Network data processing method and storage medium

Abstract

The invention discloses a network data processing method and a storage medium, and the method comprises the steps: a data transmitting end obtains network operation data, carries out the division of the network operation data, and determines a plurality of target data blocks of a first length corresponding to the network operation data according to a division result; the data sending end encrypts each target data block through an initialization vector to obtain a ciphertext data block corresponding to the target data block, and generates a data authentication tag corresponding to the ciphertext data block; and the data sending end sends the ciphertext data block and the data authentication tag to a data receiving end, so that the data receiving end performs security verification on the ciphertext data block through the data authentication tag and decrypts the network operation data through the initialization vector and the ciphertext data block. Confidentiality and integrity protection of data in the transmission process can be achieved, and safe transmission and verification of network operation data are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of network data application, and in particular to a network data processing method and a storage medium. Background Art

[0002] In modern network communications, secure data transmission is a key issue. Traditional data transmission methods often face the risk of data being eavesdropped, tampered with, and forged, especially in scenarios involving sensitive information, such as financial transactions and medical data transmission. In order to ensure the integrity and authenticity of data, an efficient and secure encryption and verification mechanism is required.

[0003] In the related technologies, although encryption methods can protect data to a certain extent, they still have certain security risks when facing complex network environments and advanced attack methods. In addition, the data division and encryption process are not standardized and unified, making it difficult to ensure the reliability and consistency of data during transmission. Summary of the invention

[0004] The present invention provides a network data processing method and a storage medium to solve the risks of data being eavesdropped, tampered with and forged during data transmission in the related art, as well as the problem of lack of standardization in data division and encryption processes.

[0005] According to one aspect of the present invention, a network data processing method is provided, which is applied to a data sending end, and the method comprises:

[0006] Acquire network operation data, divide the network operation data, and determine a plurality of target data blocks of a first length corresponding to the network operation data according to the division result;

[0007] Encrypting each of the target data blocks by using an initialization vector to obtain a ciphertext data block corresponding to the target data block, and generating a data authentication tag corresponding to the ciphertext data block;

[0008] The ciphertext data block and the data authentication tag are sent to a data receiving end, so that the data receiving end performs security verification on the ciphertext data block through the data authentication tag and decrypts the network operation data through the initialization vector and the ciphertext data block.

[0009] According to another aspect of the present invention, a network data processing method is provided, which is applied to a data receiving end, and the method comprises:

[0010] The receiving data transmitting end sends a ciphertext data block corresponding to the network operation data, an initialization vector and a data authentication tag, and generates a data authentication tag corresponding to the ciphertext data block;

[0011] In the case that the generated data authentication tag is the same as the data authentication tag sent by the data sending end, the ciphertext data block is decrypted according to the initialization vector to obtain network operation data corresponding to the ciphertext data block.

[0012] According to another aspect of the present invention, there is provided a network data processing device, which is applied to a data sending end, and the device comprises:

[0013] A first target data block determination module, configured to obtain network operation data, divide the network operation data, and determine a plurality of target data blocks of a first length corresponding to the network operation data according to the division result;

[0014] A first data authentication label generation module, used to encrypt each of the target data blocks by using an initialization vector to obtain a ciphertext data block corresponding to the target data block, and generate a data authentication label corresponding to the ciphertext data block;

[0015] The first network operation data decryption module is used to send the ciphertext data block and the data authentication tag to the data receiving end, so that the data receiving end can perform security verification on the ciphertext data block through the data authentication tag and decrypt the network operation data through the initialization vector and the ciphertext data block.

[0016] According to another aspect of the present invention, there is provided a network data processing device, which is configured at a data receiving end, and includes:

[0017] A second data authentication label generation module, configured to receive a ciphertext data block corresponding to the network operation data, an initialization vector and a data authentication label sent by a data sending end, and generate a data authentication label corresponding to the ciphertext data block;

[0018] a second network operation data decryption module, configured to decrypt the ciphertext data block according to the initialization vector when the generated data authentication tag is the same as the data authentication tag sent by the data sending end, and obtain the network operation data corresponding to the ciphertext data block;

[0019] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0020] at least one processor; and

[0021] a memory communicatively connected to the at least one processor; wherein,

[0022] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network data processing method described in any embodiment of the present invention.

[0023] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network data processing method described in any embodiment of the present invention when executed.

[0024] The technical solution of the embodiment of the present invention is as follows: first, by acquiring network operation data, the network operation data is divided, and a plurality of target data blocks of a first length corresponding to the network operation data are determined according to the division results. Through data division and standardization processing, the efficiency and consistency of data transmission can be ensured; then, by encrypting each of the target data blocks respectively through an initialization vector to obtain a ciphertext data block corresponding to the target data block, and generating a data authentication tag corresponding to the ciphertext data block, the confidentiality and integrity of the data can be ensured, and the data can be effectively prevented from being tampered with and forged; finally, by sending the ciphertext data block and the data authentication tag to the data receiving end, so that the data receiving end performs security verification on the ciphertext data block through the data authentication tag and decrypts the network operation data through the initialization vector and the ciphertext data block, the integrity and authenticity of the data transmission can be ensured, the risks of data being eavesdropped, tampered with and forged in data transmission in the related technology, and the problem of lack of standardization in the data division and encryption process can be solved, the confidentiality and integrity protection of the data during transmission can be realized, and the secure transmission and verification of the network operation data can be ensured.

