Data transmission method and device and electronic equipment

Abstract

The invention discloses a data transmission method and device and electronic equipment, a first terminal and a second terminal construct a first data transmission channel through a point-to-point network server, and when the first terminal and the second terminal belong to the same local area network, the first terminal sends data to the second terminal based on a second data transmission channel of the local area network. When the first terminal and the second terminal do not belong to the same local area network, the first terminal and the second terminal perform session key negotiation, data is encrypted by using a session key obtained by negotiation, the encrypted data is sent to the second terminal based on the first data transmission channel, and the data is transmitted to the second terminal according to the judgment whether the two terminals belong to the same local area network. The local area network or the public network is automatically selected to transmit data, the transmission speed is high and more bandwidth resources are saved during local area network transmission, and the security and speed of data transmission are effectively ensured by combining the constructed first data transmission channel with session key negotiation during public network transmission, so that the security and efficiency of data transmission are improved.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, and in particular to a data transmission method, apparatus, and electronic device. Background Technology

[0002] With the development of industry-specific equipment in digital financial services, government affairs, and policing, an increasing number of intelligent systems, such as Android and OpenHarmony (an open-source distributed operating system), are being used in terminals across various industries, such as cash registers, law enforcement recorders, and government service terminals. Debugging these devices often requires data or file transfer over a network. Existing cross-network segment data transmission solutions cannot simultaneously achieve a balance between security and transmission efficiency during data transmission. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a data transmission method, apparatus and electronic device that can improve data transmission security and transmission efficiency.

[0004] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: A data transmission method, applied to an electronic device, the method comprising: The first terminal and the second terminal establish a first data transmission channel through a point-to-point network server; The first terminal determines whether it belongs to the same local area network as the second terminal. If so, it sends data to the second terminal through the second data transmission channel of the local area network. If not, it negotiates a session key with the second terminal to obtain a session key, encrypts the data using the session key, and then sends the encrypted data to the second terminal through the first data transmission channel.

[0005] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is as follows: A data transmission device, comprising: The first terminal is used to establish a first data transmission channel with the second terminal through a point-to-point network server; and Determine whether the device belongs to the same local area network as the second terminal. If so, send data to the second terminal through the second data transmission channel of the local area network. If not, negotiate a session key with the second terminal to obtain a session key. Use the session key to encrypt the data and then send the encrypted data to the second terminal through the first data transmission channel. The second terminal is used to establish a first data transmission channel with the first terminal through a point-to-point network server; and Receive data sent by the first terminal; A peer-to-peer network server is used to establish a first data transmission channel between the first terminal and the second terminal; and Data forwarding is performed between the first terminal and the second terminal.

[0006] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is as follows: An electronic device includes a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement the steps of the data transmission method described above.

[0007] The beneficial effects of this invention are as follows: A first terminal and a second terminal establish a first data transmission channel through a point-to-point network server. When the first terminal and the second terminal belong to the same local area network (LAN), the first terminal sends data to the second terminal based on the second data transmission channel of the LAN. When the first terminal and the second terminal do not belong to the same LAN, the first terminal and the second terminal negotiate a session key. After encrypting the data using the negotiated session key, the encrypted data is sent to the second terminal based on the first data transmission channel. Thus, based on whether the first terminal and the second terminal belong to the same LAN, the system automatically selects either a LAN or a public network for data transmission. When transmitting over a LAN, the transmission speed is faster and bandwidth resources are more efficient. When transmitting over a public network, the established first data transmission channel combined with session key negotiation effectively ensures the security and speed of data transmission, thereby improving data transmission security and efficiency. Attached Figure Description

[0008] Figure 1 A flowchart illustrating the steps of a data transmission method provided in an embodiment of the present invention; Figure 2 This is a flowchart illustrating the creation of a first data transmission channel in a data transmission method provided by an embodiment of the present invention. Figure 3 This is a flowchart of a data transmission method according to an embodiment of the present invention for session key negotiation; Figure 4 A structural diagram of a data transmission device provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0009] To make the technical problems, technical solutions, and beneficial effects to be solved by this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this application.

