key based on an asymmetric encryption algorithm, and to generate a random number in the further data processing process, to encrypt the symmetric password based on the asymmetric public key and the random number, and then to encapsulate the encrypted message encrypted based on the heap password and the encrypted symmetric password into a data packet, thereby realizing the organic combination of very symmetric encryption and symmetric encryption, and effectively improving the encryption strength of the data. Therefore, the encryption method and the specific data encapsulation method proposed in the above embodiments are only for exemplary explanation, and this application does not make any specific limitations on the specific encryption / decryption method of the data and the data encapsulation method.

[0054] It should also be noted that, based on the method proposed in this embodiment, the server can safely send the encrypted actual data and the symmetric password to the client, and the client can correctly decrypt the data packet and obtain the data of the target service. This method not only ensures the security of data transmission, but also ensures the integrity and traceability of the data.

[0055] In addition, when the client decides to stop receiving data from the target service, the data transmission method proposed in the present application also includes: receiving a close subscription request instruction issued by the client, the close subscription request instruction indicating that the client stops receiving data from the target service; in response to the close subscription request instruction, terminating the data transmission activity related to the client, and deleting the asymmetric public key associated with the client stored on the server; updating the status information of the server, marking that the client no longer receives data from the target service, and sending a confirmation message to the client.

[0056] In a specific embodiment of the present application, in order to ensure the security and reliability of data transmission, when the client decides to stop receiving data from the target service, the server needs to process the subscription closure request and perform corresponding cleanup operations. Specifically, when the client decides not to receive data from the target service, it sends a subscription closure request instruction to the server, which clearly indicates that the client stops receiving data from a specific target service, wherein the subscription closure request instruction may include the following information: client identification (such as client ID), target service identification (such as service ID), timestamp, used to prevent replay attacks. Then, after the server receives the subscription closure request instruction issued by the client, it first verifies the validity of the request, including checking the client identification and timestamp to ensure that the request comes from a legitimate client and has not been tampered with. If the verification is successful, in response to the subscription closure request instruction, all data transmission activities related to the client are immediately terminated, any new data packets are stopped from being sent to the client, and all scheduled data transmission tasks are canceled. In addition, the server also needs to delete the asymmetric public key associated with the client stored on the server to ensure that the asymmetric public key is no longer used for any future encryption operations, thereby improving the security of the system. Finally, the client receives the confirmation message sent by the server and parses the confirmation message to confirm that the subscription has been successfully closed, thereby updating the local status information to reflect that the data of the target service is no longer received.

[0057] It should be noted that the server updates its internal status information, marking that the client no longer receives data from the target service. The updated status information may include the following information: client subscription status: changed from "active" to "cancelled"; record the timestamp of closing the subscription; clear other temporary session records related to the client. The server generates a confirmation message indicating that the subscription closing request has been successfully processed. The confirmation message may include the following: confirmation code or status code, indicating that the request was successfully processed; timestamp of closing the subscription; unique transaction ID generated by the server for subsequent tracking or auditing.

[0058] It should be noted that based on the method proposed in this embodiment, the server can effectively process the client's subscription closing request, terminate data transmission activities, delete the stored asymmetric public key, and update status information, while sending confirmation information to the client to ensure the security and reliability of the entire process.

[0059] Figure 4 It is a schematic diagram of a data packet decryption process shown in an exemplary embodiment of the present application.

[0060] like Figure 4 As shown, in the data transmission method proposed in this application, after the client receives the data packet, it parses the encrypted symmetric key and the encrypted message. Then, the private key in the asymmetric key system is used to decrypt the encrypted symmetric key to obtain the symmetric key actually used. Finally, the encrypted message is converted to the original message with the symmetric key. This process effectively ensures the security and integrity of information transmission.

