Encryption sending method and device, equipment, storage medium and product
By integrating symmetric keys and trusted execution environment unit identifiers with public key encryption, the problem of low security in traditional symmetric encryption is solved, achieving efficient and secure data transmission, preventing key leakage and man-in-the-middle attacks, and enhancing data confidentiality and integrity.
Patent Information
- Application Number
- CN202511421354.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-30
- Publication Date
- 2026-01-13
AI Technical Summary
Traditional symmetric encryption has low security during data transmission, especially since encrypted data is easily decrypted once the session key is intercepted. Furthermore, existing technologies are unable to effectively prevent man-in-the-middle attacks and counterfeit devices from bypassing security checks.
The method integrates the first symmetric key and the target unit identifier of the target trusted execution environment unit into integrated information, encrypts the information using the public key of the destination node, and then performs secondary encryption using the public key of the target trusted execution environment unit to ensure that only the target trusted execution environment unit of the destination node can decrypt the data.
It improves the security of data transmission, prevents key leakage and man-in-the-middle attacks, enhances the confidentiality and integrity of data, and further improves the security of data transmission through the isolation and protection features of the Trusted Execution Environment (TEE) unit.
Smart Images
Figure CN121333657A_ABST
Abstract
Description
Technical Field
[0001] This application belongs to the field of information security technology, and in particular relates to an encrypted transmission method, apparatus, device, storage medium and product. Background Technology
[0002] Data encryption is the process of converting plaintext (raw data) into ciphertext (unreadable format) through mathematical algorithms. It aims to protect the confidentiality, integrity, and availability of data and prevent unauthorized access or tampering.
[0003] For data encryption, traditional symmetric encryption (such as AES) can generally be used. Although traditional symmetric encryption is efficient, if the session key is intercepted during transmission, the encrypted data is very likely to be decrypted, leading to the risk of leakage. It can be seen that there is currently a problem with the low security of encryption. Summary of the Invention
[0004] This application provides an encrypted transmission method, apparatus, device, storage medium, and product, which can improve the effectiveness of encryption.
[0005] In a first aspect, embodiments of this application provide an encrypted transmission method, the method comprising:
[0006] The first symmetric key and the target unit identifier of the target trusted execution environment unit are integrated into the first integrated information. The target trusted execution environment unit is selected from the set of trusted execution environment units in the destination node. The target trusted execution environment unit is a trusted execution environment unit used to decrypt encrypted data.
[0007] The first integrated information is encrypted using the first public key of the destination node to obtain the first encrypted integrated information, and the first encrypted integrated information is sent to the destination node so that the destination node decrypts the first encrypted integrated information using the first private key of the destination node to obtain the first symmetric key and the target unit identifier, and obtains the second private key of the target trusted execution environment unit corresponding to the target unit identifier;
[0008] The target data to be transmitted is encrypted using the first symmetric key and the second public key of the target trusted execution environment unit to obtain encrypted data. The encrypted data is then sent to the destination node, so that the destination node can decrypt the encrypted data using the second private key and the first symmetric key to obtain the target data.
[0009] In some embodiments, the above-mentioned integration of the first symmetric key and the target unit identifier of the target trusted execution environment unit into first integrated information includes: integrating the first symmetric key, the target timestamp for generating the first symmetric key, and the target unit identifier of the target trusted execution environment unit into first integrated information; the destination node decrypts the first encrypted integrated information using its first private key to obtain the first symmetric key and the target unit identifier, including: the destination node decrypts the first encrypted integrated information using its first private key to obtain the first symmetric key, the target timestamp, and the target unit identifier; the destination node decrypts the encrypted data using its second private key and the first symmetric key to obtain the target data includes: if the difference between the target timestamp and the receiving timestamp at which the destination node receives the target timestamp is less than a preset threshold, the destination node decrypts the encrypted data using its second private key and the first symmetric key to obtain the target data.
[0010] In some embodiments, the above-mentioned method of encrypting the target data to be transmitted using the first symmetric key and the second public key of the target trusted execution environment unit to obtain encrypted data includes: encrypting the target data using the first symmetric key and a randomly generated initialization vector to obtain initial encrypted data; encrypting the initial encrypted data using the second public key to obtain encrypted data; and the destination node decrypting the encrypted data using the second private key and the first symmetric key to obtain the target data includes: the destination node decrypting the encrypted data using the second private key to obtain the initial encrypted data, and decrypting the initial encrypted data using the first symmetric key to obtain the target data.
[0011] Secondly, embodiments of this application provide an encrypted transmission device, the device comprising:
[0012] The information integration module is used to integrate the first symmetric key and the target unit identifier of the target trusted execution environment unit into first integrated information. The target trusted execution environment unit is selected from the set of trusted execution environment units in the destination node. The target trusted execution environment unit is a trusted execution environment unit used to decrypt encrypted data.