[0010] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0011] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0012] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0013] In related technologies, methods such as using WiFi P2P technology to transmit data between two terminals over a local area network, or using a public network server as an intermediary to connect two terminals to different network segments for data transmission, cannot effectively guarantee the security and efficiency of data transmission.

[0014] To address the aforementioned problems, this application provides a data transmission method. The following is a detailed description of one such data transmission method.

[0015] The data transmission method in this application can be used in data transmission scenarios between two terminals. The electronic device in this application can be an electronic device in a remote desktop scenario of a smart cash register or an electronic device in a scenario where law enforcement video is transferred from a law enforcement recorder to a police car's large screen.

[0016] The data transmission method of this invention is described in detail below, with reference to the appendix. Figure 1 This includes steps 110-120.

[0017] Step 110: The first terminal and the second terminal establish a first data transmission channel through a point-to-point network server.

[0018] In one embodiment of this application, reference is made to the appendix. Figure 2 Step 110 includes the following steps 111-116: Step 111: The first terminal and the second terminal send the first acquisition request to the peer-to-peer (P2P) network server.

[0019] In one optional implementation, the first acquisition request is a timed request at 1-second intervals. The first terminal and the second terminal send timed requests at 1-second intervals to the peer-to-peer network server, and stop sending after receiving the external IP address and port returned by the peer-to-peer network server. If the external IP address and port are not received, the sending stops after the number of requests reaches 3.

[0020] Step 112: The peer-to-peer network server returns the external IP address and port to the first terminal and the second terminal respectively according to the first acquisition request.

[0021] Step 113: The first terminal and the second terminal send their respective internal network IP and port, as well as their external network IP and port, to each other based on the point-to-point network server.

[0022] Step 114: After receiving the intranet IP and port and the extranet IP and port from the other end, the first terminal and the second terminal send hole punching messages to each other.

[0023] In one optional implementation, the punching message is a timed message with a 1-second interval. The first terminal and the second terminal send timed messages to each other with a 1-second interval until they receive the timed message from the other party, and then stop sending. If they do not receive the timed message from the other party, they stop sending messages after the number of times they have sent messages has reached 10.

[0024] Step 115: After receiving the hole punching message from the other end, the first terminal and the second terminal send response messages to each other.

[0025] Step 116: After receiving the response message from the peer, the first terminal and the second terminal save the peer's internal network IP and port as well as the external network IP and port, thus completing the construction of the first data transmission channel.

[0026] In this way, the two terminals exchange internal and external network IPs and ports through a point-to-point network server, thereby efficiently building the first data transmission channel. This ensures that only these two terminals can transmit data through this channel, guaranteeing the security of data transmission. Through retransmission mechanisms and multiple response interactions, the success rate and stability of channel creation are improved.

[0027] In one embodiment of this application, after step 110, the method further includes: The peer-to-peer network server determines whether the master keys of the first terminal and the second terminal exist. If so, it generates a first dynamic subkey for the first terminal and a second dynamic subkey for the second terminal. In an optional implementation, the algorithm for generating the dynamic subkeys is a symmetric encryption algorithm, such as AES / CBC / 192.

[0028] The peer-to-peer network server encrypts the respective dynamic subkeys of the first terminal and the second terminal using their master keys, respectively, to obtain the encrypted first dynamic subkey of the first terminal and the encrypted second dynamic subkey of the second terminal. In an optional implementation, the peer-to-peer network server records the association information between each terminal and the dynamic subkey, as well as the information on the establishment of a data transmission channel between the two terminals.

[0029] The peer-to-peer network server sends the encrypted first dynamic subkey to the first terminal and the encrypted second dynamic subkey to the second terminal.

[0030] The first terminal uses a preset first master key to decrypt the encrypted first dynamic subkey to obtain the first dynamic subkey, and then stores the first dynamic subkey. In an optional implementation, the first dynamic subkey can be stored in a secure area, such as SE / TEE or other secure areas.

[0031] The second terminal uses a preset second master key to decrypt the encrypted second dynamic subkey to obtain the second dynamic subkey, and stores the second dynamic subkey.