[0061] The present application also provides a data transmission method, which includes: obtaining an initial key pair generated by an asymmetric encryption algorithm, the initial key pair including an asymmetric public key and a private key; querying the service information of at least one server to determine the target server that provides the required target service, and sending the asymmetric public key to the target server to subscribe to the target service; issuing a data request to the target server, instructing the target server to generate one or more random numbers, and generating a symmetric password based on the random numbers; encrypting actual data of the target service based on the symmetric password, and encrypting the symmetric password based on the asymmetric public key, combining the encrypted actual data with the encrypted symmetric password to form a data packet; receiving a data packet sent by the target server in response to the data request, decrypting the symmetric password in the data packet based on the private key, and decrypting the original data in the data packet based on the decrypted symmetric password to obtain the data of the target service.

[0062] In one embodiment of the present application, the client first generates a pair of keys through an asymmetric encryption algorithm, which includes an asymmetric public key for public sharing and a secure private key that is only retained locally. Then, in order to find a service that can meet specific needs, the client will query the service information provided by multiple service terminals on the network, and finally determine a target service terminal that can provide the required functions, and send the previously generated asymmetric public key to this target service terminal as part of subscribing to the service. After completing the subscription, when the client needs to obtain data from the target service terminal, it sends a clear data request to the server terminal, instructing the server terminal to use the previously received asymmetric public key to encrypt the original data to be provided, thereby ensuring that only the party with the corresponding private key can decrypt the data. Subsequently, the target server terminal performs the encryption operation as required and sends the data packet containing the encrypted data to the client. After receiving the data packet, the client first uses the private key it holds to decrypt the symmetric cipher used to protect the content in the data packet, and then uses this symmetric cipher to further decrypt the original data in the entire data packet, and finally securely obtains the information from the target server terminal.

[0063] In another embodiment of the present application, when the client decides to stop receiving data from the target service, the method also includes: issuing a close subscription request instruction to the target server, the close subscription request instruction indicating that the client terminates receiving data from the target service; receiving a confirmation message sent by the target server in response to the close subscription request instruction, the confirmation message indicating that the server has terminated the data transmission activity related to the client and has deleted the asymmetric public key associated with the client stored on the server; updating the client status information and recording the status of no longer receiving data from the target service.

[0064] In a specific embodiment of the present application, first, the client sends a close subscription request instruction to the target server, explicitly informing the server that it no longer wishes to receive any data from the service; then, after receiving the close request, the server will perform corresponding processing, including immediately stopping sending subsequent data to the client, and removing the previously saved asymmetric public key associated with the client from the system, and then the server will return a confirmation message to the client, indicating that the server has successfully ended the data transmission activity for the client and has safely deleted all related key information stored on its server; finally, on the client side, it will update its own status information to reflect the current state change of no longer subscribing to the service, and record this new status setting to ensure that it will not mistakenly continue to try to obtain or process data from the unsubscribed service in the future. Throughout the process, through clear instruction exchange and status update mechanisms, it is ensured that both parties can accurately know and comply with the latest protocol on data flow control.

[0065] Figure 5 It is a schematic diagram of the entire data transmission process shown in an exemplary embodiment of the present application.

[0066] like Figure 5 As shown in the figure, during the entire data transmission process, the server first provides services to the outside world. Subsequently, the client searches for and finds the required service and sends a subscription request containing its asymmetric public key to the server. After receiving this asymmetric public key, the server saves it. When the client needs to obtain data, it will initiate a data request to the server. The server verifies the identity of the client by matching the previously stored asymmetric public key, encrypts the data with the asymmetric public key, and then sends the encrypted data to the client. After receiving the data, the client uses its own private key to decrypt the data, so that it can securely access and process the information. Finally, when the communication ends, the client sends a disconnection request to the server. The server finds the corresponding asymmetric public key record based on this request and removes it from the system to complete the entire interaction process.

[0067] In addition, the data transmission method proposed in the present application also includes: implementing data transmission between the client and the server based on a secure communication protocol to prevent the data from being intercepted or tampered with by a third party during the transmission process, and the secure communication protocol includes transport layer security or secure socket layer security; authenticating the data source before data transmission to ensure that the source of the data is credible and to avoid the data being attacked or incorrectly parsed, and the identity authentication is implemented based on any one or more of digital certificates, asymmetric public key infrastructure, or two-factor authentication.