[0025] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 is a flow chart of a network data processing method provided according to Embodiment 1 of the present invention;

[0028] Figure 2 is a flow chart of a network data processing method provided according to Embodiment 2 of the present invention;

[0029] Figure 3 is a flow chart of a network data processing method provided according to Embodiment 3 of the present invention;

[0030] Figure 4 is a schematic diagram of the structure of a network data processing device provided according to a fourth embodiment of the present invention;

[0031] Figure 5 is a schematic diagram of the structure of a network data processing device provided according to Embodiment 5 of the present invention;

[0032] Figure 6 It is a structural schematic diagram of an electronic device for implementing the network data processing method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0035] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0036] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0037] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0038] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0039] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0040] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0041] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0042] Embodiment 1

[0043] Figure 1 A flowchart of a network data processing method is provided for the first embodiment of the present invention. This embodiment is applicable to data transmission with high security and data integrity and is applied to the data sending end. The method can be executed by a network data processing device, which can be implemented in the form of hardware and / or software. Optionally, it can be implemented by an electronic device, which can be a mobile terminal, a PC or a server, etc.

[0044] like Figure 1 As shown, the method may specifically include:

[0045] S110: Acquire network operation data, divide the network operation data, and determine a plurality of target data blocks of a first length corresponding to the network operation data according to the division result.

[0046] Among them, the data sending end can be understood as the party responsible for generating and sending data in network communication, which is used to prepare, encrypt and send data. The data sending end can be any type of device or system, including but not limited to servers, computers and mobile devices. The network operation data can be understood as various types of data transmitted in the communication network. The network operation data can include but not limited to information sent by users (such as text messages, pictures, videos, etc.), network status information (such as bandwidth usage, delay, packet loss rate, etc.) and system operation logs. The network operation data can be used to detect network performance, troubleshoot and optimize network services. The division result can be understood as the result of dividing a larger network operation data into several smaller network operation data, which can improve the efficiency and reliability of network operation data during transmission. The first length can be understood as a standard for quantifying the uniform length of all target data blocks, which can ensure the standardization of target data blocks and facilitate processing and transmission. The target data block can be understood as each small data unit after division, and the target data block is a data unit of the first length, which is convenient for subsequent encryption and transmission.

[0047] On the basis of the above scheme, optionally, the network operation data is divided, and a plurality of target data blocks of the first length corresponding to the network operation data are determined according to the division result, including: dividing the network operation data according to the first length to obtain at least one initial data block, and when the length of the initial data block reaches the first length, using the initial data block as the target data block; when the length of the initial data block does not reach the first length, padding the initial data block to the first length according to a preset padding algorithm, and using the padded initial data block as the target data block.

[0048] The initial data block can be understood as a preliminary data block obtained by dividing the network operation data, and the length of the initial data block may not be completely consistent. The preset filling algorithm can be understood as an algorithm for padding the initial data block to the first length, and is used to pad the initial data block using the preset filling algorithm when the length of the initial data block does not reach the first length, so as to ensure that the length of the initial data block reaches the first length. The preset filling algorithm can be zero filling, random filling or other specific filling methods.

[0049] An optional implementation, assuming that the first length is 1024 bytes, the network operation data is 3200 bytes, after division, the first initial data block is 1024 bytes, the second initial data block is 1024 bytes, and the third initial data block is 1152 bytes. The lengths of the first and second initial data blocks are 1024 bytes, which is consistent with the first length, and can be directly used as target data blocks; for the third initial data block, which exceeds the first length, it can be further divided; the first 1024 bytes of the third initial data block are used as the target data block, and the remaining 128 bytes are padded to 1024 bytes using a preset padding algorithm as the target data block; finally, the length of the generated target data blocks is 1024 bytes.

[0050] The above scheme ensures the standardization of all data blocks by dividing the network operation data into target data blocks of fixed length (first length) and filling the initial data blocks that are less than the fixed length through a preset filling algorithm, which not only improves the efficiency of data processing and transmission, but also enhances the security and integrity of the data.

[0051] S120. Encrypt each of the target data blocks using an initialization vector to obtain a ciphertext data block corresponding to the target data block, and generate a data authentication tag corresponding to the ciphertext data block.