[0013] The information encryption module is used to encrypt the first integrated information using the first public key of the destination node to obtain the first encrypted integrated information, and send the first encrypted integrated information to the destination node so that the destination node can decrypt the first encrypted integrated information using the first private key of the destination node to obtain the first symmetric key and the target unit identifier, and obtain the second private key of the target trusted execution environment unit corresponding to the target unit identifier;
[0014] The encrypted transmission module is used to encrypt the target data to be transmitted using the first symmetric key and the second public key of the target trusted execution environment unit to obtain encrypted data, and send the encrypted data to the destination node so that the destination node can decrypt the encrypted data using the second private key and the first symmetric key to obtain the target data.
[0015] Thirdly, embodiments of this application provide an electronic device, the device including: a processor and a memory storing computer program instructions;
[0016] When the processor executes computer program instructions, it implements the encrypted transmission method as described in the first aspect.
[0017] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the encrypted transmission method as described in the first aspect.
[0018] Fifthly, embodiments of this application provide a computer program product in which instructions, when executed by a processor of an electronic device, cause the electronic device to perform the encrypted transmission method as described in the first aspect.
[0019] The encrypted transmission method, apparatus, electronic device, computer-readable storage medium, and computer program product of this application embodiment encrypt target data using a first symmetric key at the sending node, and then perform secondary encryption using a second public key of the target trusted execution environment unit. This encryption method combines the efficiency of symmetric encryption with the security of asymmetric encryption, and ensures that only the target trusted execution environment unit at the destination node can decrypt the data, thereby effectively preventing key leakage and man-in-the-middle attacks. This mechanism not only improves the security of data transmission, but also further enhances the confidentiality and integrity of data through the isolation and protection characteristics of the trusted execution environment unit. In addition, the target trusted execution environment unit can be flexibly and temporarily determined from the trusted execution environment unit centralization, thus preventing other devices from obtaining the second public key in advance, further improving the security of data encryption. Attached Figure Description
[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0021] Figure 1 This is a flowchart illustrating the encrypted transmission method provided in an embodiment of this application;
[0022] Figure 2 This is a schematic diagram of the data encryption process provided in an embodiment of this application;
[0023] Figure 3 This is a schematic diagram of the data decryption process provided in an embodiment of this application;
[0024] Figure 4 This is a flowchart of the key lifecycle status provided in the embodiments of this application;
[0025] Figure 5 This is a schematic diagram of the structure of the encrypted transmission device provided in the embodiments of this application;
[0026] Figure 6 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation
[0027] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.
[0028] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.
[0029] Traditional symmetric encryption (such as AES) is highly efficient, but lacks secure key distribution and management mechanisms. If the session key is intercepted during transmission, the entire communication process is at risk of leakage. Furthermore, most dynamic key management schemes only periodically rotate keys in the background or locally, without embedding timestamps or replay protection in each communication. If data packets are intercepted and replayed with delay, it is difficult to detect. While some systems have audit trail functions, they are often limited to the log level and cannot block attacks during real-time decryption. Moreover, existing communication encryption focuses primarily on network or application layer encryption, neglecting to verify the uniqueness of the communicating devices, making them vulnerable to being bypassed by impersonated devices or virtual nodes.
[0030] To address the related technical problems, embodiments of this application provide an encrypted transmission method, apparatus, device, computer storage medium, and computer program product. The encrypted transmission method provided in this application embodiment will be described first below.
[0031] This encrypted transmission method can be executed by the sending device (i.e., the sending node).
[0032] Figure 1 This paper illustrates a flowchart of the encrypted transmission method provided in an embodiment of this application, in conjunction with... Figure 1 , Figure 2 and Figure 3 The encrypted transmission method is explained. Figure 2 This is a schematic diagram of the data encryption process provided in an embodiment of this application. Figure 2 The following example illustrates the use of an AES session key K as the first symmetric key, an RSA public key as the first public key, and a hash function as the first preset function. Figure 3 This is a schematic diagram illustrating the data decryption process provided in an embodiment of this application. Figure 1 As shown, the encrypted transmission method specifically includes the following steps S101-S103:
[0033] Step S101: Integrate the first symmetric key and the target unit identifier of the target trusted execution environment unit into first integrated information.
[0034] The first symmetric key mentioned above is the symmetric key used to encrypt the target data to be sent to the destination node.
[0035] The first symmetric key mentioned above can be a session key temporarily generated by the sending node, a one-time session key, a unique key with time usage restrictions, or an AES session key.
[0036] The aforementioned target trusted execution environment unit is selected from the set of trusted execution environment units in the destination node.
[0037] The aforementioned set of trusted execution environment units includes multiple trusted execution environment units, and different trusted execution environment units have different public and private keys.
[0038] The aforementioned target trusted execution environment unit is a trusted execution environment unit used to decrypt encrypted data.
[0039] In some implementations, the above-mentioned integration of the first symmetric key and the target unit identifier of the target trusted execution environment unit into the first integrated information may be achieved using a first target integration algorithm. The first target integration algorithm may involve concatenating the first symmetric key and the target unit identifier to obtain first concatenated information, and then using a first preset algorithm to calculate the first integrated information.
[0040] The first preset algorithm mentioned above can be a hash function, a cyclic redundancy check algorithm, etc.
[0041] In some implementations, the destination node contains multiple trusted execution environment units, and the following steps may be included before step S101:
[0042] The sending node selects the target trusted execution environment unit from the trusted execution environment unit set in the destination node.