[0032] In this way, the dynamic subkeys of each terminal are generated by the peer-to-peer network server, and the dynamic subkeys of each terminal are encrypted and injected into the corresponding terminal. This can ensure the security of the dynamic subkeys and make it easier for the terminal to use the dynamic subkeys to encrypt secure data in the future.

[0033] Step 120: The first terminal determines whether it belongs to the same local area network as the second terminal. If so, it sends data to the second terminal based on the second data transmission channel of the local area network. If not, it negotiates a session key with the second terminal to obtain a session key, encrypts the data using the session key, and then sends the encrypted data to the second terminal based on the first data transmission channel.

[0034] In one embodiment of this application, sending data to the second terminal via the second data transmission channel of the local area network includes: The first terminal determines whether the data is marked as secure data. If so, it uses the first dynamic subkey to encrypt the data to obtain encrypted data, and sends the encrypted data to the second terminal via the second data transmission channel of the local area network. If not, it sends the data to the second terminal via the second data transmission channel of the local area network.

[0035] In this way, when the first terminal wants to send data, it first determines whether the data is marked as secure data. If so, the data is encrypted using the terminal's dynamic subkey and then sent to the second terminal via the second data transmission channel on the local area network. Otherwise, the data is sent directly to the second terminal. This ensures that some sensitive security data, such as transaction passwords and sensitive user information, can be securely transmitted in a local area network environment.

[0036] In one embodiment of this application, reference is made to the appendix. Figure 3 The session key is negotiated with the second terminal to obtain the following: The first terminal sets the first device status value to the initial value and generates the first public-private key pair (prv1, pub1).

[0037] The second terminal sets the second device status value to an initial value; in an optional implementation, the initial value is 0.

[0038] The first terminal generates a first status value information and sends the asymmetric key algorithm parameters, the first public key pub1, and the first status value information to the second terminal through the peer-to-peer network server; in an optional embodiment, the first status value information is 1.

[0039] The second terminal determines whether the second device status value is a first preset value. If not, no action is taken; if so, the second device status value is updated according to the first status value information, and a second public-private key pair (prv2, pub2) and a first random number k1 are generated according to the asymmetric key algorithm parameters. In one optional embodiment, the asymmetric key algorithm is RSA1024 (an asymmetric encryption algorithm using a 1024-bit key). In another optional embodiment, the first preset value is 0. For example, if the first status value information is 1, the second device status value is updated from 0 to 1.

[0040] The second terminal uses the first public key pub1 to encrypt the first random number k1 to obtain the first ciphertext ek1.

[0041] The second terminal generates a second status value and sends the second public key pub2, the first ciphertext ek1, and the second status value to the first terminal through the peer-to-peer network server. In an optional implementation, the second status value is 2.

[0042] The first terminal determines whether the first device status value is a first preset value. If not, no action is taken. If so, the first device status value is updated according to the second status value information, and the first private key prv1 is used to decrypt the first ciphertext ek1 to obtain the first random number k1. For example, if the second status value information is 2, the first device status value is updated from 0 to 2.

[0043] The first terminal generates a second random number k2, and negotiates a session key k based on the first random number k1 and the second random number k2, and calculates the first verification value kcv1 of the session key.

[0044] The first terminal uses the second public key pub2 to encrypt the second random number k2 to obtain the second ciphertext ek2.

[0045] The first terminal generates a third status value and sends the second ciphertext ek2, the first checksum kcv1, and the third status value to the second terminal through the peer-to-peer network server. In an optional implementation, the third status value is 3.

[0046] The second terminal determines whether the second device status value is a second preset value. If not, no processing is performed; if so, the second device status value is updated according to the third status value information, and the second private key prv2 is used to decrypt the second ciphertext ek2 to obtain the second random number k2. In an optional implementation, the second preset value is 1.

[0047] The second terminal negotiates and generates a session key k based on the first random number k1 and the second random number k2, and calculates the second verification value kcv2 of the session key.

[0048] The second terminal determines whether the second verification value kcv2 and the first verification value kcv1 are consistent. If they are, the session key negotiation is completed.