[0052] Among them, the initialization vector can be understood as a random or pseudo-random value used in the encryption algorithm to increase the security of encryption, and can prevent the same target data block from generating the same ciphertext after being encrypted at different times, thereby improving security. The encryption can be understood as the process of converting the target data block into a ciphertext data block to protect the confidentiality and integrity of the data to be transmitted. The ciphertext data block can be understood as the target data block after encryption. The ciphertext data block cannot be read directly and can only be restored to the target data block through the correct key and decryption algorithm. The data authentication tag can be understood as an additional information tag used to verify the integrity and authenticity of the data, which is used to ensure that the data in the received ciphertext data block has not been tampered with. The recipient can confirm the source and integrity of the data by verifying the data authentication tag.

[0053] On the basis of the above scheme, optionally, the generating of the data authentication label corresponding to the ciphertext data block includes: obtaining a preset authentication value, performing a Galois field multiplication operation on each of the ciphertext data blocks, performing an XOR operation on the operation result of the ciphertext data block and the preset authentication value, and obtaining the data authentication label corresponding to the ciphertext data block.

[0054] Among them, the preset authentication value can be understood as a pre-set fixed value used to generate a data authentication tag. The Galois field is a finite field with a finite number of elements. The Galois field multiplication operation can be understood as a special mathematical operation, which is commonly used in cryptography and can provide good diffusion and obfuscation, thereby enhancing data security. Exemplarily, in the Galois field, the multiplication result of two bytes is still one byte.

[0055] In an optional implementation, the data transmitter generates a 128-bit preset authentication value, which remains unchanged during the entire data transmission process, such as 0x1A2B3C4D5E6F78901234567890ABCDEF; each ciphertext data block is processed using Galois field multiplication, and the ciphertext data block C is a 128-bit value 0x1234567890ABCDEF1234567890ABCDEF, which is in GF(2^128 ) domain, select a fixed multiplication factor K (0x02), calculate the result m of c*k to be 0x2468ACCE13579BDF2468ACCE13579BDF; perform an XOR operation on the result m of the Galois field multiplication operation and the preset authentication value, and the result is 0x3E4390836D36E34F365CAAC6A73B6C62; and confirm the result obtained by the above XOR operation as the data authentication tag corresponding to the ciphertext data block.

[0056] The data authentication tag generated by the above scheme has high security and uniqueness, and can effectively verify the integrity and authenticity of the data. The combined use of Galois field multiplication and XOR operations not only enhances the security of the data, but also improves the reliability and efficiency of data authentication, making the data more secure during transmission and preventing the risk of data tampering or forgery.

[0057] S130. Send the ciphertext data block and the data authentication tag to a data receiving end, so that the data receiving end performs security verification on the ciphertext data block through the data authentication tag and decrypts the network operation data through the initialization vector and the ciphertext data block.

[0058] The data receiving end can be understood as the party responsible for receiving data in network communication, which is used to receive, verify and decrypt data. The security verification can be understood as the process of checking whether the data of the received ciphertext data block is complete and not tampered with through the data authentication tag. The decryption can be understood as the process of converting the ciphertext data block into the target data block. The decryption requires the use of the same key and decryption algorithm as the encryption.

[0059] The technical solution of the embodiment of the present invention is as follows: first, by acquiring network operation data, the network operation data is divided, and a plurality of target data blocks of a first length corresponding to the network operation data are determined according to the division results. Through data division and standardization processing, the efficiency and consistency of data transmission can be ensured; then, each of the target data blocks is encrypted by an initialization vector to obtain a ciphertext data block corresponding to the target data block, and a data authentication tag corresponding to the ciphertext data block is generated, so that the confidentiality and integrity of the data can be ensured, and the data can be effectively prevented from being tampered with and forged; finally, by sending the ciphertext data block and the data authentication tag to a data receiving end, so that the data receiving end performs security verification on the ciphertext data block through the data authentication tag and decrypts the network operation data through the initialization vector and the ciphertext data block, the integrity and authenticity of the data transmission can be ensured through data authentication tag verification and initialization vector decryption, which solves the risks of data being eavesdropped, tampered with and forged in data transmission in the related technology, and the problem of lack of standardization in data division and encryption process, and can achieve confidentiality and integrity protection of data during transmission, and ensure the secure transmission and verification of network operation data.

[0060] Embodiment 2

[0061] Figure 2 A flowchart of a network data processing method provided for the second embodiment of the present invention, this embodiment is based on the above embodiment, how the data sending end encrypts each of the target data blocks respectively through the initialization vector to obtain the ciphertext data block corresponding to the target data block. Optionally, the data sending end encrypts each of the target data blocks respectively through the initialization vector to obtain the ciphertext data block corresponding to the target data block, including: the data sending end obtains a randomly generated initialization vector of the second length, and generates a target count value of the third length through a preset counting method, and constructs an initial counter block according to the initialization vector and the target count value, wherein the sum of the second length and the third length is equal to the first length; the data sending end uses the AES-256 encryption algorithm and the quantum key to encrypt the initial counter block to obtain a key stream corresponding to the target data block, and performs an XOR operation on the key stream and the target data block to obtain a ciphertext data block corresponding to the target data block. For specific implementation methods, please refer to the description of this embodiment. Among them, the technical features that are the same or similar to the above embodiments are not repeated here.