[0043] Step S102: The first integrated information is encrypted using the first public key of the destination node to obtain the first encrypted integrated information. The first encrypted integrated information is then sent to the destination node so that the destination node can decrypt the first encrypted integrated information using its first private key to obtain the first symmetric key and the target unit identifier. The second private key of the target trusted execution environment unit corresponding to the target unit identifier is then obtained.
[0044] In some implementations, the first public key mentioned above may be an RSA public key.
[0045] In some implementations, the first private key is matched with the first public key.
[0046] The above-mentioned method of obtaining the second private key of the target trusted execution environment unit corresponding to the target unit identifier can be achieved by determining the target trusted execution environment unit corresponding to the target unit identifier from a preset identifier correspondence and obtaining the second private key of the target trusted execution environment unit.
[0047] The aforementioned preset identifier correspondence is used to characterize the correspondence between unit identifiers and trusted execution environment units.
[0048] In some embodiments, the above-described method of encrypting the first integrated information using the first public key of the destination node to obtain the first encrypted integrated information may further include the following:
[0049] Receive the public key sent by the destination node.
[0050] The above lattice public key is the public key for lattice cryptography, such as the key for LWE or RLWE problems.
[0051] A second symmetric key is generated based on the lattice public key and using a lattice cryptography algorithm.
[0052] The aforementioned lattice cryptography algorithm can be used in the NewHope protocol.
[0053] The second symmetric key is XORed with the first integrated information to obtain the XOR result.
[0054] The first encrypted integrated information is obtained by encrypting the XOR result using the first public key of the destination node.
[0055] The aforementioned destination node uses its first private key to decrypt the first encrypted integrated information, obtaining a first symmetric key and a target unit identifier, including:
[0056] The destination node uses its first private key to decrypt the first encrypted integrated information and obtains the XOR result.
[0057] A second symmetric key is generated based on the lattice public key and using a lattice cryptography algorithm.
[0058] Using the second symmetric key, the XOR result is de-XORed to obtain the first integrated information, and the first symmetric key and the target unit identifier are obtained from the first integrated information.
[0059] In this embodiment, lattice cryptography is a cryptographic system based on lattice theory. Currently, no effective quantum algorithm (such as Shor's algorithm) has been found capable of breaking it. Therefore, the second symmetric key generated using the lattice cryptography algorithm based on the lattice public key is difficult to crack and has high security. Furthermore, the sending node uses the destination node's lattice public key to dynamically and randomly generate a one-time session key (i.e., the second symmetric key). This second symmetric key is only used for this communication or for this data encryption. Different keys can be used for each communication, avoiding the risk of all communication content being deciphered due to the leakage of a single key. Finally, in this embodiment, the second symmetric key is first XORed with the first integrated information, and then the result is encrypted using the first public key. This ensures that the final encrypted object is no longer the naked, potentially fixed key itself, but a randomized result XORed with unknown plaintext. This increases the difficulty for attackers to analyze. This structure provides double masking for key information (the first integrated information and the second symmetric key), adding redundant security to data transmission.
[0060] Step S103: The target data to be transmitted is encrypted using the first symmetric key and the second public key of the target trusted execution environment unit to obtain encrypted data. The encrypted data is then sent to the destination node so that the destination node can decrypt the encrypted data using the second private key and the first symmetric key to obtain the target data.
[0061] The aforementioned second private key matches the aforementioned second public key.
[0062] In some embodiments, the encryption of the target data to be transmitted using the first symmetric key and the second public key of the target trusted execution environment unit to obtain encrypted data may include the following:
[0063] The target data is encrypted using the first symmetric key and a randomly generated initialization vector to obtain the initial encrypted data.
[0064] In some implementations, the above-mentioned encryption of target data using a first symmetric key and a randomly generated initialization vector to obtain initial encrypted data can be based on a target encryption mode, using a first symmetric key and a randomly generated initialization vector to encrypt target data to obtain initial encrypted data.
[0065] The target encryption mode mentioned above can be AES encryption mode. The target encryption mode can be determined by the target network status indicators of the network used for data transmission between the sending node and the destination node. The target encryption mode can be determined based on a preset encryption mode correspondence and the target network status indicators. The encryption mode correspondence is used to characterize the correspondence between the network status indicators and the encryption mode. The network status indicators can include at least one of the following: network packet loss rate, network latency, etc.
[0066] The initial encrypted data is encrypted using the second public key to obtain the encrypted data.
[0067] The destination node uses the second private key and the first symmetric key to decrypt the encrypted data to obtain the target data, which may include the following:
[0068] The destination node uses the second private key to decrypt the encrypted data, obtaining the initial encrypted data.
[0069] The destination node uses the first symmetric key to decrypt the initial encrypted data to obtain the target data.
[0070] In some embodiments, sending encrypted data to the destination node can also involve sending encrypted data and an initialization vector to the destination node, so that the destination node can decrypt the encrypted data using a second private key to obtain initial encrypted data, and then decrypt the initial encrypted data using the initialization vector and a first symmetric key to obtain the target data.