[0049] In this way, during the session key negotiation process between two terminals, the session key is not easily cracked by generating public and private key pairs and random numbers by themselves. Furthermore, the device status value and status value information prevent repeated session key negotiation between terminals, thus ensuring the reliability of the session key negotiation.

[0050] In one embodiment of this application, reference is made to the appendix. Figure 3After confirming that the session key negotiation is complete, the following steps are also included: The second terminal sends the key negotiation result, the first connection status parameter, and the fourth status value information to the first terminal. In one optional implementation, the first connection status parameter is false. The fourth status value information is 4.

[0051] The first terminal determines whether the first device status value is a third preset value. If it is not the third preset value, it determines whether the first device status value is a fourth preset value. If it is the fourth preset value and the first connection status parameter is in the first state, it sends a response message. If it is the third preset value, it updates the first device status value according to the fourth status value information, starts a heartbeat timing thread, and notifies the upper-layer application that the session connection is successful. In an optional implementation, the third preset value is 2, and the fourth preset value is 4.

[0052] The first terminal sends a response message, a second connection status parameter, and a fifth status value to the second terminal. In one optional implementation, the second connection status parameter is true. The fifth status value is 4.

[0053] The second terminal determines whether the second device status value is a fifth preset value. If so, it updates the second device status value according to the fifth status value information, starts the heartbeat timing thread, and notifies the upper-layer application that the session connection is successful. If not, it does not process the request. In an optional implementation, the fifth preset value is 3.

[0054] In this way, a successful session connection is ensured, and the two terminals can encrypt and transmit data using the negotiated session key, thus guaranteeing the validity of the session key.

[0055] In one embodiment of this application, after encrypting the data using the session key, sending the encrypted data to the second terminal via the first data transmission channel includes: The first terminal determines whether the data is marked as secure data. If not, it encrypts the data using the session key and sends the encrypted data to the second terminal via the first data transmission channel. If so, it encrypts the data once using the first dynamic subkey to obtain encrypted data.

[0056] The first terminal uses the session key to perform a second encryption on the data after the first encryption, resulting in a second-encrypted data. In an optional implementation, the session encryption algorithm used for the second encryption of the session key is AES / CBC / 192.

[0057] The data after secondary encryption is sent to the second terminal via the first data transmission channel.

[0058] In this way, when the first terminal and the second terminal are not on the same local area network, both need to use a session key to encrypt the data in order to ensure data transmission security. If the data is marked as secure data, it needs to be encrypted once using a dynamic subkey, and then encrypted a second time using the session key, thereby ensuring that the security level of secure data transmission is improved when transmitting data over the public network.

[0059] In one embodiment of this application, after encrypting the data using the session key and sending the encrypted data to the second terminal via the first data transmission channel, the method further includes: The second terminal generates a second acquisition request and encrypts the second acquisition request using the second dynamic subkey to obtain the encrypted second acquisition request.

[0060] The second terminal sends the encrypted second acquisition request to the peer-to-peer network server.

[0061] The peer-to-peer network server decrypts the encrypted second acquisition request and encrypts the first dynamic subkey using the second master key according to the second acquisition request, thus obtaining the encrypted first dynamic subkey. In an optional implementation, after decrypting the encrypted second acquisition request, the peer-to-peer network server can also verify the information on the data transmission channel established between the two terminals. If the verification is successful, the first dynamic subkey is encrypted using the second master key according to the second acquisition request, further improving data security.

[0062] The peer-to-peer network server sends the encrypted first dynamic subkey to the second terminal.

[0063] The second terminal uses the second master key to decrypt the encrypted first dynamic subkey to obtain the first dynamic subkey.

[0064] The second terminal uses the session key to decrypt the data after secondary encryption to obtain the data after primary encryption, and then uses the first dynamic subkey to decrypt the data after primary encryption to obtain the data.

[0065] In this way, after the first terminal sends the encrypted data to the second terminal, the second terminal requests the first dynamic subkey from the peer-to-peer network server. The peer-to-peer network server encrypts and transmits the first dynamic subkey to the second terminal. The second terminal uses the session key and the first dynamic subkey to decrypt the encrypted data and obtain the data. The entire data acquisition process also achieves data security protection.