[0062] like Figure 2 As shown, the method may specifically include:

[0063] S210: Acquire network operation data, divide the network operation data, and determine a plurality of target data blocks of a first length corresponding to the network operation data according to the division result.

[0064] S220. Obtain a randomly generated initialization vector of a second length, and generate a target count value of a third length through a preset counting method, and construct an initial counter block according to the initialization vector and the target count value, wherein the sum of the second length and the third length is equal to the first length.

[0065] The preset counting method can be understood as a pre-set technical method for generating a value of a specific length, and for ensuring that the generated value meets specific requirements. The initial counter block can be understood as a data block constructed by an initialization vector and a target count value, and is used in a counter mode during encryption and decryption to ensure that the encryption result of each data block is unique, and can be spliced ​​by the initialization vector and the target count value, and the total length is equal to the first length.

[0066] S230, encrypting the initial counter block using the AES-256 encryption algorithm and the quantum key to obtain a key stream corresponding to the target data block, performing an XOR operation on the key stream and the target data block to obtain a ciphertext data block corresponding to the target data block, and generating a data authentication tag corresponding to the ciphertext data block.

[0067] Among them, the AES-256 encryption algorithm can be understood as an implementation of the Advanced Encryption Standard, which is usually encrypted using a 256-bit key to provide high-security data encryption. The quantum key can be understood as a key generated using the principles of quantum mechanics, which has extremely high security and unpredictability and can be used in the encryption and decryption process to ensure the high confidentiality of the data of the initial counter block. The key stream can be understood as a series of key values ​​generated by the encryption algorithm, which is used to perform an XOR operation with the target data block.

[0068] On the basis of the above scheme, optionally, before the data sending end uses the AES-256 encryption algorithm and the quantum key to encrypt the initial counter block, it also includes: receiving the quantum state sent by the data sending end based on a preset quantum distribution protocol, determining the target measurement basis corresponding to the quantum state, and determining the target measurement result corresponding to the target measurement basis; feeding back the target measurement basis and the target measurement result corresponding to the target measurement basis to the data sending end, so that the data sending end determines the quantum key according to the received measurement result corresponding to the quantum state and the target measurement basis, and sends the quantum key to the data receiving end.

[0069] Among them, the quantum distribution protocol can be understood as a protocol that uses the principles of quantum mechanics to securely distribute keys between communicating parties, which is used to ensure the security of the key generation and distribution process. The quantum state can be understood as a physical quantity used to encode information during the quantum key distribution process. The target measurement basis can be understood as a basis selected by the recipient for measuring the quantum state during the quantum key distribution process. The target measurement result can be understood as the result obtained after the recipient uses the target measurement basis to measure the quantum state during the quantum key distribution process, which is used to generate the quantum key.

[0070] The above scheme generates highly secure quantum keys through the quantum key distribution protocol, and encrypts the initial counter block using the AES-256 encryption algorithm before data transmission, ensuring the high security of key generation and distribution, effectively preventing man-in-the-middle attacks and eavesdropping. The unpredictability and high security of quantum keys, combined with the powerful encryption capabilities of AES-256, greatly enhance the overall security and reliability of data transmission, ensuring that data will not be tampered with or forged during transmission, thereby protecting the security of sensitive information.

[0071] S240, sending the ciphertext data block, the initialization vector and the data authentication tag to a data receiving end, so that the data receiving end performs security verification on the ciphertext data block through the data authentication tag and decrypts the network operation data through the initialization vector and the ciphertext data block.

[0072] The technical solution of the embodiment of the present invention obtains a randomly generated initialization vector and a target count value through the data sending end, constructs an initial counter block, and encrypts it using the AES-256 encryption algorithm and the quantum key to generate a key stream. The key stream is XOR-operated with the target data block to generate a ciphertext data block. Before encryption, the data sending end and the receiving end generate and share the quantum key through the quantum distribution protocol to ensure the security and unpredictability of the key, which not only improves the confidentiality and integrity of data transmission and prevents data from being tampered with and forged, but also ensures the efficiency and consistency of data transmission through standardized data division and encryption processes, thereby improving the overall security and reliability.

[0073] Embodiment 3

[0074] Figure 3 A flowchart of a network data processing method is provided for Embodiment 3 of the present invention. This embodiment is applicable to data transmission scenarios with high security and data integrity, and is applied to a data receiving end. The method can be executed by a network data processing device, which can be implemented in the form of hardware and / or software. Optionally, it can be implemented by an electronic device, which can be a mobile terminal, a PC, a server, etc.