[0071] In some embodiments, sending encrypted data to the destination node can also involve sending encrypted data and encryption parameters to the destination node, so that the destination node can decrypt the encrypted data using a second private key to obtain initial encrypted data, and obtain the target encryption mode and initialization vector from the encryption parameters. The destination node can then decrypt the initial encrypted data using the target decryption mode corresponding to the target encryption mode, the initialization vector, and the first symmetric key to obtain the target data. The encryption parameters include the target encryption mode and the initialization vector.
[0072] In this embodiment, the target data is encrypted using a first symmetric key and a randomly generated initialization vector. After obtaining the initial encrypted data, the second public key is used to encrypt the initial encrypted data again. This forces the attacker to break through two layers of encryption simultaneously to obtain the original plaintext. Even if the asymmetric encryption layer becomes vulnerable due to cracking or improved computing power (such as quantum computing), the attacker still needs to break through the symmetric encryption layer to obtain valid information. This provides redundant security and defense in depth for data transmission.
[0073] In some embodiments, the above-described method of encrypting the target data to be transmitted using a first symmetric key and a second public key of the target trusted execution environment unit to obtain encrypted data may further include the following:
[0074] From the set of key segmentation schemes, determine the target key segmentation scheme.
[0075] The above key segmentation scheme set includes a variety of key segmentation schemes.
[0076] The first symmetric key is divided into multiple first segments using the target key segmentation scheme, and the second public key is divided into multiple second segments using the target key segmentation scheme. The multiple first segments and multiple second segments are then interleaved to obtain an interleaved key.
[0077] The aforementioned target key segmentation scheme can be to divide the first symmetric key into multiple first segments according to a preset length, and to divide the second public key into multiple second segments according to a preset length.
[0078] For example, if multiple first segments include A1, A2, A3, ..., An, and multiple second segments include B1, B2, B3, ..., Bn, then the sequence after interleaving them could be: A1, B1, A2, B2, A3, B3, ..., An, Bn.
[0079] The target key segmentation scheme is encrypted using the first public key to obtain the encryption scheme, and the encryption scheme is sent to the destination node so that the destination node can decrypt the encryption scheme based on the first private key to obtain the target key segmentation scheme.
[0080] The target data is encrypted using an interleaved key to obtain encrypted data.
[0081] The aforementioned destination node uses the second private key and the first symmetric key to decrypt the encrypted data, obtaining the target data, including:
[0082] The destination node recovers the interleaved key based on the segmentation scheme of the first symmetric key, the second public key, and the target key, and decrypts the encrypted data based on the interleaved key to obtain the target data.
[0083] The aforementioned destination node recovers the interleaved key based on the first symmetric key, the second public key, and the target key segmentation scheme. This can be achieved by the destination node dividing the first symmetric key into multiple first segments using the target key segmentation scheme, and dividing the second public key into multiple second segments using the target key segmentation scheme, and then interleaving the multiple first segments and multiple second segments to obtain the interleaved key.
[0084] In this embodiment, the first symmetric key and the second public key have different statistical properties at the data level. Interleaving them together destroys any possible patterns or structural features that may exist on their own. This makes the generated interleaved key more like a true random number, thus making it more resistant to pattern-based cryptanalysis attacks. What the attacker now needs to guess is no longer a standard, fixed-length symmetric key, but a complex key with an unknown structure constructed from two different source keys. That is, to reconstruct the final interleaved key used for encryption, the attacker must simultaneously possess complete information about the first symmetric key and the second public key. This means that the security of data transmission no longer depends on a single key, but on both symmetric and asymmetric cryptography, thereby improving the security of data transmission.
[0085] In some embodiments, the above-described integration of the first symmetric key and the target unit identifier of the target trusted execution environment unit into the first integrated information may further include:
[0086] The first symmetric key, the target timestamp for generating the first symmetric key, and the target unit identifier are integrated into the first integrated information.
[0087] The aforementioned destination node uses its first private key to decrypt the first encrypted integrated information to obtain the first symmetric key and the target unit identifier, and may also include the following:
[0088] The aforementioned destination node uses its first private key to decrypt the first encrypted integrated information, obtaining the first symmetric key, the target timestamp, and the target unit identifier.
[0089] The destination node uses the second private key and the first symmetric key to decrypt the encrypted data to obtain the target data, which may also include the following:
[0090] If the difference between the target timestamp and the receiving timestamp of the target timestamp received by the destination node is less than a preset threshold, the destination node uses its second private key and first symmetric key to decrypt the encrypted data and obtain the target data.
[0091] In some implementations, the above-mentioned integration of the first symmetric key, the target timestamp for generating the first symmetric key, and the target unit identifier into the first integrated information may be achieved using a second target integration algorithm. The second target integration algorithm may involve concatenating the first symmetric key, the target timestamp, and the target unit identifier to obtain second concatenated information, and then using a first preset algorithm to calculate the second concatenated information to obtain the first integrated information.
[0092] In this embodiment, by incorporating a timestamp into the first integrated information, it can be ensured that the first symmetric key can only be used within a limited time, preventing replay attacks and improving the security of data transmission.