[0066] In one embodiment of this application, the method further includes: Step 130: The first terminal and the second terminal disconnect the first data transmission channel through the point-to-point network server.

[0067] Step 140: The first terminal, the second terminal, and the peer-to-peer network server destroy the first dynamic subkey and the second dynamic subkey.

[0068] In this way, after the data transmission is completed, the two terminals disconnect the first data transmission channel through the peer-to-peer network server. Then, both the terminals and the peer-to-peer network server destroy the dynamic subkey. During the next secure data transmission, the dynamic subkey is generated and injected again to further ensure data security.

[0069] The following describes specific application examples of this application. This application can apply the above solution to the remote desktop scenario of a smart cash register, and transmit video streams and control commands through the above solution.

[0070] In a remote desktop scenario for a smart POS terminal, two things are crucial: firstly, video stream data needs to be transmitted via a data transmission channel to allow the master control unit to access the real-time interface of the controlled terminal; secondly, the data transmission channel also needs to transmit the operation coordinates or control commands that the master control unit requires the controlled terminal to respond to. The main implementation process is as follows: Preset master key: When a smart POS terminal leaves the factory, a master key can be pre-programmed or written into the system code, and the corresponding master key and terminal information can be saved in the P2P server background.

[0071] First data transmission channel creation: The host terminal requests the local external IP address and port from the P2P server, and the P2P server returns the host terminal's external IP address and port.

[0072] The controlled device also requests its own external IP address and port from the P2P server, and the P2P server returns the external IP address and port of the controlled device.

[0073] The master and slave terminals exchange IP addresses and ports on the internal and external networks through a P2P server.

[0074] The master and slave ends each receive the internal and external network IPs and ports of the peer and start sending hole punching messages at 1-second intervals. After 10 retransmissions, if there is still no response, the sending stops and the hole punching fails.

[0075] If the master and slave ends receive a hole punching message, they stop the timer, send a response message to the other end, and then save the other end's internal and external network IP and port. Hole punching is successful, that is, the first data transmission channel is successfully created.

[0076] Dynamic subkey generation: The P2P server checks whether the master keys of the master and slave are stored. If so, it generates a dynamic subkey for each of the master and slave terminals. The dynamic subkey is then encrypted using the master key corresponding to the terminal. The P2P server records the association information between the terminal and the dynamic subkey, as well as the information on the data transmission channel established between the two terminals.

[0077] The P2P server sends each terminal's encrypted dynamic subkey to the corresponding terminal.

[0078] The master control end and the controlled end use a preset master key to decrypt the encrypted dynamic subkey. If the decryption is successful, the dynamic subkey is stored.

[0079] Data transmission process: The controlled device acquires screen recording data, uses the screen recording data as the video data stream of the controlled device, and marks the video data stream of the controlled device as ordinary data.

[0080] If the IPs of the two terminals are on the same local area network, the controlled terminal directly transmits the controlled terminal's video data stream to the master terminal through the second data transmission channel of the local area network.

[0081] If the IP addresses of the two terminals are not on the same local area network, the two terminals negotiate the session key through the first data transmission channel established above.

[0082] Before being sent, the video stream data from the controlled device is encrypted using a session key.

[0083] After receiving the data, the master control terminal decrypts it using the session key and then displays the video stream data from the controlled terminal.

[0084] The master control terminal displays the interface of the controlled terminal, allowing users to operate and control the device from the master terminal, such as clicking on the interface or pressing the Home button. These commands are sent to the controlled terminal in the form of data. Because the control command data is relatively sensitive, it is marked as secure data.

[0085] Before transmitting control command data, the master control terminal encrypts the data using the saved dynamic subkey and then sends it to the controlled terminal.

[0086] The controlled end requests the dynamic subkey from the master end from the P2P server, and the request information is encrypted using the dynamic subkey of the controlled end.

[0087] The P2P server decrypts the request information and verifies the information on the data transmission channel established between the two terminals. If the verification is successful, the server uses the master key of the controlled terminal to encrypt the dynamic subkey of the master terminal and sends it to the controlled terminal.