[0075] like Figure 3 As shown, the method may specifically include:

[0076] S310, receiving a ciphertext data block, an initialization vector and a data authentication tag corresponding to the network operation data sent by the data sending end, and generating a data authentication tag corresponding to the ciphertext data block.

[0077] S320. When the generated data authentication tag is identical to the data authentication tag sent by the data sending end, decrypt the ciphertext data block according to the initialization vector to obtain network operation data corresponding to the ciphertext data block.

[0078] On the basis of the above scheme, optionally, the decrypting the ciphertext data block according to the initialization vector includes: generating a target count value of a third length by a preset counting method, constructing an initial counter block according to the initialization vector and the target count value, wherein the second length of the initialization vector and the third length are equal to the first length of the ciphertext data block; encrypting the initial counter block by using an AES-256 encryption algorithm and a quantum key to obtain a key stream corresponding to the initial counter block, and performing an XOR operation on the key stream and the ciphertext data block to obtain a target data block corresponding to the ciphertext data block.

[0079] In an optional implementation, a target count value of a third length of 0x0000000000000001 is generated by a preset counting method; a 64-bit initialization vector 0x1A2B3C4D5E6F7890 and a 64-bit target count value 0x0000000000000001 are concatenated together to form a 128-bit initial counter block 0x1A2B3C4D5E6F78900000000000000001; and an AES-256 encryption algorithm and a quantum key are used to initialize the counter block 0x1A2B3C4D5E6F7890. 0000000000000001 is encrypted to generate a 128-bit key stream 0x2468ACCE13579BDF2468ACCE13579BDF; the 128-bit key stream 0x2468ACCE13579BDF2468ACCE13579BDF is XORed with the 128-bit ciphertext data block 0x365CB2B68DFF466E365CB2B68DFF466E to restore the target data block 0x1234567890ABCDEF1234567890ABCDEF.

[0080] The above scheme ensures that the decryption process of the ciphertext data block is highly secure and reliable by generating an initial counter block and using the AES-256 encryption algorithm and quantum key to generate a key stream. The target data block is restored through an XOR operation to ensure the integrity and authenticity of the data. This not only enhances the security of data transmission and prevents the risk of data tampering or forgery, but also improves the efficiency and accuracy of data decryption, ensuring the efficiency and confidentiality of data transmission.

[0081] On the basis of the above scheme, optionally, the network data processing method further includes: receiving a quantum state sent by a data sending end based on a preset quantum distribution protocol, determining a target measurement basis corresponding to the quantum state, and determining a target measurement result corresponding to the target measurement basis; feeding back the target measurement basis and the target measurement result corresponding to the target measurement basis to the data sending end, so that the data sending end determines the quantum key according to the received measurement result corresponding to the quantum state and the target measurement basis; receiving the quantum key sent by the data sending end, and saving the quantum key.

[0082] The above scheme receives the quantum state through the data receiving end, determines the target measurement basis and measurement results, and feeds this information back to the data sending end. The data sending end determines the quantum key based on the received information and sends it to the data receiving end, ensuring the high security of key generation and distribution, effectively preventing middleman attacks and eavesdropping, and the unpredictability and high security of quantum keys improve the overall security and reliability of data transmission, ensure the integrity and confidentiality of data during transmission, and prevent the risk of data tampering or forgery.

[0083] On the basis of the above scheme, optionally, after obtaining the network operation data corresponding to the ciphertext data block, it also includes: analyzing the network operation data through a network security detection module to obtain the network security status corresponding to the data sending end; when the network security status corresponding to the data sending end is the risk operation status, determining the target risk type corresponding to the data sending end according to the network operation data, and determining the risk isolation response according to the target risk type.

[0084] Among them, the network security detection module can be understood as a software or hardware component that detects potential security threats in network operation data, and can be used to analyze network operation data and identify abnormal behaviors and potential security threats. The network security detection module can be obtained by training a pre-established deep learning model through sample network data. The sample network data can be understood as a network data sample for training a deep learning model, including normal and abnormal network traffic and system logs. Exemplarily, the deep learning model can be trained using historical network traffic records and traffic data of known attack patterns. The network security state can be understood as a state that describes the current security status of the network. Exemplarily, the network security state may include a safe operation state and a risky operation state. The safe operation state can be understood as an operation state in which the network is operating normally and no obvious security threats are detected. Exemplarily, in the case of a safe operation state, the network traffic is normal, there is no abnormal activity, and there is no alarm information in the system log. The risky operation state can be understood as an operation state in which there are potential security threats or abnormal behaviors in the network. Exemplarily, in the case of a risky operation state, the network traffic is abnormal, there is an alarm information in the system log, and there may be malware, unauthorized access, etc. The target risk type can be understood as a specific security threat type determined based on network operation data under a risk operation state. Exemplarily, the target risk type may include but is not limited to unauthorized access or data leakage. The risk isolation response can be understood as isolation and response measures taken for security threat types. The risk isolation response may include restricting communication with the data sending end and / or starting a preset emergency response procedure. The restriction on communication with the data sending end may be a temporary or permanent restriction of network communication with the data sending end to prevent the spread of threats. The initiation of a preset emergency response procedure can be understood as executing a predefined emergency response plan, specifically, isolating infected devices, notifying administrators, or starting a backup system.