[0093] In some embodiments, the above-described integration of the first symmetric key and the target unit identifier of the target trusted execution environment unit into the first integrated information may further include:
[0094] The first symmetric key, the device fingerprint of the destination node, and the target unit identifier are integrated into the first integrated information.
[0095] The aforementioned destination node uses its first private key to decrypt the first encrypted integrated information to obtain the first symmetric key and the target unit identifier, and may also include the following:
[0096] The aforementioned destination node uses its first private key to decrypt the first encrypted integrated information, obtaining the first symmetric key, the device fingerprint, and the target unit identifier.
[0097] The destination node uses the second private key and the first symmetric key to decrypt the encrypted data to obtain the target data, which may also include the following:
[0098] If the destination node successfully authenticates itself using the device fingerprint, it decrypts the encrypted data using the destination node's second private key and first symmetric key to obtain the target data.
[0099] In some implementations, the integration of the first symmetric key, the device fingerprint of the destination node, and the target unit identifier into the first integrated information can be achieved using a third target integration algorithm. This third target integration algorithm can involve concatenating the first symmetric key, the device fingerprint of the destination node, and the target unit identifier to obtain third concatenated information, and then using a first preset algorithm to calculate the first integrated information.
[0100] In some embodiments, before the first symmetric key, the device fingerprint of the destination node, and the target unit identifier are integrated into the first integrated information, the sending node sends a device fingerprint instruction to the destination node and receives the device fingerprint sent by the destination node based on the device fingerprint instruction.
[0101] The aforementioned device fingerprint is an identifier for the destination node, used to indicate the destination node. The device fingerprint can be a MAC address, IP address (such as the public IP address or local area network IP address of the destination node), DNS server address used by the destination node, etc.
[0102] In some embodiments, the device fingerprint described above can be generated by any of the following:
[0103] The destination node acquires multiple execution duration data generated by executing a preset instruction a first preset number of times. Each execution of the preset instruction corresponds to one execution duration data. Features are extracted from multiple execution duration data to obtain a first temporal feature vector. A second preset algorithm is used to calculate the first temporal feature vector to obtain the device fingerprint.
[0104] The aforementioned preset instructions can be RDRAND and RDTSC instructions. The second preset algorithm can be the same as the first preset algorithm, and the first preset algorithm can also be a hash function or a cyclic redundancy check algorithm, etc.
[0105] The RDRAND instruction described above is a hardware-generated random number instruction. Based on the CPU's internal random number generator, it can produce high-quality random numbers. Due to differences in hardware design and implementation, different CPUs may exhibit different timing characteristics when executing the RDRAND instruction. The RDTSC instruction (Read Time-Stamp Counter) is used to read the current value of the processor's timestamp counter. It can provide high-precision time measurement; by recording the timestamps before and after the execution of a specific instruction, the execution time of the instruction can be accurately measured. Due to differences in CPU microarchitecture, the execution time of the same instruction may vary on different CPUs.
[0106] The device fingerprint mentioned above is a CPU microarchitecture fingerprint. The process of generating a CPU microarchitecture fingerprint can be as follows:
[0107] When executing the RDRAND and RDTSC instructions, the CPU generates a random number and obtains the start timestamp and end timestamp of the RDRAND instruction through the RDTSC instruction, thus obtaining the execution time of the RDRAND instruction.
[0108] The above process is repeated multiple times to collect a large amount of execution time data for RDRAND instructions. Due to the characteristics of the CPU microarchitecture, these execution times will exhibit certain differences and patterns. By analyzing these time differences, timing feature information related to the CPU microarchitecture can be extracted. This timing feature information can include average execution time, the degree of fluctuation in time data, the periodicity and regularity of time data, or the symmetry of time data distribution, etc.
[0109] The extracted timing features are processed, for example, by converting them into a fixed-length binary sequence using a specific algorithm. Then, a hash function is used to perform a hash operation on this binary sequence, generating a 256-bit hash value, i.e., CPU_Hash. This hash value can serve as a unique identifier for the CPU, i.e., as a device fingerprint.
[0110] The destination node acquires multiple memory bus latency data generated by accessing the preset memory a second preset number of times. Each access to the preset memory corresponds to one memory bus latency data. Features are extracted from the multiple memory bus latency data to obtain a second timing feature vector. A third preset algorithm is used to calculate the second timing feature vector to obtain the device fingerprint.
[0111] The aforementioned third preset algorithm can be the same as the first or second preset algorithm, or it can be a hash function or a cyclic redundancy check algorithm, etc.
[0112] The device fingerprint mentioned above is a physical fingerprint in memory. The physical fingerprint in memory can be obtained in the following ways:
[0113] The "hammering" process involves repeatedly accessing specific memory rows (e.g., activating, reading, or writing operations). Simultaneously, during the "hammering" process, the memory bus latency for each access is measured. Simulating the "hammering" process involves repeatedly and rapidly accessing memory storage units in a specific manner to mimic the behaviors associated with a Rowhammer attack.