[0068] In a specific embodiment of the present application, during the entire data transmission process, the server first publishes the required services in accordance with the AutoSARAP specification. After the client is started, the required target service is found through the service discovery mechanism. Once the target service is found, the client generates an asymmetric key pair (asymmetric public key and private key) and sends a subscription request to the server, which contains the generated asymmetric public key and necessary client identification information. After receiving the subscription request, the server verifies the validity of the request, saves the asymmetric public key provided by the client, and associates the asymmetric public key with the client identification. Next, the client sends a request to the server to obtain data, instructing the server to send data for a specific target service. After receiving the data request, the server matches the previously saved client asymmetric public key and uses the asymmetric public key to encrypt the original data of the target service. Specifically, the server generates a random number, generates a symmetric cipher based on the random number, and then uses the symmetric cipher to encrypt the actual data. Next, the server encrypts the symmetric cipher using the asymmetric public key provided by the client, and combines the encrypted actual data and the encrypted symmetric cipher into a final data packet. The server sends the data packet to the client through a physical channel (such as a network connection). After receiving the data packet, the client uses its private key to decrypt the symmetric password in the data packet, and then uses the decrypted symmetric password to decrypt the actual data to obtain the original data content. The client processes the decrypted data, such as displaying it to the user or using it for other business logic. When the client decides not to receive data from the target service anymore, the client sends a disconnect request to the server, which contains the client identification information. After receiving the disconnect request, the server finds the asymmetric public key record associated with the client identification and deletes it. The server updates the internal status information, marking that the client no longer receives data from the target service, and sends a confirmation message to the client, indicating that the disconnect request has been successfully processed.

[0069] It should be noted that through the above process, the client can securely subscribe to the services published by the server and ensure the security of data transmission through asymmetric encryption, from the client generating a key pair to the server encrypting the data, to the client decrypting the data, and finally the client disconnecting and cleaning up the resources. Each step ensures the confidentiality and integrity of the data, improving the security of the system and the reliability of data transmission.

[0070] An embodiment of the present application also provides an electronic device, including: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by one or more processors, the electronic device implements the data transmission method provided in the above-mentioned embodiments.

[0071] Figure 6The structure diagram of the computer system suitable for implementing the electronic device of the embodiment of the present application is shown. It should be noted that: Figure 6 The computer system 600 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0072] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 602 or the program loaded from the storage part 608 to the random access memory (RAM) 603, such as executing the method in the above embodiment. In the RAM 603, various programs and data required for system operation are also stored. The CPU 601, ROM 602 and RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0073] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed so that a computer program read therefrom is installed into the storage section 608 as needed.

[0074] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 609, and / or installed from a removable medium 611. When the computer program is executed by a central processing unit (CPU) 601, various functions defined in the system of the present application are executed.

[0075] It should be noted that the computer-readable medium shown in the embodiment of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. This propagated data signal can take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. A computer program contained on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0076] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0077] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0078] Another aspect of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor of a computer, the computer executes the above data transmission method. The computer-readable storage medium may be included in the electronic device described in the above embodiment, or may exist independently without being assembled into the electronic device.

[0079] Another aspect of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the data transmission method provided in each of the above embodiments.

[0080] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the technology may modify or change the above embodiments without violating the spirit and scope of the present invention. Therefore, all equivalent modifications or changes made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. A data transmission method, characterized in that: The method comprises: Obtaining an asymmetric public key and a subscription request issued by a client, and determining a target service of the client based on the subscription request; In response to the subscription request, generating one or more random numbers, and generating a symmetric password based on the random numbers; Encrypting the actual data of the target service based on the symmetric cipher, encrypting the symmetric cipher based on the asymmetric public key, and combining the encrypted actual data with the encrypted symmetric cipher to form a data packet; The data packet is sent to the client, so that the client decrypts the symmetric password based on its own private key, and decrypts the actual data based on the decrypted symmetric password to obtain the data of the target service.