[0085] The above scheme uses the network security detection module at the data receiving end to analyze the network operation data in real time and accurately identify the network security status of the data sending end. When a risky operation status is detected, it can quickly determine the specific target risk type and take corresponding risk isolation response measures, such as restricting communications or launching preset emergency response procedures. This not only improves the security and reliability of the network and effectively prevents the spread of potential security threats, but also reduces business interruptions and data losses caused by security incidents, ensuring the stable operation of the network and the integrity of the data.

[0086] The technical solution of the embodiment of the present invention ensures the integrity and authenticity of the data by receiving the ciphertext data block, initialization vector and data authentication tag corresponding to the network operation data sent by the data sending end, generating a data authentication tag corresponding to the ciphertext data block; and when the generated data authentication tag is the same as the data authentication tag sent by the data sending end, the ciphertext data block is decrypted according to the initialization vector to obtain the network operation data corresponding to the ciphertext data block, which not only effectively prevents the data from being tampered with and forged, and improves the security and reliability of data transmission, but also ensures the efficiency and consistency of data transmission through standardized encryption and verification processes, thereby improving the overall security and credibility.

[0087] Embodiment 4

[0088] Figure 4 This is a schematic diagram of the structure of a network data processing device provided in Embodiment 3 of the present invention, which is configured at the data sending end. Figure 4 As shown, the device includes: a first target data block determination module 410, a first data authentication tag generation module 420, and a first network operation data decryption module 430.

[0089] Among them, the first target data block determination module 410 is used to obtain network operation data, divide the network operation data, and determine multiple target data blocks of first length corresponding to the network operation data according to the division results; the first data authentication label generation module 420 is used to encrypt each of the target data blocks through the initialization vector to obtain the ciphertext data block corresponding to the target data block, and generate a data authentication label corresponding to the ciphertext data block; the first network operation data decryption module 330 is used to send the ciphertext data block and the data authentication label to the data receiving end, so that the data receiving end can perform security verification on the ciphertext data block through the data authentication label and decrypt the network operation data through the initialization vector and the ciphertext data block.

[0090] The technical solution of the embodiment of the present invention is as follows: first, the network operation data is obtained through the first target data block determination module 410, the network operation data is divided, and a plurality of target data blocks of a first length corresponding to the network operation data are determined according to the division result. Through data division and standardization processing, the efficiency and consistency of data transmission can be ensured; then, each of the target data blocks is encrypted by the initialization vector through the first data authentication label generation module 420 to obtain a ciphertext data block corresponding to the target data block, and a data authentication label corresponding to the ciphertext data block is generated, which can ensure the confidentiality and integrity of the data and effectively prevent the data from being tampered with and forged; finally , the ciphertext data block and the data authentication tag are sent to the data receiving end through the first network operation data decryption module 430, so that the data receiving end can perform security verification on the ciphertext data block through the data authentication tag and decrypt the network operation data through the initialization vector and the ciphertext data block. The data authentication tag verification and initialization vector decryption can ensure the integrity and authenticity of data transmission, solve the risks of data being eavesdropped, tampered with and forged in data transmission in related technologies, and the problem of lack of standardization in data division and encryption process, and can realize confidentiality and integrity protection of data during transmission, ensuring the secure transmission and verification of network operation data.

[0091] On the basis of the above scheme, optionally, the first data authentication label generation module includes: a first initial counter block construction submodule and a ciphertext data block acquisition submodule. The first initial counter block construction submodule is used to obtain a randomly generated initialization vector of a second length, generate a target count value of a third length by a preset counting method, and construct an initial counter block according to the initialization vector and the target count value, wherein the sum of the second length and the third length is equal to the first length; the ciphertext data block acquisition submodule is used to encrypt the initial counter block using the AES-256 encryption algorithm and the quantum key to obtain a key stream corresponding to the target data block, and perform an XOR operation on the key stream and the target data block to obtain a ciphertext data block corresponding to the target data block.

[0092] Based on the above solution, optionally, the first data authentication label generation module further includes: a target measurement result determination submodule and a quantum key sending submodule.

[0093] Among them, the target measurement result determination submodule is used to receive the quantum state sent by the data sending end based on a preset quantum distribution protocol before encrypting the initial counter block using the AES-256 encryption algorithm and the quantum key, determine the target measurement basis corresponding to the quantum state, and determine the target measurement result corresponding to the target measurement basis; the quantum key sending submodule is used to feed back the target measurement basis and the target measurement result corresponding to the target measurement basis to the data sending end, so that the data sending end determines the quantum key according to the received measurement result corresponding to the quantum state and the target measurement basis, and sends the quantum key to the data receiving end.