[0114] It can calculate statistical parameters such as the average value, standard deviation, and distribution of memory bus latency, analyze the trends and patterns of latency changes, and process the extracted feature information. For example, it can convert the data into a fixed-length binary sequence using a specific algorithm. Then, a hash function is used to perform a hash operation on this binary sequence to generate a hash value, i.e., IP_Hash. This hash value can serve as a unique identifier for the physical memory address, i.e., it can be used as a device fingerprint.
[0115] The destination node acquires multiple execution duration data points generated by executing a preset instruction a first preset number of times. Each execution of the preset instruction corresponds to one execution duration data point. Features are extracted from the multiple execution duration data points to obtain a first temporal feature vector. A first preset algorithm is used to calculate the first temporal feature vector to obtain a first device fingerprint. The destination node also acquires multiple memory bus latency data points generated by accessing preset memory a second preset number of times. Each access to preset memory corresponds to one memory bus latency data point. Features are extracted from the multiple memory bus latency data points to obtain a second temporal feature vector. A second preset algorithm is used to calculate the second temporal feature vector to obtain a second device fingerprint. The first device fingerprint and the second device fingerprint are concatenated to obtain the device fingerprint.
[0116] In some embodiments, the above-mentioned authentication of the destination node using device fingerprint may involve obtaining a local device fingerprint from the destination node, integrating the local device fingerprint, the first symmetric key, and the target unit identifier using a third target integration algorithm to obtain second integrated information, and authenticating the destination node based on the second integrated information. In this case, if the second integrated information is the same as the first integrated information, the authentication is determined to be successful; if the second integrated information is different from the first integrated information, the authentication is determined to be unsuccessful.
[0117] The method for obtaining the local device fingerprint from the destination node is the same as the method for obtaining the device fingerprint from the destination node.
[0118] In this embodiment, by integrating the device's unique identifier into the integrated information, it can be ensured that only the designated device can recover the first symmetric key, preventing fake devices from accessing the system and improving the security of data transmission.
[0119] In some embodiments, the above-described integration of the first symmetric key and the target unit identifier of the target trusted execution environment unit into the first integrated information may further include:
[0120] The first symmetric key, target timestamp, device fingerprint, and target unit identifier are integrated into the first integrated information.
[0121] The aforementioned destination node uses its first private key to decrypt the first encrypted integrated information to obtain the first symmetric key and the target unit identifier, and may also include the following:
[0122] The aforementioned destination node uses its first private key to decrypt the first encrypted integrated information, obtaining the first symmetric key, the target timestamp, the device fingerprint, and the target unit identifier.
[0123] The destination node uses the second private key and the first symmetric key to decrypt the encrypted data to obtain the target data, which may also include the following:
[0124] If the destination node successfully authenticates itself using the device fingerprint and the difference between the target timestamp and the receiving timestamp of the target timestamp received by the destination node is less than a preset threshold, the destination node decrypts the encrypted data using its second private key and first symmetric key to obtain the target data.
[0125] In some implementations, the integration of the first symmetric key, target timestamp, device fingerprint, and target unit identifier into the first integrated information can be achieved using a fourth target integration algorithm. This fourth target integration algorithm can involve concatenating the first symmetric key, target timestamp, device fingerprint, and target unit identifier to obtain fourth concatenated information, and then using a first preset algorithm to calculate the first integrated information.
[0126] Figure 2 In this context, AES Mode represents the encryption mode, IV represents the initialization vector, Cipher Text represents the encrypted data, AES GCM(K, IV, Data) represents the encryption algorithm that uses K and IV to encrypt the target data data, SHA2569 represents the hash function, K represents the first symmetric key, the fingerprint is the device fingerprint, T represents the target timestamp, and T_recv represents the received timestamp.
[0127] For example, refer to Figure 2For the time synchronization mechanism and verification process, the sending node adds the local UTC timestamp (target timestamp) and device fingerprint to the digest to be signed (first integrated information), for example: H = SHA256(K_AES + MAC address + Timestamp), where SHA256 is the hash function, K_AES is the first symmetric key, the MAC address is the device fingerprint, and the Timestamp is the target timestamp. Before decryption, the destination node decrypts the first encrypted integrated information C_RSA with the RSA private key, verifies whether the local device fingerprint is consistent with the bound content, and verifies whether the timestamp is within ±60 seconds. If the verification is successful and the timestamp is within the window, decryption is performed. If the verification fails or the timestamp is not within the window, it is determined to be data abnormality or attack behavior, and decryption is rejected.
[0128] Verification process to check if the local device fingerprint matches the bound content: Before encryption, the sending node concatenates the AES key with the device fingerprint and calculates the digest using SHA256. After the destination node decrypts the first encrypted integrated information, it also concatenates and hashes the local device information. The two digests are compared, and only if they are completely consistent can the session key (first symmetric key) be used.
[0129] In this embodiment, a session key expiration mechanism can also be used. Each first symmetric key is only valid for one communication and includes the generation time. After the destination node verifies the key generation time, it marks the key as "used" in the local database. Repeated use of the same key will trigger an early warning mechanism to prevent the decryption process.
[0130] In some embodiments, the above-mentioned encryption of the target data to be transmitted using a first symmetric key and a second public key of the target trusted execution environment unit to obtain encrypted data includes:
[0131] Get the data to be transmitted.