2. The data transmission method according to claim 1, characterized in that: When the client decides to stop receiving data from the target service, the method further includes: Receiving a subscription closing request instruction issued by a client, wherein the subscription closing request instruction indicates that the client terminates receiving data of the target service; In response to the close subscription request instruction, terminate the data transmission activity related to the client, and delete the asymmetric public key associated with the client stored on the server; Update the status information of the server, mark the client no longer receiving data from the target service, and send confirmation information to the client.

3. The data transmission method according to claim 1, characterized in that: Before generating random numbers, also include: Performing validity verification on the subscription request, the validity verification at least including checking whether the subscription request comes from a known or trusted client and checking whether the information included in the subscription request meets a preset security condition; If the subscription request passes the validity verification, a random number is generated, and a symmetric password is generated based on the random number; If the subscription request fails to pass the validity verification, the subscription request is rejected and specific error information is returned to the client.

4. The data transmission method according to claim 1, characterized in that: The encrypted actual data is combined with the encrypted symmetric password to form a data packet, including: The encrypted actual data and the symmetric password encrypted by the client's asymmetric public key are encapsulated into a data packet based on a preset format, and additional information is added to the data packet during the encapsulation process. The additional information includes at least one of the version number, timestamp, and serial number of the data packet.

5. A data transmission method, characterized in that: The method comprises: Obtaining an initial key pair generated by an asymmetric encryption algorithm, the initial key pair comprising an asymmetric public key and a private key; Querying service information of at least one server to determine a target server that provides the required target service, and sending the asymmetric public key to the target server to subscribe to the target service; Sending a data request to the target server, instructing the target server to generate one or more random numbers, and generating a symmetric password based on the random numbers; so as to trigger the server to encrypt the actual data of the target service based on the symmetric password, and encrypt the symmetric password based on the asymmetric public key, and combine the encrypted actual data with the encrypted symmetric password to form a data packet; Receive a data packet sent by the target service end in response to the data request, decrypt the symmetric password in the data packet based on the private key, and decrypt the original data in the data packet based on the decrypted symmetric password to obtain the data of the target service.

6. The data transmission method according to claim 5, characterized in that: When the client decides to stop receiving data from the target service, the method further includes: Sending a close subscription request instruction to the target server, wherein the close subscription request instruction indicates that the client terminates receiving data of the target service; Receiving confirmation information sent by the target server in response to the close subscription request instruction, the confirmation information indicating that the server has terminated the data transmission activity related to the client and has deleted the asymmetric public key associated with the client stored on the server; The client status information is updated, and the status of no longer receiving data from the target service is recorded.

7. The data transmission method according to any one of claims 1 to 6, characterized in that: The method further comprises: Implementing data transmission between the client and the server based on a secure communication protocol, wherein the secure communication protocol includes transport layer security or secure socket layer security; The data source is authenticated before data transmission, and the authentication is implemented based on any one or more of digital certificates, asymmetric public key infrastructure or two-factor authentication.

8. A data transmission system, characterized in that: The system comprises: A client, used to issue an asymmetric public key and a subscription request, wherein the subscription request is used to determine a target service of the client; A server, configured to receive the subscription request and determine a target server that provides the target service based on the asymmetric public key in the request, wherein the server includes one or more servers; The target service end generates one or more random numbers in response to the subscription request, and generates a symmetric password based on the random numbers; encrypts the actual data of the target service based on the symmetric password, and combines the encrypted actual data with the symmetric password to form a data packet; and sends the data packet to the client; The client is used to receive a data packet sent by the target server in response to the data request, decrypt the symmetric password in the data packet based on the private key, and decrypt the original data in the data packet based on the decrypted symmetric password to obtain the data of the target service.

9. An electronic device, characterized in that: It comprises a processor, a memory and a communication bus; the communication bus is used to connect the processor and the memory; the processor is used to execute the computer program stored in the memory to implement the data transmission method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and the computer program is used to enable a computer to execute the data transmission method according to any one of claims 1 to 7.

Images