[0088] After the controlled end obtains the dynamic subkey of the master end, it can use it to decrypt the received control command data.

[0089] If the controlled end and the master end are not on the same local area network, the encrypted control command data needs to be encrypted again using the session key negotiated in the session key negotiation phase before being sent to the controlled end through the first data transmission channel.

[0090] After the remote control is completed and the terminal and P2P server exit the control, the dynamic subkey is destroyed.

[0091] This application can also apply the above solution to the scenario of transferring law enforcement video from a law enforcement recorder to a police car's large screen.

[0092] In law enforcement video streaming scenarios using body-worn cameras, the export of these video streams often requires very strict control, with the core management focus on ensuring data integrity and confidentiality. Due to limitations such as device size, direct on-site analysis of law enforcement video is often inconvenient on the body-worn camera itself. The solution described above enables secure transmission and data protection of the video from the body-worn camera, allowing for rapid viewing and analysis of the video stream on devices such as police car screens.

[0093] Preset master key: When law enforcement recorders and police cars leave the factory, the master key can be protected by a key pre-setting program or by writing data protection into the system code, and the corresponding master key and device information can be stored on the P2P server.

[0094] First data transmission channel creation: The law enforcement recorder requests its external IP address and port from the P2P server, and the P2P server returns the external IP address and port of the law enforcement recorder.

[0095] The police car's large screen terminal also requests the local external IP address and port from the P2P server, and the P2P server returns the police car's large screen terminal's external IP address and port.

[0096] The law enforcement recorder and the police car's large screen exchange internal and external network IPs and ports via a P2P server.

[0097] The law enforcement recorder and the police car screen terminal each started sending requests at 1-second intervals using the received internal and external network IPs and ports. After 10 resends, there was still no response, so the sending stopped and the hole punching failed.

[0098] If the law enforcement recorder and the police car screen receive a hole punching message, they stop the timer, send a response message to the other end, and then save the other end's internal and external network IP and port. If the hole punching is successful, the first data transmission channel is successfully created.

[0099] The P2P server checks if the master keys for both terminals are stored. If so, it generates a dynamic subkey for each terminal and encrypts the dynamic subkey using the corresponding master key. It records the association information between the terminals and the dynamic subkeys, as well as the information about the data transmission channel established between the two terminals.

[0100] The P2P server sends the encrypted dynamic subkey to its respective terminal. The terminal decrypts the encrypted dynamic subkey using a preset master key. If decryption is successful, the dynamic subkey is stored.

[0101] The screen recording data acquired by the law enforcement recorder is used as the law enforcement recorder video data stream, which is marked as safe data.

[0102] If the body camera and the police car screen are not on the same local area network, the body camera will encrypt the video using the dynamic subkey saved above before transmission, and then encrypt it again using the session key before transmitting it to the police car screen through the first data transmission channel.

[0103] The police car's large screen requests the corresponding dynamic sub-key from the law enforcement recorder from the P2P server, and the request information is encrypted using the dynamic sub-key from the police car's large screen.

[0104] The P2P server decrypts the request information and verifies the information on the data transmission channel established between the two terminals. If the verification is successful, it uses the master key of the police car screen terminal to encrypt the dynamic subkey of the law enforcement recorder terminal and sends it to the police car screen terminal.

[0105] After obtaining the dynamic subkey from the law enforcement recorder, the police car's large screen can use it to decrypt the received video data stream from the law enforcement recorder.

[0106] After the transmission is complete, the dynamic subkey is destroyed on the law enforcement recorder, the police car screen, and the P2P server.

[0107] By using dynamic subkey allocation and strong session control on the P2P server, the security and integrity of data transmission are ensured.

[0108] Please refer to Figure 4 The present invention also provides a data transmission device, comprising: The first terminal is used to establish a first data transmission channel with the second terminal through a point-to-point network server; and Determine whether the device belongs to the same local area network as the second terminal. If so, send data to the second terminal through the second data transmission channel of the local area network. If not, negotiate a session key with the second terminal to obtain a session key. Use the session key to encrypt the data and then send the encrypted data to the second terminal through the first data transmission channel. The second terminal is used to establish a first data transmission channel with the first terminal through a point-to-point network server; and Receive data sent by the first terminal; A peer-to-peer network server is used to establish a first data transmission channel between the first terminal and the second terminal; and Data forwarding is performed between the first terminal and the second terminal.