[0132] The data to be transmitted includes multiple data sets.
[0133] The data to be transmitted is divided into multiple sets of target data.
[0134] For each set of target data, the target data to be transmitted is encrypted using the first symmetric key and the second public key of the target trusted execution environment unit to obtain encrypted data.
[0135] The data to be transmitted can be pipeline data.
[0136] The above-mentioned division of the data to be transmitted into multiple sets of target data can be based on business importance, bandwidth requirements, or data type.
[0137] Business importance characterizes the degree of impact of data on business. Based on business importance, data can be divided into high priority, medium priority, and low priority.
[0138] Bandwidth requirements are determined by the size and frequency of data transmission. Based on the size and frequency of data transmission, data can be categorized into high bandwidth requirements, medium bandwidth requirements, and low bandwidth requirements.
[0139] Data type refers to the format or purpose of data. Based on data type, data can be divided into text data, image data, video data, real-time data, etc.
[0140] In this embodiment, the data to be transmitted is automatically divided into multiple independent groups according to the importance of the business, bandwidth requirements, or data type. Each group is then encrypted and transmitted separately, which improves encryption efficiency and reduces the risk of single-point decryption.
[0141] Furthermore, this embodiment can also construct a key status table, which records the entire process of each first symmetric key from creation to use to expiration. The first symmetric key is decrypted only once within its extremely short lifespan (e.g., a validity period of 3 minutes). Repeated use or expired requests trigger rejection and alarm mechanisms, completely preventing key abuse. (Refer to...) Figure 4 , Figure 4 A flowchart illustrating the key lifecycle status provided in this application embodiment.
[0142] The overall solution can be integrated into the application layer / transmission layer, avoiding the limitations of transparent encryption of the operating system and firmware encryption of storage devices, and can be adapted to real-time transmission scenarios with high security requirements such as the Internet of Things, mobile terminals, and pipeline monitoring.
[0143] In this embodiment, the sending node encrypts the target data using a first symmetric key and performs secondary encryption using the second public key of the target trusted execution environment (TEE). This encryption method combines the efficiency of symmetric encryption with the security of asymmetric encryption. Symmetric encryption can quickly process large amounts of data, ensuring transmission efficiency, while public key encryption leverages the security of the TEE to ensure that only the target TEE of the destination node can decrypt the data, effectively preventing key leakage and man-in-the-middle attacks. This mechanism not only improves the security of data transmission but also further enhances the confidentiality and integrity of the data through the isolation and protection characteristics of the TEE. Furthermore, the target TEE can be flexibly and temporarily determined from the TEE pool, thus preventing other devices from obtaining the second public key in advance, further improving the security of data transmission.
[0144] To better implement the above method, this application provides an encrypted transmission device, referring to... Figure 5 , Figure 5This is a schematic diagram of the structure of the encrypted transmission device provided in the embodiments of this application, as shown below. Figure 5 As shown, the encrypted transmission device 500 specifically includes the following:
[0145] The information integration module 501 is used to integrate the first symmetric key and the target unit identifier of the target trusted execution environment unit into first integrated information. The target trusted execution environment unit is selected from the set of trusted execution environment units in the destination node. The target trusted execution environment unit is a trusted execution environment unit used to decrypt encrypted data.
[0146] The information encryption module 502 is used to encrypt the first integrated information using the first public key of the destination node to obtain the first encrypted integrated information, and send the first encrypted integrated information to the destination node so that the destination node can decrypt the first encrypted integrated information using the first private key of the destination node to obtain the first symmetric key and the target unit identifier, and obtain the second private key of the target trusted execution environment unit corresponding to the target unit identifier.
[0147] The encryption sending module 503 is used to encrypt the target data to be transmitted using a first symmetric key and a second public key of the target trusted execution environment unit to obtain encrypted data, and send the encrypted data to the destination node so that the destination node can decrypt the encrypted data using a second private key and a first symmetric key to obtain the target data.
[0148] In some embodiments, the information integration module 501 is specifically used to: integrate the first symmetric key, the target timestamp for generating the first symmetric key, and the target unit identifier of the target trusted execution environment unit into first integrated information. The destination node uses its first private key to decrypt the first encrypted integrated information to obtain the first symmetric key, the target timestamp, and the target unit identifier. If the difference between the target timestamp and the timestamp used by the destination node to decrypt the target timestamp is less than a preset threshold, the destination node uses its second private key and the first symmetric key to decrypt the encrypted data to obtain the target data.
[0149] In some embodiments, the encryption sending module 503 is specifically used to: encrypt the target data using a first symmetric key and a randomly generated initialization vector to obtain initial encrypted data; encrypt the initial encrypted data using a second public key to obtain encrypted data; the destination node decrypts the encrypted data using a second private key to obtain the initial encrypted data; and decrypts the initial encrypted data using the first symmetric key to obtain the target data.
[0150] The encrypted sending device 500 provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be described again here.
[0151] Figure 6 A schematic diagram of the hardware structure of the electronic device provided in an embodiment of this application is shown.