[0094] On the basis of the above scheme, optionally, the first data authentication label generation module includes: a data authentication label generation submodule. The data authentication label generation submodule is used to obtain a preset authentication value, perform a Galois field multiplication operation on each of the ciphertext data blocks, perform an XOR operation on the operation result of the ciphertext data block and the preset authentication value, and obtain a data authentication label corresponding to the ciphertext data block.

[0095] On the basis of the above scheme, optionally, the first target data block determination module may include: a first target data block determination submodule and a second target data block determination submodule. The first target data block determination submodule is used to divide the network operation data according to the first length to obtain at least one initial data block, and when the length of the initial data block reaches the first length, the initial data block is used as the target data block; the second target data block determination submodule is used to pad the initial data block to the first length according to a preset padding algorithm when the length of the initial data block does not reach the first length, and the padded initial data block is used as the target data block.

[0096] The network data processing device provided in the embodiment of the present invention can execute the network data processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0097] Embodiment 5

[0098] Figure 5 This is a schematic diagram of the structure of a network data processing device provided in Embodiment 3 of the present invention, which is used for a data receiving end. Figure 5As shown, the device includes: a second data authentication label generation module 510, and a second network operation data decryption module 530. The second data authentication label generation module 510 is used to receive the ciphertext data block, the initialization vector and the data authentication label corresponding to the network operation data sent by the data sending end, and generate a data authentication label corresponding to the ciphertext data block; the second network operation data decryption module 530 is used to decrypt the ciphertext data block according to the initialization vector when the generated data authentication label is the same as the data authentication label sent by the data sending end, and obtain the network operation data corresponding to the ciphertext data block.

[0099] The technical solution of the embodiment of the present invention is to generate a data authentication label corresponding to the ciphertext data block by receiving the ciphertext data block, the initialization vector and the data authentication label corresponding to the network operation data sent by the data sending end through the second data authentication label generation module 510, thereby ensuring the integrity and authenticity of the data; and through the second network operation data decryption module 530, when the data authentication label generated by the second data authentication label generation module 510 is the same as the data authentication label sent by the data sending end, the ciphertext data block is decrypted according to the initialization vector to obtain the network operation data corresponding to the ciphertext data block, which not only effectively prevents data from being tampered with and forged, and improves the security and reliability of data transmission, but also ensures the efficiency and consistency of data transmission through standardized encryption and verification processes, thereby improving the overall security and credibility.

[0100] On the basis of the above scheme, optionally, the second network operation data decryption module includes: a second initial counter block construction submodule and a target data block acquisition submodule. The second initial counter block construction submodule is used to generate a target count value of a third length by a preset counting method, and to construct an initial counter block according to the initialization vector and the target count value, wherein the second length of the initialization vector and the length of the third length are equal to the first length of the ciphertext data block; the target data block acquisition submodule is used to encrypt the initial counter block using the AES-256 encryption algorithm and the quantum key to obtain a key stream corresponding to the initial counter block, and perform an XOR operation on the key stream and the ciphertext data block to obtain a target data block corresponding to the ciphertext data block.

[0101] On the basis of the above scheme, optionally, the network data processing device further includes: a target measurement result determination module, a quantum key determination module, and a quantum key storage module. The target measurement result determination module is used to receive the quantum state sent by the data sending end based on the preset quantum distribution protocol, determine the target measurement basis corresponding to the quantum state, and determine the target measurement result corresponding to the target measurement basis; the quantum key determination module is used to feed back the target measurement basis and the target measurement result corresponding to the target measurement basis to the data sending end, so that the data sending end determines the quantum key according to the received measurement result corresponding to the quantum state and the target measurement basis; the quantum key storage module is used to receive the quantum key sent by the data sending end and store the quantum key.

[0102] On the basis of the above scheme, optionally, the network data processing device further includes: a network security status module and a risk isolation response determination module. The network security status module is used to analyze the network operation data corresponding to the ciphertext data block through the network security detection module after obtaining the network operation data, so as to obtain the network security status corresponding to the data sending end, wherein the network security detection module is obtained by training a pre-established deep learning model through sample network data; the network security status includes a safe operation status and a risk operation status; the risk isolation response determination module is used to determine the target risk type corresponding to the data sending end according to the network operation data when the network security status corresponding to the data sending end is the risk operation status, and determine the risk isolation response according to the target risk type, wherein the risk isolation response includes restricting communication with the data sending end and / or starting a preset emergency response procedure.

[0103] The network data processing device provided in the embodiment of the present invention can execute the network data processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0104] Embodiment 6

[0105] Figure 6A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0106] like Figure 6 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0107] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0108] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a network data processing method.

[0109] In some embodiments, a network data processing method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of a network data processing method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform a network data processing method in any other appropriate manner (e.g., by means of firmware).