[0109] In one optional implementation, both the first terminal and the second terminal include a master key module and a subkey module. The master key module of the terminal is used to store a preset master key. The subkey module of the terminal is used to store a dynamic subkey.

[0110] The peer-to-peer network server includes a master key module, a dynamic subkey module, and a dynamic subkey distribution module. The master key module manages the terminal's master key and uses the terminal's master key to encrypt the dynamic subkey to be injected. The dynamic subkey module generates the terminal's dynamic subkey. The dynamic subkey distribution module distributes the corresponding dynamic subkey to the two terminals that need to transmit data, allowing the terminals to use the dynamic subkey to decrypt and encrypt secure data.

[0111] Please refer to Figure 5 The present invention also provides an electronic device 200, including a memory 201 and a processor 202, and a computer program stored on the memory 201 and running on the processor 202. When the processor 202 executes the computer program, it implements the various steps of the data transmission method described above.

[0112] The beneficial effects of the electronic device of the present invention are the same as those of the method described above, and will not be repeated here.

[0113] The above are merely embodiments of the present invention and do not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention's specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A data transmission method applied to an electronic device, characterized in that, The method includes: The first terminal and the second terminal establish a first data transmission channel through a point-to-point network server; The first terminal determines whether it belongs to the same local area network as the second terminal. If so, it sends data to the second terminal through the second data transmission channel of the local area network. If not, it negotiates a session key with the second terminal to obtain a session key, encrypts the data using the session key, and then sends the encrypted data to the second terminal through the first data transmission channel.

2. The data transmission method according to claim 1, characterized in that, The first terminal and the second terminal establish a first data transmission channel through a point-to-point network server, including: The first terminal and the second terminal send a first acquisition request to the peer-to-peer network server; The peer-to-peer network server returns the external IP address and port to the first terminal and the second terminal respectively according to the first acquisition request; The first terminal and the second terminal send their respective internal network IP and port, as well as their external network IP and port, to each other based on the point-to-point network server; After receiving the intranet IP and port and the extranet IP and port from the other end, the first terminal and the second terminal send hole punching messages to each other; After receiving the hole punching message from the other end, the first terminal and the second terminal send response messages to each other; After receiving the response message from the peer, the first terminal and the second terminal save the peer's internal network IP and port as well as its external network IP and port, thus completing the construction of the first data transmission channel.

3. The data transmission method according to claim 1, characterized in that, After the first terminal and the second terminal establish the first data transmission channel through the point-to-point network server, it also includes: The peer-to-peer network server determines whether the master keys of the first terminal and the second terminal exist. If so, it generates the first dynamic subkey of the first terminal and the second dynamic subkey of the second terminal. The peer-to-peer network server uses the master keys of the first terminal and the second terminal to encrypt their respective dynamic subkeys, thereby obtaining the encrypted first dynamic subkey of the first terminal and the encrypted second dynamic subkey of the second terminal. The peer-to-peer network server sends the encrypted first dynamic subkey to the first terminal and the encrypted second dynamic subkey to the second terminal; The first terminal uses a preset first master key to decrypt the encrypted first dynamic subkey to obtain the first dynamic subkey, and stores the first dynamic subkey. The second terminal uses a preset second master key to decrypt the encrypted second dynamic subkey to obtain the second dynamic subkey, and stores the second dynamic subkey.

4. The data transmission method according to claim 3, characterized in that, Sending data to the second terminal via the second data transmission channel of the local area network includes: The first terminal determines whether the data is marked as secure data. If so, it uses the first dynamic subkey to encrypt the data to obtain encrypted data, and sends the encrypted data to the second terminal via the second data transmission channel of the local area network. If not, it sends the data to the second terminal via the second data transmission channel of the local area network.