[0152] The electronic device may include a processor 601 and a memory 602 storing computer program instructions.
[0153] Specifically, the processor 601 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.
[0154] Memory 602 may include mass storage for data or instructions. For example, and not limitingly, memory 602 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 602 may include removable or non-removable (or fixed) media. Where appropriate, memory 602 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 602 is non-volatile solid-state memory.
[0155] In some embodiments, memory 602 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Thus, generally, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this disclosure.
[0156] The processor 601 implements any of the encrypted transmission methods described in the above embodiments by reading and executing computer program instructions stored in the memory 602.
[0157] In one example, the electronic device may also include a communication interface 603 and a bus 610. For example, Figure 6 As shown, the processor 601, memory 602, and communication interface 603 are connected through bus 610 and complete communication with each other.
[0158] The communication interface 603 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.
[0159] Bus 610 includes hardware, software, or both, that couples components of an online data traffic metering device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 610 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.
[0160] The electronic device can execute the encrypted transmission method in the embodiments of this application, thereby achieving the combination Figure 1 and Figure 5 The described encrypted transmission method and apparatus.
[0161] Furthermore, in conjunction with the encrypted transmission methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the encrypted transmission methods in the above embodiments.
[0162] In conjunction with the encrypted transmission methods in the above embodiments, this application provides a computer program product. When the instructions in the computer program product are executed by the processor of an electronic device, the electronic device executes any one of the encrypted transmission methods in the above embodiments.
[0163] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.
[0164] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.
[0165] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.
[0166] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.
[0167] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.
Claims
1. An encrypted transmission method, characterized in that, The method includes: The first symmetric key and the target unit identifier of the target trusted execution environment unit are integrated into the first integrated information. The target trusted execution environment unit is selected from the set of trusted execution environment units in the destination node. The target trusted execution environment unit is a trusted execution environment unit used to decrypt encrypted data. The first integrated information is encrypted using the first public key of the destination node to obtain the first encrypted integrated information, and the first encrypted integrated information is sent to the destination node so that the destination node decrypts the first encrypted integrated information using the first private key of the destination node to obtain the first symmetric key and the target unit identifier, and obtains the second private key of the target trusted execution environment unit corresponding to the target unit identifier; The target data to be transmitted is encrypted using the first symmetric key and the second public key of the target trusted execution environment unit to obtain encrypted data. The encrypted data is then sent to the destination node, so that the destination node can decrypt the encrypted data using the second private key and the first symmetric key to obtain the target data.
2. The encrypted transmission method according to claim 1, characterized in that, The step of integrating the first symmetric key and the target unit identifier of the target trusted execution environment unit into first integrated information includes: The first symmetric key, the target timestamp for generating the first symmetric key, and the target unit identifier of the target trusted execution environment unit are integrated into the first integrated information; The destination node uses its first private key to decrypt the first encrypted integration information to obtain the first symmetric key and the target unit identifier, including: The destination node uses its first private key to decrypt the first encrypted integrated information to obtain the first symmetric key, the target timestamp, and the target unit identifier. The destination node uses the second private key and the first symmetric key to decrypt the encrypted data to obtain the target data, including: If the difference between the target timestamp and the receiving timestamp of the destination node is less than a preset threshold, the encrypted data is decrypted using the second private key and the first symmetric key to obtain the target data.
3. The encrypted transmission method according to claim 1, characterized in that, The process of encrypting the target data to be transmitted using the first symmetric key and the second public key of the target trusted execution environment unit to obtain encrypted data includes: The target data is encrypted using the first symmetric key and a randomly generated initialization vector to obtain the initial encrypted data. The initial encrypted data is encrypted using the second public key to obtain encrypted data; The destination node uses the second private key and the first symmetric key to decrypt the encrypted data to obtain the target data, including: The destination node uses the second private key to decrypt the encrypted data to obtain the initial encrypted data, and uses the first symmetric key to decrypt the initial encrypted data to obtain the target data.
4. An encrypted transmission device, characterized in that, The device includes: The information integration module is used to integrate the first symmetric key and the target unit identifier of the target trusted execution environment unit into first integrated information. The target trusted execution environment unit is selected from the set of trusted execution environment units in the destination node. The target trusted execution environment unit is a trusted execution environment unit used to decrypt encrypted data. The information encryption module is used to encrypt the first integrated information using the first public key of the destination node to obtain the first encrypted integrated information, and send the first encrypted integrated information to the destination node so that the destination node can decrypt the first encrypted integrated information using the first private key of the destination node to obtain the first symmetric key and the target unit identifier, and obtain the second private key of the target trusted execution environment unit corresponding to the target unit identifier; The encrypted transmission module is used to encrypt the target data to be transmitted using the first symmetric key and the second public key of the target trusted execution environment unit to obtain encrypted data, and send the encrypted data to the destination node so that the destination node can decrypt the encrypted data using the second private key and the first symmetric key to obtain the target data.
5. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the encrypted transmission method as described in any one of claims 1-3.
6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the encrypted transmission method as described in any one of claims 1-3.
7. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device performs the encrypted transmission method as described in any one of claims 1-3.