[0110] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0111] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0112] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0113] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0114] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0115] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0116] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0117] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A network data processing method, characterized in that: Applied to the data sending end, including: Acquire network operation data, divide the network operation data, and determine a plurality of target data blocks of a first length corresponding to the network operation data according to the division result; Encrypting each of the target data blocks by using an initialization vector to obtain a ciphertext data block corresponding to the target data block, and generating a data authentication tag corresponding to the ciphertext data block; The ciphertext data block and the data authentication tag are sent to a data receiving end, so that the data receiving end performs security verification on the ciphertext data block through the data authentication tag and decrypts the network operation data through the initialization vector and the ciphertext data block.

2. The method according to claim 1, characterized in that The data transmitting end encrypts each of the target data blocks by using an initialization vector to obtain a ciphertext data block corresponding to the target data block, including: Obtaining a randomly generated initialization vector of a second length, generating a target count value of a third length by a preset counting method, and constructing an initial counter block according to the initialization vector and the target count value, wherein the sum of the second length and the third length is equal to the first length; The initial counter block is encrypted using an AES-256 encryption algorithm and a quantum key to obtain a key stream corresponding to the target data block, and an XOR operation is performed on the key stream and the target data block to obtain a ciphertext data block corresponding to the target data block.

3. The method according to claim 2, characterized in that Before the data sending end uses the AES-256 encryption algorithm and the quantum key to encrypt the initial counter block, it also includes: Receiving a quantum state sent by a data transmitting end based on a preset quantum distribution protocol, determining a target measurement basis corresponding to the quantum state, and determining a target measurement result corresponding to the target measurement basis; The target measurement basis and the target measurement result corresponding to the target measurement basis are fed back to the data sending end, so that the data sending end determines the quantum key according to the received measurement result corresponding to the quantum state and the target measurement basis, and sends the quantum key to the data receiving end.

4. The method according to claim 1, characterized in that The generating a data authentication tag corresponding to the ciphertext data block includes: A preset authentication value is obtained, and a Galois field multiplication operation is performed on each of the ciphertext data blocks, and an XOR operation is performed on the operation result of the ciphertext data block and the preset authentication value to obtain a data authentication tag corresponding to the ciphertext data block.

5. The method according to claim 1, characterized in that The dividing the network operation data and determining a plurality of target data blocks of a first length corresponding to the network operation data according to the division result includes: Dividing the network operation data according to a first length to obtain at least one initial data block, and when the length of the initial data block reaches the first length, using the initial data block as a target data block; When the length of the initial data block does not reach the first length, the initial data block is padded to the first length according to a preset padding algorithm, and the padded initial data block is used as the target data block.

6. A network data processing method, characterized in that: Applied to the data receiving end, including: The receiving data transmitting end sends a ciphertext data block corresponding to the network operation data, an initialization vector and a data authentication tag, and generates a data authentication tag corresponding to the ciphertext data block; In the case that the generated data authentication tag is the same as the data authentication tag sent by the data sending end, the ciphertext data block is decrypted according to the initialization vector to obtain network operation data corresponding to the ciphertext data block.

7. The method according to claim 6, characterized in that The decrypting the ciphertext data block according to the initialization vector includes: Generate a target count value of a third length by a preset counting method, and construct an initial counter block according to the initialization vector and the target count value, wherein the sum of the second length of the initialization vector and the third length is equal to the first length of the ciphertext data block; The initial counter block is encrypted using an AES-256 encryption algorithm and a quantum key to obtain a key stream corresponding to the initial counter block, and an XOR operation is performed on the key stream and the ciphertext data block to obtain a target data block corresponding to the ciphertext data block.

8. The method according to claim 7, characterized in that Also includes: Receiving a quantum state sent by a data transmitting end based on a preset quantum distribution protocol, determining a target measurement basis corresponding to the quantum state, and determining a target measurement result corresponding to the target measurement basis; Feeding back the target measurement basis and the target measurement result corresponding to the target measurement basis to the data transmitting end, so that the data transmitting end determines the quantum key according to the received measurement result corresponding to the quantum state and the target measurement basis; Receive the quantum key sent by the data sending end, and save the quantum key.

9. The method according to claim 6, characterized in that After obtaining the network operation data corresponding to the ciphertext data block, the method further includes: The network operation data is analyzed by a network security detection module to obtain a network security status corresponding to the data sending end, wherein the network security detection module is obtained by training a pre-established deep learning model through sample network data; the network security status includes a safe operation status and a risky operation status; In a case where the network security status corresponding to the data sending end is the risk operation status, the target risk type corresponding to the data sending end is determined according to the network operation data, and a risk isolation response is determined according to the target risk type, wherein the risk isolation response includes restricting communication with the data sending end and / or initiating a preset emergency response procedure.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network data processing method described in any one of claims 1-5 or 6-9 when executed.

Images