5. A data transmission method according to claim 3, characterized in that, After encrypting the data using the session key, sending the encrypted data to the second terminal via the first data transmission channel includes: The first terminal determines whether the data is marked as secure data. If not, it encrypts the data using the session key and sends the encrypted data to the second terminal via the first data transmission channel. If yes, it encrypts the data once using the first dynamic subkey to obtain encrypted data. The first terminal uses the session key to perform secondary encryption on the data that was encrypted once, to obtain the data that was encrypted twice. The data after secondary encryption is sent to the second terminal via the first data transmission channel.

6. The data transmission method according to claim 1, characterized in that, The session key obtained by negotiating a session key with the second terminal includes: The first terminal sets the first device status value to an initial value and generates a first public-private key pair; The second terminal sets the second device status value to the initial value; The first terminal generates first status value information and sends the asymmetric key algorithm parameters, the first public key, and the first status value information to the second terminal through the peer-to-peer network server. The second terminal determines whether the second device status value is a first preset value. If so, it updates the second device status value according to the first status value information and generates a second public-private key pair and a first random number according to the asymmetric key algorithm parameters. The second terminal uses the first public key to encrypt the first random number to obtain the first ciphertext; The second terminal generates a second status value and sends the second public key, the first ciphertext, and the second status value to the first terminal through the peer-to-peer network server. The first terminal determines whether the first device status value is a first preset value. If so, it updates the first device status value according to the second status value information and uses the first private key to decrypt the first ciphertext to obtain the first random number. The first terminal generates a second random number, and negotiates and generates a session key based on the first random number and the second random number, and calculates a first check value for the session key; The first terminal uses the second public key to encrypt the second random number to obtain the second ciphertext; The first terminal generates third status value information and sends the second ciphertext, the first check value, and the third status value information to the second terminal through the peer-to-peer network server. The second terminal determines whether the second device status value is the second preset value. If so, it updates the second device status value according to the third status value information and uses the second private key to decrypt the second ciphertext to obtain the second random number. The second terminal negotiates and generates a session key based on the first random number and the second random number, and calculates a second check value for the session key; The second terminal determines whether the second verification value and the first verification value are consistent. If they are, it determines that the session key negotiation is complete.

7. A data transmission method according to claim 5, characterized in that, After encrypting the data using the session key, and sending the encrypted data to the second terminal via the first data transmission channel, the method further includes: The second terminal generates a second acquisition request and encrypts the second acquisition request using the second dynamic subkey to obtain the encrypted second acquisition request; The second terminal sends the encrypted second acquisition request to the peer-to-peer network server; The peer-to-peer network server decrypts the encrypted second acquisition request and encrypts the first dynamic subkey using the second master key according to the second acquisition request to obtain the encrypted first dynamic subkey. The peer-to-peer network server sends the encrypted first dynamic subkey to the second terminal; The second terminal uses the second master key to decrypt the encrypted first dynamic subkey to obtain the first dynamic subkey; The second terminal uses the session key to decrypt the data after secondary encryption to obtain the data after primary encryption, and then uses the first dynamic subkey to decrypt the data after primary encryption to obtain the data.

8. A data transmission method according to claim 7, characterized in that, The method further includes: The first terminal and the second terminal disconnect the first data transmission channel through the point-to-point network server; The first terminal, the second terminal, and the peer-to-peer network server destroy the first dynamic subkey and the second dynamic subkey.

9. A data transmission device, characterized in that, include: The first terminal is used to establish a first data transmission channel with the second terminal through a point-to-point network server. as well as Determine whether the device belongs to the same local area network as the second terminal. If so, send data to the second terminal through the second data transmission channel of the local area network. If not, negotiate a session key with the second terminal to obtain a session key. Use the session key to encrypt the data and then send the encrypted data to the second terminal through the first data transmission channel. The second terminal is used to establish a first data transmission channel with the first terminal through a point-to-point network server. as well as Receive data sent by the first terminal; A peer-to-peer network server is used to establish a first data transmission channel between the first terminal and the second terminal. as well as Data forwarding is performed between the first terminal and the second terminal.

10. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement the various steps of a data transmission method according to any one of claims 1-8.

Images